Getting started
The Cellar engine is a single static binary that runs today under Termux — the Android app that wraps it is in development. If you can paste a few commands, you can run an AI agent on your phone tonight.
Install
You need Termux (from F-Droid or GitHub — the Play build is abandoned) on any arm64 Android phone. Then:
$ pkg install proot golang git $ git clone https://github.com/Airn0x/Cellar # opens with the beta $ cd Cellar/engine $ go build -o cellar . && export PATH="$PATH:$PWD"
That's the whole toolchain. The engine has zero dependencies outside the Go
standard library; the binary weighs ~6 MB and also runs on a regular Linux box
for development — machines still need proot there; only the image
extraction step has a plain-tar fallback.
Your first machine
$ cellar create dev --distro debian downloading debian trixie (20260724_05:24) ... downloaded 90.3 MB, sha256 ok extracting ... machine "dev" ready (debian trixie) $ cellar shell dev root@localhost:~# cat /etc/os-release | head -1 PRETTY_NAME="Debian GNU/Linux 13 (trixie)"
Machines are full distro userlands (alpine, debian,
ubuntu) downloaded from the linuxcontainers.org community image server,
sha256-verified against the build's manifest, and unpacked into app-private storage.
Inside one you are (fake) root: apt and apk work normally.
Agent stacks
Stacks are one-command installs from the catalog, idempotent by design:
$ cellar apply dev claude-code $ cellar exec dev -e ANTHROPIC_API_KEY=sk-… -- claude -p "hello from my phone"
| stack | what you get | distros |
|---|---|---|
claude-code | Claude Code CLI — the reference agent harness | debian, ubuntu |
python-uv | Python 3 + the uv package manager | any |
node | Node.js + npm | any |
sshd | OpenSSH server on port 2222 | any |
Secrets travel as environment variables via -e — they are never written
into the rootfs and never included in an export. (The app will move this into
Android Keystore.)
Daemons & logs
$ cellar start dev -- '/usr/sbin/sshd -D -e' started "dev" (pid 27428) — logs: cellar logs dev $ cellar logs dev | tail -5 $ cellar stop dev
The init command is remembered — next time, plain cellar start dev
relaunches it. One proot session per running machine keeps the process tree small,
which matters: Android's phantom-process killer counts your children.
(Field notes covers the whole survival guide.)
0.0.0.0 on any port ≥ 1024 and it's reachable from your LAN
(or tailnet) immediately. There is no port-mapping layer to fight.
CLI reference
cellar create <name> --distro alpine|debian|ubuntu [--release R] [--json] cellar ls [--json] # state: stopped · up:PID · broken cellar shell <name> cellar exec <name> [-e K=V]... -- <command...> cellar start <name> [-e K=V]... [-- <init command...>] cellar stop <name> cellar logs <name> cellar rm <name> [--force] # --force also cleans up broken machines cellar export <name> [-o file.tar.gz] cellar apply <machine> <stack> cellar catalog [--json] cellar version
Every read command takes --json: the CLI is the API. The Android app,
your scripts, and the agents themselves all drive the same surface.
Environment
| variable | meaning |
|---|---|
CELLAR_HOME | state directory (default ~/.cellar) |
CELLAR_PROOT | proot binary (default: found in PATH) |
CELLAR_CATALOG | catalog dir (default: ../catalog relative to the binary, then $CELLAR_HOME/catalog) |
CELLAR_DNS | DNS server override, host or host:port — used by the engine and written into each machine's resolv.conf |
CELLAR_IMAGE_SERVER | alternative image mirror |
CELLAR_SECCOMP=1 | re-enable proot's seccomp fast path (breaks npm; benchmarking only) |