---
title: "smolvm: A Sandbox for Untrusted Python & JavaScript Code"
source: "Simon Willison 博客（Atom）"
source_tier: "t2"
url: "https://simonwillison.net/2026/Aug/19/smolmachines-untrusted-sandbox/"
permalink: "https://feed.astralor.com/items/itm_a76a88cb6bb59a73c7466efd"
published: "2026-08-19T23:16:00.000Z"
score: 72
channel: "tech"
tags: ["Claude Code","Claude Fable 5","Firecracker","GitHub Actions","KVM","smolvm"]
---

# smolvm: A Sandbox for Untrusted Python & JavaScript Code

## AI commentary

> This story is worth watching because it showcases two frontiers at once: smolvm provides a lightweight reliable sandbox for running untrusted code, and the AI agent automatically switched test platforms when constrained, demonstrating autonomous engineering that matters for AI-assisted development. It is especially relevant for platform security engineers and developers running user-supplied scripts.

## At a glance

Simon Willison investigates smolvm as a fast and secure sandbox for running untrusted Python and JavaScript code, aiming to limit CPU and RAM usage, block network access, and restrict file access to designated paths. During testing, the Claude Code for web environment lacked KVM support, so Claude Fable 5 switched to GitHub Actions runners, which expose /dev/kvm, to run the real test suite. This demonstrates the AI agent's proactive problem-solving when facing environmental limitations. The tests ultimately confirmed smolvm's ability to enforce resource limits and isolation, while illustrating a creative workaround for missing nested virtualization in constrained environments.

## Key points

- smolvm is evaluated as a fast secure sandbox for untrusted Python and JavaScript.
- Security goals include limiting CPU/RAM, no network access, and file access only to designated files.
- The Claude Code for web environment lacks KVM, so tests were moved to a GitHub Actions runner.
- This highlights AI agent Fable's proactive problem-solving under environmental constraints.

## Full text

Research: smolmachines / smolvm as a sandbox for untrusted Python & JavaScript I tasked Claude Fable 5 running in Claude Code for web with the following research task: Put https://smolmachines.com through its paces as a fast secure sandbox. Explore what it would take to use this to run untrusted Python and JavaScript code in a way that is limited in what RAM and CPU time it can take up (protection against "while true") with no network access and filesystem access only to designated files Goal is to be able to use this to execute user-provided tasks for things like data transformations It quickly ran into a problem: the Claude Code for web environment can't run smol machines. Quoting the notes it wrote: This Claude Code container: Linux 6.18.5-fc-v20 (itself a Firecracker guest), 4 vCPU, 15GB RAM. No /dev/kvm, no vmx/svm CPU flags → no nested virt. smolvm machine run fails as expected: "kvm not available". Plan B: GitHub Actions ubuntu runners DO expose /dev/kvm → run the real test battery via a temporary workflow on this branch, collect logs, remove workflow in final commit. And Plan B is what it did, installing smolvm and running these tests directly in a GitHub Actions runner against that branch. That was a creative solution to the environmental limits posed by Claude Code for web. Another example of Fable being relentlessly proactive. Tags: research, sandboxing, ai, github-actions, generative-ai, llms, claude-mythos-fable

---

Verify against the original before citing; curated by Astral Feed: https://feed.astralor.com/items/itm_a76a88cb6bb59a73c7466efd