Give every agent its own computer.
CreateOS Sandbox runs each workload in a Firecracker micro-VM with its own kernel. Connect sandboxes over a private network, pause to zero with state preserved, and never pay an egress fee.
const sandbox = await client.createSandbox({
shape: "s-4vcpu-4gb",
rootfs: "devbox:1",
});
await sandbox.runCommand("node", ["--version"]);▍→stdoutv20.x.x
Spin up a Sandbox in Seconds.
Install the SDK, then drive sandboxes from TypeScript, the CLI, or MCP, so an agent can provision its own compute through a tool call. Spawn it, run a command, read the output, tear it down.
npm install @nodeops-createos/sandbox
# or: bun add @nodeops-createos/sandboximport { CreateosSandboxClient } from "@nodeops-createos/sandbox";
// baseUrl from CREATEOS_SANDBOX_BASE_URL, apiKey from CREATEOS_SANDBOX_API_KEY
const client = new CreateosSandboxClient();
const sandbox = await client.createSandbox({
shape: "s-4vcpu-4gb",
rootfs: "devbox:1",
});
try {
const { result } = await sandbox.runCommand("node", ["--version"]);
console.log(result.stdout); // "v20.x.x"
} finally {
// sandboxes bill while running, so always tear down
await sandbox.destroy();
}A Real Machine Boundary, Not a Shared Kernel.
Every sandbox is a Firecracker micro-VM running its own Linux kernel. That is the gating difference: the isolation is at the level of the machine, not a process namespace you hope holds.
Its own kernel
Every sandbox is a Firecracker micro-VM running its own Linux kernel. There is no shared kernel to escape, so the boundary is the hardware-level isolation a real machine gives you.
Blind to everything else
Code inside one sandbox cannot see the host or any other tenant. Run untrusted or model-generated code without exposing your infrastructure.
Contained by default
A guest kernel compromise stays inside that one micro-VM. It does not spread to the host or to the rest of your fleet.
How the Sandbox is Built
Each sandbox runs in a Firecracker micro-VM with its own kernel. Sandboxes connect to each other over a private network. Egress goes outbound only, and the disk syncs to the object storage you control.
Network egress
Pause to Zero, Resume in Place.
A paused sandbox is a Firecracker snapshot on disk: guest memory and device state are frozen, and compute billing stops. Resuming restores that exact state into a new micro-VM instead of cold-booting, so a multi-step agent run survives idle gaps without losing its place.
Pause is a snapshot, not a shutdown
Pausing serializes the full guest state, the RAM, the vCPU registers, and the device state, to a Firecracker snapshot on disk, then stops the VM. Compute billing drops to zero while it is paused.
Resume restores state, not a reboot
Resuming maps the snapshot back into a fresh micro-VM. Processes, open file descriptors, and memory come back exactly as they were, so the agent continues mid-task with no cold boot and no setup to re-run.
Auto-pause on idle
Set an inactivity timeout and the sandbox snapshots itself when no command is running. Idle agents hold their state without holding a compute bill.
Templates are pre-baked rootfs
Save a configured sandbox, its root filesystem and installed dependencies, as a template, then launch identical environments from it in a single call. No reprovisioning per run.
// Snapshot and suspend. Compute billing stops here.
await sandbox.pause();
await sandbox.waitUntilPaused();
sandbox.status; // "paused"
// Later: restore that exact machine, not a reboot.
await sandbox.resume();
await sandbox.waitUntilRunning();
// Or let the control plane do it on idle.
await sandbox.setAutoPause(300);Your Data, in Your Buckets.
Keep a run's output without copy steps, and keep it in storage you own. Moving data costs nothing extra.
Disk syncs automatically
The ephemeral disk syncs on its own, so a run's output is captured without manual copy steps.
Mount your own buckets
Mount your own Amazon S3, MinIO, or Cloudflare R2 as a filesystem. The data stays in storage you control.
No egress fees, ever
Move data in and out without per-gigabyte egress charges. What you read and write is yours to move freely.
Simple Per-Second Pricing.
Billed per second while a sandbox runs. No egress fees, no minimums, with our cost basis and margin published rather than asserted.
- Per vCPU-hour
- $0.03616363
- Per GiB-RAM-hour
- $0.01159025
- Per GB-hour, storage
- $0.0001584
- Egress, any volume
- $0
Work Out What Yours Would Cost.
Pick a shape and a monthly runtime. The rate is the one above, and the published cost basis behind it is the same one the pricing page shows.
Estimated cost
$43.87per month
Compute
720 vCPU-hours × $0.03616363
$26.04
Memory
1,440 GiB-hours × $0.01159025
$16.69
Storage
10 GB × 720 h × $0.0001584
$1.14
Egress
Unmetered, any volume
$0.00
Billed per second while running. Pause to stop paying for idle vCPU; memory and storage are still charged, with your state preserved. USD, no egress fees.
