{"slug": "qemu", "name": "QEMU", "category": "infra", "category_name": "Infrastructure and DevOps", "description": "Open-source machine emulator and virtualizer for running VMs and emulating other CPU architectures.", "recommenders": 12, "commenters": 28, "warners": 2, "score": 12.902, "rising": 4.04, "first": "2025-11-14", "latest": "2026-10-30", "why": "HN commenters recommend QEMU for isolated sandbox VMs, especially for running AI coding agents with full permissions, and for emulating other CPU architectures such as RISC-V, MIPS and x86.", "why_is_quote": false, "has_verdict": true, "sentiment": {"recommend": 12, "neutral": 14, "compare": 1, "warn": 2}, "spark": [1, 1, 0, 1, 0, 0, 0, 2, 2, 1, 4, 0], "listed": true, "loved": ["Agent sandboxing", "Architecture emulation"], "caveat": "macOS performance", "short_quote": "QEMU virtual machines. Sandboxes like firejail and bubblewrap share a kernel: attacker is one exploit away from root.", "icon": false, "domain": "qemu.org", "github_repo": null, "official_url": "https://www.qemu.org", "pricing": "open source", "aliases": ["QEMU"], "verdict": [{"text": "HN commenters recommend QEMU for isolated sandbox VMs, especially for running AI coding agents with full permissions,", "cites": [{"id": 796496320, "item_id": 49781020, "url": "https://news.ycombinator.com/item?id=49781020", "by": "JonChesterfield", "date": "2026-09-20", "stance": "recommend", "quote": "Highly recommend qemu instead.", "excerpt": "Highly recommend qemu instead. The sandbox machines are just more IP addresses on the local network. If you want them completely offline, put them on a network that doesn't have a route to anywhere. The sketchy AI harness is very happy with a whole machine to itself, complete with root access. You can push/pull git repos in from the outside, so all it can do is trash it's own sandbox and get reinstated from scratch b", "context": "", "use_case": "sandboxing AI agents in VMs", "switched_from": "", "story": "Software sandboxing: The basics (2025)"}, {"id": 788935360, "item_id": 49308460, "url": "https://news.ycombinator.com/item?id=49308460", "by": "matheusmoreira", "date": "2026-08-15", "stance": "recommend", "quote": "QEMU virtual machines. Sandboxes like firejail and bubblewrap share a kernel: attacker is one exploit away from root.", "excerpt": "QEMU virtual machines. Sandboxes like firejail and bubblewrap share a kernel: attacker is one exploit away from root. Hypervisors present an infinitely smaller attack surface, and if they're ever defeated the entire industry is done, not just me. I have a base system image that gets forked off into delta qcow2 images for every project I'm working on or whatever ephemeral execution context I need. I started a side pro", "context": "", "use_case": "isolating dev tools in VMs", "switched_from": "firejail", "story": "Firefox is now the last major browser that still supports uBlock Origin"}, {"id": 753844097, "item_id": 47115256, "url": "https://news.ycombinator.com/item?id=47115256", "by": "einarfd", "date": "2026-02-22", "stance": "recommend", "quote": "Originally I used docker, but I\u2019m now in the process of jettisoning that, and switching to qemu.", "excerpt": "I\u2019ve been building sandboxing for Claude code workloads. So I can let it run wild without breaking my computer. Originally I used docker, but I\u2019m now in the process of jettisoning that, and switching to qemu. For my use case I want ssh access and being able to use docker in docker. This allows for things like test containers and docker compose. You can get all of that working with docker. But you kind of have to figh", "context": "building sandboxing for Claude Code workloads", "use_case": "sandboxing Claude Code workloads", "switched_from": "Docker", "story": "NanoClaw Moved from Apple Containers to Docker"}, {"id": 787849522, "item_id": 49240595, "url": "https://news.ycombinator.com/item?id=49240595", "by": "matheusmoreira", "date": "2026-08-10", "stance": "neutral", "quote": "coding my own QEMU VM orchestration solution was among the first things I used it for", "excerpt": "I too skip all permissions, but I run the harnesses inside an isolated virtual machine. I took care to firejail Claude Code on my host since day one, and coding my own QEMU VM orchestration solution was among the first things I used it for. Alarm fatigue will quickly destroy any and all \"meticulously approve every little command the AI wants to run\" workflows. Give it a virtual machine and let it cook. If it blows up", "context": "", "use_case": "VM orchestration for agents", "switched_from": "", "story": "Auto mode is now the default in Claude Code"}]}, {"text": " and for emulating other CPU architectures such as RISC-V, MIPS and x86.", "cites": [{"id": 794661616, "item_id": 49666351, "url": "https://news.ycombinator.com/item?id=49666351", "by": "westurner", "date": "2026-09-11", "stance": "recommend", "quote": "Qemu also supports 32bit and 64bit RISC-V", "excerpt": "Emulation of RISC-V in software; container2wasm has TinyEmu for RISC-V. dearchap/tinyemu: https://github.com/dearchap/tinyemu Qemu also supports 32bit and 64bit RISC-V: \"RISC-V System emulator \u2014 QEMU documentation\" https://www.qemu.org/docs/master/system/target-riscv.html Emu86 emulates RISC-V in Python and also WASM now IIRC: https://news.ycombinator.com/item?id=41899475 .. https://github.com/gcallah/Emu86/blob/mast", "context": "", "use_case": "RISC-V emulation", "switched_from": "", "story": "RISC-V Emulator and Linux System from Scratch"}, {"id": 741874689, "item_id": 46367168, "url": "https://news.ycombinator.com/item?id=46367168", "by": "infinet", "date": "2025-12-23", "stance": "neutral", "quote": "Once I used an old MIPS debian in qemu to test big endian.", "excerpt": "Once I used an old MIPS debian in qemu to test big endian. I thought since LoongArch has its root in MIPS it may be big endian. It turns out \"LoongArch bit designations are always little-endian\".", "context": "", "use_case": "emulating MIPS", "switched_from": "", "story": "Debian adds LoongArch as officially supported architecture"}, {"id": 734870993, "item_id": 45929437, "url": "https://news.ycombinator.com/item?id=45929437", "by": "octagons", "date": "2025-11-14", "stance": "neutral", "quote": "opt to run them via QEMU on the x86 platforms", "excerpt": "I\u2019ve been running an Incus cluster of 3 fairly beefy servers for about a year now. It\u2019s my go-to recommendation for anyone wanting to setup a new virtualized environment. One of my favorite features is how you can tag different cluster members for different architectures. In the same cluster, I can have traditional dual-socket x86 servers