# Celesto (formerly SmolVM) vs Modal Sandboxes (slim)

> Celesto scores 68 (B) to Modal Sandboxes's 66 (B) for code sandboxes. Prices, MCP, x402, uptime and agent notes side by side.

- Full: https://www.anchorterminal.com/compare/celesto-vs-modal-sandboxes.md (~5,650 tokens) · this version ~3,180 tokens · JSON https://www.anchorterminal.com/compare/celesto-vs-modal-sandboxes.json · canonical https://www.anchorterminal.com/compare/celesto-vs-modal-sandboxes
- Index: https://www.anchorterminal.com/llms.txt · API: https://www.anchorterminal.com/api/v1/index.json · MCP: https://www.anchorterminal.com/mcp · Updated: 2026-11-07
- Licence: CC BY 4.0, credit Anchor Terminal and link this page (https://www.anchorterminal.com/terms/#data)

Celesto (formerly SmolVM) scores 68 (B) on agent readiness against Modal Sandboxes's 66 (B), and leads in 4 of 7 scored categories. Modal Sandboxes leads on security & auth, maintenance & community and transparency & trust. Both do code sandboxes.

- Celesto (formerly SmolVM): B 68, rank #298 of 1486 · https://www.anchorterminal.com/tools/celesto.min.md
- Modal Sandboxes: B 66, rank #387 of 1486 · https://www.anchorterminal.com/tools/modal-sandboxes.min.md
- Celesto (formerly SmolVM), good for Local microVM sandboxes for agent code, browsers and desktops on Linux and macOS, with a path to a hosted cloud. Ahead on Reliability, 66 against 55; Schema & documentation, 85 against 79; Payments & pricing, 60 against 20. Also No key needed to call it; Free to start without a card; Open source.
- Modal Sandboxes, good for GPU work inside a sandbox, or agents already running on Modal. Ahead on Security & auth, 79 against 52; Maintenance & community, 93 against 81; Transparency & trust, 78 against 70.

| Category | Celesto (formerly SmolVM) | Modal Sandboxes |
| --- | --- | --- |
| Reliability (16%) | 66 | 55 |
| Performance (10%) | pending | pending |
| Schema & documentation (13%) | 85 | 79 |
| Agent ergonomics (13%) | 69 | 67 |
| Security & auth (14%) | 52 | 79 |
| Payments & pricing (10%) | 60 | 20 |
| Task success (10%) | pending | pending |
| Maintenance & community (7%) | 81 | 93 |
| Transparency & trust (7%) | 70 | 78 |

| Fact (where they differ) | Celesto (formerly SmolVM) | Modal Sandboxes |
| --- | --- | --- |
| Vendor | Celesto AI, Inc. | Modal |
| Auth | None | API key |
| Last release | 2026-11-05 | 2026-10-27 |
| Terms last updated | 2026-10-30 | 2026-05-01 |
| Privacy policy last updated | 2026-10-30 | 2023-05-17 |
| Popularity | 1.1k stars, 699 PyPI/wk | 514 stars, 941k npm/wk, 10.1M PyPI/wk |
| Agent reviews | none | 3.3/5 (8) |

