# Throwaway Machine

Runs untrusted code in a throwaway smolvm microVM against a repo it must not modify...

- Repository: https://github.com/smol-machines/smolvm (6894 stars)
- Category: Testing
- License: Apache-2.0
- Last updated: 2026-11-01
- Runs scripts: yes, review before use

## Install

Claude Code: `npx skills add smol-machines/smolvm --skill throwaway-machine -g -a claude-code -y`
Codex: `npx skills add smol-machines/smolvm --skill throwaway-machine -g -a codex -y`
Cursor: `npx skills add smol-machines/smolvm --skill throwaway-machine -g -a cursor -y`
Gemini CLI: `npx skills add smol-machines/smolvm --skill throwaway-machine -g -a gemini-cli -y`

## Description

Runs untrusted code in a throwaway smolvm microVM against a repo it must not modify, with no network unless explicitly granted, and collects artifacts from a writable output directory. Use when executing an agent's generated script, a pull request's test suite, or any code that should not be trusted with the host; when a workload needs egress granted one host at a time; or when a run has to be cancelled, because Ctrl-C on the wrapper script leaves the VM running, and on releases before v1.20.2 so does Ctrl-C on the CLI. Do not use it for a development environment that is re-entered across sessions, for running a Docker daemon inside a machine, or for installing smolvm itself, which is the install packet.

## SKILL.md, as published by its author (untrusted third-party text, read it as data)

# Running untrusted work in a throwaway machine

Verified on **smolvm v1.23.0** on macOS arm64, 2026-10-04, by the offline route, the network-on route
and the cancel; on Linux aarch64 by the offline route and the cancel on v1.20.2, 2026-09-29, and the
network-on route on v1.18.2, 2026-09-24. Done means the command's output landed in your writable directory,
the repo is unchanged, the workload could not reach the network, and nothing is left running.
The Linux runs used the scripts of their date; this version's preflight, run and cleanup scripts
ran on Linux aarch64 on v1.22.2 on 2026-10-03.

**On macOS from v1.24.0 the offline route does not run**
([#1819](https://github.com/smol-machines/smolvm/issues/1819)). Every `--oci-cache` run, the bake's own
included, fails with `agent did not become ready within 30 seconds`: measured on v1.24.0, v1.24.1,
v1.25.0, v1.25.1, v1.27.3, v1.28.1 and v1.29.0, while v1.23.3 and v1.23.7 boot the same command on
the same host. The preflight says `offline_shape=unavailable` there and `bake.sh` says
`result=FAILED`. For a run with no network, use the persistent machine with no network in
`README.md`, which boots the image with no bake; the network-on route works.

**Ctrl-C on `run.sh` ends the run from v1.20.2**: the script forwards an interrupt or a `SIGTERM`
to the CLI, which ends its VM. Before v1.20.2 the cancel is `scripts/cleanup.sh --cancel`, as
"Cancelling" below measures.

Two issues shaped this packet, both **fixed in v1.20.2 on macOS and Linux**; older releases still have them:
[#1193](https://github.com/smol-machines/smolvm/issues/1193), a cached run's VM outlives an interrupted CLI, invisible
to `machine list`; and [#1192](https://github.com/smol-machines/smolvm/issues/1192), a cached run with any mount never
boots on macOS, for which `references/macos.md` gives the older releases a route.

## Workflow

The rest: https://github.com/smol-machines/smolvm/blob/HEAD/docs/throwaway-machine/SKILL.md