{
  "id": 3700689,
  "title": "I run browser automation inside a disposable VM",
  "url": "https://urgent.news/2026/08/27/i-run-browser-automation-inside-a-disposable-vm",
  "topic": "tech",
  "section": "Tech",
  "published": "2026-08-27T08:00:08.000Z",
  "source": {
    "name": "Dev.to",
    "slug": "dev-to",
    "url": "https://dev.to/anyesh/i-run-browser-automation-inside-a-disposable-vm-2le5"
  },
  "original_language": "en",
  "account": "Automating browser automation requires a disposable virtual machine (VM) to handle arbitrary web pages on the open internet. This VM is launched on demand and terminated after each job to ensure security. Chromium's rendering engine assumes 4 KB memory pages, but the Raspberry Pi it runs on uses 16 KB pages, causing navigation issues. To resolve this, the VM is built with its own kernel, avoiding page-size problems and preventing interference with the host kernel and network stack.\n\nThe VM costs around 2 GB of memory and takes a few seconds to boot, making it cost-effective compared to running a browser process on the GPU box. The VM provides protection against kernel-level exploits, but the compromised guest can still reach other devices on the network due to network address translation (NAT). To mitigate this, a separate firewall rule on the host is enforced, limiting the guest's traffic to specific ranges and allowing everything else. This ensures the compromised guest cannot reach other devices on the LAN.\n\nJobs requiring anonymous browsing or a real logged-in session are handled by separate guests with distinct user accounts, disk profiles, and machine identities. This approach prevents session-security heuristics from detecting anomalous behavior caused by alternating between exits. The VPN guest's profile starts empty to prevent issues with CAPTCHAs and forced re-logins. When building the VPN path, a lesson was learned: the firewall rule should allow traffic on the tunnel's interface rather than dropping everything else. This mistake caused the VPN tunnel to be inadvertently killed when it came up, highlighting the importance of correct firewall rule implementation.",
  "summary": "Automating a browser that holds real logins means running code that fetches arbitrary pages on the open internet. That code needs to be treated as something that can be compromised. That's the assumption behind every decision here. Why a VM instead of a sandboxed process The browser automation on this network runs inside a disposable virtual machine, launched on demand and torn down after each…",
  "key_points": [],
  "editors_take": null,
  "illustration": null,
  "coverage": {
    "outlets": 1,
    "also_reported_by": []
  },
  "ai_generated": true,
  "disclaimer": "Summaries, key points and the editor’s take are written by software from other outlets’ reporting and may contain errors — always check the linked original."
}