Celesto (formerly SmolVM) vs Sandbox0

Celesto (formerly SmolVM) 60

Read with the self-hosted rule, scoring the hosted option for the price lines. No x402, MPP or L402 (0 of 40). Celesto Cloud publishes hourly prices for six sizes without a login (20). A one-time $5 Micro credit needs no card, and the local SDK is free (20). The graded local SDK installs from PyPI and runs with no account, so an agent needs no signup (20). Cloud use needs a browser signup and a card top-up. Total 60.

Sandbox0 20

No x402, MPP or L402 in the docs, llms.txt or the OpenAPI file (0 of 40). Per-unit prices published without a login, $0.015 per GiB-hour of compute billed by the second and $0.02 per GiB-month of retained incremental storage, with network and object-store requests at $0.00 for now (20). The one-time $5 welcome credit now needs a saved card. The pricing page asks whether a card is needed for the welcome credit, answers yes and says the credit follows Stripe confirming a saved card, where on 21 October it needed none (0). Signup and the first s0 auth login are a device login a person approves in a browser. Keys can be minted by API afterwards, but only from an existing session or key (0). 0 + 20 + 0 + 0 = 20.

Celesto (formerly SmolVM) 66

Read with the local-software lines, because the graded surface runs on the owner's machine. Installs from PyPI as celesto with Python 3.11 or newer on Linux and macOS stated, plus an install script (20). The repository has pytest, e2e, lint, TypeScript and smoke-test workflows and 38 test packages, but GitHub's API answered with a rate limit, so no run result was read (15 of 25, unchecked). 22 open issues and pull requests against about 188 commits in 90 days. The open bugs include a snapshot restore that can lose a VM's disk if interrupted and a thread-safety issue with five replies (18 of 25). A dated changelog with Security, Fixed, Added and Removed sections, and the rename to Celesto marked as a breaking release, though versions stay below 1.0 (13 of 15). Pre-1.0 per SECURITY.md (0). Total 66.

Sandbox0 37

Graded with the hosted lines, on Sandbox0 Cloud only. No status page found. sandbox0.ai/status answers 404, status.sandbox0.ai doesn't resolve, and none is linked from the site, llms.txt or docs (0, re-read 4 November). No readable incident history (5). Default quotas are published with numbers, 20 running sandboxes, unlimited paused sandboxes, 5 claims a second and 100 API requests a second per team, burst 200 (15). Quota failures return 429 with error.code quota_exceeded, claims carry Retry-After, and the OpenAPI file documents Idempotency-Key on pause, resume, restart, fork, snapshot capture and restore, sessions and template creation, with the docs saying to retry the same resize on 503. The core write, POST /api/v1/sandboxes (claim), which starts a billed sandbox and is the listing's own example call, takes no key, and the keys on pause and resume apply only to their conditional memory forms. That is safe-retry guidance without idempotency keys on the core write (12; the 21 October 13 isn't a checklist value). The terms provide the service as is and no SLA is published (0). The core sandbox API carries no beta label, but memory checkpoints and live migration are called experimental, the OpenAPI file is version 0.1.0 and the SDKs are 0.10.x (5 of 10, the 21 October partial kept). 0 + 5 + 15 + 12 + 0 + 5 = 37.

Celesto (formerly SmolVM) 70

Apache-2.0 in LICENSE and on PyPI (30). The privacy policy of 30 October 2026 links a subprocessor registry and describes the CLI telemetry in the same terms as the docs, but gives no retention periods beyond as long as necessary. Stopped cloud disks are kept 30 days per the pricing page (18 of 30). The changelog marks removals and the breaking rename, and the glossary lists older names still accepted, with no written deprecation policy (10 of 20). Telemetry is disclosed in the README, CLI reference and privacy policy, with three opt-outs, but it is on by default after the notice (16 of 20). Total 74.

Sandbox0 47

The hosted service is closed under clear, dated terms naming Lougao, LLC and Delaware law. The SDKs and CLI are Apache-2.0, and the earlier runtime stays Apache-2.0 as an unmaintained archive that no longer matches the service (18 of 30). The privacy policy (effective 17 June 2026, re-read 4 November) says what is collected, that customer content is processed only to run the service and that no advertising cookies are used, but retention is "as long as needed" with no periods, and no DPA was found (12 of 30). No deprecation policy. The terms say parts of the service may be changed or discontinued, and self-hosting ended on 16 October 2026 with no notice found before that day. The deployment page now dates the end clearly (3 of 20). Data location is stated (U.S. infrastructure, one U.S. East region), but service providers are described by kind only and not named (8 of 20).

