Claude Code sandbox: run your tests in a CreateOS microVM

Claude Code sandbox: run your tests in a CreateOS microVM

To give Claude Code a sandbox off your laptop, install the CreateOS Sandbox plugin, sign in with createos login, and run /createos-sandbox:offload . "npm ci && npm test". Claude keeps running on your machine. The build, the test suite or the untrusted script runs on a throwaway Linux box that destroys itself when it finishes.

The plugin is for developers who use Claude Code and want heavy or risky work to run somewhere other than their own computer. CreateOS Sandbox runs each job in a Firecracker microVM with its own guest kernel, root filesystem and network identity.

Claude Code is Anthropic's product. The CreateOS Sandbox plugin is maintained by CreateOS and is not an Anthropic product.

Key takeaways

• The CreateOS Sandbox plugin adds a skill and slash commands to Claude Code that run work in disposable sandboxes.
• /createos-sandbox:offload uploads a directory, runs one command, and destroys the box whether the command passed or failed.
• Each CreateOS sandbox is a Firecracker microVM with its own guest kernel, so offloaded work is VM-isolated from your laptop.
• Outbound network access from a CreateOS sandbox is open until you set a rule, and the plugin sets one with the -p flag.

What does the CreateOS Sandbox plugin add to Claude Code?

The plugin adds a skill, two hooks and slash commands under the /createos-sandbox: namespace. Per the plugin docs:

• The skill teaches Claude when to offload: heavy builds, untrusted code, test matrices and clean-room reproductions.
• A hint hook spots commands such as npm ci, cargo build, pytest and make and suggests offloading them. It never blocks the command, and COS_NO_HINT=1 turns it off.
• Slash commands cover one-shot jobs (offload, fanout, shell), a reusable box (up, run, down), networking and snapshots.

For background, read what an AI agent sandbox is.

How do I set up the CreateOS Sandbox plugin in Claude Code?

Four steps take you from install to a first offloaded test run. You need Claude Code, a CreateOS account and a project with a command to run. The plugin installs the createos CLI the first time a command needs it; installing it yourself first is optional (see Prerequisites).

Step 1: How do I add the CreateOS plugin marketplace?

Add the CreateOS plugin marketplace first. Claude Code installs plugins from marketplaces, which are catalogs of plugins and where to fetch them (Claude Code plugins docs). Copy the exact command from the Install section of our docs.

This is a third-party marketplace, and a plugin runs with your user privileges. Read Plugin security and trust before you install any plugin.

Step 2: How do I install the plugin?

Run one command inside Claude Code:

/plugin install createos-sandbox@createos

For user, project or local install scopes, see Install and manage plugins.

Step 3: How do I sign in to CreateOS?

Open a normal terminal and run:

createos login

Browser sign-in needs a real terminal, so Claude cannot run it for you. In CI, a devcontainer or anywhere headless, export CREATEOS_API_KEY in your shell instead; the key wins when both are present. Never paste a key into the conversation.

Step 4: How do I run my tests in a sandbox from Claude Code?

Run offload with a directory and a command:

/createos-sandbox:offload . "npm ci && npm test"

The plugin uploads the current directory, runs the command on a fresh box, and tears the box down whether the tests passed or failed. Large folders such as .git, node_modules and target are left out of the upload automatically.

Useful flags:

How do I stop the sandbox from reaching the internet?

Pass an egress preset, because outbound traffic is unrestricted until you do. With no rules a CreateOS sandbox can reach any host. Once any rule is set, everything not on the list is dropped in-kernel on the host, outside the VM (Limits and defaults).

The plugin ships four presets: npm, python-uv, rust-cargo and github. For a Node test run that only needs the registry, add -p npm.

A domain rule is a strong control for HTTPS but a weak one for cleartext HTTP. To prevent exfiltration, write IP or CIDR rules through the Egress API. For why the kernel boundary matters, read when a coding agent needs a microVM.

When should I keep a box instead of offloading?

Use up, run and down when Claude edits locally and rebuilds remotely in a loop. The box is keyed to your repository and keeps state between run calls, so installed dependencies stay put. offload fits work with a finish line. Firecracker sandboxes for AI agents covers the pause and fork model underneath.

What are the limits of the CreateOS Sandbox plugin?

The main limits are the account box cap, the 1 GB default shape and public URLs with no authentication.

• Box cap. Your account caps how many boxes are open at once (paused ones count) and how many you create per day. A create over the cap fails rather than queueing.
• Default size. offload uses a 1 vCPU, 1 GB shape. A build that runs out of memory needs a larger shape via -s.
• Bandwidth. Each box gets 50 GiB of outbound traffic by default, and it can be extended.
• Environment variables. Declare them when the box is created: 64 entries, 4 KiB per value, 64 KiB total.
• Public URLs. expose serves a port on a public HTTPS URL with no authentication in front of it. Use tunnel to keep it private.
• No GPUs. No GPU shapes are offered.

When do I not need this?

If you only want to limit which files and hosts Claude's shell commands reach, Claude Code's built-in Bash sandbox does that. The operating system enforces it around commands that still run on your machine. Use the plugin when the work should run off your laptop.

Common questions

How do I run Claude Code tests in an isolated microVM?

Install the CreateOS Sandbox plugin, sign in with createos login, then run /createos-sandbox:offload . "npm ci && npm test". The plugin uploads your directory to a Firecracker microVM with its own guest kernel, runs the command, and destroys the box afterwards.

Does the plugin run Claude Code itself in the cloud?

No. Claude keeps running on your machine and only the work you offload runs remotely.

Can a CreateOS sandbox reach the internet during an offloaded job?

Yes, by default. Egress is unrestricted until you set a rule, so add a preset such as -p npm and extra hosts with -e. Once any rule is set, everything else is dropped in-kernel on the host, outside the VM.

How do I use the CreateOS Sandbox plugin in CI or a devcontainer?

Export CREATEOS_API_KEY in the shell instead of using browser sign-in, which needs a real terminal. The API key takes precedence when both are present. Never paste the key into the Claude conversation.

What happens to the sandbox when my tests fail?

The offload command destroys the box whether the command passed or failed. Add -K to keep the box after a failure so you can inspect it.

How is this different from Claude Code's built-in /sandbox?

Claude Code's built-in sandbox restricts files and network hosts for shell commands that still run on your own machine. The CreateOS Sandbox plugin moves the work off your machine into a VM-isolated box with its own guest kernel.

Next step

The plugin docs page has the marketplace command, every slash command and every default in one place. Open the CreateOS Sandbox plugin docs for Claude Code and run your first offload.

About CreateOS

CreateOS runs AI agents and the code they write. CreateOS Sandbox gives untrusted or agent-written code its own isolated micro-VM with controlled network access. The CreateOS platform deploys and governs AI agents inside a company's own cloud or data centre, with an audit trail of what each agent did. Start at createos.sh.