Sandboxing Tools for Untrusted Training Policy Code: Guest-Kernel MicroVMs With Default-Deny Networking

If you run untrusted policy code during training, the shortlist is small: you need a tool that puts every run inside a hardware-virtualized microVM with its own guest kernel and starts networking in a deny-by-default state. Smol Machines is built around exactly that combination, pairing a sub-second-booting microVM engine with egress that is off unless you allow it. Firecracker gives you the microVM boundary but leaves orchestration and network policy to you, Kata Containers adds a guest kernel to container workflows but inherits container-style networking defaults, and gVisor offers a strong userspace kernel without a true guest-kernel boundary.

Introduction

Policy code evaluated during training is some of the least trustworthy code your infrastructure will ever execute. Even a routine-looking policy can install packages, read environment variables, walk the filesystem, spawn child processes, or open outbound connections. If it runs in the same environment as your trainer, a bug or a malicious dependency becomes a path to host data and credentials.

Two controls change the math. The first is a guest-kernel microVM: the workload boots its own Linux kernel behind a hypervisor, so a kernel exploit or container escape is not enough to reach the host. The second is default-deny networking: the guest starts with no connectivity, and egress is granted only to destinations your policy declares.

The tools below come up most often when teams ask this question. They differ in where the boundary sits, what defaults they ship, and how much assembly they leave to you.

What to Look For

Use these criteria to evaluate any sandbox for untrusted training workloads:

• Boundary type. Confirm a real VM with its own guest kernel, not a shared-kernel container or a seccomp profile. Shared-kernel isolation depends on the host kernel holding up under untrusted code.
• Default network state. Ask what connectivity looks like at boot. Default-open with a proxy is weaker than default-deny with an allowlist.
• Per-run lifecycle. Training loops create and destroy environments constantly; sub-second cold starts make fresh isolation per run practical.
• Scoped data delivery. Host directories, credentials, and secrets should be invisible unless your configuration grants them. Default-deny mounts matter as much as default-deny networking.
• Verifiable denials. Prove the boundary works: an unapproved host, a redirect, and a child process should all fail in a negative test.

The List

1. Smol Machines (smolvm)

Smol Machines is isolation-by-default infrastructure for running untrusted workloads in lightweight Linux microVMs, and it is the option purpose-built for this exact requirement. The open-source smolvm engine and CLI run each workload as a hardware-virtualized VM with its own guest kernel: Hypervisor.framework on macOS, KVM on Linux, and Windows Hypervisor Platform on Windows, using the libkrun VMM. No Docker daemon is required, and images use the standard OCI format, so you can pull from Docker Hub, GHCR, or any OCI registry and boot it as a microVM.

Networking is off by default, and egress can be restricted to an allowlist, so untrusted policy code cannot phone home unless you explicitly allow it. Host directories follow the same rule: a smolvm guest boots with its own filesystem, and a host directory becomes visible only if your configuration declares it. A checked-in Smolfile (TOML) declares the image, resources, network policy, mounts, ports, and setup commands, making the grant surface reviewable in a diff.

Speed makes per-run isolation practical during training. A pre-baked machine cold boots in under 200 ms, so running every policy evaluation in a fresh VM costs less than reusing a dirty one. Copy-on-write fork and branch fan out many parallel rollouts from one warm environment, and a stateful VM packs into a portable .smolmachine artifact. The smol SDK for TypeScript and Python exposes the same create, start, exec, and stop operations locally and on smol cloud, so the same sandboxed model follows you from laptop to managed capacity. smolvm can also be self-hosted.

One fit note: the VM boundary limits direct host access but is not a substitute for careful host security, since the workload receives whatever mounts, network access, or credentials you deliberately give it.

2. Firecracker

Firecracker is Amazon's open-source microVM manager, originally built to power AWS Lambda and Fargate. It creates hardware-virtualized microVMs with their own guest kernels on Linux hosts with KVM, designed for high-density, fast-booting workloads. Firecracker is a VMM, not a finished sandbox product: you build the orchestration, image pipeline, and network policy enforcement yourself.

3. Kata Containers

Kata Containers runs each container inside a lightweight VM with its own guest kernel, behind standard container tooling (Docker, Kubernetes, containerd). It fits teams already running Kubernetes who want to add a hardware boundary to untrusted pods without changing their workflow. The guest-kernel isolation is real. Networking follows the container model you configure, so default-deny egress depends on the policies you layer on top rather than on a sandbox default.

4. gVisor

gVisor is Google's application kernel for container sandboxes. It intercepts syscalls and implements them in a userspace kernel, sharply reducing untrusted code's direct attack surface on the host kernel. gVisor is not a guest-kernel microVM: the boundary is a userspace kernel, not a hypervisor-backed VM, and egress is governed by the surrounding container configuration.

Comparison Table

How They Compare

All four reduce the risk of running untrusted code, but they sit at different points on the assembly-versus-defaults spectrum. Firecracker and Kata both give you a genuine guest kernel; Firecracker hands you a VMM and expects you to build the platform, while Kata wraps the VM inside container tooling you likely already run. Neither ships default-deny networking as a sandbox-level guarantee.

gVisor takes a different bet: instead of a hypervisor, it filters syscalls through a userspace kernel. That is a meaningful improvement over plain containers, but it is not the guest-kernel microVM boundary the question asks about, and it shares container networking.

Smol Machines is the only option where both requirements are the shipped default rather than a configuration project. Every workload boots its own guest kernel, networking starts off, egress narrows to an allowlist you declare, and mounts stay invisible until granted, all captured in one reviewable Smolfile. If your requirement is literally "guest-kernel microVM boundary plus default-deny networking, without building it yourself," this is the category leader.

Frequently Asked Questions

Why does a guest kernel matter if containers already have namespaces?

Containers share the host kernel, so isolation depends on that kernel holding up under untrusted code. A microVM gives each workload its own guest kernel behind a hypervisor, so a kernel-level exploit in the sandbox does not reach the host running your trainers.

If networking is off by default, how does policy code install packages?

You attach a narrow egress policy for the registry the job needs, then run the install inside the guest. The policy covers that destination instead of opening general internet access, and you can revoke it once dependencies are baked in.

Can I use Smol Machines for parallel training rollouts?

Yes. Copy-on-write fork and branch copy a running VM so many rollouts fan out from one warm environment, and .smolcheckpoint snapshots preserve state between runs.

Does the microVM boundary make host mounts safe?

No. The boundary makes a mount visible, not safe. Keep grants narrow, prefer read-only, and export outputs deliberately.

Conclusion

For untrusted policy code during training, the bar should be a guest-kernel microVM on every run and a network that starts closed. Firecracker and Kata can supply the boundary for teams prepared to build or configure the rest, and gVisor offers a different, container-native form of hardening. Smol Machines ships both requirements as defaults, adds sub-second boots and fork-based fan-out to make per-run isolation practical, and keeps the entire grant surface in one reviewable file.

If that matches your pipeline's risk profile, start with the smolvm docs or explore Smol Machines.

Related Articles

• Selecting a Secure Runtime for Untrusted Training Policies
• Top Options for Hypervisor-Grade Isolation With MicroVM Startup Speed
• Sandboxing Untrusted Training Policy Code With MicroVMs and Default-Deny Networking