smolmachines / smolvm as a sandbox for untrusted Python & JavaScript
Simon Willison's research on smolmachines/smolvm as a sandbox for untrusted Python and JavaScript found that smolvm 1.8.3 is well suited for sandboxing untrusted data transformations using hardware-isolated VMs rather than shared-kernel containers. Tests confirmed that offline local images, no-network execution, CPU/RAM limits, guest-enforced timeouts, storage quotas, read-only input mounts, writable output mounts, and the `--unprivileged` flag all worked as intended. Performance was notable: cold starts around 0.6–1.5 seconds and warm executions around 50 ms. Willison tasked Claude Fable 5 running in Claude Code for web with researching smolmachines.com as a fast secure sandbox, but the environment couldn't run smolvm because it lacked /dev/kvm and vmx/svm CPU flags, making nested virtualization impossible. The agent then used GitHub Actions runners, which expose /dev/kvm, to run the test battery via a temporary workflow. This creative workaround highlighted Fable's proactive problem-solving. The post was published on 19th August 2026.
Developers can use smolvm for secure, fast execution of untrusted code with resource limits and no network access.