smolmachines / smolvm as a sandbox for untrusted Python & JavaScript

Why is this worth talking about?

Imagine you're building an online platform where users can upload Python or JavaScript scripts for data processing. What's your biggest nightmare? A user uploading a while True: pass infinite loop, or a malicious script trying to read all files on your server. Traditional Docker containers (shared kernel) offer isolation but carry escape risks and lack 'hard' resource limits. Today, renowned AI blogger Simon Willison shared an experiment conducted autonomously by his AI agent, showcasing a near-perfect solution: smolvm.

Breaking it down: Why a 'virtual machine' and not a 'container'?

smolvm is built on AWS's open-source Firecracker virtualization technology. Think of it as an 'ultra-minimal virtual machine': each piece of user code runs inside a completely separate 'virtual computer' with its own OS kernel, CPU, and memory. This is an order of magnitude more secure than Docker, which shares the host's kernel. Containers are like partitioning a shared building with dividers, where everyone uses the same foundation and utilities; virtual machines are like giving each tenant their own separate house.

The experiment tested key security features: offline local images (no network needed to download), no-network execution, strict CPU/memory limits (to prevent infinite loops), read-only input mounts (to protect original data), and writable output mounts (only results can be written). All these limits are enforced by the host, making them unbreakable by user code. The most surprising aspect was performance: cold starts (first run) take only 0.6-1.5 seconds, and warm runs (sandbox already ready) take about 50 milliseconds. This is so fast it's nearly imperceptible to users.

Trend Insight: AI Agents as R&D Leads

The experiment itself might be more insightful than the smolvm technology. Simon Willison didn't write the test code himself; instead, he gave his AI agent (Claude Fable 5) a high-level directive: 'Test smolvm and see if it can safely run untrusted code.' The agent then autonomously completed the entire R&D workflow: analyzing environmental constraints (discovering the current environment doesn't support nested virtualization), creatively proposing a workaround (using GitHub Actions' KVM environment), installing dependencies, writing test scripts, executing tests, and compiling reports. This reveals a deeper trend: We are entering the era of 'AI as the engineer.' In the future, giving an AI a goal will enable it to read documentation, debug, find resources, and complete projects on its own. This signals a massive shift in the developer's role—from 'executor' more towards 'decision-maker' and 'reviewer.'

Practical Value: What does this mean for me?

1. If you're building an online code execution platform (like data science notebooks, automation tools, or AI code interpreters): smolvm offers one of the most secure, high-performance open-source sandbox solutions available today. It's more secure than Docker and faster/lighter than traditional virtual machines. You should evaluate it immediately.
2. If you care about AI application security: This provides a solid security foundation for the high-risk feature of 'AI agents executing code.' Imagine your future AI assistant safely processing local files and analyzing data for you without 'going off the rails.'
3. If you want to understand working in the AI era: Simon's experiment is a perfect case study. It demonstrates how to collaborate with an AI agent: provide clear, goal-oriented tasks, let the AI handle the tedious implementation details, and focus your energy on evaluating results and making decisions. Learning to 'direct' AI agents will become a critical skill.

Counter-intuitive/Unexpected Angle

Most people still associate sandboxes with 'poor performance' and 'complex configuration.' However, smolvm's test results (millisecond-level warm starts) completely overturn this notion. This means security and speed are no longer a trade-off. Furthermore, the 'tester' for this experiment was itself an AI, creating an interesting recursion: an AI is testing the technology that will protect the AI's own safe execution environment in the future. This might hint at some embryonic form of future AI systems improving and safeguarding themselves.