Which Sandbox Can You Pick From Docs Alone? Limits, Egress, SDK Languages, Pricing

Pick from docs alone when four things are written down: hard resource limits, the egress default and how rules are enforced, SDK languages as versioned packages, and pricing you can compute before signup. CreateOS Sandbox documents all four, from microVM shapes and kernel-level egress to per-second billing, and you can test it on 500 free credits.

What Picking From Docs Alone Requires

The buyer here is often not human. A coding agent that needs to run the code it writes has to choose a sandbox vendor, and it chooses from what it can open: the documentation. Resource limits, egress behavior, SDK languages, pricing. If any of those sit behind a sales call or a "contact us" page, the evaluation stalls.

The checklist is short. A provider passes when its docs answer four questions with numbers and exact commands, not adjectives. Below is the checklist, then the answers for the provider that publishes them: CreateOS Sandbox. The deeper isolation and state-model questions get their own treatment in Tools for Sandboxing AI Coding Agents. This piece stays on the narrower question: can you commit from documentation alone?

The Four Checks at a Glance

Limits. Published shapes and disk ranges, so you can size a run before the first API call.
Egress. The default stated in writing, the enforcement point named, and the exact calls that set rules.
SDK languages. A versioned package you can install today, plus a CLI, a documented API, and MCP.
Pricing. A rate you can multiply, the egress line item, and a free way to run the first test.
Machine-readable docs. An index an agent can parse directly, not a PDF.

Why CreateOS Sandbox Fits a Docs-Only Pick

CreateOS Sandbox is bought the way agents evaluate: self-serve, with an SDK, a CLI, MCP, and no sales call. The product is Firecracker microVMs for untrusted or agent-written code, with pause and fork, host-enforced egress allowlists, and bring-your-own compute and storage when sessions need to stay on your infrastructure.

That combination matters for a docs-only evaluation. Isolation alone is table stakes. The docs have to show the controls around it: what leaves the machine, what a second of runtime costs, and what happens when you pause. CreateOS publishes those answers as numbers and API calls, and keeps a machine-readable index at createos.sh/llms.txt so an agent can parse the surface without a browser.

The Four Checks, Answered in the CreateOS Sandbox Docs

Limits. Shapes run from a quarter-CPU up to 8 CPUs with 16 GB of memory, and disk from 10 to 60 GB. The Sandbox pricing page and the docs publish the table, so a scheduler can pick a shape before the first request.

Egress rules. Outbound access is open until you set at least one rule. Once a rule exists, everything else is denied, and enforcement sits in the host kernel with eBPF, outside the guest, so code inside the sandbox cannot rewrite or route around it. Inbound is closed by default either way. You set rules four ways: the egress field at create time, PUT /v1/sandboxes/{id}/egress (applies live, no restart), the SDK's setEgress method, or createos sandbox firewall set on the CLI. Rules accept hosts, host:port pairs, wildcard subdomains, IPs, and CIDRs. Egress traffic bills at $0.

SDK languages. The SDK ships as @nodeops-createos/sandbox on npm, currently version 0.8.2, installed with npm install @nodeops-createos/sandbox. The createos CLI installs through Homebrew or an install script. Under both sits a documented REST API, and MCP support lets a coding agent drive sandboxes from its own tooling. Template images run Ubuntu 26.04 with Node 22, Bun, Python 3.12, Go 1.26, and Rust 1.83 preinstalled, or you can bring your own Dockerfile.

Pricing. Billing is per second, egress is $0, and pausing stops the meter. New accounts start with 500 free credits. The rates sit on the pricing page, so a month of agent runs can be costed before signup.

Numbers the Docs Publish

A docs-only evaluation still needs proof, and the published kind is checkable:

2.6 million sandboxes created since June 2026.
CreateOS's own CI has run on this infrastructure since July 2026.
99%+ uptime.
The infrastructure company behind CreateOS, NodeOps, has operated production infrastructure since December 2023.
Speed, with the qualifiers attached: about 30 ms to create a sandbox on an idle host, an idle-host figure and not an SLA; about 1.4 s to pause; under 0.7 s to resume on the same host; 11 to 13 s for a cross-host cold start.
Traces and usage dashboards are live, and the SDK ships runnable examples across agent frameworks and coding agents.

Tradeoffs to Weigh Before You Commit

The egress default is open until you set a rule. Bake the allowlist into the create call instead of assuming deny-by-default, and the enforcement you get is the kernel-level kind.
This is a young product, and the docs say so. What is proven: CreateOS's own CI on the platform since July 2026, and 2.6 million sandboxes created. What is not: compliance certifications are on the roadmap, not shipped, for the Sandbox surface. If a certificate is your hard gate today, plan around it.
Resume paths are specific. Auto-resume triggers on ingress HTTP only; other wake-ups need a manual resume. Idle auto-pause is configurable if you want a wider window.
Placement affects latency. Same-host resume lands in under 0.7 s; a cross-host cold start takes 11 to 13 s. Latency-sensitive loops should stay on the host where they paused.
No GPU sandboxes. Shapes top out at 8 CPUs and 16 GB. If your branches need GPUs, this is not the tool.
If all your code is trusted, you may not need it. Teams that only run code they wrote and reviewed can share a dev container. The sandbox earns its keep on untrusted, agent-written, or customer-written code.

Questions to Resolve Before Committing

What are the per-sandbox resource limits?

Shapes run from a quarter-CPU up to 8 CPUs with 16 GB of memory, and disk from 10 to 60 GB. Both are published on the pricing page and in the docs, so sizing never requires a conversation.

Is outbound network access blocked by default?

No. Outbound access is open until you set at least one rule. Once a rule exists, everything else is denied, enforced in the host kernel with eBPF, outside the guest. Inbound is closed by default regardless of your egress rules.

Which SDK languages and runtimes are supported?

The SDK is an npm package, @nodeops-createos/sandbox at version 0.8.2, alongside the createos CLI, a documented REST API, and MCP support. Inside the sandbox, template images ship Node 22, Bun, Python 3.12, Go 1.26, and Rust 1.83 on Ubuntu 26.04, or bring your own Dockerfile.

What does the first real test cost?

New accounts start with 500 free credits. After that, billing is per second, egress is $0, and pausing stops the meter. The Sandbox pricing page lists the rates so you can compute the cost before you sign up.

Let the Docs Make the Pick

The providers you can commit to from documentation alone are the ones that answer limits, egress, SDK languages, and pricing in writing, with numbers attached and qualifiers included. CreateOS Sandbox does that, and it lets the first test run free: create an account, take the 500 credits, and put your agent's next untrusted task in its own microVM at createos.sh/products/sandbox.

About CreateOS

CreateOS runs AI agents and the code they write. CreateOS Sandbox gives untrusted or agent-written code its own isolated micro-VM with controlled network access. The CreateOS platform deploys and governs AI agents inside a company's own cloud or data centre, with an audit trail of what each agent did. Start at createos.sh.