Download
Optional sandbox

Try Kernl in a throwaway VM first

This is not the normal way to install Kernl. It is an optional path for anyone who would rather try it inside a throwaway Windows virtual machine before running it on their real one.

Most people should just download Kernl. The usual way is to download Kernl for Windows and run the installer like any other app. Only use the VM below if you specifically want to try it in isolation first.

Quick setup

Open Windows PowerShell (no need to run it as Administrator) and paste this one line. irm downloads our setup script and iex runs it immediately, without saving it first. It looks for a Windows 11 ISO on its own first, then asks Windows to elevate only for the part that actually needs it. That is the fast way. If you would rather read the script before anything runs, use the next section instead. 

irm https://getkernl.ai/install/windows-vm.ps1 | iex

It sets up the VM and installs Windows by itself, and offers to download the official Windows 11 ISO from Microsoft if you do not already have one, so there is nothing to grab by hand. It does not install Kernl for you: you do that yourself inside the VM, like a normal user (that first-run experience is the test).

Prefer to inspect it first

Download, read it in Notepad, then do a dry run. It prints every step it would take, and writes nothing at all: no VM, no Windows feature change, not even its own log. 

Invoke-WebRequest https://getkernl.ai/install/windows-vm.ps1 -OutFile kernl-vm-install.ps1
notepad .\kernl-vm-install.ps1
PowerShell -ExecutionPolicy Bypass -File .\kernl-vm-install.ps1 -DryRun

Confirm the script is exactly what we publish. Run Get-FileHash .\kernl-vm-install.ps1 -Algorithm SHA256 and compare it with this, which is the hash of the file served at that address. PowerShell prints capitals and this is lower case; it is the same value.

windows-vm.ps1 389d4f89d27f87c8ff9d237acae9c3b801ed4a04c886349f57cbc2f77315cc54

What this installs

  • Hyper-V on your PC, if it is not already enabled.
  • A clean, isolated Windows 11 virtual machine named Kernl-Sandbox, sized conservatively from your hardware.
  • A 'Download Kernl' shortcut on the VM desktop. You install Kernl yourself, inside the VM.
  • Your NVIDIA graphics card can be shared with the test copy, so models run on it. Only if you ask for it.

Requirements

  • Windows 10 or 11 Pro, Enterprise, or Education. Hyper-V is not available on Windows Home.
  • Hardware virtualization enabled in your BIOS or UEFI (Intel VT-x or AMD-V). Most machines have this on already.
  • A free Windows 11 image from Microsoft, used once to set up the VM. The script offers to fetch it for you, about 6 GB, and keeps it so a rerun does not download it again.
  • Disk: the virtual drive is created with an 80 GB ceiling and grows only as it fills, so the script looks for a drive with about 90 GB free. A fresh Windows install uses a good deal less than the ceiling, and models you download inside the VM come out of the same space.
  • To use a graphics card inside the VM: an NVIDIA card and the optional -Gpu flag. Worth knowing before you rely on it: sharing a card this way reliably passes the device through, but running a model on it inside a VM is experimental and may not work at all. Without it Kernl still runs on the processor, or you can connect an account of your own.

This needs administrator rights, but you do not have to start PowerShell as Administrator yourself: the script resolves the Windows ISO first, then asks Windows to elevate for the part that actually needs it (enabling Hyper-V, creating the VM). Accept that one prompt and it continues on its own. The first time Hyper-V is turned on may need one reboot; the script says so and exits cleanly, and rerunning the same command afterward picks up where it left off.

After install

  1. 1You can leave it alone. The virtual machine installs Windows by itself and logs straight into the desktop, with no setup screens and no password to type.
  2. 2Double-click Download Kernl on the desktop, then install and run Kernl yourself, exactly like a new user would. That first-run experience is the test.
  3. 3Open or return to the VM anytime with vmconnect.exe localhost Kernl-Sandbox, or from Hyper-V Manager.

Why a Hyper-V VM, not WSL2?

