CreateOS, Explained: The Execution Layer Where AI Agents Actually Run

CreateOS is an infrastructure platform built by NodeOps Inc. that runs AI agents and the code they write: it gives each session its own isolated machine, enforces the rules on what that machine can reach, and records what the agent did. It ships as two product lines, CreateOS Sandbox for untrusted or agent-written code and CreateOS Studio, the enterprise platform that deploys and governs agents inside a company's own cloud or data centre.

Introduction

If your product makes agents write or run code, you eventually hit the same question: where does that code execute? Your own servers are too exposed. A plain container shares a kernel with everything around it. A serverless function gives you neither a persistent filesystem nor the network posture a long task needs.

CreateOS exists to answer that question. It is the execution layer underneath the agent builders and coding tools: they write the code, CreateOS is the machine it runs on. The company behind it, NodeOps, has operated production infrastructure since December 2023. Scale to date: 2.6 million sandboxes created since June 2026 (as of 1 October 2026).

This piece explains what CreateOS is, how the two product lines fit together, and what each one actually does.

Key Takeaways

CreateOS runs AI agents and the code they write. It is not another agent builder; it sits underneath them.
CreateOS Sandbox gives every session a Firecracker microVM with its own guest kernel, not a container.
Outbound access in a sandbox is open until you set at least one egress rule; once set, everything else is denied, enforced in the host kernel with eBPF, outside the guest.
Sandboxes pause, resume, and fork, so an agent can wait on a human or branch into parallel rollouts without paying for idle compute.
CreateOS Studio is the enterprise side: deploy, isolate, monitor, audit, and bill AI agents inside your own VPC or on-premise, with an audit trail of what each agent did.
New accounts start with 500 free credits, and billing is per second with $0 egress.

What CreateOS Actually Is

CreateOS is a runtime. The category it competes in is sometimes called "agent infrastructure," but the plain description is simpler: it is the safe computer that agent-written code runs on.

That distinction matters because most teams building AI products conflate two problems. The first is getting an agent to produce correct output. The second is running that output without exposing your infrastructure to code nobody reviewed. Agent builders solve the first. CreateOS solves the second, and then adds the operational layer around it: deploy, isolate, monitor, audit, bill.

The platform is built by NodeOps Inc., the infrastructure company behind CreateOS, operating production infrastructure since December 2023. For company background: NodeOps, the company behind CreateOS, raised a $5M seed round led by L1D in May 2024.

CreateOS Sandbox: A Machine Per Session

CreateOS Sandbox is the product most developers meet first. Every sandbox is a Firecracker microVM with its own guest kernel. That is a different isolation model from a container: the code inside cannot see or touch the host kernel, because it has its own.

What that gets you in practice:

Isolation by default, not a setting you have to remember. Each session gets its own machine. One customer's code cannot see another's.
Egress governance that survives compromise. Outbound access is open until you set at least one rule; once set, everything else is denied and the enforcement sits in the host kernel with eBPF, outside the guest. Code inside the VM cannot rewrite or route around it. Inbound is closed by default regardless.
Pause, resume, fork. Pausing writes a snapshot of full guest state and stops compute billing. Resume restores that exact machine. Forking a paused sandbox branches its memory and working state, which is how you run parallel rollouts and keep the winner.
Private networks between sandboxes. Multi-agent systems can talk directly over a private overlay network with per-network DNS, no public exposure.
Bring your own. Storage (S3, R2, MinIO), compute (the same API on your machines), or a full self-host of the control plane when code cannot leave your boundary.

Speed matters for agent workloads, Restore times depend on the host: creation is about 30 ms on an idle host, which is not an SLA. Pause takes about 1.4 seconds, same-host resume under 0.7 seconds, and a cross-host cold start runs 11 to 13 seconds.

Pricing is per second with $0 egress, and shapes run from a quarter CPU up to 8 CPUs and 16 GB of RAM. You can check current limits on the Sandbox pricing page or start with the free credits every new account receives.

CreateOS Studio: The Governed Layer for Enterprises

The second product line answers a different buyer's problem. Enterprise teams rarely stall because they cannot build an agent. They stall at one of three gates: security review, deployment boundary, or accountability for what the agent does live.

CreateOS Studio is the governed execution layer for that motion. It deploys and governs AI agents inside the company's own cloud or data centre, in CreateOS cloud, a customer VPC, or fully on-premise, with zero data retention by default. Every run executes in an isolated sandbox, and every run leaves an audit trail of what the agent did.

Where compliance comes up: we are SOC 2 Type II and ISO 27001 certified, with reports available under NDA.

Studio is framework-agnostic. It runs agents you already built, including vendor copilots and internal frameworks, and applies the same guardrails, approval gates, permissions, and audit to all of them. Native billing and usage metering sit on the same surface, so platform teams can see and bill for what each agent consumes, with traces and usage dashboards live today.

One real deployment shows the shape of it: a Maharashtra-based textile manufacturer runs AI oversight over the CCTV it already owns, delivered by our engineers in 75 days.

Which One Fits Your Problem

The split is straightforward. If your product makes agents write or run code you did not review, start with Sandbox. It is self-serve: SDK, CLI, MCP, no sales call. The docs cover the API, the egress rules, and the SDK.

If you are a platform or security team trying to move a stuck agent initiative into production inside a regulated environment, Studio is the conversation. It is sales-led, with a fixed-scope proof of concept before a platform licence.

The tradeoff worth naming: CreateOS is opinionated. If your team only ever runs code it wrote and reviewed itself, and you need GPUs, it is the wrong tool. Sandbox does not offer GPU shapes. If you need governed execution for code you cannot trust, that constraint stops mattering.

Frequently Asked Questions

Is CreateOS a container platform? No. Each CreateOS Sandbox is a Firecracker microVM with its own guest kernel. A container shares the host kernel with everything around it; a microVM does not, which is why code inside cannot reach the host even if it is compromised.

Can I restrict what a sandbox can reach on the internet? Yes, through an egress allowlist. Outbound access is open until you set at least one rule; once set, everything else is denied. Rules are enforced in the host kernel with eBPF, outside the guest, so code inside cannot rewrite them. You set rules via the API, SDK, or CLI.

Does CreateOS run inside my own cloud? Yes. Studio deploys in CreateOS cloud, a customer VPC, or fully on-premise, with zero data retention by default. Sandbox supports bring-your-own compute and storage, and the control plane can be self-hosted when code cannot leave your boundary.

What does CreateOS cost? Sandbox bills per second with $0 egress, and new accounts start with 500 free credits. Studio is licensed through a sales-led engagement after a fixed-scope proof of concept. Current Sandbox pricing is on the pricing page.

Conclusion

CreateOS answers a question every AI team hits eventually: where does the code run, and what contains it? Sandbox gives untrusted, agent-written code its own machine with governed egress, pause, and fork. Studio gives enterprises the governed layer that takes agents from proof of concept to production inside their own infrastructure. Both rest on the same idea: the boundary that runs the agent enforces the rules on it. If your agents write code, that boundary is not optional. The only question is whether you built it yourself or picked one that already ships.

About CreateOS CreateOS runs AI agents and the code they write. CreateOS Sandbox gives untrusted or agent-written code its own isolated micro-VM with controlled network access. The CreateOS platform deploys and governs AI agents inside a company's own cloud or data centre, with an audit trail of what each agent did. Start at createos.sh.