Show HN: Popcorn: a security workbench of disposable microVMs

A workbench for risky work.

Each job runs in a corn: a small virtual machine that cannot touch your computer.

Popcorn is a desktop app for Linux. Use it for untrusted code, suspicious packages and unknown binaries. You and Claude Code do the work in a corn. Your files, keys and network stay outside.

🌽 A corn is a Firecracker microVM with its own Linux kernel. It starts in about one second.

• Terminal. Open a shell in a corn.
• Network. Each new host waits for your approval: deny, allow once or always allow.
• Files in. Drop files on the window, or select them. They go to~/inbox .
• Files out. Export files from~/outbox . Popcorn saves them as copies that cannot run.
• Shared folder. The corn gets a copy of a folder. Popcorn writes back only the changes that you approve.

• A hypervisor escape is rare, but possible. Firecracker runs as your user, without its jailer.
• If you allow a host, the corn can send data to that host.
• Inside a corn, your account has root. The corn is the sandbox, not the account.
• Keep your kernel and Firecracker up to date.

flowchart LR
  subgraph host["Your computer"]
    app["Popcorn app"]
    gate["Network gate<br/>ask, allow, refuse<br/>public addresses only"]
    proxy["Claude proxy<br/>adds your token"]
    token[("Claude token")]
    files["Files<br/>inbox, outbox, review"]
  end

  subgraph corn["Corn: Firecracker microVM"]
    shell["Shell and Claude Code"]
    disk[("Corn disk<br/>over a read-only image")]
  end

  shell -- "vsock" --> gate
  shell -- "vsock" --> proxy
  gate -- "approved hosts" --> internet(("Internet"))
  proxy --> anthropic(("api.anthropic.com"))
  token -.-> proxy
  app <-- "vsock: terminal" --> shell
  files <-- "vsock: tar" --> shell
  shell --- disk

A new connection waits for you:

sequenceDiagram
  participant C as Code in corn
  participant G as Network gate
  participant Y as You
  participant H as Remote host
  C->>G: CONNECT example.com:443
  alt An address on your network, such as 127.0.0.1
    G-->>C: 403 Forbidden, without asking
  else A name
    G->>Y: Show the yellow band
    alt Deny, or no answer in 90 s
      G-->>C: 403 Forbidden
    else Allow once or always
      G->>G: Resolve the name. Keep public addresses only.
      alt No public address
        G-->>C: 403 Forbidden
      else
        G->>H: Connect to a checked address
        G-->>C: 200 Connection established
      end
    end
  end

Popcorn runs on Linux with KVM. Read docs/DEV.md for system packages.

./scripts/fetch-firecracker.sh   # Firecracker and a guest kernel, one time
./scripts/build-image.sh         # the workbench image, with Docker, one time
cargo run --release

Popcorn then asks for three items: your name, the image, and a Claude token (optional). Get a token with claude setup-token.

• docs/DEV.md : stack, build, tests and workflow.