SmolVM shows that code isolation doesn't require OS-sized containers

Local sandbox without a shared kernel

Using AI agents, Simon Willison tested smolvm (version 1.8.3) as an isolated environment for untrusted Python and JavaScript. While standard containers share the kernel with the host OS, smolvm uses hardware-isolated virtual machines (VMs).

The test confirmed that the tool handles the core requirements for processing user data: it runs entirely offline with no network access, respects CPU and memory limits, caps storage, and separates read-only and writable mounts. Cold starts take about a second, and warm executions drop under 50 milliseconds.

A shift for data-pipeline developers

For engineers building platforms that ingest code from users, a secure sandbox has always been a headache. A standard Docker container does not guarantee cloud-level isolation.

SmolVM provides a lightweight isolation layer that prevents infinite loops or malicious code from consuming server resources, all without requiring heavy orchestration. Teams can run user-provided data transformations without worrying about their wider infrastructure.

The limits of deep virtualization

Although the architecture is sound, the test revealed a practical limitation: smolvm requires hardware virtualization support (KVM). Claude Code, where Willison started the experiment, runs inside a Firecracker guest and does not expose KVM. For production deployments, this means developers need bare metal servers or cloud providers that support nested virtualization, which is rarely the default on cheap instances.

Adoption beyond data science will decide

The next step is watching whether this layer remains a niche tool for data analysts. The real proof of success will be its integration into low-code and no-code platforms, which currently run user scripts in unnecessarily expensive container setups.

Lilith's verdict

Running someone else's code has always been a gamble, one we used to solve by buying heavier armor in the form of massive containers. This shows that sometimes you just need to put the attacker in a terrarium where they simply can't see the outside world.