SmolVM, now published as Celesto, gives an AI agent its own computer for running code, browsing the web, and using desktop apps. Each sandbox is a lightweight virtual machine (microVM) that starts in about 500 ms and keeps files and state between sessions. Because the agent runs in a separate virtual machine rather than as a process on the host, untrusted code sits behind a hardware isolation boundary instead of a container boundary.
One Python API and CLI drive several virtual machine monitors: Firecracker on Linux, QEMU on macOS, and libkrun. The same Computer API runs locally during development or against Celesto Cloud for remote and production work. CLI commands print readable output by default and stable JSON for scripts and agents, with nonzero exit codes and a suggested recovery command on failure.
| Runtime | Use it when an agent needs |
|---|---|
| Minimal computer | Commands, code, and files |
| Browser | Chromium, CDP, screenshots, or a live viewer |
| Linux desktop | A full desktop and multiple GUI apps |
| Windows computer | PowerShell or Windows software |
| macOS desktop | App or installer tests on Apple Silicon |
Presets start coding agents (Codex, Claude Code, Pi, Hermes, OpenCode, and OpenClaw) inside their own sandbox without direct access to the host environment. Examples cover OpenAI Agents SDK, LangChain, and Pydantic AI tools, plus computer-use browser automation. The same project hosts OpenMuse, an open-source computer coworker that browses websites in a disposable Linux desktop while a person watches, approves clicks, or takes control.
Features
- MicroVM isolation: each sandbox is a separate virtual machine, a stronger boundary than process-level containers
- Fast start: a ready microVM in about 500 ms without an image pull on each start
- Local or cloud: the same Computer API across local development and Celesto Cloud
- Persistent state and snapshots: files survive across sessions, and snapshots pause and restore memory, disk, and active processes
- Host mounts: read-only access to selected local directories by default, with opt-in writable mounts
- Network policy: disable outbound access or allow specific IPv4 ranges on Linux with Firecracker
- Browser sandbox: Chromium with a CDP endpoint for Playwright, plus live-view and screen-control URLs in visible mode
- Multiple operating systems: Linux desktops, Windows 11 guests, and a macOS desktop preview on Apple Silicon
- Coding-agent presets: run Codex, Claude Code, Pi, Hermes, OpenCode, or OpenClaw in an isolated sandbox
- Agent-friendly CLI: JSON output with fixed fields and a strict health check for unattended jobs
- Framework examples: sandbox tools for OpenAI Agents SDK, LangChain, and Pydantic AI