Kernl is a Windows desktop app. It uses WebView2 for its interface, ships as an installer, and updates itself. WSL2 runs Linux, so it can host a server build but it cannot run the Windows app a tester downloads. A Hyper-V VM runs the app, its installer, and its updater, in its own Windows install separate from yours.

Honest note: Hyper-V is a strong isolation boundary, much stronger than WSL2. It is still not an air-gapped security appliance. The VM has internet access so it can download models and updates. It also turns on Enhanced Session Mode, a host-wide Hyper-V setting (not scoped to this one VM) that lets clipboard copy/paste and file drag-and-drop cross between the VM window and your desktop; uninstalling the sandbox does not turn it back off. Keep Kernl in its default localhost mode unless you have a clear reason not to.

Nothing is exposed to your network

Kernl stays on localhost inside the VM. You reach it through the VM window, and the script adds no firewall rule, opens no port, and offers no switch to do either. If you want the VM on your network you would set that up in Hyper-V yourself, deliberately, outside anything this script does. The security notes cover what Kernl itself can reach.

Uninstall

Removes the VM: its registration, its unattended-setup files, and (with -RemoveVhd) its virtual disk. By default it keeps the disk so you do not lose anything. 

$p = "$env:TEMP\kernl-vm-uninstall.ps1"
Invoke-WebRequest https://getkernl.ai/install/windows-vm-uninstall.ps1 -OutFile $p
PowerShell -ExecutionPolicy Bypass -File $p

It leaves the Hyper-V feature, the virtual switch, Enhanced Session Mode, and your GPU drivers alone, since other VMs may use them. Removing Hyper-V itself is always a separate, manual choice.

Troubleshooting

It says a reboot is required.

That happens the first time Hyper-V is turned on. Reboot, then rerun the exact same command. The script resumes from where it stopped.

It says Windows Home is not supported.

Hyper-V ships only on Windows Pro, Enterprise, and Education. On Home, install Kernl normally instead, or use a cloud API key on any machine.

It warns that virtualization is disabled.

Enable Intel VT-x or AMD-V (sometimes called SVM) in your BIOS or UEFI, then rerun. If Hyper-V is already running, this warning can be a false alarm and you can ignore it.

Can I see what it will do without changing anything?

Yes. Add -DryRun to any run. It prints every step and changes nothing.

The GPU is not detected inside the VM.

GPU sharing through Hyper-V is advanced and needs the host graphics driver copied into the guest. The script prints the exact paths. Even once the card shows up, running a model on it inside a VM is experimental and may not work. If you do not need that, skip it and use the processor or an account of your own.

Where are the logs?

Everything is logged to %LOCALAPPDATA%\Kernl\logs\install-vm.log on the host.

Security notes

  • The one-line command above runs our script the moment it arrives, without saving it. That is convenient and it does mean you are trusting us. The section above it downloads the same script to a file so you can read it first, and shows you how to confirm it is the one we published. Both are offered on purpose.
  • It opens no firewall port and adds no firewall rule. Kernl is reachable only from inside the virtual machine.
  • It downloads Windows itself only from Microsoft, and only if you do not already have a copy. It never gets Windows from us.
  • Windows and Hyper-V come from Microsoft, and Kernl from our own release host. It also fetches two open-source tools, aria2 to pull the ISO on more than one connection because Microsoft's CDN throttles a single one, and Fido to resolve Microsoft's own download link. Both are pinned to an exact release or commit and checked against a known SHA-256 before they run, and the script deletes the file and stops if the hash does not match.
  • The setup path never asks you for a guest password. It makes a random one for each VM, so there is no shared default and nothing for you to type, and stores it in Kernl's data folder encrypted with Windows DPAPI, which only your account on this machine can decrypt. That is what lets a rerun reconnect to the same VM. Uninstalling deletes it along with the VM, and a dry run does not write it at all. Point the script at a VM you already have and it asks you instead, and stores nothing.

Stuck, or want the full step-by-step reference including reboot and rerun behavior? Ask in the Kernl community.

Just want the normal install on your own machine? Download Kernl for Windows.