smolvm reportedly enables hardware-isolated sandboxing for untrusted Python and JavaScript code

smolmachines' smolvm presents an alternative to traditional container-based sandboxing by using hardware-isolated virtual machines. This approach provides stronger isolation guarantees than shared-kernel containers, which is critical when executing untrusted Python or JavaScript code. The solution targets use cases like user-provided data transformations where security and resource control are paramount.

The implementation demonstrates several practical sandboxing features: CPU and RAM limits prevent resource exhaustion attacks, guest-enforced timeouts stop infinite loops, and storage quotas control disk usage. Input files are mounted read-only while outputs are writable, creating a controlled environment for data processing. These features work together to create a secure execution context without network access.

Performance characteristics show cold starts between 0.6 to 1.5 seconds and warm executions around 50 ms, which compares favorably to some container solutions. However, the dependency on KVM (Kernel-based Virtual Machine) creates a significant infrastructure requirement. The testing revealed that environments without nested virtualization support (like the Claude Code web environment) cannot run smolvm, limiting deployment options.

The research approach itself demonstrates practical engineering challenges. When faced with an environment lacking KVM support, the solution was to move testing to GitHub Actions runners which do provide the necessary hardware virtualization. This workaround highlights both the creativity needed for real-world testing and the platform dependency that engineers must consider when evaluating smolvm for production use.

For engineers considering smolvm, the key trade-offs become clear: stronger isolation and better performance than some alternatives, but with a narrower range of supported environments. The solution appears particularly well-suited for batch processing of untrusted code where execution time and resource limits are critical, but less appropriate for environments where KVM support cannot be guaranteed.