Celesto (formerly SmolVM) vs Daytona

Celesto (formerly SmolVM) 52

Framework reading for local software. No credential is needed for local use, and the local API server and dashboard each require a bearer token, and cloud keys carry named permissions (22 of 30). Each computer has its own guest kernel, browser and display access uses capability URLs with a read-only option, and raw VNC is off. Against that, outbound networking is open by default and the restricting modes are opt-in (12 of 20). The security doc warns against giving connection URLs to a model as page content, but there is no guidance on treating command or page output as untrusted (5 of 15). computer logs shows startup output, with no audit log of commands (5 of 15). SECURITY.md with GitHub private vulnerability reporting and a supported-versions table, Security sections in the changelog, no security.txt, bug bounty or certification (8 of 20). Total 52.

Daytona 73

API keys with per-action scopes (write:sandboxes separate from delete:sandboxes, plus snapshot, volume, audit, secret and billing scopes), an expiry date and immediate revocation, and manager keys that issue scoped child keys at runtime. The docs say any valid key in the organisation can reach a running sandbox whatever its scopes, so 27 of 30 (27). Container sandboxes get their own namespaces and resource limits on a shared kernel, while Linux VM and Windows classes get their own kernel (6). Tier 1 and 2 organisations get restricted network access that can't be changed per sandbox, and full internet with per-sandbox allow lists starts at Tier 3 (5). We found nothing on keeping credentials out of the sandbox or on running untrusted code (5). Audit logs behind their own key scope, log streaming and webhooks (15). An organisation-wide security policy (security@daytona.io or GitHub private reporting, acknowledgement within 5 business days, discretionary rewards) covers app.daytona.io and the clients repository. The SafeBase trust centre lists SOC 2 Type 1 and Type 2, ISO/IEC 27001 and HIPAA, with reports and a pen-test summary on request. Four advisories were published on GitHub in June 2026. No security.txt (404 on 2 November), and a discretionary reward doesn't count as a bounty. Read as modal-sandboxes' 15 (15). 27 + 6 + 5 + 5 + 15 + 15 = 73.

Celesto (formerly SmolVM) 66

Read with the local-software lines, because the graded surface runs on the owner's machine. Installs from PyPI as celesto with Python 3.11 or newer on Linux and macOS stated, plus an install script (20). The repository has pytest, e2e, lint, TypeScript and smoke-test workflows and 38 test packages, but GitHub's API answered with a rate limit, so no run result was read (15 of 25, unchecked). 22 open issues and pull requests against about 188 commits in 90 days. The open bugs include a snapshot restore that can lose a VM's disk if interrupted and a thread-safety issue with five replies (18 of 25). A dated changelog with Security, Fixed, Added and Removed sections, and the rename to Celesto marked as a breaking release, though versions stay below 1.0 (13 of 15). Pre-1.0 per SECURITY.md (0). Total 66.

Daytona 85

Better Stack status page at status.app.daytona.io with per-service history, read from its RSS feed and incident pages on 2 November (20). The two Windows runner outages (31 July and 1 August) have left the 90 days from 4 August. The window holds a degradation of new sandbox creation in us-central-1 (11 August, 17.5 hours), elevated creation errors for 4 minutes (4 September), a builder queue backlog (12 September), sandbox listing degraded on 1 and 30 October, reduced GPU capacity (16 October), some dashboard settings unavailable (22 October) and a provider outage on a subset of US runners (29 and 30 October). Each is one region, one endpoint or a subset of runners, so partial and minor (20). Rate limits published per tier, 10,000 to 50,000 general requests and 300 to 600 sandbox creations a minute (15). 429s carry Retry-After-{throttler} and X-RateLimit-* headers, and the docs advise exponential backoff (1s, 2s, 4s, 8s). No idempotency keys found (10). An SLA page (last updated 22 August 2025) commits to 99.95% monthly uptime with service credits for Tier 4 and above (10). GA (10). 20 + 20 + 15 + 10 + 10 + 10 = 85.

Celesto (formerly SmolVM) 69

A CLI and SDK add no tool definitions to an agent's context. Collected command output is capped at 8 MiB with streaming as the alternative (18 of 25). computer list, logs --follow and name lookups, with little filtering (10 of 20). JSON errors carry a recovery command where Celesto has one, and cloud errors carry stable codes, operation and computer context and recovery fields since 0.1.7 (18 of 20). State-changing cloud requests are never replayed automatically and computers are addressed by unique names, but there are no idempotency keys (10 of 20). with Computer() creates and deletes a computer with no parameters, with Python and an alpha TypeScript SDK (13 of 15). Total 69.

Daytona 55

List and toolbox calls return whole objects or files, with no field selection found (15). Labels and list calls exist, but we didn't confirm documented filters or page sizes (10). JSON errors with statusCode, message and error, plus rate-limit headers, and since 0.220.0 the SDKs report queue timeouts and spot evictions as distinct errors (15). No idempotency keys or safe-retry guidance for creates found (0). SDKs in Python, TypeScript, Ruby, Go and Java, and a create call works with an empty body, though the 15-minute auto-stop default can stop a sandbox mid-task (15). We scored the API, not the local MCP server. Total 55.

Celesto (formerly SmolVM) 60

Read with the self-hosted rule, scoring the hosted option for the price lines. No x402, MPP or L402 (0 of 40). Celesto Cloud publishes hourly prices for six sizes without a login (20). A one-time $5 Micro credit needs no card, and the local SDK is free (20). The graded local SDK installs from PyPI and runs with no account, so an agent needs no signup (20). Cloud use needs a browser signup and a card top-up. Total 60.

Daytona 50

No x402, MPP or L402 (0). Per-second prices published per vCPU, GiB of memory, GiB of storage and GPU, re-read on 2 November (20). $200 of compute, "no credit card required" (20). Stripe Projects lists Daytona, so an agent can create the account through the operator's Stripe login, per the 1 October check (10). Total 50.

Celesto (formerly SmolVM) 70

Apache-2.0 in LICENSE and on PyPI (30). The privacy policy of 30 October 2026 links a subprocessor registry and describes the CLI telemetry in the same terms as the docs, but gives no retention periods beyond as long as necessary. Stopped cloud disks are kept 30 days per the pricing page (18 of 30). The changelog marks removals and the breaking rename, and the glossary lists older names still accepted, with no written deprecation policy (10 of 20). Telemetry is disclosed in the README, CLI reference and privacy policy, with three opt-outs, but it is on by default after the notice (16 of 20). Total 74.

Daytona 64

SDKs and API clients are Apache-2.0 and the CLI is AGPL-3.0, but the platform code went private in June 2026 (20). Privacy policy and terms (both updated 22 August 2025) and a DPA (last updated 13 October 2026) that returns or deletes customer personal data at termination or on request. The docs say stopped, paused and archived sandboxes are kept until you delete them, with no retention period after deletion (15). Breaking changes appear in release notes, with no deprecation policy or dated notices found (5). Shared regions in the US and EU are named, and the DPA points to a sub-processor list with service and location in the trust centre, with 30 days' email notice of changes. The trust centre shows Latitude.sh, Leaseweb, OVHcloud and Stripe, and we couldn't read the locations (15). 20 + 15 + 5 + 15 = 55.