Celesto AI
Show HN: Automate legacy software on a Windows Sandbox
Last verified:
What is Celesto AI?
SmolVM is an open-source microVM sandbox built by Celesto AI that gives AI agents their own disposable computer for safely executing untrusted code. It creates hardware-isolated virtual machines that boot in approximately 500 milliseconds using Firecracker on Linux or QEMU on macOS. The tool is specifically designed for AI agents that need to run LLM-generated code, browse the web, or execute PowerShell commands in Windows 11 sandboxes without risking the host system.
Key features include sub-second boot times (~500ms), hardware-level isolation using KVM-backed microVMs, Python SDK and CLI for easy management, snapshot/pause/resume capabilities, persistent environments across sessions, network domain allowlists for egress control, browser sandbox with live view, host directory mounting (read-only or writable), file upload functionality, and pre-installed coding agents like Claude Code, Codex, and Pi. The Windows 11 sandbox support specifically enables running PowerShell commands, uploading files to Windows paths, and injecting environment variables.
SmolVM is primarily for developers building AI agents, teams running untrusted code from LLMs, security-conscious organizations needing hardware isolation stronger than containers, and anyone automating computer-use agents that require browser access or shell execution. It's ideal for coding agents, SDR automation, browser automation, and any workflow where AI-generated code must be safely executed.
Celesto AI pricing
Pricing model: Freemium
SmolVM is completely free and open-source under the Apache 2.0 license. It runs on your own infrastructure (Linux via Firecracker, macOS via QEMU) with no subscription fees. The tool installs via pip install smolvm or curl installer script. There are no paid tiers mentioned - the entire feature set including Windows sandboxes, browser sandbox, snapshots, and all SDK features are available free. Enterprise API access for bulk dataset usage may be available in the future.
Celesto AI pros
- Open-source under Apache 2.0 license
- Sub-second boot time (~500ms)
- Hardware-level isolation stronger than containers
- Python SDK with clean, pythonic API
- CLI for terminal-based sandbox management
- Windows 11 sandbox support with PowerShell
- Snapshot and restore VM state instantly
- Pause/resume VM functionality
- Persistent environments across agent turns
- Network domain allowlists for egress control
- Browser sandbox with live view capability
- Host directory mounting (read-only or writable)
- File upload to sandbox from host
- Pre-installed coding agents (Claude, Codex, Pi)
- ~43ms command execution overhead
- Automatic SSH key generation and configuration
- Built-in NAT and port forwarding
- Auto-cleanup of resources
- Supports macOS and Linux
- Custom image building with ImageBuilder
Celesto AI cons
- Linux and macOS only (no Windows host support)
- Requires KVM/Firecracker on Linux
- May need sudo for host dependency installation
- Windows 11 support is newer feature
- No Windows host machine support
- Local development only, not cloud-hosted
- Requires Python installed (or auto-installed)
- Network security needs manual configuration for production
Frequently asked questions about Celesto AI
What is SmolVM and what does it do?
SmolVM is an open-source microVM sandbox that gives AI agents their own disposable computer. Each microVM boots in milliseconds, runs any code or software, persists files and state across sessions, and disappears when done. It provides hardware-isolated environment for safely executing untrusted AI-generated code without risking the host system.
How fast does SmolVM boot?
SmolVM boots in approximately 500 milliseconds (~572ms for create + start). Command execution has only ~43ms overhead. The full lifecycle (boot → run → teardown) takes about 3.5 seconds. SSH becomes ready in ~2.1 seconds.
What operating systems does SmolVM support?
SmolVM runs on Linux (using Firecracker/KVM backend) and macOS (using QEMU backend). The sandboxes themselves can run Alpine Linux, Debian-based images, and Windows 11. Windows host machines are not currently supported.
How is SmolVM more secure than Docker containers?
Unlike containers that share the host kernel, SmolVM uses KVM-backed microVMs providing hardware-level virtualization. This gives significantly smaller attack surface and stronger isolation at the hypervisor boundary, making it impossible for untrusted code to escape or access the host system.
Can I restrict which websites a sandbox can access?
Yes. SmolVM supports network domain allowlists through internet_settings parameter. You can specify allowed_domains to lock down egress so agents can only reach specific APIs or domains. By default, sandboxes have full internet access.
How do I use SmolVM with Windows 11?
SmolVM now supports Windows 11 sandboxes. You can boot disposable Windows VMs from Python using smolvm create --os windows, run PowerShell commands, upload files into Windows paths, pass environment variables, and tear down the VM when done. This works via the Python SDK or CLI.
Can I mount my local project folder to the sandbox?
Yes. Use --mount flag to share local directories with the sandbox. By default mounts are read-only - sandbox can read files but changes stay inside VM. Add --writable-mounts to allow the sandbox to edit host files. Multiple directories can be mounted at custom paths.
How do I save and restore sandbox state?
SmolVM supports snapshots via CLI: smolvm snapshot create my-sandbox to save state, smolvm snapshot list to view snapshots, and smolvm snapshot restore my-sandbox --snapshot-id snap_abc123 to restore. You can also pause and resume VMs to maintain state across sessions.
What coding agents work with SmolVM?
SmolVM has one-command setup for Claude Code (smolvm claude start), Codex (smolvm codex start), and Pi coding agent (smolvm pi start). These launch sandboxes with the respective coding agent pre-installed and ready to use with git credentials configured.
Is SmolVM free to use?
Yes, SmolVM is completely free and open-source under Apache 2.0 license. It runs on your own infrastructure with no subscription fees. All features including Windows sandboxes, browser sandbox, snapshots, and SDK are available free. Enterprise API access for bulk usage may be available in the future.