What Is CreateOS?

CreateOS is an execution layer for AI work: it runs AI agents and the code they write. The name covers two products. CreateOS Sandbox gives untrusted or agent-written code its own Firecracker microVM with host-enforced network controls. The CreateOS platform deploys and governs agents in your cloud or data centre, with an audit trail of what each agent did.

Introduction

Your agents moved past the demo stage. Two problems decide what happens next. Agents write code that needs a machine which fails safely when it misbehaves. And once an agent acts inside a company, someone must answer for what it did.

CreateOS exists for both. It is built by NodeOps Inc., the infrastructure company behind CreateOS, operating production infrastructure since December 2023, with a $5M seed round from May 2024 and Product Hunt's #1 product of the day on 4 February 2026. Two product lines carry the name: CreateOS Sandbox, the machine for code nobody fully trusts, and the CreateOS platform, the governed layer enterprises run agents on. They are bought differently, so each gets its own section below.

CreateOS at a Glance

An execution layer, not an agent builder. CreateOS runs and governs agents; it does not author them.
Two products, one name. Sandbox isolates untrusted code in Firecracker microVMs; the platform deploys, monitors, audits, and bills AI workloads from one surface.
Real usage, not projections. 2.6 million sandboxes created since June 2026, with CreateOS's own CI running on them since July 2026.
Your boundary, your choice. The platform deploys in CreateOS cloud, your VPC, or on-premise. Sandbox runs on our cloud or yours.

Why This Solution Fits

Two buyers, two motions.

If you build a product where agents write and run code, you are the Sandbox buyer. You decide close to the SDK, you want self-serve, and you need your agent's code to fail safely.

If you run a platform team told to "make the AI safe for production," you are the platform buyer. Enterprise agent efforts stall at three gates: security review, deployment boundary, and accountability once an agent acts. CreateOS is built to clear all three, which is why it fits a team stuck at any one of them.

Not a fit: prototyping shops with no production pressure, agent-framework shoppers, anyone needing full air-gap today, and, on the Sandbox side, anyone needing GPUs.

What CreateOS Does

CreateOS Sandbox: a machine for code you did not write

Every sandbox is a Firecracker microVM with its own guest kernel. Not a container. Not a shared-kernel process namespace. Isolation sits at the machine boundary.

Network control works like this: outbound access is open until you set at least one rule. Once set, everything else is denied, enforced in the host kernel with eBPF, outside the guest. Code inside cannot rewrite the rules or route around them. Inbound is closed by default either way.

State is a primitive. Pause snapshots the full machine in about 1.4 seconds and stops the meter. Resume on the same host takes under 0.7 seconds. Fork branches a paused sandbox's memory and disk, so you can run N candidate fixes and keep the winner. New sandboxes start in tens of milliseconds on an idle host, not an SLA.

Sandboxes join private overlay networks with private DNS, so a team of agents talks directly without public exposure. Bring your own S3, R2, or MinIO bucket, run the same API on your own machines, or self-host the control plane entirely. Billing is per second with $0 egress, and new accounts start with 500 free credits. The SDK installs with npm, the CLI is createos sandbox, and an MCP server ships alongside. The product docs cover the quickstart and full API; the Sandbox product page has the rest.

The CreateOS platform: governance from proof of concept to production

The platform is the governed layer under the agents an enterprise already built. Deploy, isolate, monitor, audit, and bill from one surface instead of stitching together four or five vendors.

Governance is enforced in the architecture. Each agent is an identifiable principal with frozen permissions: a locked list of allowed actions a vendor cannot silently extend. An agent can pause mid-task to ask a person for approval. Every run carries hard limits on steps, tokens, time, and tool calls. Guardrails fail closed: no guardrail, no answer. The audit log is immutable, append-only, and exportable. Tenant isolation is structural, not a setting.

Operations run through one gateway to every model, including OpenAI, Anthropic, AWS Bedrock, and OpenRouter, so you can switch providers without re-platforming. Traces and usage dashboards are live, with billing and metering native to the deploy surface. Existing agents connect to the same gateway and gain the same guardrails and audit without a rebuild. Data retention defaults to zero. Deployment runs in CreateOS cloud, your VPC, or fully on-premise. SOC 2 Type II and ISO 27001 reports are available under NDA for the enterprise platform.

What Is Actually Proven

The numbers, with their sources:

2.6 million sandboxes created since June 2026. CreateOS's own CI has run on Sandbox since July 2026.
99%+ uptime on infrastructure operated since December 2023.
A $5M seed round closed in May 2024, and Product Hunt's #1 product of the day on 4 February 2026.
A cotton-processing manufacturer with eighty facilities went from kickoff to production in 75 days. The customer is unnamed by policy.
A live healthcare customer runs on the platform today, a regulated profile, also unnamed by policy.

What is young, said plainly: Sandbox is a young product, and its compliance certifications are roadmap items, not shipped certs. The enterprise platform carries SOC 2 Type II and ISO 27001, with reports under NDA. The distinction matters when a security review asks.

What to Weigh Before You Buy

The egress default. Outbound access is open until you set a rule. Set the allowlist at create time and the locked-down network you assumed is what you get.
No GPU sandboxes. If your workload needs them, look elsewhere for that part.
The platform is opinionated: one governed path, not a toolbox of parts. Teams that want to assemble their own stack will feel the rails.
Full air-gap deployment is not available today.
Compare before you commit. The alternatives page sets out the comparisons, and Sandbox pricing is published, per second, with $0 egress.

Frequently Asked Questions

What does CreateOS actually do?

It runs AI agents and the code they write. CreateOS Sandbox gives untrusted or agent-written code its own Firecracker microVM with host-enforced network controls. The CreateOS platform deploys and governs agents inside a company's own cloud or data centre, with an audit trail of what each agent did.

Is CreateOS Sandbox a container?

No. Every sandbox is a Firecracker microVM with its own guest kernel. A container shares the host kernel; a sandbox does not. That is why code inside cannot route around the egress rules enforced on the host.

Where does CreateOS run, your cloud or mine?

Both. The platform deploys in CreateOS cloud, a customer VPC, or fully on-premise, with zero data retention by default. Sandbox runs on our cloud or yours through bring-your-own compute, with your own S3, R2, or MinIO bucket for storage.

How much does CreateOS cost?

Sandbox bills per second with $0 egress, and new accounts start with 500 free credits. Shapes run from a quarter CPU up to 8 CPUs with 16 GB of RAM and 10 to 60 GB of disk. The enterprise platform is sold through a fixed-scope proof of concept, then a platform licence.

The Bottom Line

CreateOS is the layer that lets you say yes to agents: the machine for the code they write, and the governance for what they do. One company runs both, on production infrastructure operated since December 2023, with 2.6 million sandboxes to point at.

If your agents write code, stop putting it on a shared box. Start free with 500 credits and run the first sandbox today. If your enterprise agent effort is stuck at security review, deployment boundary, or accountability, bring that stuck pilot to createos.sh and put one governed agent into production.

About CreateOS

CreateOS runs AI agents and the code they write. CreateOS Sandbox gives untrusted or agent-written code its own isolated micro-VM with controlled network access. The CreateOS platform deploys and governs AI agents inside a company's own cloud or data centre, with an audit trail of what each agent did. Start at createos.sh.