with a dozen DIMM slots as well as Raspberry Pis. The architecture tagging lets", "context": "deals with a lot of embedded firmware", "use_case": "running ARM workloads on x86", "switched_from": "", "story": "Incus-OS: Immutable Linux OS to run Incus as a hypervisor"}]}, {"text": " Complaints are scattered rather than common: on macOS one user found Colima with Apple's virtualization framework faster and less buggy,", "cites": [{"id": 775659857, "item_id": 48478741, "url": "https://news.ycombinator.com/item?id=48478741", "by": "einsteinx2", "date": "2026-06-10", "stance": "warn", "quote": "found it works better than QEMU (better performance and resolved some bugs I was running into with the Supabase docker stack)", "excerpt": "Yeah I was gonna say I use Colima with Apple\u2019s virtualization framework (it\u2019s not the default for some reason but it\u2019s a single command line flag), and found it works better than QEMU (better performance and resolved some bugs I was running into with the Supabase docker stack)", "context": "", "use_case": "macOS virtualization", "switched_from": "", "story": "macOS Container Machines"}]}, {"text": " and another hit a qemu-user bug that breaks uv for cross-platform targets.", "cites": [{"id": 780308993, "item_id": 48769312, "url": "https://news.ycombinator.com/item?id=48769312", "by": "thewisenerd", "date": "2026-07-02", "stance": "warn", "quote": "", "excerpt": "podman's been great for me on macOS for testing stuff quick; which earlier used to need a whole limactl[3]/virt thing. you can set it up with qemu-user-static for --platform linux/amd64; i don't remember which i exactly used, or if official docs have been updated for it but looked something like [1] there is one sneaky bug in qemu that breaks uv [2] for cross-platform targets so i keep having to fall back to lima for", "context": "", "use_case": "cross-platform emulation", "switched_from": "", "story": "Podman v6.0.0"}]}], "praise": [{"label": "Agent sandboxing", "summary": "A full VM gives AI agents and untrusted code a stronger boundary than shared-kernel sandboxes or Docker.", "quotes": [{"id": 788935360, "item_id": 49308460, "url": "https://news.ycombinator.com/item?id=49308460", "by": "matheusmoreira", "date": "2026-08-15", "stance": "recommend", "quote": "QEMU virtual machines. Sandboxes like firejail and bubblewrap share a kernel: attacker is one exploit away from root.", "excerpt": "QEMU virtual machines. Sandboxes like firejail and bubblewrap share a kernel: attacker is one exploit away from root. Hypervisors present an infinitely smaller attack surface, and if they're ever defeated the entire industry is done, not just me. I have a base system image that gets forked off into delta qcow2 images for every project I'm working on or whatever ephemeral execution context I need. I started a side pro", "context": "", "use_case": "isolating dev tools in VMs", "switched_from": "firejail", "story": "Firefox is now the last major browser that still supports uBlock Origin"}, {"id": 796496320, "item_id": 49781020, "url": "https://news.ycombinator.com/item?id=49781020", "by": "JonChesterfield", "date": "2026-09-20", "stance": "recommend", "quote": "Highly recommend qemu instead.", "excerpt": "Highly recommend qemu instead. The sandbox machines are just more IP addresses on the local network. If you want them completely offline, put them on a network that doesn't have a route to anywhere. The sketchy AI harness is very happy with a whole machine to itself, complete with root access. You can push/pull git repos in from the outside, so all it can do is trash it's own sandbox and get reinstated from scratch b", "context": "", "use_case": "sandboxing AI agents in VMs", "switched_from": "", "story": "Software sandboxing: The basics (2025)"}, {"id": 753844097, "item_id": 47115256, "url": "https://news.ycombinator.com/item?id=47115256", "by": "einarfd", "date": "2026-02-22", "stance": "recommend", "quote": "Originally I used docker, but I\u2019m now in the process of jettisoning that, and switching to qemu.", "excerpt": "I\u2019ve been building sandboxing for Claude code workloads. So I can let it run wild without breaking my computer. Originally I used docker, but I\u2019m now in the process of jettisoning that, and switching to qemu. For my use case I want ssh access and being able to use docker in docker. This allows for things like test containers and docker compose. You can get all of that working with docker. But you kind of have to figh", "context": "building sandboxing for Claude Code workloads", "use_case": "sandboxing Claude Code workloads", "switched_from": "Docker", "story": "NanoClaw Moved from Apple Containers to Docker"}]}, {"label": "Architecture emulation", "summary": "Emulates RISC-V, MIPS, Intel Mac OS X and other targets for testing and cross-architecture workloads.", "quotes": [{"id": 794661616, "item_id": 49666351, "url": "https://news.ycombinator.com/item?id=49666351", "by": "westurner", "date": "2026-09-11", "stance": "recommend", "quote": "Qemu also supports 32bit and 64bit RISC-V", "excerpt": "Emulation of RISC-V in software; container2wasm has TinyEmu for RISC-V. dearchap/tinyemu: https://github.com/dearchap/tinyemu Qemu also supports 32bit and 64bit RISC-V: \"RISC-V System emulator \u2014 QEMU documentation\" https://www.qemu.org/docs/master/system/target-riscv.html Emu86 emulates RISC-V in Python and also WASM now IIRC: https://news.ycombinator.com/item?id=41899475 .. https://github.com/gcallah/Emu86/blob/mast", "context": "", "use_case": "RISC-V emulation", "switched_from": "", "story": "RISC-V Emulator and Linux System from Scratch"}, {"id": 741874689, "item_id": 46367168, "url": "https://news.ycombinator.com/item?id=46367168", "by": "infinet", "date": "2025-12-23", "stance": "neutral", "quote": "Once I used an old MIPS debian in qemu to test big endian.", "excerpt": "Once I used an old MIPS debian in qemu to test big endian. I thought since LoongArch has its root in MIPS it may be big endian. It turns out \"LoongArch bit designations are always little-endian\".", "context": "", "use_case": "emulating MIPS", "switched_from": "", "story": "Debian adds LoongArch as officially supported architecture"}, {"id": 792300016, "item_id": 49518751, "url": "https://news.ycombinator.com/item?id=49518751", "by": "BillStrong", "date": "2026-09-01", "stance": "recommend", "quote": "You can emulate Intel Mac OS X using QEMU on linux machines", "excerpt": "VMs with GPU passed through. You can get Mac compatible GPUs that will work, look for the Dortania OpenCore guide GPU lists to find one that works for the version of Mac OS X it runs on. Looking on Macintosh Repository, that game