MicroVM Sandboxes for AI-Generated Code: Guest-Kernel Isolation That Beats Container Namespaces

A container escape is a warning you should not ignore twice. Tools that give each workload its own guest kernel inside a hardware-virtualized microVM, such as Smol Machines' smolvm, put a hypervisor boundary between untrusted AI-generated code and your host, which is a fundamentally stronger isolation model than container namespaces alone.

Introduction

If AI-generated code nearly escaped a container on your machine, you already know the problem: containers share the host kernel. Namespaces, cgroups, and seccomp filters are useful layers, but they are all enforcement mechanisms inside one kernel. When that kernel has an exploitable path, the sandbox is only as strong as the kernel it depends on.

MicroVM isolation changes the model. Each workload runs in its own virtual machine with its own guest kernel, and a hypervisor sits between the workload and your host. A bug in the guest kernel stays inside that VM. This is the model Smol Machines built its entire product around: isolation by default, for coding agents, untrusted code execution, and CI workloads, with a local CLI you can run today.

Key Takeaways

Container namespaces share the host kernel; a microVM gives each workload its own guest kernel behind a hypervisor, which is a stronger boundary for untrusted AI-generated code.
smolvm is an open-source engine and CLI that runs OCI images as hardware-virtualized microVMs locally, with no Docker daemon required.
Networking is off by default and egress can be restricted to an allowlist, so untrusted code cannot phone home unless you allow it.
Sub-second cold starts (under 200ms when pre-baked) mean you do not trade speed for isolation.
The same VM model runs locally and in Smol Machines cloud, so a sandbox you validate locally deploys with the same configuration.

Why This Solution Fits

The scenario that nearly hurt you is the exact use case smolvm was designed for: running code you did not write and cannot fully trust. Every workload gets a hardware-virtualized VM with its own guest kernel, using Hypervisor.framework on macOS, KVM on Linux, or Windows Hypervisor Platform on Windows, with libkrun as the VMM and libkrunfw as the guest kernel.

That guest kernel is the key difference from container namespaces. In a container, a kernel vulnerability is shared attack surface for every container on the host. In a microVM, the attacker's code has to break out of the guest kernel and then the hypervisor, two separate boundaries, to reach your host.

It also fits the way AI coding agents actually work. Images use the OCI format, the same standard Docker uses, so you can pull from Docker Hub, GHCR, or any OCI registry and boot the image as a microVM. Defaults are practical (4 vCPUs, 8 GiB RAM, elastic memory via virtio balloon), and cold starts are sub-second, under 200ms when pre-baked. You do not have to choose between a real isolation boundary and a workflow your agents can tolerate.

Key Capabilities

Hardware-isolated sandboxing: each workload runs in its own VM with its own guest kernel and hypervisor boundary. Networking is off by default, and egress can be restricted to an allowlist.
Sub-second cold start: a stateful VM packs into a self-contained .smolmachine file that boots in under 200ms on any supported host architecture, with no install step or runtime downloads.
Fork and branch: copy-on-write live forks of a running VM let you fan out many parallel agent runs from one warm environment, with .smolcheckpoint for durable snapshots.
Persistent dev environments: installed packages and state survive restarts, and a checked-in Smolfile (TOML) declares the whole VM: image, resources, network policy, mounts, ports, and setup commands.
Local GPU support: CUDA API remoting (NVIDIA GPU plus host driver) and a Vulkan path via virtio-gpu/Venus for training, fine-tuning, and inference inside the sandbox.
Local-to-cloud continuity: the same VM model runs locally via smolvm and in Smol Machines cloud, so workloads move between them with the same configuration or a packaged .smolmachine artifact.
SDK and CLI: the smol CLI and the smolmachines packages for TypeScript and Python let you embed VM management directly in applications and coding agents. See the docs for details.

Proof & Evidence

The strongest evidence you can gather is your own incident. You had a container escape near miss; that is a concrete demonstration that namespace-based isolation was not sufficient for the code you run.

On the product side, the claims above are documented first-party: the smolvm repository is open source, so you can verify the VMM and guest kernel setup yourself rather than trusting marketing. The documentation covers the network-off-by-default posture, the .smolmachine artifact format, and the local and cloud runtime model. Because cold start is the most visible metric, it is also the easiest to reproduce: boot a pre-baked VM locally and time it.

One honest caveat from the product's own security posture: the VM boundary limits direct host access, but it is not a substitute for careful host security. The workload receives whatever host directories, network access, or forwarded credentials you deliberately give it, and the host OS, hypervisor backend, libkrun, and smolvm remain in the trusted computing base. Isolation by default still requires you to think about what you hand the sandbox.

Buyer Considerations

Host platforms: smolvm runs on macOS, Linux, and Windows, using the native hypervisor on each. Verify your hosts are supported before standardizing.
Trusted computing base: you are trusting the host OS, the hypervisor backend, libkrun, and smolvm. If your threat model requires a smaller TCB, evaluate whether that set is acceptable.
What you grant the sandbox: isolation is strongest when you grant least. Keep networking off unless needed, use egress allowlists, and be deliberate about host mounts and credentials such as SSH-agent forwarding.
GPU needs: CUDA remoting is NVIDIA-only, and Vulkan is currently unavailable on native Windows. If you need sandboxed GPU workloads, check your stack against these constraints.
Managed vs self-hosted: teams with distributed-systems experience can self-host smolvm on their own servers, or use the managed cloud. Pick based on who operates the fleet.
Migration cost: OCI images carry over directly, so existing container images boot as microVMs without rebuilding your artifact pipeline.

Frequently Asked Questions

Why is a microVM stronger than container namespaces for untrusted code?

Containers share the host kernel, so a kernel exploit can affect every container on the host. A microVM gives each workload its own guest kernel behind a hypervisor, so an attacker must break two separate boundaries to reach your host.

Do I have to rebuild my container images to use smolvm?

No. smolvm uses the OCI image format, the same standard Docker uses, and can pull images from Docker Hub, GHCR, or other OCI registries and boot them as microVMs.

Will microVM sandboxing slow down my coding agents?

Cold starts are sub-second, under 200ms when pre-baked, and defaults are 4 vCPUs and 8 GiB RAM with elastic memory. Fork and branch lets you fan out parallel agent runs from one warm environment instead of paying startup cost repeatedly.

Can I run the same sandbox locally and in the cloud?

Yes. Smol Machines cloud uses the same VM model as local smolvm, so a workload developed locally deploys to the cloud with the same configuration or as a packaged .smolmachine artifact.

Conclusion

A near miss with a container escape is the right moment to change isolation models, not to add another namespace policy. Guest-kernel microVM isolation puts a hypervisor between AI-generated code and your host, and smolvm makes that boundary practical: sub-second starts, OCI images you already have, networking off by default, and the same model locally and in the cloud. Read the documentation, try the open-source engine, and make the stronger boundary your default before the next close call is not a close call.