Why the edge:
- Payments & pricing, Celesto (formerly SmolVM) +40: Celesto (formerly SmolVM) 60 (Read with the self-hosted rule, scoring the hosted option for the price lines. No x402, MPP or L402 (0 of 40). Celesto Cloud publishes hourly prices for six sizes without a login (20). A one-time $5 Micro credit needs no card, and the local SDK is free (20). The graded local SDK installs from PyPI and runs with no account, so an agent needs no signup (20). Cloud use needs a browser signup and a card top-up. Total 60.); Modal Sandboxes 20 (No x402, MPP or L402 (0). Per-second CPU, memory and GPU prices published, unchanged on 1 November (20). Starter includes $30 of compute every month, but the billing guide still says a payment method must be on file to use Modal, re-read on 1 November (0). Modal isn't in Stripe Projects, and an account starts with a person signing up (0). 0 + 20 + 0 + 0 = 20.)
- Security & auth, Modal Sandboxes +27: Celesto (formerly SmolVM) 52 (Framework reading for local software. No credential is needed for local use, and the local API server and dashboard each require a bearer token, and cloud keys carry named permissions (22 of 30). Each computer has its own guest kernel, browser and display access uses capability URLs with a read-only option, and raw VNC is off. Against that, outbound networking is open by default and the restricting modes are opt-in (12 of 20). The security doc warns against giving connection URLs to a model as page content, but there is no guidance on treating command or page output as untrusted (5 of 15). `computer logs` shows startup output, with no audit log of commands (5 of 15). SECURITY.md with GitHub private vulnerability reporting and a supported-versions table, Security sections in the changelog, no security.txt, bug bounty or certification (8 of 20). Total 52.); Modal Sandboxes 79 (A token ID and secret pair per workspace, revocable, with an optional TTL through `modal token new --expires-in` since 1.6.0, plus Connect Tokens that open one sandbox's HTTP or WebSocket server to an outside caller. Service Users on Team and Enterprise get no Environment access by default and hold a Viewer or Contributor role per Environment, manageable from the CLI and SDK since 1.6.2. No token scoped to sandbox actions found (25). gVisor or a full VM runtime through `runtime="vm"` (the guide says Modal chooses when `runtime` is unset, and 1.6.0 named gVisor as the current default); the sandbox guide limits only nested virtualisation to Team and Enterprise (8). Outbound traffic can be blocked or limited to CIDR ranges, GA, with a domain allow list in beta, and inbound connections only through tunnels or Connect Tokens, which `inbound_cidr_allowlist` can restrict (10). Modal Secrets go into the sandbox's environment by default. Sidecars, in beta under an experimental API, can run a credential proxy in a separate trusted container so the secret never enters the sandbox, with a worked example, per the 6 October check, not re-read on 1 November (11). Audit logs on Enterprise only (10). SOC 2 Type 2, a private HackerOne bug bounty through security@modal.com and stated fix times (24 hours critical, one week high), per the 6 October check, not re-read on 1 November. No security.txt (404 on 1 November) and no advisories for the `modal` PyPI or npm packages in OSV on 1 November (15). 25 + 8 + 10 + 11 + 10 + 15 = 79.)
- Maintenance & community, Modal Sandboxes +12: Celesto (formerly SmolVM) 81 (0.1.13 on PyPI on 5 November 2026, tagged 6 November (30). 22 PyPI releases in the 90 days to 6 November (20). Most open issues are filed by maintainers. Outside reports such as the thread-safety issue got replies, and several recent ones have none yet; pull-request reply times were not read (15 of 25). The Python SDK is current, the TypeScript SDK is an alpha not published to npm (8 of 15). uv and Cargo lock files, CodeQL and publish workflows, with run results unread (8 of 10). Total 81.); Modal Sandboxes 93 (1.6.3 on 2026-10-27 (30). 1.5.4 on 12 August, 1.5.5 on 28 August, 1.6.0 on 28 September, 1.6.1 on 3 October, 1.6.2 on 15 October and 1.6.3 on 27 October (20). 17 open issues on modal-client, response times not visible to us, per the 1 October check, not re-read on 1 November (18). The Python SDK is current, and the JavaScript and Go SDKs (both tagged 0.11.1, still beta) are in the same repository, read from a clone on 1 November (15). CodeQL and unit tests running on main, per the 1 October check, not re-read on 1 November (10). 30 + 20 + 18 + 15 + 10 = 93.)
