{"slug": "show-hn-popcorn-a-security-workbench-of-disposable-microvms", "title": "Show HN: Popcorn: a security workbench of disposable microVMs", "summary": "Popcorn is a Linux desktop app that runs each risky job in a \"corn\" ā a Firecracker microVM with its own Linux kernel that boots in about one second and has no network card, no access to the host's files, and only a private vsock channel to the Popcorn app. The workbench gates every new outbound host behind user approval (auto-refusing after 90 seconds), blocks loopback, private and link-local addresses, and keeps the user's Claude token outside the VM by injecting it only into requests to api.anthropic.com. Popcorn runs on Linux with KVM and notes that Firecracker runs as the user without its jailer, so a hypervisor escape, while rare, remains possible.", "body_md": "A workbench for risky work.\n\n Each job runs in a **corn**: a small virtual machine that cannot touch your computer.\n\nPopcorn is a desktop app for Linux. Use it for untrusted code, suspicious packages and unknown binaries. You and Claude Code do the work in a corn. Your files, keys and network stay outside.\n\nš½ A corn is a [Firecracker](https://firecracker-microvm.github.io/) microVM with its own Linux\nkernel. It starts in about one second.\n\n- **Terminal.** Open a shell in a corn.\n- **Network.** Each new host waits for your approval: deny, allow once or always allow.\n- **Files in.** Drop files on the window, or select them. They go to`~/inbox` .\n- **Files out.** Export files from`~/outbox` . Popcorn saves them as copies that cannot run.\n- **Shared folder.** The corn gets a copy of a folder. Popcorn writes back only the changes that you approve.\n\n| Guarantee | How | \n|---|---|\n| A corn has its own kernel | Each corn is a separate virtual machine, not a container. A kernel exploit stays inside the corn. | \n| A corn has no network card | Its only link is a private channel to Popcorn. It has no route to your network or the internet. | \n| You approve each new host | Popcorn holds each new connection and asks you. If you do not answer in 90 seconds, Popcorn refuses it. | \n| A corn cannot reach your network | Popcorn refuses addresses on your computer or local network (loopback, private, link-local), even for a host you allowed, and connects only to the addresses it checked. | \n| Your Claude token stays outside | Claude Code in the corn has only a fake token. Popcorn adds your real token to requests to `api.anthropic.com` . | \n| A corn cannot see your files | No folder from your computer is connected to a corn. A corn has only its own Linux system and its own disk. | \n| Files come out only when you export them | A corn cannot send files to your computer. Exported files are plain copies. | \n| Your folder changes only with your approval | You review each changed file. Popcorn writes only the files that you approve, and only inside that folder. | \n| Your keys stay outside | Popcorn does not share your home folder, or a folder with `.ssh` ,`.gnupg` ,`.aws` or`.config` . It also leaves out`.git` and ignored files. | \n\n- A hypervisor escape is rare, but possible. Firecracker runs as your user, without its jailer.\n- If you allow a host, the corn can send data to that host.\n- Inside a corn, your account has root. The corn is the sandbox, not the account.\n- Keep your kernel and Firecracker up to date.\n\n```\nflowchart LR\n subgraph host[\"Your computer\"]\n app[\"Popcorn app\"]\n gate[\"Network gate
ask, allow, refuse
public addresses only\"]\n proxy[\"Claude proxy
adds your token\"]\n token[(\"Claude token\")]\n files[\"Files
inbox, outbox, review\"]\n end\n\n subgraph corn[\"Corn: Firecracker microVM\"]\n shell[\"Shell and Claude Code\"]\n disk[(\"Corn disk
over a read-only image\")]\n end\n\n shell -- \"vsock\" --> gate\n shell -- \"vsock\" --> proxy\n gate -- \"approved hosts\" --> internet((\"Internet\"))\n proxy --> anthropic((\"api.anthropic.com\"))\n token -.-> proxy\n app <-- \"vsock: terminal\" --> shell\n files <-- \"vsock: tar\" --> shell\n shell --- disk\n```\n\nA new connection waits for you:\n\n```\nsequenceDiagram\n participant C as Code in corn\n participant G as Network gate\n participant Y as You\n participant H as Remote host\n C->>G: CONNECT example.com:443\n alt An address on your network, such as 127.0.0.1\n G-->>C: 403 Forbidden, without asking\n else A name\n G->>Y: Show the yellow band\n alt Deny, or no answer in 90 s\n G-->>C: 403 Forbidden\n else Allow once or always\n G->>G: Resolve the name. Keep public addresses only.\n alt No public address\n G-->>C: 403 Forbidden\n else\n G->>H: Connect to a checked address\n G-->>C: 200 Connection established\n end\n end\n end\n```\n\nPopcorn runs on Linux with KVM. Read [docs/DEV.md](https://github.com/KunalSin9h/popcorn/blob/main/docs/DEV.md) for system packages.\n\n```\n./scripts/fetch-firecracker.sh # Firecracker and a guest kernel, one time\n./scripts/build-image.sh # the workbench image, with Docker, one time\ncargo run --release\n```\n\nPopcorn then asks for three items: your name, the image, and a Claude token (optional). Get a token with\n`claude setup-token`.\n\n- [docs/DEV.md](https://github.com/KunalSin9h/popcorn/blob/main/docs/DEV.md) : stack, build, tests and workflow.", "url": "https://wpnews.pro/news/show-hn-popcorn-a-security-workbench-of-disposable-microvms", "canonical_source": "https://github.com/KunalSin9h/popcorn", "published_at": "2026-10-12 20:31:21+00:00", "updated_at": "2026-10-12 20:50:59.928694+00:00", "lang": "en", "topics": ["ai-agents", "ai-tools", "developer-tools", "ai-safety"], "entities": ["Popcorn", "Firecracker", "Claude Code", "Anthropic", "api.anthropic.com", "Linux", "KVM", "KunalSin9h"], "also_reported_by": [], "alternates": {"html": "https://wpnews.pro/news/show-hn-popcorn-a-security-workbench-of-disposable-microvms", "markdown": "https://wpnews.pro/news/show-hn-popcorn-a-security-workbench-of-disposable-microvms.md", "text": "https://wpnews.pro/news/show-hn-popcorn-a-security-workbench-of-disposable-microvms.txt", "jsonld": "https://wpnews.pro/news/show-hn-popcorn-a-security-workbench-of-disposable-microvms.jsonld"}}