will run on Intel CPUs and Snow Leopard, 10.6+. (IDK for sure.) You can emulate Intel Mac OS X using QEMU on linux machines, there are some scripts that make it easy from Proxmox that I use.", "context": "", "use_case": "emulating Mac OS X", "switched_from": "", "story": "Run macOS Software on Linux"}]}, {"label": "qcow2 snapshots", "summary": "The copy-on-write qcow2 disk format makes forking, snapshotting and restoring VMs cheap.", "quotes": [{"id": 774786544, "item_id": 48424159, "url": "https://news.ycombinator.com/item?id=48424159", "by": "theaniketmaurya", "date": "2026-06-06", "stance": "recommend", "quote": "We use QEMU for our sandbox infra.", "excerpt": "We use QEMU for our sandbox infra. QEMU comes with qcow2 (copy-on-write), a native disk image format. It allows the VM to only write changes to disk which saves time and space specially if you want to snapshot and restore changes. Wrote a piece on building a mental model for qcow2 overlays.", "context": "builds sandbox infra", "use_case": "sandbox infrastructure VMs", "switched_from": "", "story": "How Qcow2 Overlays Work in QEMU"}, {"id": 788935360, "item_id": 49308460, "url": "https://news.ycombinator.com/item?id=49308460", "by": "matheusmoreira", "date": "2026-08-15", "stance": "recommend", "quote": "QEMU virtual machines. Sandboxes like firejail and bubblewrap share a kernel: attacker is one exploit away from root.", "excerpt": "QEMU virtual machines. Sandboxes like firejail and bubblewrap share a kernel: attacker is one exploit away from root. Hypervisors present an infinitely smaller attack surface, and if they're ever defeated the entire industry is done, not just me. I have a base system image that gets forked off into delta qcow2 images for every project I'm working on or whatever ephemeral execution context I need. I started a side pro", "context": "", "use_case": "isolating dev tools in VMs", "switched_from": "firejail", "story": "Firefox is now the last major browser that still supports uBlock Origin"}]}, {"label": "Quick to spin up", "summary": "Simple VMs start quickly, which makes one VM per project practical.", "quotes": [{"id": 785233824, "item_id": 49077114, "url": "https://news.ycombinator.com/item?id=49077114", "by": "bitbasher", "date": "2026-07-27", "stance": "recommend", "quote": "A simple qemu virtual machine is nice and quick to spin up.", "excerpt": "A simple qemu virtual machine is nice and quick to spin up. I mainly work inside an openbsd or linux virtual machine. I use a different vm for each project and I have a \"sandbox\" vm I use to run random things I download/test.", "context": "", "use_case": "sandboxing untrusted code", "switched_from": "", "story": "Ask HN: How to deal with security implications of running/installing projects?"}, {"id": 782685459, "item_id": 48917841, "url": "https://news.ycombinator.com/item?id=48917841", "by": "rmunn", "date": "2026-07-15", "stance": "neutral", "quote": "running the `qemu-system-x86_64` command (takes a couple of seconds)", "excerpt": "I've been running Claude Code in a VM, where I clone the GitHub repos I want it to work on (they're open source so no login info needed) but have no other credentials. I used to reset the VM every day, but that was getting to be a bit of a hassle so I switched to a monthly reset. But even so, it would be hard for Claude to exfil anything more than what open-source projects I've been working on in the past month (at w", "context": "", "use_case": "running VMs", "switched_from": "", "story": "I tricked Claude into leaking your deepest, darkest secrets"}]}, {"label": "Extensibility", "summary": "TCG plugins, the microvm machine type and fault simulation support custom tooling and testing.", "quotes": [{"id": 776969153, "item_id": 48560572, "url": "https://news.ycombinator.com/item?id=48560572", "by": "xvilka", "date": "2026-06-16", "stance": "recommend", "quote": "QEMU now has the notion of TCG plugins[1] that can read/write registers and memory, which is enough for most cases.", "excerpt": "The problem is that it's not sustainable - QEMU improved so much since the moment of fork and updating the QEMU code in Unicorn is always done manually. It is especially important for architectures that evolve quickly - ARM64, RISC-V, x86. Meanwhile, QEMU now has the notion of TCG plugins[1] that can read/write registers and memory, which is enough for most cases. You can see many examples of the plugins in contrib/p", "context": "", "use_case": "CPU emulation with plugins", "switched_from": "", "story": "Unicorn \u2013 The Ultimate CPU Emulator"}, {"id": 787856641, "item_id": 49241040, "url": "https://news.ycombinator.com/item?id=49241040", "by": "cv_h", "date": "2026-08-10", "stance": "neutral", "quote": "uses QEMU's microvm machine type under the hood", "excerpt": "I wrote a CLI tool that uses QEMU's microvm machine type under the hood. It can take any docker image and build a microvm. I use it regularly to run Claude/Codex with permission checks disabled. https://github.com/cvhariharan/mvm", "context": "", "use_case": "microVM backend", "switched_from": "", "story": "Docker Sandboxes \u2013 Disposable, isolated sandboxes for AI agents"}, {"id": 804962704, "item_id": 50310169, "url": "https://news.ycombinator.com/item?id=50310169", "by": "fschuett", "date": "2026-10-30", "stance": "neutral", "quote": "all of these are simulateable in QEMU or Linux (tc netem / blkdebug)", "excerpt": "It's not that crashes don't happen, it's just that they don't \"randomly\" happen. The error codes from bad hardware are predictable (against kernel bugs... well I use an \"allnoconfig\" kernel, which disables like 95% of the kernel). Bad hardware, bad network, bad RAM, all of these are simulateable in QEMU or Linux (tc netem / blkdebug). If I count my test suite for the ISO, I have ~2500 unit tests (placement groups tes", "context": "building own storage system", "use_case": "fault simulation testing", "switched_from": "", "story": "AI isn't replacing SREs, it's deskilling them"}]}, {"label": "GPU passthrough", "summary": "Users pass whole GPUs and USB controllers through to VMs.", "quotes": [{"id": 794793792, "item_id": 49674612, "url": "https://news.ycombinator.com/item?id=49674612", "by": "matja", "date": "2026-09-12", "stance": "recommend", "quote": "I have a few QEMU VMs where I use PCI-passthrough of a whole GPU and a USB controller", "excerpt": "> I wish the stars would align for QEMU to gain support for sunlight/moonlight streaming directly in the hypervisor. I didn't know I wanted it until you said it. I have a few QEMU VMs where I use PCI-passthrough of a whole GPU and a USB controller, and wire the display and USB outputs physically