CelestoAI/SmolVM

Open-source AI sandbox infrastructure with unified API for VMMs -- Firecracker, QEMU and libkrun.

What it solves

SmolVM provides secure, isolated, and disposable microVMs (virtual machines) specifically designed for AI agents. It solves the problem of running untrusted AI-generated code or allowing agents to interact with the web and local filesystems without risking the host machine's security or stability.

How it works

SmolVM creates hardware-isolated sandboxes that boot in sub-second time (approximately 500ms). It supports multiple operating systems, including Linux, Windows 11, and a preview version for macOS desktops on Apple Silicon. The system allows for state persistence across sessions through snapshots, network egress controls to prevent data exfiltration, and the ability to mount host directories as either read-only or writable.

Who it’s for

Developers building AI agents that need to execute shell commands, run code, browse the web, or interact with a local codebase safely. It also provides pre-configured environments for coding agents like Claude Code, Codex, and Pi.

Highlights

  • Sub-second boot times: VMs boot in roughly 500ms, avoiding long provisioning delays.
  • Hardware-level isolation: Ensures untrusted code cannot escape the sandbox to the host.
  • Browser sandbox: Integrated browser environments that agents can control via CDP, VNC, or a web viewer.
  • Multi-OS support: Support for Linux, Windows 11, and macOS (preview).
  • Network controls: Ability to restrict internet access to specific allowed domains.
  • Host directory mounting: Mount local folders directly into the sandbox for agent access to real codebases.
  • Snapshotting: Pause and resume sandboxes with memory and disk state intact.

Related

  • Project
    superradcompany/microsandbox

    A tool for running untrusted workloads in fast, local microVMs with hardware-level isolation, specifically designed for AI agents and automation.

  • Dispatch
    SmolVM: Local MicroVM Sandboxing for AI Agents and Custom Development

    SmolVM introduces an innovative approach to local sandboxing, leveraging microVMs to create isolated environments for developing and running AI agents, custom harnesses, and even its own infrastructure. This tool offers a secure and efficient way to manage complex development workflows.

  • Project
    jingkaihe/matchlock

    A CLI tool and SDK for running AI agents in isolated, ephemeral microVMs with network allowlisting and secure secret injection via MITM proxy.

  • Project
    TencentCloud/CubeSandbox

    A high-performance, secure sandbox service for AI agents that provides hardware-isolated MicroVMs with sub-60ms startup times and E2B SDK compatibility.

  • Project
    h5i-dev/h5i

    A lightweight, pure-Rust browser for AI agents that provides policy-controlled network access, detailed auditing, and multiple tiers of sandboxing.