The disposable VM that exists because Chromium wants 4 KB pages

A page size is not a runtime flag. It is fixed when the kernel is built, and every process on the box inherits it, which is why Chromium's 4 KB assumption and a 16 KB kernel cannot be reconciled by configuring anything ^[1]. Two moves existed: rebuild the kernel, or give the browser a different one. The rebuild was tried, and it cost the Pi its Ethernet, which on that particular box meant the house lost DNS ^[2]. The failure mode of the direct fix was not a stalled browser job. It was name resolution for every other device on the network.

So the guest does two jobs with one artefact. It supplies a kernel built the way the renderer expects, and it keeps that kernel away from the resolver running on the same hardware ^[3]. The compatibility argument and the isolation argument land on the same answer, which is unusual enough to be worth naming: here the sandbox is not a precaution layered on a working setup, it is the working setup.

Placement follows the same accounting. About 2 GB while running and a few tens of seconds to boot cold ^[4] is affordable on the box that has to be up anyway ^[5]. On the GPU box, that same guest would claim roughly a quarter of the 8 GB pool a resident model is sitting in ^[6][7]. The author's rule for this is that a job goes where it costs the least to be wrong about it, the same reasoning that put DNS on the low-power box to begin with ^[14].

The write-up is more careful than most about what the boundary does not do. A kernel-level exploit of the browser stays inside the guest; the guest talking to the rest of the LAN is a separate question that the VM does not answer ^[8]. Outbound traffic leaves through network address translation on the host, and translation rewrites addresses rather than refusing connections, so a compromised browser can still open a socket to anything on the local network ^[9]. The patch is a host firewall rule keyed to the dedicated user account the guest process runs as, denying that uid the local ranges while allowing everything else, loaded at boot and reasserted whenever a guest starts ^[10]. The placement is the point: enforcement lives somewhere the compromised party cannot read, let alone edit ^[11].

One more constraint wears a security shape and is not one. A single cookie jar that sometimes exits from the home connection and sometimes from a rotating VPN address is the exact pattern session heuristics are tuned to flag, and the profile pays in CAPTCHAs and forced re-logins until it locks out ^[12]. Hence two guests, one per exit mode, each with its own account, disk profile and machine identity, selected before a job starts rather than switched inside it ^[13]. The VPN guest's profile starts empty and stays empty, so a job wanting anonymity and a real session simultaneously has nowhere to run, and the author files that as intended rather than missing ^[15].