Show HN: Popcorn: a security workbench of disposable microVMs Popcorn is a Linux desktop app that runs each risky job in a "corn" — a Firecracker microVM with its own Linux kernel that boots in about one second and has no network card, no access to the host's files, and only a private vsock channel to the Popcorn app. The workbench gates every new outbound host behind user approval (auto-refusing after 90 seconds), blocks loopback, private and link-local addresses, and keeps the user's Claude token outside the VM by injecting it only into requests to api.anthropic.com. Popcorn runs on Linux with KVM and notes that Firecracker runs as the user without its jailer, so a hypervisor escape, while rare, remains possible. A workbench for risky work. Each job runs in a corn : a small virtual machine that cannot touch your computer. Popcorn is a desktop app for Linux. Use it for untrusted code, suspicious packages and unknown binaries. You and Claude Code do the work in a corn. Your files, keys and network stay outside. 🌽 A corn is a Firecracker https://firecracker-microvm.github.io/ microVM with its own Linux kernel. It starts in about one second. - Terminal. Open a shell in a corn. - Network. Each new host waits for your approval: deny, allow once or always allow. - Files in. Drop files on the window, or select them. They go to ~/inbox . - Files out. Export files from ~/outbox . Popcorn saves them as copies that cannot run. - Shared folder. The corn gets a copy of a folder. Popcorn writes back only the changes that you approve. | Guarantee | How | |---|---| | A corn has its own kernel | Each corn is a separate virtual machine, not a container. A kernel exploit stays inside the corn. | | A corn has no network card | Its only link is a private channel to Popcorn. It has no route to your network or the internet. | | You approve each new host | Popcorn holds each new connection and asks you. If you do not answer in 90 seconds, Popcorn refuses it. | | A corn cannot reach your network | Popcorn refuses addresses on your computer or local network loopback, private, link-local , even for a host you allowed, and connects only to the addresses it checked. | | Your Claude token stays outside | Claude Code in the corn has only a fake token. Popcorn adds your real token to requests to api.anthropic.com . | | A corn cannot see your files | No folder from your computer is connected to a corn. A corn has only its own Linux system and its own disk. | | Files come out only when you export them | A corn cannot send files to your computer. Exported files are plain copies. | | Your folder changes only with your approval | You review each changed file. Popcorn writes only the files that you approve, and only inside that folder. | | Your keys stay outside | Popcorn does not share your home folder, or a folder with .ssh , .gnupg , .aws or .config . It also leaves out .git and ignored files. | - A hypervisor escape is rare, but possible. Firecracker runs as your user, without its jailer. - If you allow a host, the corn can send data to that host. - Inside a corn, your account has root. The corn is the sandbox, not the account. - Keep your kernel and Firecracker up to date. flowchart LR subgraph host "Your computer" app "Popcorn app" gate "Network gate