smolvm runs untrusted code in fast, hardware-isolated micro-VMs

smolvm, from the smolmachines project, is a sandbox for running untrusted Python and JavaScript inside hardware-isolated virtual machines rather than shared-kernel containers. The distinction matters for anyone running code an AI agent wrote or a user supplied: a full VM boundary is harder to escape than a container. Simon Willison tested it and reports cold starts of about 0.6 to 1.5 seconds and warm executions around 50 milliseconds, fast enough to sit inside an interactive loop. It supports offline images with no network access, CPU and memory caps, guest-enforced timeouts, storage quotas, read-only input mounts with a writable output directory, and an unprivileged execution mode.

The write-up has a second story worth reading. Willison had Claude Fable research whether smolvm would actually work, and when the agent's own environment lacked the kernel virtualization it needed, it switched to GitHub Actions runners, which expose /dev/kvm, to finish the testing. He calls that kind of adaptation "relentlessly proactive."

Why it matters

If you let agents or users run code, a fast VM sandbox with strict network and resource limits is a safer default than a container, and the sub-second startup means you no longer have to trade much speed for that isolation.