Quick start

Set up KVM

Sandboxes are hardware VMs, not containers. Linux hosts need KVM (/dev/kvm); macOS hosts need Apple Silicon (Virtualization.framework). cellard installs the microsandbox runtime on first sandbox use.

If a host fails to start sandboxes, use the platform guides:

Linux

Confirm the KVM module and device exist:

lsmod | grep kvm
ls -l /dev/kvm

An Intel host usually shows kvm_intel and kvm; AMD shows kvm_amd and kvm. If /dev/kvm is missing, enable CPU virtualization in firmware/UEFI (and nested virtualization if this host is itself a VM), then load the module. On cloud VMs, use nested-virt capable instance types and enable nested virtualization at launch — see Infrastructure with Terraform.

grep -E -c '(vmx|svm)' /proc/cpuinfo   # 0 means virtualization is off or hidden
sudo modprobe kvm_intel                # Intel
sudo modprobe kvm_amd                  # AMD

glibc must be 2.28 or newer. The cellar service user needs read/write access to /dev/kvm — install (next section) adds that user to the kvm group.

See the Linux troubleshooting page for permissions, nested VMs, and msb doctor.

macOS

Apple Silicon only — Intel Macs are not supported. There is no separate KVM feature to enable; Virtualization.framework is already present.

See macOS troubleshooting if sandbox startup fails.

Install

On each host, install Cellar, create the cellar system user, and start the daemon:

curl -fsSL https://cellar.prodioslabs.in/install.sh | bash
# Or include the gateway non-interactively:
# curl -fsSL https://cellar.prodioslabs.in/install.sh | bash -s -- --install-cellar-gateway true
sudo systemd-sysusers
sudo usermod -aG kvm cellar
sudo systemctl daemon-reload
sudo systemctl enable --now cellard
# If you installed cellar-gateway:
sudo systemctl enable --now cellar-gateway

See non-root access to run the CLI without sudo.

Next: initialize and join

With cellard running, create the first manager and add workers or managers: