CreateOS Sandbox vs Alibaba Cloud ACK
ACK is the right platform if you already run Kubernetes and want long-lived services or AI workloads in Alibaba Cloud regions, particularly mainland China. CreateOS Sandbox is the right tool if you want an isolated micro-VM per task from one API, without running clusters, node pools or bare-metal nodes. Alibaba also sells a separate ACS Agent Sandbox in public preview, which this page does not compare.
Pricing at a Glance
CreateOS rates verified 17 October 2026. Alibaba Cloud ACK pricing as published on 17 October 2026. Rates billed per GB rather than per GiB, or as bundled sizes, are quoted as published rather than converted.
CreateOS Sandbox
- Compute
- $0.0362 /vCPU-hr
- Memory
- $0.0116 /GiB-hr
Alibaba Cloud ACK
Alibaba lists ACK managed Pro at USD 0.09 per cluster per hour pay-as-you-go and ACK managed Basic with no cluster fee, with worker nodes billed separately as ECS instances, as of 17 October 2026.
Where CreateOS Sandbox Fits Better
What CreateOS Sandbox brings to this matchup, with a plain note on where Alibaba Cloud ACK has the edge.
No cluster to run: sandboxes come from an API call, while ACK needs clusters and node pools you manage.
VM isolation per sandbox by default; on ACK the VM-isolated runV runtime needs ECS Bare Metal nodes, and the default runC containers share the host kernel.
Pause and resume with memory, which ACK does not document for pods.
Where Alibaba Cloud ACK is strong
A full managed Kubernetes platform in Alibaba Cloud regions, with central GPU scheduling and an optional per-pod VM-isolated runtime, for teams that already operate Kubernetes.
Which to Pick
Pick CreateOS Sandbox if
- You want sandboxes without operating a cluster.
- You want VM isolation per task without buying bare-metal nodes.
- You need pause, resume and fork for agent sessions.
Pick Alibaba Cloud ACK if
- You already run Kubernetes and want it managed in Alibaba Cloud.
- You serve users in mainland China.
- You need GPU scheduling across ECS GPU instance families.
Head-to-Head Comparison
Every dimension side by side, checked on 17 October 2026 against each vendor's own docs and pricing pages. "Not published" means we could not find it on the vendor's pages, not that the feature is missing.
| Dimension | CreateOS Sandbox | Alibaba Cloud ACK |
|---|---|---|
| Isolation | Firecracker micro-VM with its own guest kernel | Default runC containers on ECS VMs; optional runV pods with their own kernel on ECS Bare Metal |
| Create and destroy by API | Yes: REST API, CLI, MCP server and SDKs for TypeScript, Go, Python, Rust, C# and Java (all but TypeScript pre-1.0) | Kubernetes API, Alibaba Cloud APIs, SDKs, CLI and Terraform (vendor-stated) |
| Memory snapshot (pause and resume) | Yes: disk, memory and CPU state saved; vCPU stops billing, memory and storage still bill | Not documented for pods |
| Fork | Yes: fork a paused sandbox into many independent sandboxes | Not published |
| Outbound network controls | Open with no rules; deny-by-default once any host, IP, CIDR or wildcard rule exists, enforced on the host outside the VM | No single default published; depends on VPC setup (e.g. NAT gateway) and network policies |
| Billing granularity | Per second while running: $0.03616363/vCPU-hr, $0.01159025/GiB-hr, storage $0.0001584/GB-hr | Hourly cluster fee (Pro) plus ECS resources |
| Largest size | 8 vCPU / 16 GB on Enterprise; 8 vCPU / 8 GB on Pro | Bounded by the ECS instance type chosen; no per-pod maximum published |
| GPU | None; no GPU shapes | Yes, via ECS GPU instance families |
Common Questions
Does ACK isolate pods in their own virtual machines?
Only with the optional Sandboxed-Container runtime (runV), which gives each pod a lightweight VM with its own kernel and requires ECS Bare Metal nodes. The default runC runtime shares the host kernel. Every CreateOS sandbox is a Firecracker micro-VM with its own guest kernel.
What does ACK cost on top of the worker nodes?
ACK managed Pro adds USD 0.09 per cluster per hour, and ACK managed Basic has no cluster fee; worker nodes are billed as ECS instances either way. CreateOS has no cluster fee: you pay per second for each sandbox's vCPU, memory and storage.
Is Alibaba's ACS Agent Sandbox part of ACK?
Alibaba's ACS Agent Sandbox page does not say it runs from ACK clusters, so this page treats it as a separate product. It is in public preview with MicroVM isolation and hibernate with memory preserved (vendor-stated). The comparison here covers ACK itself.
Sources
Checked 17 October 2026.
- Alibaba Cloud ACK: overview, cluster types, GPU, APIs
- Alibaba Cloud ACK: pricing
- Alibaba Cloud ACK: isolation, runV overhead
- Alibaba Cloud ACK: sandboxed runtime requirements (bare metal, K8s 1.16-1.34)
- Alibaba Cloud ACK: related ACS Agent Sandbox (notes)
- CreateOS sandbox security
- CreateOS pause, resume and fork
- CreateOS Sandbox pricing
See CreateOS Sandbox for yourself
Book a demo, or explore the Sandbox and its pricing.