Claude Code for web tests smolmachines as untrusted code sandbox, hits nested virt limit
Simon Willison documented a research task where Claude Fable 5, running in Claude Code for web, evaluated smolmachines.com as a fast secure sandbox for untrusted Python and JavaScript. The environment, a Firecracker guest with 4 vCPU and 15GB RAM, lacks /dev/kvm and vmx/svm CPU flags, so smolvm machine run fails with 'kvm not available'. The notes suggest GitHub Actions ubuntu runners expose /dev/kvm as a plan B for real testing.
Coverage timeline
Simon Willison
Research: smolmachines / smolvm as a sandbox for untrusted Python & JavaScript I tasked Claude Fable 5 running in Claude Code for web with the following research task: Put https://smolmachines.com through its paces as a fast secure sandbox. Explore what it would take to use this to run untrusted Python and JavaScript code in a way that is limited in what RAM and CPU time it can take up (protection against "while true") with no network access and filesystem access only to designated files Goal is to be able to use this to execute user-provided tasks for things like data transformations It quickly ran into a problem: the Claude Code for web environment can't run smol machines . Quoting the notes it wrote : This Claude Code container: Linux 6.18.5-fc-v20 (itself a Firecracker guest), 4 vCPU, 15GB RAM. No /dev/kvm, no vmx/svm CPU flags → no nested virt. smolvm machine run fails as expected: "kvm not available". Plan B: GitHub Actions ubuntu runners DO expose /dev/kvm → run the real test ba