into a KVM switch - works great, but not having to fiddle with the KVM (and run out of physical ports) would be - indeed, k", "context": "", "use_case": "VMs with GPU passthrough", "switched_from": "", "story": "I refuse to let SPICE die"}, {"id": 792300016, "item_id": 49518751, "url": "https://news.ycombinator.com/item?id=49518751", "by": "BillStrong", "date": "2026-09-01", "stance": "recommend", "quote": "You can emulate Intel Mac OS X using QEMU on linux machines", "excerpt": "VMs with GPU passed through. You can get Mac compatible GPUs that will work, look for the Dortania OpenCore guide GPU lists to find one that works for the version of Mac OS X it runs on. Looking on Macintosh Repository, that game will run on Intel CPUs and Snow Leopard, 10.6+. (IDK for sure.) You can emulate Intel Mac OS X using QEMU on linux machines, there are some scripts that make it easy from Proxmox that I use.", "context": "", "use_case": "emulating Mac OS X", "switched_from": "", "story": "Run macOS Software on Linux"}]}], "caveats": [{"label": "macOS performance", "summary": "One user found Colima with Apple's virtualization framework performed better and avoided bugs they hit with QEMU.", "quotes": [{"id": 775659857, "item_id": 48478741, "url": "https://news.ycombinator.com/item?id=48478741", "by": "einsteinx2", "date": "2026-06-10", "stance": "warn", "quote": "found it works better than QEMU (better performance and resolved some bugs I was running into with the Supabase docker stack)", "excerpt": "Yeah I was gonna say I use Colima with Apple\u2019s virtualization framework (it\u2019s not the default for some reason but it\u2019s a single command line flag), and found it works better than QEMU (better performance and resolved some bugs I was running into with the Supabase docker stack)", "context": "", "use_case": "macOS virtualization", "switched_from": "", "story": "macOS Container Machines"}]}, {"label": "qemu-user bug", "summary": "A qemu-user bug breaks uv for cross-platform targets, forcing a fallback to Lima.", "quotes": [{"id": 780308993, "item_id": 48769312, "url": "https://news.ycombinator.com/item?id=48769312", "by": "thewisenerd", "date": "2026-07-02", "stance": "warn", "quote": "", "excerpt": "podman's been great for me on macOS for testing stuff quick; which earlier used to need a whole limactl[3]/virt thing. you can set it up with qemu-user-static for --platform linux/amd64; i don't remember which i exactly used, or if official docs have been updated for it but looked something like [1] there is one sneaky bug in qemu that breaks uv [2] for cross-platform targets so i keep having to fall back to lima for", "context": "", "use_case": "cross-platform emulation", "switched_from": "", "story": "Podman v6.0.0"}]}, {"label": "Hardware differences", "summary": "QEMU does not check segmentation limits the way real hardware does.", "quotes": [{"id": 757692225, "item_id": 47355764, "url": "https://news.ycombinator.com/item?id=47355764", "by": "toast0", "date": "2026-03-12", "stance": "neutral", "quote": "qemu doesn't check segmentation limits but real hardware does.", "excerpt": "> RTL8139 network driver (WIP) It's good to have support for real networking hardware, but consider virtio-net as well. A lot of VMs support it and it's more streamlined. 32-bit x86, bios boot means doing a lot of things for compatibility with systems that were old enough to drink before you were born... skipping to simplified virtualized interfaces wherever possible makes a lot of sense; even if your OS can run in 1", "context": "hobby OS developer", "use_case": "testing hobby OS kernel", "switched_from": "", "story": "Show HN: Aurion OS \u2013 A 32-bit GUI operating system written from scratch in C"}]}, {"label": "No GPU on Mac", "summary": "Linux VMs on macOS do not get access to the real GPU, which limits model performance.", "quotes": [{"id": 790955509, "item_id": 49434719, "url": "https://news.ycombinator.com/item?id=49434719", "by": "jlokier", "date": "2026-08-25", "stance": "recommend", "quote": "some free and open source (QEMU, UTM, Lima, Colima)", "excerpt": "You can't run Linux directly on these. Asahi Linux supports up to M2 only. Linux runs very well in a VM on macOS. There are many good options for this, some free and open source (QEMU, UTM, Lima, Colima), some proprietary (VMware Fusion, Parallels). But Linux in a VM doesn't get access to the real GPU, so model performance is limited. Those running on the CPU perform well, and those needing the GPU don't. However, ma", "context": "", "use_case": "running Linux VMs on macOS", "switched_from": "", "story": "Apple introduces M6 and M5 Ultra"}]}, {"label": "Slower startup", "summary": "A VM-based browser starts slower than a native instance.", "quotes": [{"id": 735186529, "item_id": 45949158, "url": "https://news.ycombinator.com/item?id=45949158", "by": "scrps", "date": "2025-11-16", "stance": "neutral", "quote": "I use qemu + cage + firefox and some glue logic to fire up a copy of a base image which gets deleted on exit.", "excerpt": "Nonpersistent vm-based browser, I use qemu + cage + firefox and some glue logic to fire up a copy of a base image which gets deleted on exit. Fires up slower than a native firefox instance but runs all the same. Can containerize for the less paranoid and less work but browsers touching host kernel gives me the ick as does the idea of trying to write ebpf policies for firefox to mitigate. Browsers are pain.", "context": "", "use_case": "disposable browser VM", "switched_from": "", "story": "Supercookie: Browser Fingerprinting via Favicon (2021)"}]}], "who": [{"by": "fschuett", "context": "building own storage system", "url": "https://news.ycombinator.com/item?id=50310169", "date": "2026-10-30"}, {"by": "theaniketmaurya", "context": "builds sandbox infra", "url": "https://news.ycombinator.com/item?id=48424159", "date": "2026-06-06"}, {"by": "toast0", "context": "hobby OS developer", "url": "https://news.ycombinator.com/item?id=47355764", "date": "2026-03-12"}, {"by": "einarfd", "context": "building sandboxing for Claude Code workloads", "url": "https://news.ycombinator.com/item?id=47115256", "date": "2026-02-22"}, {"by": "octagons", "context": "deals with a lot of embedded firmware", "url": "https://news.ycombinator.com/item?id=45929437", "date": "2025-11-14"}], "tags": ["for AI agent sandboxing", "for cross-architecture emulation", "for OS and low-level development", "for Linux users"], "use_cases": ["fault simulation testing", "sandboxing ai agents", "document creation workflows", "emulation", "sandboxing ai agents in vms", "vms with gpu passthrough"], "compared": [{"slug": "claude-code", "name": "Claude Code", "co": 