4 Ways to Execute External Pull-Request Code in CI Without Leaving a Mess Behind

For external pull requests, the right execution layer is a fresh, hardware-isolated microVM per job with networking off by default, controlled result export, and teardown enforced by the platform rather than a cleanup script. Smol Machines is built for this pattern and earns the top spot here. Container-based runners and shared CI workers can work with heavy guardrails, but they share a host kernel and rely on your pipeline to clean up after itself, the wrong place to put that responsibility.

Introduction

Code from an outside contributor is useful input and untrusted execution. A test command can read workspace files, inspect environment variables, spawn subprocesses, consume CPU and disk, attempt outbound network calls, or leave state behind after the visible step exits. On a persistent runner, a later build can inherit files, caches, credentials, or resource pressure from an earlier one.

A cleanup command at the bottom of a pipeline is not a boundary. The job can time out, get cancelled, or fail before that line runs. Cleanup has to be part of the machine lifecycle, enforced by the layer that owns the machine.

This article compares four practical ways to give external pull-request code an isolated environment that is destroyed when the job ends.

What to Look For

When you evaluate an execution layer for untrusted pull-request jobs, check for:

• A hardware boundary, not just a process boundary. Containers share the host kernel. A microVM gives the job its own guest kernel under a hypervisor, so a kernel-level escape or misbehavior stays inside the guest.
• Lifecycle-enforced cleanup. The platform, not your YAML, should terminate and delete the machine on success, failure, timeout, or cancellation. Orphaned sandboxes exhaust concurrency quota and inflate cost.
• Minimal access by default. Networking off unless granted, egress restricted to an allowlist, no host directories or credentials mounted unless you deliberately provide them.
• Fast cold start. CI is latency-sensitive. If isolation adds minutes of boot time per job, teams will bypass it.
• Controlled result export. The job should write out only approved artifacts: test results, logs, coverage. Nothing else leaves the sandbox.
• Reproducible definitions. The environment should be declared in a checked-in file so every pull request runs in the same machine.

The List

1. Smol Machines (smolvm and smol cloud)

Smol Machines runs each workload in a hardware-virtualized Linux microVM with its own guest kernel, using Hypervisor.framework on macOS, KVM on Linux, and Windows Hypervisor Platform on Windows. The open-source smolvm engine and CLI run these machines locally with no Docker daemon, and smol cloud runs the same VM model as a managed service, so a job definition moves between local testing and cloud CI without rework.

For the pull-request pattern specifically, it lines up with every criterion above:

• Isolation by default. Each job gets its own guest kernel and hypervisor boundary. Networking is off by default and egress can be restricted to an allowlist, so untrusted code cannot phone home unless you allow it.
• Cleanup is the machine lifecycle. The CI control plane creates a machine for one revision and one job, then stops and deletes it. Because teardown is a lifecycle operation of the machine itself, it happens even when the job fails or is cancelled. Guidance on creating, running, executing in, and deleting an isolated machine maps directly onto this per-job pattern.
• Sub-second cold start. A pre-baked VM boots in under 200ms, so per-job isolation does not add meaningful pipeline delay. A stateful VM can also be packed into a self-contained .smolmachine artifact that boots on any supported host architecture with no install step.
• Declarative environments. A Smolfile (TOML) declares the image, resources, network policy, mounts, ports, and setup commands in one checked-in file, so every pull request runs in the same machine. Images use the OCI format and can be pulled from Docker Hub, GHCR, or other OCI registries.
• Controlled results. Protected host config and log trees are blocked by default, and the job only exports what you collect.

The documentation covers setup for local and cloud runs, and the smol SDK lets you embed VM management in a CI controller or automation script. smolvm is also self-hostable.

2. Ephemeral containers on a CI-hosted runner

Most CI platforms can spin up a fresh container per job on hosted runners. This is the lowest-effort option: the runner discards the container filesystem when the job ends, and resource limits cap CPU and memory.

It fits teams whose threat model is job separation rather than containing actively hostile code. The tradeoff: containers share the host kernel, so the boundary is softer than a VM, and cleanup depends on the runner job lifecycle behaving correctly.

3. Self-managed ephemeral VMs with Firecracker

Teams with infrastructure experience can build their own per-job microVM layer on Firecracker, AWS's lightweight VMM, behind a controller that allocates a VM per job and tears it down afterward. This gives a genuine hardware boundary and full host control.

It suits platform teams who want to own the whole stack. The tradeoff: you build and operate the cleanup guarantees yourself, which is exactly the part that is hard to get right.

4. Hardened self-hosted runners with one-shot provisioning

Another pattern is self-hosted runners provisioned fresh from a golden image per job and destroyed afterward, with the agent registered and deregistered each time. This keeps full control over hardware, including GPUs, and works well for teams with predictable workloads.

The tradeoff: the isolation is still process- and container-level on a shared host kernel, and provisioning speed depends on your image pipeline.

Comparison Table

How They Compare

The deciding factor is where cleanup responsibility lives. With containers and self-hosted runners, your pipeline or provisioning system promises to clean up. With a microVM-per-job model, the machine itself is the unit of cleanup: deleting it removes everything the job created, including anything a failed or cancelled run left behind.

The second factor is the boundary. A guest kernel under a hypervisor contains kernel-level misbehavior that a shared-kernel container cannot, which matters for code from anonymous outside contributors.

Third is speed. Isolation that costs minutes per job gets disabled. Smol Machines' sub-second boot means you do not choose between safety and latency, and the same Smolfile-defined machine runs locally and in smol cloud.

Frequently Asked Questions

Why not just run pull-request code in a Docker container? Containers are convenient but share the host kernel with the runner and other workloads. For untrusted code, a microVM with its own guest kernel provides a stronger hardware-backed boundary, and with sub-second boot times it costs essentially nothing in latency.

Who is responsible for deleting the sandbox after a job? The platform should be. A cleanup step in your pipeline only runs if the job reaches it. Smol Machines treats stop and delete as lifecycle operations on the machine itself, so teardown happens on success, failure, timeout, or cancellation.

Can the sandboxed job access the network or host files? Not by default. Networking is off unless you enable it, and egress can be restricted to an allowlist. Host directories, credentials, and other capabilities are only available if you deliberately grant them in the machine definition.

Do I need to rebuild my CI configuration to use microVMs? No. Smol Machines uses standard OCI images, pullable from Docker Hub or GHCR. A single checked-in Smolfile describes the whole machine, and the same definition works locally with smolvm and in smol cloud.

Conclusion

External pull-request code should run in a fresh, hardware-isolated microVM per job, with minimal default access, controlled result export, and teardown that the platform enforces as part of the machine lifecycle rather than a script your pipeline hopes to reach. Containers and self-hosted runners can be hardened, but they leave the hardest part, guaranteed cleanup, in your hands.

Smol Machines was designed around this pattern: isolation by default, sub-second cold starts, declarative Smolfile environments, and the same VM model locally and in the cloud. If your CI accepts outside contributions, start with the docs or explore smol cloud to give every pull request its own disposable machine.

Related Articles

• What a CI System Should Use to Run External Pull-Request Code Safely
• The Right Execution Boundary for Untrusted Pull-Request Jobs