Celesto (formerly SmolVM) 85

Read as an SDK and CLI. The repository ships an OpenAPI document for the local server (24 operations) and the cloud API (171 operations), from which the TypeScript client is generated (25). llms.txt at celesto.ai, plus Markdown docs in the repository (10). The README's runtime table says when to use each runtime, and the automation section says to prefer exec and keep shell, ssh and desktop for interactive work (14 of 20). Network modes are closed values (open, off, public, restricted) and the SDK takes typed keyword arguments, though internet_settings is a plain dict (11 of 15). Examples directory, a JSON envelope for every command and documented cloud error fields such as required_scope, without a full error catalogue (12 of 15). Dated changelog and tags, pre-1.0 (13 of 15). Total 85.

Sandbox0 77

OpenAPI 3.0.3 file with 106 paths and 145 operations, the same file in each SDK repository and the archived runtime. It isn't linked from the docs or served on sandbox0.ai, so an agent has to find it on GitHub (20 of 25). llms.txt and every docs page as raw Markdown at a .md address (10). Docs say when to use each lifecycle and context type, and 884 descriptions in the spec explain fields, but the pages are long and mix in internal architecture such as ctld, Nomad and PostgreSQL leases (16 of 20). 106 enums and 386 required lists in the spec; the error details field is free-form (13 of 15). Examples in Go, Python, TypeScript and CLI on every guide, but only two examples in the spec. Error responses are typed as a {code, message, details} envelope per status, with a few codes named in the docs (11 of 15). API paths are /api/v1 and the SDKs and CLI publish GitHub releases with commit lists, but there's no public changelog page; /changelog answers 404 (7 of 15).

Celesto (formerly SmolVM) 52

Framework reading for local software. No credential is needed for local use, and the local API server and dashboard each require a bearer token, and cloud keys carry named permissions (22 of 30). Each computer has its own guest kernel, browser and display access uses capability URLs with a read-only option, and raw VNC is off. Against that, outbound networking is open by default and the restricting modes are opt-in (12 of 20). The security doc warns against giving connection URLs to a model as page content, but there is no guidance on treating command or page output as untrusted (5 of 15). computer logs shows startup output, with no audit log of commands (5 of 15). SECURITY.md with GitHub private vulnerability reporting and a supported-versions table, Security sections in the changelog, no security.txt, bug bounty or certification (8 of 20). Total 52.

Sandbox0 58

Bearer API keys scoped to a team, with roles admin, developer, builder and viewer that can't exceed the caller's, expiry of 30 to 365 days or never, deactivation and an introspection route. No OAuth for API clients found (25 of 30). The viewer role gives a read-only key. Network policy can block all egress, allow and deny by rule, and allow or deny named MCP tool calls, and cloud metadata endpoints are blocked under any policy. No confirmation step for destructive calls (14 of 20). Sandboxes return output of code the agent runs. Credential sources are injected by the egress proxy so raw secrets stay out of the sandbox, but no guidance on treating sandbox output as untrusted was found (8 of 15). Historical logs and runtime metrics per sandbox; the signed audit event ledger needs the enterprise sandbox_audit feature, and network audit is optional (8 of 15). No security.txt (404), no security page (404), no bug bounty, no certification and no published advisories (OSV lists none for sandbox0 on 4 November). Security reports go to contact@sandbox0.ai per the archived runtime's SUPPORT.md, and the s0 install script downloads a release without verifying a checksum (2 of 20).

Celesto (formerly SmolVM) 69

A CLI and SDK add no tool definitions to an agent's context. Collected command output is capped at 8 MiB with streaming as the alternative (18 of 25). computer list, logs --follow and name lookups, with little filtering (10 of 20). JSON errors carry a recovery command where Celesto has one, and cloud errors carry stable codes, operation and computer context and recovery fields since 0.1.7 (18 of 20). State-changing cloud requests are never replayed automatically and computers are addressed by unique names, but there are no idempotency keys (10 of 20). with Computer() creates and deletes a computer with no parameters, with Python and an alpha TypeScript SDK (13 of 15). Total 69.

Sandbox0 74

Graded on the REST API and SDKs. Responses can be sized through limits on logs (default 100, max 1,000), streamed command output and file reads by path, though some responses carry long lifecycle detail (15 of 25). Cursors on logs, contexts and sessions, and limits on lists (14 of 20). Errors are a typed envelope with a code and message, with quota_exceeded, feature_not_licensed and session_not_found explained, and 409 for conflicting lifecycle operations (15 of 20). Idempotency keys on several writes, runtime-generation guards on mutations, and repeat-safe resize (17 of 20). SDKs in Go, Python and TypeScript plus the CLI, and claims need only a template name, but ttl and hard_ttl default to 0 so an idle sandbox keeps billing until told otherwise (13 of 15).