CreateOS Sandbox vs Red Hat OpenShift
OpenShift is the choice for large organisations that want to run sandboxed workloads on their own governed Kubernetes, on-premises or in any cloud. CreateOS Sandbox is the choice when you want a hosted sandbox API, billed per second, without running a cluster.
Pricing at a Glance
CreateOS rates verified 17 October 2026. Red Hat OpenShift pricing as published on 17 October 2026. Rates billed per GB rather than per GiB, or as bundled sizes, are quoted as published rather than converted.
CreateOS Sandbox
- Compute
- $0.0362 /vCPU-hr
- Memory
- $0.0116 /GiB-hr
Red Hat OpenShift
Red Hat says self-managed OpenShift pricing varies by sizing and subscription, while ROSA reserved instances start at $0.076 per hour (4 vCPU, 3-year contract, billed by AWS), as of 17 October 2026.
Where CreateOS Sandbox Fits Better
What CreateOS Sandbox brings to this matchup, with a plain note on where Red Hat OpenShift has the edge.
A hosted per-call sandbox API: no cluster, operators or worker nodes to run.
Public per-second rates with a Free plan, instead of subscription sizing.
Outbound rules travel with each sandbox and are enforced on the host; on OpenShift the Kata VM boundary itself does not filter traffic, so cluster network policy has to.
CreateOS is SOC 2 Type II and ISO 27001 certified, with reports available under NDA.
Where Red Hat OpenShift is strong
OpenShift is enterprise-grade Kubernetes that runs the same way on-premises and on every major cloud, with operator-managed Kata VM isolation for untrusted pods, GPU worker nodes, and a Technology Preview operator for VM-isolated AI-agent sandboxes.
Which to Pick
Pick CreateOS Sandbox if
- You want sandboxes today without operating Kubernetes.
- You want to pay per second for what runs.
- You want pause, resume and fork as API calls.
Pick Red Hat OpenShift if
- You must run sandboxed workloads on your own infrastructure or on-premises.
- You already operate OpenShift and want agent sandboxes on the same platform.
- You need GPU worker nodes next to your sandboxes.
Head-to-Head Comparison
Every dimension side by side, checked on 17 October 2026 against each vendor's own docs and pricing pages. "Not published" means we could not find it on the vendor's pages, not that the feature is missing.
| Dimension | CreateOS Sandbox | Red Hat OpenShift |
|---|---|---|
| Built for | Sandboxes created by API for agent and untrusted code | Running and governing containerised apps across hybrid and multi-cloud infrastructure |
| Isolation | Firecracker micro-VM with its own guest kernel | Containers by default; optional sandboxed containers run each pod in its own lightweight VM via Kata Containers |
| Ephemeral per-run environments | Yes: create a sandbox per run by API and destroy it after | Pods are ephemeral; scheduling is yours to configure |
| Pause and resume | Yes: pause saves disk, memory and CPU state; vCPU stops billing, memory and storage still bill | Not applicable at platform level |
| Outbound network | Open with no rules; deny-by-default once any host, IP, CIDR or wildcard rule exists, enforced on the host outside the VM | Network policies and egress controls set by the cluster operator; Kata boundary does not filter traffic |
| Billing | Per second: $0.03616363 per vCPU-hour, $0.01159025 per GiB-hour, storage $0.0001584 per GB-hour | Subscription (self-managed) or hourly via cloud marketplaces; ROSA from $0.076/hour reserved |
| Run untrusted code | Yes: each sandbox is its own micro-VM, with host-enforced outbound rules and inbound closed by default | Yes, with Kata sandboxed containers; agent sandbox operator is Technology Preview |
Common Questions
Does OpenShift isolate pods in VMs?
Optionally. OpenShift sandboxed containers run each pod in its own lightweight VM using Kata Containers, while ordinary pods are containers. Every CreateOS sandbox is a Firecracker micro-VM with its own guest kernel, root filesystem and network identity, with no option to turn that off.
Does the Kata VM boundary on OpenShift control egress?
No. Red Hat notes the Kata VM boundary does not filter network traffic or enforce egress policy, so you set that in cluster network policies. CreateOS egress rules are set per sandbox by API and enforced on the host outside the VM.
Can I try OpenShift for free?
Yes. Red Hat offers a free 30-day Developer Sandbox, trials of OpenShift Dedicated and self-managed OpenShift, and an 8-hour ROSA demo. CreateOS has a Free plan with no card required, 1 concurrent sandbox and 500 credits.
Sources
Checked 17 October 2026.
See CreateOS Sandbox for yourself
Book a demo, or explore the Sandbox and its pricing.