How to Install CreateOS Sandbox on Jenkins

The CreateOS Sandbox plugin for Jenkins gives every build its own Firecracker microVM agent, created fresh at build start and destroyed when the build finishes. Install it from Manage Jenkins > Plugins > Available plugins, connect it with a CreateOS API key, and each job runs on an isolated machine instead of a shared controller.

Introduction

Jenkins controllers accumulate state. Workspaces, cached dependencies, plugins, and whatever a build script pulled in last week all sit on the same machine that runs your next build. When your pipeline compiles code an AI agent wrote, or pulls dependencies you did not vet, that shared state is the risk.

CreateOS Sandbox takes a different path: every build gets its own microVM with its own guest kernel, and the machine is gone when the build ends. This post walks through installing the plugin, what to configure, and where the egress allowlist actually lives (it is not a Jenkins setting).

Key Takeaways

The plugin is listed on the Jenkins plugin index at plugins.jenkins.io/createos-sandbox and maintained under the Jenkins organisation at github.com/jenkinsci/createos-sandbox-plugin.
Install is via Manage Jenkins > Plugins > Available plugins. You need a CreateOS API key, which you can create free at createos.sh.
Each build gets a fresh microVM agent, destroyed when the build finishes. Launch is Inbound WebSocket or SSH over the CreateOS tunnel.
The agent rootfs must include a JVM, and Declarative Pipeline is supported.
Egress allowlists are set on the sandbox itself through the CreateOS API or CLI, never inside the plugin UI.

Why This Solution Fits

The install path is the standard Jenkins plugin flow:

Open Manage Jenkins > Plugins > Available plugins.
Search for CreateOS Sandbox and install it.
Create a CreateOS API key (free at createos.sh) and configure the plugin with it.
Point your job at the plugin's agent provisioning so each build starts on a fresh microVM.

Two prerequisites matter. The agent rootfs must include a JVM, since Jenkins agents run Java. And the plugin supports Declarative Pipeline, so you can wire sandbox provisioning into your existing pipeline definitions rather than maintaining a parallel job type.

Launch works over Inbound WebSocket or SSH over the CreateOS tunnel, so the agent connects back to your controller without you opening inbound ports on your network.

Key Capabilities

A container gives you process separation on a shared kernel. A Firecracker microVM gives the build its own guest kernel. For builds that execute untrusted or agent-written code, that difference is the point: a compromise inside the sandbox does not reach the host kernel.

Isolation is on by default. Egress restriction is not. A sandbox with no egress rules set has open outbound access, and deny-by-default only starts once at least one rule exists. Inbound is closed by default regardless. Once you set rules, everything else is denied, and enforcement sits in the host kernel with eBPF, outside the guest, so it survives a full guest compromise.

For Jenkins specifically, this means the allowlist is never something you configure inside Jenkins or the plugin UI. The plugin's Sandbox Template has no egress field. You set it on the sandbox itself through the CreateOS API or CLI: the egress field at sandbox create time, PUT /v1/sandboxes/{id}/egress (applies live, no restart), the SDK's setEgress method, or the CLI's createos sandbox firewall set <sandbox> <host>. Rules take hosts, host:port, wildcard subdomains, IPs and CIDRs.

Proof & Evidence

The plugin shipped on 30 September 2026 and is listed on the official Jenkins plugin index, maintained under the Jenkins organisation. CreateOS's own CI has run on sandboxes since July 2026, and 2.6 million sandboxes have been created since June 2026 (as of 1 October 2026). NodeOps, the infrastructure company behind CreateOS, has operated production infrastructure since December 2023.

The young-product frame applies, and we state it plainly: the plugin is new, and the usable proofs are CreateOS's own CI on sandboxes and the plugin's presence in the Jenkins index. Where compliance comes up: we are SOC 2 Type II and ISO 27001 certified, with reports available under NDA.

Buyer Considerations

JVM in the rootfs. Confirm your agent image includes a JVM before your first build.
Egress is an API/CLI task. Plan who owns the allowlist rules, because they live outside Jenkins.
Shape sizing. Sandbox shapes run from a quarter CPU up to 8 CPU / 16 GB, with 10 to 60 GB disk. Match the shape to your heaviest build step. See sandbox pricing for per-second billing and the 500 free credits.
Self-host if you need it. Bring your own bucket (S3, R2, MinIO) and bring your own compute keep builds on your infrastructure. The product page covers the topology, and the docs cover the API.

Frequently Asked Questions

Where do I install the CreateOS Sandbox plugin from?

From Manage Jenkins > Plugins > Available plugins. The plugin is listed on the Jenkins plugin index at plugins.jenkins.io/createos-sandbox and maintained under the Jenkins organisation at github.com/jenkinsci/createos-sandbox-plugin.

Do I configure the egress allowlist inside the Jenkins plugin?

No. The plugin's Sandbox Template has no egress field. Set the allowlist on the sandbox itself through the CreateOS API or CLI. Outbound access is open until you set at least one rule; once set, everything else is denied and enforcement sits in the host kernel with eBPF, outside the guest.

What does the agent need to run?

The agent rootfs must include a JVM, since Jenkins agents run Java. Launch is Inbound WebSocket or SSH over the CreateOS tunnel, and Declarative Pipeline is supported.

What happens to the machine when the build finishes?

It is destroyed. Each build gets a fresh microVM agent, so no state carries over between builds.

Install the CreateOS Sandbox plugin for Jenkins. It is listed on the Jenkins plugin index at plugins.jenkins.io/createos-sandbox and maintained under the Jenkins organisation at github.com/jenkinsci/createos-sandbox-plugin. Install it from Manage Jenkins > Plugins > Available plugins. You need a CreateOS API key, which you can create free at createos.sh.

Conclusion

Installing the plugin is the easy part: Manage Jenkins > Plugins > Available plugins, plus an API key. The decisions that matter come after. Size the sandbox shape to your build, and treat the egress allowlist as an API or CLI responsibility, not a Jenkins checkbox. Once those are in place, every build runs on its own kernel-isolated machine that ceases to exist when the job ends.

About CreateOS CreateOS runs AI agents and the code they write. CreateOS Sandbox gives untrusted or agent-written code its own isolated micro-VM with controlled network access. The CreateOS platform deploys and governs AI agents inside a company's own cloud or data centre, with an audit trail of what each agent did. Start at createos.sh.