4, "switched_from": 0, "switched_to": 0}, {"slug": "lima", "name": "Lima", "co": 4, "switched_from": 0, "switched_to": 0}, {"slug": "firejail", "name": "Firejail", "co": 2, "switched_from": 1, "switched_to": 0}, {"slug": "docker", "name": "Docker", "co": 2, "switched_from": 1, "switched_to": 0}, {"slug": "utm", "name": "UTM", "co": 3, "switched_from": 0, "switched_to": 0}, {"slug": "debian", "name": "Debian", "co": 2, "switched_from": 0, "switched_to": 0}, {"slug": "ffmpeg", "name": "ffmpeg", "co": 2, "switched_from": 0, "switched_to": 0}, {"slug": "proxmox", "name": "Proxmox", "co": 2, "switched_from": 0, "switched_to": 0}], "makers": [{"id": 798853728, "item_id": 49928358, "url": "https://news.ycombinator.com/item?id=49928358", "by": "quic_bcain", "date": "2026-10-01", "stance": "recommend", "quote": "My team is looking to hire a ~entry-level software developer to help us design and extend QEMU support [1] for the Hexagon DSP", "excerpt": "Qualcomm | Canada | Full Time | Engineer | Remote(Canada)| QEMU My team is looking to hire a ~entry-level software developer to help us design and extend QEMU support [1] for the Hexagon DSP [2]. We're looking for candidates who have experience coding in C, C++ or Rust* and who aren't afraid of rolling up their sleeves and poring over disassembled code. This particular architecture is a bit more challenging than most", "context": "works at Qualcomm", "use_case": "Hexagon DSP emulation", "switched_from": "", "story": "Ask HN: Who is hiring? (October 2026)"}, {"id": 790397600, "item_id": 49399850, "url": "https://news.ycombinator.com/item?id=49399850", "by": "mzakharo1", "date": "2026-08-22", "stance": "recommend", "quote": "Having ability to spin up virtual machines speeds up development quite a bit.", "excerpt": "We recently added ESP32-C5/C6 support with WiFi to espressif QEMU. Having ability to spin up virtual machines speeds up development quite a bit. We can now take our production firmware image, and run it unmodified on QEMU. No more waiting for boards to flash, spinning up multiple boards instantly. https://github.com/CognitiveSystemsCorp/qemu_esp", "context": "works on ESP32 QEMU support", "use_case": "ESP32 firmware development", "switched_from": "", "story": "ESP32 Firmware Development with Docker Sandboxes"}, {"id": 736090336, "item_id": 46005646, "url": "https://news.ycombinator.com/item?id=46005646", "by": "pm215", "date": "2025-11-21", "stance": "recommend", "quote": "QEMU switched to a data driven representation with a python program to autogenerate the \"check bit patterns and extract fields\" code, and it's one of the better design overhauls we've done", "excerpt": "For a learning project like this one, this would probably be overkill, but my personal suggestion for instruction decoding is that it really pays in the long term to use a data driven decoder. It's fairly easy to do a handcoded \"if bits A..B are 0b1000 and...\" decoder for the basic integer parts of the instruction set, but especially as you get into complexities like SIMD and if you need your decoder to be easy to mo", "context": "QEMU contributor", "use_case": "instruction decoding design", "switched_from": "", "story": "Building a Minimal Viable Armv7 Emulator from Scratch"}], "threads": [{"url": "https://news.ycombinator.com/item?id=50305693", "title": "AI isn't replacing SREs, it's deskilling them", "mentions": 1}, {"url": "https://news.ycombinator.com/item?id=50300683", "title": "Backdoor in Claude Code for VS Code extension on the Cursor Marketplace", "mentions": 1}, {"url": "https://news.ycombinator.com/item?id=50088643", "title": "Running Windows desktop tests from Linux with disposable VMs", "mentions": 1}, {"url": "https://news.ycombinator.com/item?id=49922569", "title": "Ask HN: Who is hiring? (October 2026)", "mentions": 1}, {"url": "https://news.ycombinator.com/item?id=49841285", "title": "Pentium II at 600Mhz with Voodoo 3 Emulated on 86Box with M6 Mac Mini", "mentions": 1}, {"url": "https://news.ycombinator.com/item?id=49778670", "title": "Software sandboxing: The basics (2025)", "mentions": 1}], "sentiment_by_month": {"2025-11": {"neutral": 2, "recommend": 1}, "2025-12": {"neutral": 1, "recommend": 1}, "2026-01": {"neutral": 1}, "2026-02": {"recommend": 1, "neutral": 1}, "2026-03": {"neutral": 2}, "2026-04": {}, "2026-05": {}, "2026-06": {"recommend": 2, "warn": 1, "neutral": 1}, "2026-07": {"warn": 1, "neutral": 1, "recommend": 2}, "2026-08": {"neutral": 2, "recommend": 1}, "2026-09": {"recommend": 4, "compare": 1}, "2026-10": {"neutral": 3}}, "quotes": [{"id": 804962704, "item_id": 50310169, "url": "https://news.ycombinator.com/item?id=50310169", "by": "fschuett", "date": "2026-10-30", "stance": "neutral", "quote": "all of these are simulateable in QEMU or Linux (tc netem / blkdebug)", "excerpt": "It's not that crashes don't happen, it's just that they don't \"randomly\" happen. The error codes from bad hardware are predictable (against kernel bugs... well I use an \"allnoconfig\" kernel, which disables like 95% of the kernel). Bad hardware, bad network, bad RAM, all of these are simulateable in QEMU or Linux (tc netem / blkdebug). If I count my test suite for the ISO, I have ~2500 unit tests (placement groups tes", "context": "building own storage system", "use_case": "fault simulation testing", "switched_from": "", "story": "AI isn't replacing SREs, it's deskilling them"}, {"id": 804851744, "item_id": 50303234, "url": "https://news.ycombinator.com/item?id=50303234", "by": "darkwi11ow", "date": "2026-10-30", "stance": "neutral", "quote": "I only use agentic development tools in qemu VM that has no production", "excerpt": "I only use agentic development tools in qemu VM that has no production access or host shared folders, and the only secrets there are development. I still have my Git ssh key there, but I never use ssh agent to load the keys. The worst that agentic tools can do to me, is to install keylogger and compromise my ssh key and password, but even then my deployment workflow includes creating release in Github, which is not p", "context": "", "use_case": "sandboxing AI agents", "switched_from": "", "story": "Backdoor in Claude Code for VS Code extension on the Cursor Marketplace"}, {"id": 801434336, "item_id": 50089646, "url": "https://news.ycombinator.com/item?id=50089646", "by": "joinjune", "date": "2026-10-14", "stance": "neutral", "quote": "novel approaches to document creation with new workflows using QEMU in Linux", "excerpt": "We used several different LLM's and our own skills to build out some novel approaches to document creation with new workflows using QEMU in Linux after upgrading our desktops to Ubuntu from Windows 