Firecracker-based isolation
Each workload runs in a Firecracker micro-VM with its own Linux kernel, which creates a machine-level boundary rather than a shared-process environment.
CreateOS Sandbox
CreateOS Sandbox is an isolated compute environment for running code and agent workloads in Firecracker micro-VMs with private networking and SDK, CLI, or MCP control.
What CreateOS Sandbox does
CreateOS Sandbox is an isolated compute environment for running code and agent workloads inside Firecracker micro-VMs. Each sandbox gets its own kernel, and the product is positioned for tasks that need a real machine boundary rather than a shared runtime.
The workflow shown on the product page is straightforward: install the SDK, create a sandbox with a chosen shape and root filesystem, run commands, inspect output, and tear it down when finished. The source also describes private networking between sandboxes, pause-to-zero behavior with state preserved, and template-based reuse for repeatable environments.
Core capabilities
Private networking between sandboxes
Sandboxes can connect over a private network, making it possible to coordinate multi-agent or multi-node workflows inside isolated compute.
Pause to zero with state preserved
Paused sandboxes preserve guest memory and device state on disk, then resume in place so long-running jobs can survive idle gaps without restarting.
Template-based environment reuse
You can save a configured sandbox, including its root filesystem and installed dependencies, as a template and launch the same environment again.
Bring your own storage
The sandbox disk syncs to object storage you control, and the page says you can mount Amazon S3, MinIO, or Cloudflare R2 as a filesystem.
Programmatic control paths
CreateOS exposes Sandbox through a TypeScript SDK, the CLI, and MCP, so code or an agent can provision and manage compute programmatically.
Practical use cases
Safely execute untrusted code
Run untrusted or model-generated code in an isolated environment that is separated from the host and other tenants by a machine-level boundary.
Multi-agent workflows
Coordinate multiple agents that need to communicate with each other while remaining isolated from the public internet and the host machine.
Long-running agent sessions
Use pause-to-zero and template reuse for iterative tasks that need to resume exactly where they left off without reconfiguring the environment.
Repeatable development environments
Launch consistent sandboxes from a saved template when you need the same root filesystem and dependencies across repeated runs.
Controlled data handling
Sync outputs to storage you control and mount your own bucket when your workflow needs data to remain in your preferred object store.
Pros and Cons
Pros
- Uses Firecracker micro-VMs with separate kernels for stronger workload isolation.
- Supports private networking between sandboxes for multi-agent or multi-node setups.
- Can pause to zero and resume with state preserved, which helps reduce idle compute cost.
- Offers template reuse so configured environments can be relaunched without rebuilding them.
- Provides SDK, CLI, and MCP access for automated workflows and agent-driven provisioning.
Cons
- The public source is centered on Sandbox mechanics and does not fully document every configuration option or limit.
- Integration details beyond the storage providers and control paths mentioned on the page are not fully covered in the provided sources.
FAQ
How isolated is each sandbox?
CreateOS Sandbox runs each workload in a Firecracker micro-VM with its own kernel. The source says code inside one sandbox cannot reach the host or other tenants, and egress is controlled through an allowlist.
Can sandboxes talk to each other?
Yes. Sandboxes can communicate over a private network, which supports multi-agent workflows without exposing those services publicly.
What happens when a sandbox is idle?
A paused sandbox preserves its state and stops compute billing. The source describes this as a pause-to-zero flow that resumes in place rather than starting from scratch.
What comes preinstalled, and where does it run?
According to the source, Sandbox is preinstalled with Ubuntu 26.04 plus Node.js, Bun, Python, Go, Rust, and the Pi agent, and it is available in EU or US regions.
How do I drive sandboxes?
You can drive sandboxes with a TypeScript SDK, the CLI, or MCP. The source also mentions a browser agent can provision compute through a tool call.
Quick Facts
- Category
- Developer Tool
- Product type
- Isolated sandbox runtime
- Primary interface
- TypeScript SDK, CLI, MCP
- Execution model
- Firecracker micro-VMs with per-sandbox kernels
- Storage
- BYO object storage; supports Amazon S3, MinIO, and Cloudflare R2
- Pricing model
- Usage-based; sandbox pricing is per second while running
CreateOS Sandbox Alternatives
ByteAsk
ByteAsk is a terminal-first AI coding agent for C and C++ that edits repos and verifies changes with compilers, debuggers, sanitizers, and tests.
hob
hob is an independent workspace for coding agents, with local control over sessions, terminals, history, routing, and follow-up work.
Manta AI
Manta AI is an autonomous web app testing tool that maps app behavior, catches regressions, and generates tests from a URL, no scripts or selectors needed.
SonOf
SonOf connects to your repo and PM tool, audits your codebase, and turns approved work into shipped tickets with senior engineering review.
Ghost
Ghost is a terminal-based AI assistant for chatting, code generation, and CLI tasks. Includes free models, supports Linux, macOS, Windows, and is open source.
AakarDev AI
AakarDev AI helps teams manage AI provider access, project setup, logs, and analytics in one dashboard. BYOK support included.