Throwaway Machine
Runs untrusted code in a throwaway smolvm microVM against a repo it must not modify...
Install
npx skills add smol-machines/smolvm --skill throwaway-machine -g -a claude-code -y- Repository
- smol-machines/smolvm6.9k
- Category
- Testing
- Updated
- 3d ago
- License
- Apache-2.0
- Context cost
- Mediumabout 3,000 tokens
- Runs scripts
- Yes, review before use
What it does
Runs untrusted code in a throwaway smolvm microVM against a repo it must not modify, with no network unless explicitly granted, and collects artifacts from a writable output directory. Use when executing an agent's generated script, a pull request's test suite, or any code that should not be trusted with the host; when a workload needs egress granted one host at a time; or when a run has to be cancelled, because Ctrl-C on the wrapper script leaves the VM running, and on releases before v1.20.2 so does Ctrl-C on the CLI. Do not use it for a development environment that is re-entered across sessions, for running a Docker daemon inside a machine, or for installing smolvm itself, which is the install packet.
Running untrusted work in a throwaway machine
Verified on smolvm v1.23.0 on macOS arm64, 2026-10-04, by the offline route, the network-on route and the cancel; on Linux aarch64 by the offline route and the cancel on v1.20.2, 2026-09-29, and the network-on route on v1.18.2, 2026-09-24. Done means the command's output landed in your writable directory, the repo is unchanged, the workload could not reach the network, and nothing is left running. The Linux runs used the scripts of their date; this version's preflight, run and cleanup scripts ran on Linux aarch64 on v1.22.2 on 2026-10-03.
On macOS from v1.24.0 the offline route does not run
(#1819). Every --oci-cache run, the bake's own
included, fails with agent did not become ready within 30 seconds: measured on v1.24.0, v1.24.1,
v1.25.0, v1.25.1, v1.27.3, v1.28.1 and v1.29.0, while v1.23.3 and v1.23.7 boot the same command on
the same host. The preflight says offline_shape=unavailable there and bake.sh says
result=FAILED. For a run with no network, use the persistent machine with no network in
README.md, which boots the image with no bake; the network-on route works.
Ctrl-C on run.sh ends the run from v1.20.2: the script forwards an interrupt or a SIGTERM
to the CLI, which ends its VM. Before v1.20.2 the cancel is scripts/cleanup.sh --cancel, as
"Cancelling" below measures.
Two issues shaped this packet, both fixed in v1.20.2 on macOS and Linux; older releases still have them:
#1193, a cached run's VM outlives an interrupted CLI, invisible
to machine list; and #1192, a cached run with any mount never
boots on macOS, for which references/macos.md gives the older releases a route.