11.", "context": "", "use_case": "document creation workflows", "switched_from": "", "story": "Running Windows desktop tests from Linux with disposable VMs"}, {"id": 797470929, "item_id": 49841933, "url": "https://news.ycombinator.com/item?id=49841933", "by": "ranger_danger", "date": "2026-09-25", "stance": "compare", "quote": "I would be interested to see a performance comparison with qemu and softgpu", "excerpt": "I would be interested to see a performance comparison with qemu and softgpu (https://github.com/JHRobotics/softgpu).", "context": "", "use_case": "emulation", "switched_from": "", "story": "Pentium II at 600Mhz with Voodoo 3 Emulated on 86Box with M6 Mac Mini"}, {"id": 796496320, "item_id": 49781020, "url": "https://news.ycombinator.com/item?id=49781020", "by": "JonChesterfield", "date": "2026-09-20", "stance": "recommend", "quote": "Highly recommend qemu instead.", "excerpt": "Highly recommend qemu instead. The sandbox machines are just more IP addresses on the local network. If you want them completely offline, put them on a network that doesn't have a route to anywhere. The sketchy AI harness is very happy with a whole machine to itself, complete with root access. You can push/pull git repos in from the outside, so all it can do is trash it's own sandbox and get reinstated from scratch b", "context": "", "use_case": "sandboxing AI agents in VMs", "switched_from": "", "story": "Software sandboxing: The basics (2025)"}, {"id": 794793792, "item_id": 49674612, "url": "https://news.ycombinator.com/item?id=49674612", "by": "matja", "date": "2026-09-12", "stance": "recommend", "quote": "I have a few QEMU VMs where I use PCI-passthrough of a whole GPU and a USB controller", "excerpt": "> I wish the stars would align for QEMU to gain support for sunlight/moonlight streaming directly in the hypervisor. I didn't know I wanted it until you said it. I have a few QEMU VMs where I use PCI-passthrough of a whole GPU and a USB controller, and wire the display and USB outputs physically into a KVM switch - works great, but not having to fiddle with the KVM (and run out of physical ports) would be - indeed, k", "context": "", "use_case": "VMs with GPU passthrough", "switched_from": "", "story": "I refuse to let SPICE die"}, {"id": 794661616, "item_id": 49666351, "url": "https://news.ycombinator.com/item?id=49666351", "by": "westurner", "date": "2026-09-11", "stance": "recommend", "quote": "Qemu also supports 32bit and 64bit RISC-V", "excerpt": "Emulation of RISC-V in software; container2wasm has TinyEmu for RISC-V. dearchap/tinyemu: https://github.com/dearchap/tinyemu Qemu also supports 32bit and 64bit RISC-V: \"RISC-V System emulator \u2014 QEMU documentation\" https://www.qemu.org/docs/master/system/target-riscv.html Emu86 emulates RISC-V in Python and also WASM now IIRC: https://news.ycombinator.com/item?id=41899475 .. https://github.com/gcallah/Emu86/blob/mast", "context": "", "use_case": "RISC-V emulation", "switched_from": "", "story": "RISC-V Emulator and Linux System from Scratch"}, {"id": 792300016, "item_id": 49518751, "url": "https://news.ycombinator.com/item?id=49518751", "by": "BillStrong", "date": "2026-09-01", "stance": "recommend", "quote": "You can emulate Intel Mac OS X using QEMU on linux machines", "excerpt": "VMs with GPU passed through. You can get Mac compatible GPUs that will work, look for the Dortania OpenCore guide GPU lists to find one that works for the version of Mac OS X it runs on. Looking on Macintosh Repository, that game will run on Intel CPUs and Snow Leopard, 10.6+. (IDK for sure.) You can emulate Intel Mac OS X using QEMU on linux machines, there are some scripts that make it easy from Proxmox that I use.", "context": "", "use_case": "emulating Mac OS X", "switched_from": "", "story": "Run macOS Software on Linux"}, {"id": 790955509, "item_id": 49434719, "url": "https://news.ycombinator.com/item?id=49434719", "by": "jlokier", "date": "2026-08-25", "stance": "recommend", "quote": "some free and open source (QEMU, UTM, Lima, Colima)", "excerpt": "You can't run Linux directly on these. Asahi Linux supports up to M2 only. Linux runs very well in a VM on macOS. There are many good options for this, some free and open source (QEMU, UTM, Lima, Colima), some proprietary (VMware Fusion, Parallels). But Linux in a VM doesn't get access to the real GPU, so model performance is limited. Those running on the CPU perform well, and those needing the GPU don't. However, ma", "context": "", "use_case": "running Linux VMs on macOS", "switched_from": "", "story": "Apple introduces M6 and M5 Ultra"}, {"id": 788935360, "item_id": 49308460, "url": "https://news.ycombinator.com/item?id=49308460", "by": "matheusmoreira", "date": "2026-08-15", "stance": "recommend", "quote": "QEMU virtual machines. Sandboxes like firejail and bubblewrap share a kernel: attacker is one exploit away from root.", "excerpt": "QEMU virtual machines. Sandboxes like firejail and bubblewrap share a kernel: attacker is one exploit away from root. Hypervisors present an infinitely smaller attack surface, and if they're ever defeated the entire industry is done, not just me. I have a base system image that gets forked off into delta qcow2 images for every project I'm working on or whatever ephemeral execution context I need. I started a side pro", "context": "", "use_case": "isolating dev tools in VMs", "switched_from": "firejail", "story": "Firefox is now the last major browser that still supports uBlock Origin"}, {"id": 787856641, "item_id": 49241040, "url": "https://news.ycombinator.com/item?id=49241040", "by": "cv_h", "date": "2026-08-10", "stance": "neutral", "quote": "uses QEMU's microvm machine type under the hood", "excerpt": "I wrote a CLI tool that uses QEMU's microvm machine type under the hood. It can take any docker image and build a microvm. I use it regularly to run Claude/Codex with permission checks disabled. https://github.com/cvhariharan/mvm", "context": "", "use_case": "microVM backend", "switched_from": "", "story": "Docker Sandboxes \u2013 Disposable, isolated sandboxes for AI agents"}, {"id": 787849522, "item_id": 49240595, "url": "https://news.ycombinator.com/item?id=49240595", "by": "matheusmoreira", "date": "2026-08-10", "stance": "neutral", "quote": "coding my own QEMU VM orchestration solution was among the first things I used it for", "excerpt": "I too skip all permissions, but I run the harnesses inside an isolated virtual machine. I took care to firejail Claude Code on my host since day one, and coding my own QEMU VM orchestration solution was among the first things I used it for. Alarm fatigue will quickly destroy any and all \"meticulously approve every little command the AI wants to run\" workflows. Give it a virtual machine and let it cook. If it blows up", "context": "", "use_case": "VM orchestration for agents", "switched_from": "", "story": "Auto mode is now the default in Claude Code"}, {"id": 785233824, "item_id": 49077114, "url": "https://news.ycombinator.com/item?id=49077114", "by": "bitbasher", "date": "2026-07-27", "stance": "recommend", "quote": "A simple qemu virtual machine is nice and quick to spin up.", "excerpt": "A simple qemu virtual machine is nice and quick to spin up. I mainly work inside an openbsd or linux virtual machine. I use a different vm for each project and I have a \"sandbox\" vm I use to run random things I download/test.", "context": "", "use_case": "sandboxing untrusted code", "switched_from": "", "story": "Ask HN: How to deal with security implications of running/installing projects?"