Skip to main content
Boot a clean worker, transfer only committed files into it, and run the pull request’s install and test commands inside the microVM. The host never executes code from the checkout. This example uses Node.js. The same create → copy → exec shape works for other toolchains.

​
Run the checks

1

Create the worker

Only the npm registry is reachable. Do not pass CI secrets or mount the host checkout into this worker.
2

Copy the commit

git archive excludes .git, checkout credentials, and uncommitted host files. In CI, make sure HEAD is the exact pull-request commit you intend to test.
3

Install and test

Package lifecycle scripts and tests execute inside the microVM. Their exit code becomes the msb exec exit code, so the same command works in CI.If the project installs from another registry, add the smallest required network rule. For fully offline checks, install reviewed dependencies once, create a snapshot, and launch each worker with --no-net; see Warm workers.
A hosted CI runner must expose KVM on Linux or run on Apple Silicon macOS. Many managed runners do not allow nested virtualization.
4

Clean up