Code execution

Code execution is the core sandbox operation: run a process inside the guest and collect its exit code, stdout, and stderr.

CLI flow

cargo run -- machine run --flake . --name codebox -d
cargo run -- machine exec codebox -- python -c 'print("hello from the guest")'

machine exec runs the command in the guest microVM, sending the request through the guest control path and returning structured output. It does not forward host stdin, so pass the program inline with python -c rather than piping it in; a heredoc would reach the host and the guest would read EOF.

Planned runtime SDK shape

Status: Planned lifecycle API.

Python

from mvm import Sandbox

# Egress is deny-by-default; naming no allow-list is what denies it.
sandbox = Sandbox.create(image="nix:./flake#python-tool")

try:
    result = sandbox.exec(["python", "-c", "print('hello')"])
    print(result.stdout)
finally:
    sandbox.stop()

TypeScript

import { Sandbox, NetworkPolicy } from "@mvm/sdk";

const sandbox = await Sandbox.create({
  image: "nix:./flake#python-tool",
  network: NetworkPolicy.denyByDefault(),
});

try {
  const result = await sandbox.exec(["python", "-c", "print('hello')"]);
  console.log(result.stdout);
} finally {
  await sandbox.stop();
}

Timeouts and errors

Every execution path should carry:

• command args;
• timeout;
• exit status;
• stdout/stderr;
• audit/run identifier;
• redacted error detail.

Do not put secrets in command args. Args are often visible in logs, metrics, audit labels, shell history, or process listings.

Security checklist

• Use a fresh or cold-restored sandbox for untrusted code.
• Keep network disabled unless the code needs it.
• Prefer file upload/download over broad host mounts.
• Redact stdout/stderr before sending it to an LLM transcript.
• Destroy or snapshot intentionally; do not leave state ambiguous.