}, {"id": 783588848, "item_id": 48974303, "url": "https://news.ycombinator.com/item?id=48974303", "by": "xvilka", "date": "2026-07-19", "stance": "recommend", "quote": "It would make sense to implement it in QEMU instead.", "excerpt": "It would make sense to implement it in QEMU instead. There was some previous work in the past, don't have a link right now to the original patchseries, but here is the repository[1]. In theory, it could be adapted to the modern QEMU code infrastructure and APIs and be a good starting point. Back in the past I started[2] doing that but quickly dropped because had no time to finish. EDIT: It looks like it might be this", "context": "", "use_case": "Itanium emulation", "switched_from": "", "story": "A new Intel Itanium (IA-64) emulator that boots Windows"}, {"id": 782685459, "item_id": 48917841, "url": "https://news.ycombinator.com/item?id=48917841", "by": "rmunn", "date": "2026-07-15", "stance": "neutral", "quote": "running the `qemu-system-x86_64` command (takes a couple of seconds)", "excerpt": "I've been running Claude Code in a VM, where I clone the GitHub repos I want it to work on (they're open source so no login info needed) but have no other credentials. I used to reset the VM every day, but that was getting to be a bit of a hassle so I switched to a monthly reset. But even so, it would be hard for Claude to exfil anything more than what open-source projects I've been working on in the past month (at w", "context": "", "use_case": "running VMs", "switched_from": "", "story": "I tricked Claude into leaking your deepest, darkest secrets"}, {"id": 780308993, "item_id": 48769312, "url": "https://news.ycombinator.com/item?id=48769312", "by": "thewisenerd", "date": "2026-07-02", "stance": "warn", "quote": "", "excerpt": "podman's been great for me on macOS for testing stuff quick; which earlier used to need a whole limactl[3]/virt thing. you can set it up with qemu-user-static for --platform linux/amd64; i don't remember which i exactly used, or if official docs have been updated for it but looked something like [1] there is one sneaky bug in qemu that breaks uv [2] for cross-platform targets so i keep having to fall back to lima for", "context": "", "use_case": "cross-platform emulation", "switched_from": "", "story": "Podman v6.0.0"}, {"id": 778879461, "item_id": 48679966, "url": "https://news.ycombinator.com/item?id=48679966", "by": "yllan", "date": "2026-06-25", "stance": "neutral", "quote": "I used QEMU during development.", "excerpt": "I\u2019m the author. This is an experiment of mine in figuring out how to let Mac OS 9 connect to modern network services and environments. Since Mac OS 9 doesn\u2019t have out-of-the-box support for modern secure networking protocols, you often have to go through a proxy, which is pretty painful. I wanted to make it possible for an old Mac to connect to modern web services on its own. There are also two related projects for c", "context": "", "use_case": "emulating Mac OS 9", "switched_from": "", "story": "OS9Map"}, {"id": 776969153, "item_id": 48560572, "url": "https://news.ycombinator.com/item?id=48560572", "by": "xvilka", "date": "2026-06-16", "stance": "recommend", "quote": "QEMU now has the notion of TCG plugins[1] that can read/write registers and memory, which is enough for most cases.", "excerpt": "The problem is that it's not sustainable - QEMU improved so much since the moment of fork and updating the QEMU code in Unicorn is always done manually. It is especially important for architectures that evolve quickly - ARM64, RISC-V, x86. Meanwhile, QEMU now has the notion of TCG plugins[1] that can read/write registers and memory, which is enough for most cases. You can see many examples of the plugins in contrib/p", "context": "", "use_case": "CPU emulation with plugins", "switched_from": "", "story": "Unicorn \u2013 The Ultimate CPU Emulator"}, {"id": 775659857, "item_id": 48478741, "url": "https://news.ycombinator.com/item?id=48478741", "by": "einsteinx2", "date": "2026-06-10", "stance": "warn", "quote": "found it works better than QEMU (better performance and resolved some bugs I was running into with the Supabase docker stack)", "excerpt": "Yeah I was gonna say I use Colima with Apple\u2019s virtualization framework (it\u2019s not the default for some reason but it\u2019s a single command line flag), and found it works better than QEMU (better performance and resolved some bugs I was running into with the Supabase docker stack)", "context": "", "use_case": "macOS virtualization", "switched_from": "", "story": "macOS Container Machines"}, {"id": 774786544, "item_id": 48424159, "url": "https://news.ycombinator.com/item?id=48424159", "by": "theaniketmaurya", "date": "2026-06-06", "stance": "recommend", "quote": "We use QEMU for our sandbox infra.", "excerpt": "We use QEMU for our sandbox infra. QEMU comes with qcow2 (copy-on-write), a native disk image format. It allows the VM to only write changes to disk which saves time and space specially if you want to snapshot and restore changes. Wrote a piece on building a mental model for qcow2 overlays.", "context": "builds sandbox infra", "use_case": "sandbox infrastructure VMs", "switched_from": "", "story": "How Qcow2 Overlays Work in QEMU"}, {"id": 757692225, "item_id": 47355764, "url": "https://news.ycombinator.com/item?id=47355764", "by": "toast0", "date": "2026-03-12", "stance": "neutral", "quote": "qemu doesn't check segmentation limits but real hardware does.", "excerpt": "> RTL8139 network driver (WIP) It's good to have support for real networking hardware, but consider virtio-net as well. A lot of VMs support it and it's more streamlined. 