Grab 500 free creditsGo Deeper
The capabilities that make CreateOS Sandbox the governed sandbox, each in depth.
Networking between sandboxes
Private overlay networks and multi-node clusters inside isolation.
Learn moreEgress you can prove
Kernel-enforced allowlist, no ingress, containment you can demonstrate.
Learn moreSelf-host the whole thing
Run the control plane and storage in your own boundary.
Learn moreA safe computer for agents
Isolation, fork, networking, and pause mapped to how agents work.
Learn moreReliability and failure modes
What happens when untrusted code OOMs, loops, or tries to phone home.
Learn moreExamples
Runnable demos: agent code-exec, fork, multi-node, self-host, and more.
Learn moreCommon Questions
How isolated is each sandbox?
Each sandbox is a Firecracker micro-VM with its own kernel. Code cannot reach the host or other tenants, so you can run untrusted or AI-generated code safely.
Can sandboxes talk to each other?
Yes, over a private network, so you can build multi-agent systems where each agent runs in its own isolated sandbox and communicates directly, with no public exposure.
What happens when a sandbox is idle?
It auto-pauses with full state preserved, and resumes in place. A paused sandbox is still charged for memory and storage, but not for vCPU.
What is preinstalled, and where does it run?
The devbox:1 image is Ubuntu 24.04 with Python 3.12 and pandas, numpy, scipy, matplotlib, pyarrow, scikit-learn, openai, anthropic and langchain preinstalled, plus Node.js 24, Bun, Go 1.26, Rust and Docker, in EU or US regions. Bake a pinned set into a template built from a Dockerfile if you need one.
Can I use my own storage?
Yes. Mount your own Amazon S3, MinIO, or Cloudflare R2 as a filesystem; the disk syncs automatically.
How do I drive sandboxes?
A TypeScript SDK, the CLI, MCP, or the REST API from any language, so an agent can provision its own compute through a tool call. There is no Python SDK yet; from Python the integration is two REST calls, create and exec.
How many sandboxes can I run at once, and is there a maximum session length?
Concurrent sandboxes are capped by plan: 1 on Free, 5 on Beginner, 20 on Pro, 30 on Enterprise, with 10 / 50 / 200 / 300 sandboxes per day. GET /v1/whoami returns your running count against the cap; ten concurrent runs need Pro. There is no maximum session length: a sandbox runs until you destroy it, pause it, or it auto-pauses on idle.
What happens on timeout, and how do I clean up?
Nothing is destroyed on a timer. Auto-pause is off by default; set auto_pause_after_seconds (60 to 86,400) to snapshot full state after that long idle, with compute billing stopped until you resume. Cleanup is an explicit destroy call: for one-sandbox-per-run jobs, destroy in a finally block.
Is outbound network access open or closed by default?
Open with no rules, deny-by-default once any rule is set. Pass the allowlist at create time; rules take host, host:port, wildcard subdomains, IPs and CIDRs and are enforced in-kernel on the host, outside the VM. Inbound is closed unless you enable ingress.
Where can I safely run AI-generated code?
In CreateOS Sandbox. Each run gets its own Firecracker micro-VM with its own guest kernel, an egress allowlist enforced in the kernel via eBPF, and no ingress by default, so untrusted or model-generated code cannot reach your host, your network, or the open internet unless you allow it.
How do I restrict and prove what untrusted code can reach?
Egress is an allowlist with no ingress by default, enforced in the kernel via eBPF outside the VM. Code inside a sandbox cannot rewrite or route around it. You allow specific hosts, everything else is denied, and you can read exactly what was blocked.
Can I self-host the sandbox in my own cloud?
Yes. Run the control plane and storage in your own environment and bring your own object storage (S3, R2, Tigris, or MinIO), so code, snapshots, and data never leave your boundary. Regulated teams run it this way when code cannot leave their network.
How do I fork a running sandbox to branch agent state?
Pause the sandbox to snapshot its state, then fork it into as many branches as you want. Each fork carries the full memory and working state of the parent, so you can run parallel rollouts and keep the winner. Pause the branches you are not using to stop paying for them.
How does pricing work, and is egress free?
Per-second billing at $0.03616363 per vCPU-hour plus $0.01159025 per GiB-RAM-hour, and $0.0001584 per GB-hour of storage. Networking is unmetered, so egress is $0. Pause a sandbox and you stop paying for vCPU; memory and storage are still charged. New accounts start with 500 free credits.
Is CreateOS Sandbox production-ready?
Yes. CreateOS Sandbox is in production and running real workloads today. Per-VM guest kernel isolation, eBPF-enforced egress, sandbox-to-sandbox networking, pause and fork, and full self-host are all live. Run it in our EU and US regions, or entirely inside your own boundary.
Give your agents a computer of their own.
Grab 500 free credits and spin up your first sandbox, or book a design-partner call.