smolvm: A Sandbox for Untrusted Python & JavaScript Code
Score
72提供了一种新兴沙箱工具的实际评估和AI代理解决问题的案例分析，但主题相对小众。
文章来自知名博主，细节丰富，测试过程透明，但深度有限。
对于需要安全执行用户代码或构建多租户环境的开发者有直接参考价值。
发布于2026年8月，信息非常新鲜，涉及当前工具链。
Simon Willison是广受信赖的技术博主，文章常被社区引用。
Base 80 × T2 Source weight ×0.9 = 72
Curation line 70Selected
Why selected
The content comes from a top tech blogger with rich details and practical references, though it is more of a personal research note than a systematic paper.
AI commentary
「This story is worth watching because it showcases two frontiers at once: smolvm provides a lightweight reliable sandbox for running untrusted code, and the AI agent automatically switched test platforms when constrained, demonstrating autonomous engineering that matters for AI-assisted development. It is especially relevant for platform security engineers and developers running user-supplied scripts.」
Quick overview
Simon Willison investigates smolvm as a fast and secure sandbox for running untrusted Python and JavaScript code, aiming to limit CPU and RAM usage, block network access, and restrict file access to designated paths. During testing, the Claude Code for web environment lacked KVM support, so Claude Fable 5 switched to GitHub Actions runners, which expose /dev/kvm, to run the real test suite. This demonstrates the AI agent's proactive problem-solving when facing environmental limitations. The tests ultimately confirmed smolvm's ability to enforce resource limits and isolation, while illustrating a creative workaround for missing nested virtualization in constrained environments.
- smolvm is evaluated as a fast secure sandbox for untrusted Python and JavaScript.
- Security goals include limiting CPU/RAM, no network access, and file access only to designated files.
- The Claude Code for web environment lacks KVM, so tests were moved to a GitHub Actions runner.
- This highlights AI agent Fable's proactive problem-solving under environmental constraints.
Full text
Showing the source text; the full translation is being generated.
Research: smolmachines / smolvm as a sandbox for untrusted Python & JavaScript
I tasked Claude Fable 5 running in Claude Code for web with the following research task:
Put https://smolmachines.com through its paces as a fast secure sandbox. Explore what it would take to use this to run untrusted Python and JavaScript code in a way that is limited in what RAM and CPU time it can take up (protection against "while true") with no network access and filesystem access only to designated files
Goal is to be able to use this to execute user-provided tasks for things like data transformations
It quickly ran into a problem: the Claude Code for web environment can't run smol machines. Quoting the notes it wrote:
- This Claude Code container: Linux 6.18.5-fc-v20 (itself a Firecracker guest), 4 vCPU, 15GB RAM. No /dev/kvm, no vmx/svm CPU flags → no nested virt.
smolvm machine runfails as expected: "kvm not available".- Plan B: GitHub Actions ubuntu runners DO expose /dev/kvm → run the real test battery via a temporary workflow on this branch, collect logs, remove workflow in final commit.
And Plan B is what it did, installing smolvm and running these tests directly in a GitHub Actions runner against that branch.
That was a creative solution to the environmental limits posed by Claude Code for web. Another example of Fable being relentlessly proactive.
Tags: research, sandboxing, ai, github-actions, generative-ai, llms, claude-mythos-fable
Related items
84
FeaturedHow to Evaluate LLMs Before Production: Lessons from GitHub
GitHub 实战分享：如何在生产前评估 LLM
This practical guide stands out because it comes from a real security scenario, not theoretical reasoning. Teams integrating LLMs into production, especially those working on security scanning and data-sensitive engineering, should definitely read it. I recommend designing evaluation sets around your own business data rather than blindly adopting public benchmarks.
84
FeaturedRuff v0.16.0 Released: Default Rules Jump from 59 to 413, CI Pipelines Need Attention
Ruff v0.16.0 发布：默认规则从59条激增至413条，CI工作流需关注
For Python developers, this is an unmissable update signal. The significant increase in Ruff's default rules means we can no longer ignore potential issues in our code, and AI fix tools can lower the upgrade cost. Notably, Astral (OpenAI) is deeply integrating AI coding capabilities with static analysis tools, which may become the norm in future engineering practices.
81
FeaturedOpenRouter Team AI Spend Controls Setup Tutorial
OpenRouter 团队 AI 支出控制设置教程
As AI API spending balloons, OpenRouter's official governance tutorial signals that platforms are taking enterprise cost management seriously. Rather than waiting for bill shock, teams should configure these guardrails early. This is especially valuable for platform engineers and finance owners overseeing AI usage.
81
FeaturedFireside Chat with Anthropic's Claude Code Team: How AI Coding Agents Reshape Software Development
Anthropic Claude Code 团队炉边谈话：AI 编码代理如何重塑软件开发
The value of this fireside chat lies not in repeating Claude Code's features, but in revealing how Anthropic internally redefines engineering processes—shifting from 'execution-heavy' to 'taste-heavy'. For anyone in an AI product team, Cat's point that 'product taste outweighs execution' is worth pondering. Thariq's subversion of the 'never rewrite' rule also reminds us that traditional software engineering principles are being rewritten by AI capabilities.
80
FeaturedGPU Management: Why Idle GPUs Are the New Grounded Aircraft
GPU管理：闲置GPU为何成为新的停飞飞机
This blog is worth reading because it elevates GPU resource management to an economic perspective, using the grounded aircraft analogy to visualize waste. Teams using Kubernetes for GPU clusters can immediately try the recommended tools. However, users in China should note the compatibility of some tools outside AWS/GCP environments.
80
FeaturedAn Opinionated Guide to Which AI to Use to Do Stuff
一份主观指南：如何选择AI来做事情
This blog post is Simon Willison's refined take on Ethan Mollick's guide, ideal for developers and power users struggling to choose between ChatGPT and Claude and their various agent modes. It cuts through the confusion of product naming and unintuitive platform differences, offering clarity that saves hours of trial and error.
80
FeaturedPyPI Implements 14-Day Upload Window to Prevent Supply Chain Poisoning
PyPI 实施14天上传期限以防止供应链投毒
This is a critical message for the Python ecosystem. If you maintain any PyPI project, check your release workflow immediately — the 14-day window means you can no longer patch or overwrite files on old releases; you must publish a new version. For security teams, this is a best practice in supply chain security worth emulating by other package managers.
80
FeaturedLobsters Community Successfully Migrates to SQLite: A Win for Single-Server Architecture
Lobsters 社区成功迁移至 SQLite：单服务器架构的胜利
This migration case is particularly noteworthy because it challenges the conventional wisdom that small sites must adopt distributed databases. Lobsters proves that in 2026, a single server with SQLite can handle an active community. For startup teams struggling with overcomplicated tech stacks, this is an excellent reference for cost reduction and efficiency improvement.