{"slug": "smolmachines-smolvm-as-a-sandbox-for-untrusted-python-javascript", "title": "smolmachines / smolvm as a sandbox for untrusted Python & JavaScript", "summary": "Simon Willison's research tested smolmachines' smolvm as a sandbox for untrusted Python and JavaScript, finding that the Claude Code for web environment lacks /dev/kvm and CPU virtualization flags, so the test battery was run on GitHub Actions runners that expose /dev/kvm. The tests, executed via a temporary workflow, aimed to enforce RAM and CPU limits, block network access, and restrict filesystem access to designated files for user-provided data transformation tasks.", "body_md": "**Research:** [smolmachines / smolvm as a sandbox for untrusted Python & JavaScript](https://github.com/simonw/research/tree/main/smolmachines-untrusted-sandbox#readme)\n\nI tasked Claude Fable 5 running in Claude Code for web with the following research task:\n\n`Put https://smolmachines.com through its paces as a fast secure sandbox. Explore what it would take to use this to run untrusted Python and JavaScript code in a way that is limited in what RAM and CPU time it can take up (protection against \"while true\") with no network access and filesystem access only to designated files`\n\n`Goal is to be able to use this to execute user-provided tasks for things like data transformations`\n\nIt quickly ran into a problem: the Claude Code for web environment can't run [smol machines](https://smolmachines.com). Quoting the [notes it wrote](https://github.com/simonw/research/blob/5e6861e54441472d194de96b49b901fd99ebc153/smolmachines-untrusted-sandbox/notes.md#environment-check):\n\n- This Claude Code container: Linux 6.18.5-fc-v20 (itself a Firecracker guest), 4 vCPU, 15GB RAM.\nNo /dev/kvm, no vmx/svm CPU flags→ no nested virt.`smolvm machine run`\n\nfails as expected: \"kvm not available\".- Plan B: GitHub Actions ubuntu runners DO expose /dev/kvm → run the real test battery via a temporary workflow on this branch, collect logs, remove workflow in final commit.\n\nAnd Plan B is [what it did](https://github.com/simonw/research/blob/5e6861e54441472d194de96b49b901fd99ebc153/.github/workflows/smolvm-sandbox-test.yml), installing smolvm and running [these tests](https://github.com/simonw/research/blob/5e6861e54441472d194de96b49b901fd99ebc153/smolmachines-untrusted-sandbox/run-tests.sh) directly in a GitHub Actions runner against that branch.\n\nThat was a creative solution to the environmental limits posed by Claude Code for web. Another example of Fable being [relentlessly proactive](https://simonwillison.net/2026/Jun/11/fable-is-relentlessly-proactive/).\n\nTags: [research](https://simonwillison.net/tags/research), [sandboxing](https://simonwillison.net/tags/sandboxing), [ai](https://simonwillison.net/tags/ai), [github-actions](https://simonwillison.net/tags/github-actions), [generative-ai](https://simonwillison.net/tags/generative-ai), [llms](https://simonwillison.net/tags/llms), [claude-mythos-fable](https://simonwillison.net/tags/claude-mythos-fable)", "url": "https://wpnews.pro/news/smolmachines-smolvm-as-a-sandbox-for-untrusted-python-javascript", "canonical_source": "https://simonwillison.net/2026/Aug/19/smolmachines-untrusted-sandbox/", "published_at": "2026-08-19 23:16:00+00:00", "updated_at": "2026-08-19 23:43:23.097161+00:00", "lang": "en", "topics": ["ai-tools", "ai-research", "developer-tools"], "entities": ["smolmachines", "smolvm", "Claude Code", "Claude Fable 5", "GitHub Actions", "Simon Willison"], "alternates": {"html": "https://wpnews.pro/news/smolmachines-smolvm-as-a-sandbox-for-untrusted-python-javascript", "markdown": "https://wpnews.pro/news/smolmachines-smolvm-as-a-sandbox-for-untrusted-python-javascript.md", "text": "https://wpnews.pro/news/smolmachines-smolvm-as-a-sandbox-for-untrusted-python-javascript.txt", "jsonld": "https://wpnews.pro/news/smolmachines-smolvm-as-a-sandbox-for-untrusted-python-javascript.jsonld"}}