CreateOS Sandbox vs Heroku
Heroku remains a sound home for conventional web apps that value git-push deploys, a large add-on marketplace and compliance coverage on Shield. For per-task agent environments, CreateOS Sandbox fits better: a micro-VM keeps its disk until you destroy it, can pause with memory intact and can be forked. Heroku has run a sustaining-engineering model since February 2026, which matters for long-term plans.
Heroku moved to a sustaining-engineering model in February 2026 and no longer sells Enterprise Account contracts to new customers; it says it remains actively supported.
Pricing at a Glance
CreateOS rates verified 17 October 2026. Heroku pricing as published on 17 October 2026. Rates billed per GB rather than per GiB, or as bundled sizes, are quoted as published rather than converted.
CreateOS Sandbox
- Compute
- $0.0362 /vCPU-hr
- Memory
- $0.0116 /GiB-hr
Heroku
Heroku dynos are priced per month and prorated to the second: Eco $5 flat, Basic $7, Standard-1X $25, up to Performance-2XL $1,500; Fir dynos range from $25 to $2,400 per month, as of 17 October 2026.
Where CreateOS Sandbox Fits Better
What CreateOS Sandbox brings to this matchup, with a plain note on where Heroku has the edge.
No forced restarts. Heroku restarts dynos at least every 24 hours and discards their filesystem writes.
Snapshot and branch: pause a sandbox with disk, memory and CPU state, then fork it. Heroku offers no snapshot or pause and resume.
Egress allowlists per sandbox, enforced on the host; Heroku does not publish an egress default for the Common Runtime.
Where Heroku is strong
A mature, simple deploy model with a large add-on marketplace, Salesforce integration and broad compliance coverage (PCI DSS Level 1, HIPAA, ISO 27001, SOC 1/2/3) on Shield Private Spaces (vendor-stated).
Which to Pick
Pick CreateOS Sandbox if
- An agent session must keep files for longer than a day
- You want to snapshot a session and branch it
- You need a disposable machine per task created by API
Pick Heroku if
- You run a conventional web app and want git-push deploys
- You need PCI or HIPAA coverage through Shield Private Spaces
- Your stack depends on Heroku add-ons or Salesforce
Head-to-Head Comparison
Every dimension side by side, checked on 17 October 2026 against each vendor's own docs and pricing pages. "Not published" means we could not find it on the vendor's pages, not that the feature is missing.
| Dimension | CreateOS Sandbox | Heroku |
|---|---|---|
| Built for | API-created sandboxes for agent-written and untrusted code | Web apps, workers and managed Postgres/Key-Value with git-push deploys |
| Isolation | Firecracker micro-VM with its own guest kernel | Container (dynos); Private Spaces and Shield add dedicated compute and network isolation |
| Ephemeral per-run environments | Yes. Create a sandbox per task by API, SDK, CLI or MCP and destroy it after | One-off dynos via heroku run; all filesystem writes discarded on stop or restart |
| Pause and resume | Yes. Saves disk, memory and CPU state; vCPU stops billing while paused, memory and storage still bill | No snapshot or pause and resume; Eco dynos sleep after 30 minutes idle |
| Outbound network | Open with no rules; deny-by-default once any rule exists (host, IP, CIDR, wildcard), enforced on the host outside the VM | Not published for the Common Runtime; Private Spaces provide network isolation |
| Billing | Per second: $0.03616363/vCPU-hr, $0.01159025/GiB-hr, storage $0.0001584/GB-hr; no egress fees (50 GiB bandwidth budget per sandbox by default) | Monthly per dyno, prorated to the second |
| Run untrusted code | Yes, the core use case; each sandbox is its own micro-VM | Not published as a use case; dynos restart at least every 24 hours |
Common Questions
Is Heroku shutting down?
No. Heroku says it remains actively supported and that credit-card customers are unaffected. Since 6 February 2026 it has run a sustaining-engineering model and no longer sells Enterprise Account contracts to new customers, which matters if you plan a long-term enterprise commitment.
How long can a one-off Heroku dyno run?
About 24 hours at most. Heroku restarts dynos at least once every 24 hours, plus up to 216 random minutes, and Fir apps can opt out. A CreateOS sandbox has no lifetime cap, and idle auto-pause stays off unless you set it.
Which compliance certifications do Heroku and CreateOS hold?
Heroku lists PCI DSS Level 1, HIPAA, ISO 27001/27017/27018 and SOC 1/2/3, with scope varying by product and HIPAA and PCI on Shield. CreateOS is SOC 2 Type II and ISO 27001 certified, with reports available under NDA.
Sources
Checked 17 October 2026.
See CreateOS Sandbox for yourself
Book a demo, or explore the Sandbox and its pricing.