---
title: "smolvm：用于运行不受信任的Python与JavaScript代码的沙箱研究"
source: "Simon Willison 博客（Atom）"
source_tier: "t2"
url: "https://simonwillison.net/2026/Aug/19/smolmachines-untrusted-sandbox/"
permalink: "https://feed.astralor.com/items/itm_a76a88cb6bb59a73c7466efd"
published: "2026-08-19T23:16:00.000Z"
score: 72
channel: "tech"
tags: ["Claude Code","Claude Fable 5","Firecracker","GitHub Actions","KVM","smolvm"]
---

# smolvm：用于运行不受信任的Python与JavaScript代码的沙箱研究

## AI 点评

> 这条新闻值得关注，因为它同时展示了两个前沿：smolvm 为运行不可信代码提供了轻量可靠的沙箱方案，而 AI 代理在环境受限时能自动切换测试平台，这种自主工程能力对 AI 辅助开发意义重大。对平台安全工程师和依赖用户脚本的服务开发者尤其有参考价值。

## 速览

Simon Willison 研究了 smolvm 作为快速安全沙箱的可行性，用于执行不受信任的 Python 和 JavaScript 代码，目标包括限制 CPU/RAM 使用、禁止网络访问、仅允许访问指定文件。测试中，Claude Code for web 环境因缺少 KVM 无法运行，于是 Claude Fable 5 转而利用 GitHub Actions 的 /dev/kvm 支持完成了真实测试。这一过程展示了 AI 代理在环境受限时主动寻找替代方案的创造力和执行力。

## 关键点

- smolvm 被评估为可运行不受信任 Python/JavaScript 的快速安全沙箱。
- 安全目标包括限制 CPU/RAM、无网络访问、仅访问指定文件。
- Claude Code for web 环境无 KVM，测试转移到 GitHub Actions runner 完成。
- 展示了 AI 代理 Fable 在受限环境中主动寻找替代路径的能力。

## 全文

Research: smolmachines / smolvm as a sandbox for untrusted Python & JavaScript I tasked Claude Fable 5 running in Claude Code for web with the following research task: Put https://smolmachines.com through its paces as a fast secure sandbox. Explore what it would take to use this to run untrusted Python and JavaScript code in a way that is limited in what RAM and CPU time it can take up (protection against "while true") with no network access and filesystem access only to designated files Goal is to be able to use this to execute user-provided tasks for things like data transformations It quickly ran into a problem: the Claude Code for web environment can't run smol machines. Quoting the notes it wrote: This Claude Code container: Linux 6.18.5-fc-v20 (itself a Firecracker guest), 4 vCPU, 15GB RAM. No /dev/kvm, no vmx/svm CPU flags → no nested virt. smolvm machine run fails as expected: "kvm not available". Plan B: GitHub Actions ubuntu runners DO expose /dev/kvm → run the real test battery via a temporary workflow on this branch, collect logs, remove workflow in final commit. And Plan B is what it did, installing smolvm and running these tests directly in a GitHub Actions runner against that branch. That was a creative solution to the environmental limits posed by Claude Code for web. Another example of Fable being relentlessly proactive. Tags: research, sandboxing, ai, github-actions, generative-ai, llms, claude-mythos-fable

---

引用前请核对原文;本文由星际流动整理:https://feed.astralor.com/items/itm_a76a88cb6bb59a73c7466efd