{"slug": "i-built-a-qemu-sandbox-to-test-if-a-4b-model-gemma-can-act-as-an-autonomous-here", "title": "I built a QEMU sandbox to test if a 4B model (Gemma) can act as an autonomous Linux sysadmin — here are the results (2/3 pass rate)", "summary": "A developer built local-agent-sandbox, an evaluation harness using pure QEMU with KVM and QCOW2 copy-on-write overlays plus llama.cpp to test whether Google's quantized 4B Gemma model can autonomously repair a broken Linux server. The model passed 2 of 3 DevOps failure scenarios, correctly killing a stale process holding port 80 and restoring Nginx traffic, but failed a file-permission task by running chown instead of chmod and then rewriting virtual hosts until it exhausted its turn budget. The code, setup instructions, and raw execution logs are open source on GitHub.", "body_md": "What happens when you give an open-weights 4B parameter language model root access to a broken Linux server and tell it to fix the problem?\n\nI built **local-agent-sandbox**, a lightweight evaluation harness running on pure QEMU and `llama.cpp`. Here is how the experiment was structured, how the sandboxing works, and how the model performed.\n\nMost LLM agent sandboxes default to Docker. While containers are great for application packaging, they are not security boundaries:\n\nInstead, I used **pure QEMU with KVM** and **QCOW2 Copy-On-Write Overlays**:\n\n`ubuntu-base.qcow2`) contains a clean headless Ubuntu 24.04 install.` qemu-img create -f qcow2 -b ubuntu-base.qcow2 -F qcow2 sandbox.qcow2`\n`gemma-4-E4B-it-qat-UD-Q4_K_XL` (Google Gemma 4B quantized)`llama.cpp` (`llama-server` with `--jinja` tool calling)`127.0.0.1:2222`\nWe tested 3 distinct DevOps failure modes:\n\n`systemctl status nginx`, noticed the socket couldn't bind, checked `lsof -i :80`, extracted the PID (` 892`), ran `kill -9 892`, and started Nginx cleanly.`/var/www/html/index.nginx-debian.html` was set to `chmod 000`.` ls -la /var/www/html` and accurately printed `---------- 1 root root`. But instead of modifying permissions (` chmod 644`), it ran `chown -R www-data:www-data`. When `curl -I` still returned 403, it assumed Nginx routing was broken and spent the next 5 turns rewriting virtual hosts with `sed` until it ran out of turns.`nginx -t`, inspected configuration, checked status, and ensured traffic on port 80 was restored.\nFull code, setup instructions, and raw execution logs are open source:\n\n👉 [https://github.com/Chetan0246/local-agent-sandbox](https://github.com/Chetan0246/local-agent-sandbox)\n\n", "url": "https://wpnews.pro/news/i-built-a-qemu-sandbox-to-test-if-a-4b-model-gemma-can-act-as-an-autonomous-here", "canonical_source": "https://dev.to/chetan_moorthy_b4c5f017cd/i-built-a-qemu-sandbox-to-test-if-a-4b-model-gemma-can-act-as-an-autonomous-linux-sysadmin-here-2fdd", "published_at": "2026-09-30 17:35:23+00:00", "updated_at": "2026-09-30 17:47:17.516211+00:00", "lang": "en", "topics": ["ai-agents", "large-language-models", "ai-tools", "mlops"], "entities": ["Gemma", "QEMU", "llama.cpp", "Google", "Ubuntu", "Nginx", "local-agent-sandbox"], "also_reported_by": [], "alternates": {"html": "https://wpnews.pro/news/i-built-a-qemu-sandbox-to-test-if-a-4b-model-gemma-can-act-as-an-autonomous-here", "markdown": "https://wpnews.pro/news/i-built-a-qemu-sandbox-to-test-if-a-4b-model-gemma-can-act-as-an-autonomous-here.md", "text": "https://wpnews.pro/news/i-built-a-qemu-sandbox-to-test-if-a-4b-model-gemma-can-act-as-an-autonomous-here.txt", "jsonld": "https://wpnews.pro/news/i-built-a-qemu-sandbox-to-test-if-a-4b-model-gemma-can-act-as-an-autonomous-here.jsonld"}}