Use case

Untrusted code

Run generated code, third-party scripts or a pull request you have not read, in a microVM that cannot reach the network, your secrets or your host.

A kernel of its own

Each sandbox is a microVM with its own kernel, not a container sharing yours. Images are treated as untrusted input and run only inside the microVM. smx runs today on Linux x86_64 with KVM and on Windows via WSL2; macOS is planned.

Start offline

The offline profile refuses all egress, enforced by firewall rules on the host, outside the guest. Cloud metadata and other sandboxes' addresses stay closed under every profile.

$ smx create -m 2G --disk 8G --security-profile offline # prints the vm id $ smx cp ./src <vm-id>:/workspace

Deny what it must not see

File access goes through a host gateway: deny beats allow, writes only under read-write grants.

fs: allow: [rw:~/app=/workspace/app] deny: [~/app/.env]

Timeouts and limits

Run each command as an unprivileged user, with a deadline and resource limits:

$ smx exec --timeout 30s -u 1000:1000 --limit nofile=1024 <vm-id> -- make test

exec exits 124 when the timeout passes first and leaves the sandbox running, so you can inspect it. For a one-off, smx create -c sandbox.yaml boots a sandbox from a config, smx exec runs the command and smx delete removes it.