SmolVM Tested as Sandbox for Untrusted Code Execution

Testing of smolvm 1.8.3 shows it can effectively sandbox untrusted Python and JavaScript code transformations using hardware-isolated virtual machines instead of shared-kernel containers. According to research published in August 2026, the tool delivered cold starts around 0.6-1.5 seconds and warm executions around 50 milliseconds while enforcing strict resource and access controls.

Background

SmolVM takes a different approach to code sandboxing than typical container-based solutions. Rather than relying on shared-kernel containers, it uses hardware-isolated VMs to run untrusted code. The research evaluated whether this architecture could handle common sandboxing requirements: preventing resource exhaustion from infinite loops, blocking network access, and restricting filesystem operations to specific paths.

The testing environment itself ran inside a Firecracker guest (Linux 6.5-fc-v20) with 4 vCPUs and 15GB RAM, demonstrating that smolvm can operate within already-virtualized environments. The research focused specifically on data transformation workloads in Python and JavaScript, a common use case for executing user-supplied code.

Method

According to the published notes, smolvm 1.8.3 successfully enforced multiple security boundaries. Offline local images allowed execution without external dependencies, while no-network execution prevented any outbound connections. CPU and RAM limits addressed the “while true” problem by capping resource consumption before runaway processes could impact the host.

Guest-enforced timeouts provided an additional layer of protection, terminating code that exceeded time budgets. Storage quotas prevented disk exhaustion attacks. The filesystem controls worked as designed: read-only input mounts gave code access to necessary data files while preventing modification, and writable output mounts collected results in isolated locations.

The --unprivileged flag added another security layer by running guest code without elevated permissions. This combination of controls created defense in depth, where multiple mechanisms would need to fail before untrusted code could escape its sandbox.

Example Walkthrough

A typical workflow would involve preparing an offline VM image containing the Python or JavaScript runtime. When untrusted code needs execution, smolvm launches a fresh VM instance with specified CPU and memory limits. The code receives read-only access to input data through mounted directories and writes results to a separate writable mount.

For a Python data transformation, the command might look like:

 --mount-ro /data/input:/input \
 --mount-rw /data/output:/output \
 python-runtime transform.py

The VM boots, executes the transformation script against input files, writes results to the output mount, and terminates. Network access remains blocked throughout. If the code attempts an infinite loop or memory exhaustion, the CPU/RAM limits and timeout terminate the VM before it impacts other workloads.

Comparison

The performance characteristics distinguish smolvm from heavier VM solutions while maintaining stronger isolation than containers. Cold start times of 0.6-1.5 seconds fall between traditional VMs (often several seconds) and containers (typically under 100ms). However, warm execution at 50ms approaches container speeds for repeated invocations.

The hardware isolation provides security guarantees that shared-kernel containers cannot match. Container escapes remain a concern with technologies like Docker, where all containers share the host kernel. SmolVM’s approach eliminates entire classes of kernel-level exploits by giving each sandbox its own kernel instance.

For data transformation workloads specifically, the research indicates smolvm hit a practical sweet spot: fast enough for interactive use while providing VM-level isolation. The ability to run inside already-virtualized environments (demonstrated by the Firecracker-in-Firecracker testing setup) adds deployment flexibility for cloud and edge scenarios.

More details are available at https://smolmachines.com.