32-bit x86, bios boot means doing a lot of things for compatibility with systems that were old enough to drink before you were born... skipping to simplified virtualized interfaces wherever possible makes a lot of sense; even if your OS can run in 1", "context": "hobby OS developer", "use_case": "testing hobby OS kernel", "switched_from": "", "story": "Show HN: Aurion OS \u2013 A 32-bit GUI operating system written from scratch in C"}, {"id": 756700338, "item_id": 47293771, "url": "https://news.ycombinator.com/item?id=47293771", "by": "LoganDark", "date": "2026-03-07", "stance": "neutral", "quote": "Claude Code helped me with things like the QEMU invocation", "excerpt": "I love Claude Code because it lets me try out ideas a lot faster. Sometimes I have to fight with it to get the outcome I want, but other times it's like I can do something in 3 days that'd otherwise take me weeks. For example, I recently had it port a diffusion language model to Swift+MLX so that I could run it on macOS. It messed up one of the details at first, but it was able to figure out the problem and fix it. A", "context": "", "use_case": "RISC-V bare-metal testing", "switched_from": "", "story": "I'm 60 years old. Claude Code has ignited a passion again"}, {"id": 755164433, "item_id": 47197777, "url": "https://news.ycombinator.com/item?id=47197777", "by": "Grauwolf", "date": "2026-02-28", "stance": "neutral", "quote": "I use either QEMU VMs or my own sandbox-run [0]", "excerpt": "I use either QEMU VMs or my own sandbox-run [0] (a bubblewrap wrapper) for isolation, depending on the use case. [0] https://codeberg.org/Grauwolf/sandbox-run", "context": "", "use_case": "isolation for AI agents", "switched_from": "", "story": "Let's Discuss Sandbox Isolation"}, {"id": 753844097, "item_id": 47115256, "url": "https://news.ycombinator.com/item?id=47115256", "by": "einarfd", "date": "2026-02-22", "stance": "recommend", "quote": "Originally I used docker, but I\u2019m now in the process of jettisoning that, and switching to qemu.", "excerpt": "I\u2019ve been building sandboxing for Claude code workloads. So I can let it run wild without breaking my computer. Originally I used docker, but I\u2019m now in the process of jettisoning that, and switching to qemu. For my use case I want ssh access and being able to use docker in docker. This allows for things like test containers and docker compose. You can get all of that working with docker. But you kind of have to figh", "context": "building sandboxing for Claude Code workloads", "use_case": "sandboxing Claude Code workloads", "switched_from": "Docker", "story": "NanoClaw Moved from Apple Containers to Docker"}, {"id": 747094321, "item_id": 46693395, "url": "https://news.ycombinator.com/item?id=46693395", "by": "jillesvangurp", "date": "2026-01-20", "stance": "neutral", "quote": "I'm currently using a qemu vm for the codex", "excerpt": "I'm currently using a qemu vm for the codex with the --yolo flag but same thing. I've been also looking at using lima for automating the creation of vms. But it does a few weird/dangerous things like mounting the entire user directory read/write. Which kind of defeats the point. There are ways of turning that off probably but it does a few dangerous/annoying things wrong by default. But a simple vm and some automatio", "context": "", "use_case": "sandbox VM for agent", "switched_from": "", "story": "Running Claude Code dangerously (safely)"}, {"id": 742231426, "item_id": 46389464, "url": "https://news.ycombinator.com/item?id=46389464", "by": "tzury", "date": "2025-12-25", "stance": "recommend", "quote": "creator of QuickJS, QEMU, FFMPEG and many other brilliant and fascinating tools!", "excerpt": "Check out this: https://bellard.org/jslinux/vm.html?url=alpine-x86.cfg&mem=192 and https://bellard.org/jslinux/ By the famous Fabrice Bellard who is the creator of QuickJS, QEMU, FFMPEG and many other brilliant and fascinating tools! https://bellard.org/", "context": "", "use_case": "", "switched_from": "", "story": "Ultimate-Linux: Userspace for Linux in Pure JavaScript"}, {"id": 741874689, "item_id": 46367168, "url": "https://news.ycombinator.com/item?id=46367168", "by": "infinet", "date": "2025-12-23", "stance": "neutral", "quote": "Once I used an old MIPS debian in qemu to test big endian.", "excerpt": "Once I used an old MIPS debian in qemu to test big endian. I thought since LoongArch has its root in MIPS it may be big endian. It turns out \"LoongArch bit designations are always little-endian\".", "context": "", "use_case": "emulating MIPS", "switched_from": "", "story": "Debian adds LoongArch as officially supported architecture"}, {"id": 736601538, "item_id": 46037596, "url": "https://news.ycombinator.com/item?id=46037596", "by": "dakiol", "date": "2025-11-24", "stance": "recommend", "quote": "top-notch software (e.g., linux, ffmpeg, qemu, etc.)", "excerpt": "LLMs subscriptions. Ideally I wouldn't need to pay for top-notch software (e.g., linux, ffmpeg, qemu, etc.), but here we are.", "context": "", "use_case": "", "switched_from": "", "story": "Ask HN: What tools do you pay for today that feel overpriced or frustrating?"}, {"id": 735186529, "item_id": 45949158, "url": "https://news.ycombinator.com/item?id=45949158", "by": "scrps", "date": "2025-11-16", "stance": "neutral", "quote": "I use qemu + cage + firefox and some glue logic to fire up a copy of a base image which gets deleted on exit.", "excerpt": "Nonpersistent vm-based browser, I use qemu + cage + firefox and some glue logic to fire up a copy of a base image which gets deleted on exit. Fires up slower than a native firefox instance but runs all the same. Can containerize for the less paranoid and less work but browsers touching host kernel gives me the ick as does the idea of trying to write ebpf policies for firefox to mitigate. Browsers are pain.", "context": "", "use_case": "disposable browser VM", "switched_from": "", "story": "Supercookie: Browser Fingerprinting via Favicon (2021)"}, {"id": 734870993, "item_id": 45929437, "url": "https://news.ycombinator.com/item?id=45929437", "by": "octagons", "date": "2025-11-14", "stance": "neutral", "quote": "opt to run them via QEMU on the x86 platforms", "excerpt": "I\u2019ve been running an Incus cluster of 3 fairly beefy servers for about a year now. It\u2019s my go-to recommendation for anyone wanting to setup a new virtualized environment. One of my favorite features is how you can tag different cluster members for different architectures. In the same cluster, I can have traditional dual-socket x86 servers with a dozen DIMM slots as well as Raspberry Pis. The architecture tagging lets", "context": "deals with a lot of embedded firmware", "use_case": "running ARM workloads on x86", "switched_from": "", "story": "Incus-OS: Immutable Linux OS to run Incus as a hypervisor"}]}