- Reliability, Celesto (formerly SmolVM) +11: Celesto (formerly SmolVM) 66 (Read with the local-software lines, because the graded surface runs on the owner's machine. Installs from PyPI as `celesto` with Python 3.11 or newer on Linux and macOS stated, plus an install script (20). The repository has pytest, e2e, lint, TypeScript and smoke-test workflows and 38 test packages, but GitHub's API answered with a rate limit, so no run result was read (15 of 25, unchecked). 22 open issues and pull requests against about 188 commits in 90 days. The open bugs include a snapshot restore that can lose a VM's disk if interrupted and a thread-safety issue with five replies (18 of 25). A dated changelog with Security, Fixed, Added and Removed sections, and the rename to Celesto marked as a breaking release, though versions stay below 1.0 (13 of 15). Pre-1.0 per SECURITY.md (0). Total 66.); Modal Sandboxes 55 (Scored on the hosted checklist, since sandboxes run on Modal's infrastructure and the SDKs are clients of its API, the reading given to e2b, daytona, runloop and vercel-sandbox. Status page at status.modal.com (Better Stack) with a Sandboxes component and incident history (20). The status feed, re-read on 1 November 2026, lists eight incidents and one scheduled maintenance from 3 August. The only outage of sandboxes, with the dashboard on 16 September, lasted 14 minutes (18:29 to 18:43 UTC). The longest were degradations, elevated errors on an endpoint that reads application and volume contents for about 2 hours on 4 September, and degraded worker networking for functions and sandboxes on 5 October. The 27 August snapshot-restore degradation recorded on 17 October from the incidents page isn't in the feed. Two incidents on 14 October hit the Kimi K3 shared inference endpoint only, and on 19 October 30 to 40 per cent of web function requests failed for 2 minutes, which doesn't touch sandboxes. The 26 October control plane maintenance was announced ahead. No core API was down for an hour, so minor only (20). Numbers are published for Function calls (200 a second synchronous, 1,500 asynchronous) and for containers per plan (100 on Starter, 5,000 on Team), but none for sandbox creation or exec, so concurrency quotas only for this surface (0). `Sandbox.create()` raises `ResourceExhaustedError` when it can't be scheduled, and a named sandbox raises `AlreadyExistsError` on a duplicate, which makes creates safe to retry. No Retry-After or backoff guidance for sandboxes found (5). The terms attach an SLA to the Service Order for plans that include one, with no published figure, per the 6 October check, not re-read on 1 November (0). Sandboxes are generally available, with Sidecars and the domain allow list in beta (10). 20+20+0+5+0+10 = 55.)
- Transparency & trust, Modal Sandboxes +8: Celesto (formerly SmolVM) 70 (Apache-2.0 in LICENSE and on PyPI (30). The privacy policy of 30 October 2026 links a subprocessor registry and describes the CLI telemetry in the same terms as the docs, but gives no retention periods beyond as long as necessary. Stopped cloud disks are kept 30 days per the pricing page (18 of 30). The changelog marks removals and the breaking rename, and the glossary lists older names still accepted, with no written deprecation policy (10 of 20). Telemetry is disclosed in the README, CLI reference and privacy policy, with three opt-outs, but it is on by default after the notice (16 of 20). Total 74.); Modal Sandboxes 78 (The client SDKs are Apache-2.0. The platform is closed under terms dated May 2026 (20). The security page states retention per product, function inputs and outputs up to 7 days, logs from 1 day on Starter to 30 days on Team and configurable on Enterprise, volumes until you delete them, and says Modal won't read code or data without permission (25). Breaking changes are confined to 1.Y.0 releases with deprecation warnings first, but there's no stated notice period (15). The region guide says inputs route through Virginia (`us-east`) by default and names the US, EU and Asia-Pacific regions a sandbox can be pinned to. The privacy policy of May 2023 names no subprocessors, and the Vanta trust portal at trust.modal.com didn't render for us (10). 20 + 25 + 15 + 10 = 70.)
- Schema & documentation, Celesto (formerly SmolVM) +6: Celesto (formerly SmolVM) 85 (Read as an SDK and CLI. The repository ships an OpenAPI document for the local server (24 operations) and the cloud API (171 operations), from which the TypeScript client is generated (25). llms.txt at celesto.ai, plus Markdown docs in the repository (10). The README's runtime table says when to use each runtime, and the automation section says to prefer `exec` and keep `shell`, `ssh` and `desktop` for interactive work (14 of 20). Network modes are closed values (`open`, `off`, `public`, `restricted`) and the SDK takes typed keyword arguments, though `internet_settings` is a plain dict (11 of 15). Examples directory, a JSON envelope for every command and documented cloud error fields such as `required_scope`, without a full error catalogue (12 of 15). Dated changelog and tags, pre-1.0 (13 of 15). Total 85.); Modal Sandboxes 79 (No REST API or OpenAPI. A typed Python SDK reference stands in, which we count as 15 of 25 for an SDK (15). llms.txt and Markdown pages (10). The sandbox guides say when to pick the VM runtime over gVisor, when to snapshot instead of running past 24 hours, and what snapshots don't cover (15). Typed parameters such as `timeout`, `block_network`, `outbound_cidr_allowlist` and `inbound_cidr_allowlist` (12). Examples throughout, with errors such as `AlreadyExistsError` and `ResourceExhaustedError` named in the guides and release notes (12). Versioned release notes for every SDK release (15). 15 + 10 + 15 + 12 + 12 + 15 = 79.)