[GH-ISSUE #140] feat: Support for SmolVM backend #87

New issue

Open

opened 2026-10-18 21:10:35 +00:00 by bsakaguchi · 1 comment

bsakaguchi commented

2026-10-18 21:10:35 +00:00

Owner

Originally created by @gaby on GitHub (Jul 20, 2026).
Original GitHub issue: https://github.com/open-webui/open-terminal/issues/140

Problem

The Docker backend isolates sandboxes with namespaces/cgroups, so every sandbox still shares the host kernel. For untrusted or AI-generated code, a kernel exploit remains an escape path, and hardening options (seccomp,
gVisor) add complexity without true hardware isolation.

Proposal

Add SmolVM as an optional backend engine. SmolVM runs each sandbox in its own microVM (Firecracker on Linux, QEMU on macOS), providing hardware-level isolation with ~500 ms boot times, which is fast enough to sit behind the existing engine interface without hurting UX.

Capabilities that map cleanly onto a Docker-style backend contract:

Python SDK + CLI for create/exec/stop lifecycle
Host directory mounts (read-only by default, opt-in writable)
Per-sandbox network egress controls (domain allow-lists)
Snapshots and pause/resume for persistent sessions
Apache 2.0, pip-installable, no Rust toolchain needed on supported hosts

Originally created by @gaby on GitHub (Jul 20, 2026). Original GitHub issue: https://github.com/open-webui/open-terminal/issues/140 ### Problem The Docker backend isolates sandboxes with namespaces/cgroups, so every sandbox still shares the host kernel. For untrusted or AI-generated code, a kernel exploit remains an escape path, and hardening options (seccomp, gVisor) add complexity without true hardware isolation. ### Proposal Add [SmolVM](https://github.com/CelestoAI/SmolVM) as an optional backend engine. SmolVM runs each sandbox in its own microVM (Firecracker on Linux, QEMU on macOS), providing hardware-level isolation with ~500 ms boot times, which is fast enough to sit behind the existing engine interface without hurting UX. Capabilities that map cleanly onto a Docker-style backend contract: - Python SDK + CLI for create/exec/stop lifecycle - Host directory mounts (read-only by default, opt-in writable) - Per-sandbox network egress controls (domain allow-lists) - Snapshots and pause/resume for persistent sessions - Apache 2.0, pip-installable, no Rust toolchain needed on supported hosts

bsakaguchi commented

2026-10-18 21:10:36 +00:00

Author

Owner

@silenceroom commented on GitHub (Aug 18, 2026):

I guess tim will never implement this because there is an enterprise version of such request. vm alike isolation belongs to the licensed user who can go with Terminal instead of OpenTerminal. T_T

@silenceroom commented on GitHub (Aug 18, 2026): I guess tim will never implement this because there is an enterprise version of such request. vm alike isolation belongs to the licensed user who can go with Terminal instead of OpenTerminal. T_T

No labels

bug

pull-request

No milestone

No project

No assignees

1 participant

Notifications

Due date

The due date is invalid or out of range. Please use the format "yyyy-mm-dd".

No due date set.

Dependencies

No dependencies set.

Reference

open-webui/open-terminal#87

No description provided.

Rows
Columns