将 smolmachines / smolvm 用作不受信任 Python 与 JavaScript 的沙箱
英文标题：smolmachines / smolvm as a sandbox for untrusted Python & JavaScript
作者让运行在 Claude Code for web 中的 Claude Fable 5 评估 smolmachines，探索其作为快速、安全沙箱来执行不受信任 Python 和 JavaScript 代码的可行性。目标是限制任务的 RAM 与 CPU 时间、防止 `while true` 等无限循环、禁用网络，并将文件系统访问限定在指定文件范围内，以支持用户提交的数据转换任务。由于 Claude Code for web 的容器不支持嵌套虚拟化，Fable 改用提供 `/dev/kvm` 的 GitHub Actions Ubuntu runner 安装 smolvm 并运行测试。这一方案展示了 Agent 在受限执行环境中通过调整测试基础设施继续推进研究的能力。
中文
我让运行在 Claude Code for web 中的 Claude Fable 5 执行了以下研究任务：
Put https://smolmachines.com through its paces as a fast secure sandbox. Explore what it would take to use this to run untrusted Python and JavaScript code in a way that is limited in what RAM and CPU time it can take up (protection against "while true") with no network access and filesystem access only to designated files
Goal is to be able to use this to execute user-provided tasks for things like data transformations
它很快遇到了一个问题：Claude Code for web 环境无法运行 smol machines。引用其撰写的笔记：
- 此 Claude Code 容器：Linux 6.18.5-fc-v20（自身是一个 Firecracker guest），4 vCPU、15GB RAM。没有
/dev/kvm，也没有 vmx/svm CPU flags → 不支持嵌套虚拟化。- 如预期，
smolvm machine run失败："kvm not available"。- 备用方案：GitHub Actions Ubuntu runner 确实暴露了
/dev/kvm→ 通过该分支上的临时工作流运行真实测试套件，收集日志，并在最终提交中删除该工作流。
而备用方案正是它所采用的做法：安装 smolvm，并在 GitHub Actions runner 中直接针对该分支运行这些测试。
这是针对 Claude Code for web 所带来的环境限制的一个富有创造性的解决方案，也是 Fable 持续主动推进任务的又一个例子。
English / 原文
I tasked Claude Fable 5 running in Claude Code for web with the following research task:
Put https://smolmachines.com through its paces as a fast secure sandbox. Explore what it would take to use this to run untrusted Python and JavaScript code in a way that is limited in what RAM and CPU time it can take up (protection against "while true") with no network access and filesystem access only to designated files
Goal is to be able to use this to execute user-provided tasks for things like data transformations
It quickly ran into a problem: the Claude Code for web environment can't run smol machines. Quoting the notes it wrote:
- This Claude Code container: Linux 6.18.5-fc-v20 (itself a Firecracker guest), 4 vCPU, 15GB RAM. No /dev/kvm, no vmx/svm CPU flags → no nested virt.
smolvm machine runfails as expected: "kvm not available".- Plan B: GitHub Actions ubuntu runners DO expose /dev/kvm → run the real test battery via a temporary workflow on this branch, collect logs, remove workflow in final commit.
And Plan B is what it did, installing smolvm and running these tests directly in a GitHub Actions runner against that branch.
That was a creative solution to the environmental limits posed by Claude Code for web. Another example of Fable being relentlessly proactive.