CreateOS Sandbox vs Rivet
Pick Rivet agentOS if your agent's tool calls are scripting, file edits and API calls that do not need a real Linux kernel, and you want them in-process with deny-by-default permissions. Pick CreateOS Sandbox when the agent needs real Linux: apt, arbitrary binaries, Docker, Go or Rust toolchains, or a dev server.
Pricing at a Glance
CreateOS rates verified 17 October 2026. Rivet pricing as published on 17 October 2026. Rates billed per GB rather than per GiB, or as bundled sizes, are quoted as published rather than converted.
CreateOS Sandbox
Lower compute rate- Compute
- $0.0362 /vCPU-hr
- Memory
- $0.0116 /GiB-hr
Rivet
- Compute
- $0.1188 /vCPU-hr
- Memory
- $0.0104 /GiB-hr
Rivet Cloud bills active execution from $0.0000330 per vCPU-second and $0.0000029 per GiB-second, plus actor hours, state storage, reads, writes and egress at $0.15 per GB, as of 17 October 2026.
Where CreateOS Sandbox Fits Better
What CreateOS Sandbox brings to this matchup, with a plain note on where Rivet has the edge.
A Firecracker micro-VM with its own guest kernel, so apt, native binaries and the Go and Rust toolchains in devbox:1 work; agentOS has no real Linux kernel.
Up to 8 vCPU / 16 GB, against Rivet Cloud's 4 GiB memory ceiling.
Lower compute rate: $0.03616363 per vCPU-hour against Rivet's from $0.1188.
Where Rivet is strong
For agent tool calls that do not need a full Linux kernel, Rivet's agentOS gives you an in-process VM starting in about 6 ms (vendor-stated), deny-by-default permissions and host functions that keep credentials on the host, far cheaper and closer to your backend than a remote sandbox.
Which to Pick
Pick CreateOS Sandbox if
- The agent installs packages, builds native code or runs Docker.
- It needs a browser or a dev server, which Rivet itself sends to a full sandbox.
- It needs more than 4 GiB of memory.
Pick Rivet if
- Your agents are in TypeScript and their tools are scripts, file edits and API calls.
- You want the environment embedded in your Node.js backend as an Apache-2.0 library.
- You want deny-by-default permissions without a remote machine.
Head-to-Head Comparison
Every dimension side by side, checked on 17 October 2026 against each vendor's own docs and pricing pages. "Not published" means we could not find it on the vendor's pages, not that the feature is missing.
| Dimension | CreateOS Sandbox | Rivet |
|---|---|---|
| Isolation | Firecracker micro-VM with its own guest kernel, root filesystem and network identity | Virtual POSIX kernel; guest JavaScript in V8 and WASM/Python in managed executors behind a sidecar; not a hardware VM, in beta security review |
| Pause and resume | Saves disk, memory and CPU state; vCPU stops billing while paused, memory and storage still bill | In-memory root by default; opt-in durable root survives VM recreation |
| Fork | Fork a paused sandbox into many independent copies, each with its own id and IP | Not published for agentOS VMs |
| Outbound network default | Open with no rules; deny-by-default once any host, IP, CIDR or wildcard rule exists, enforced on the host outside the VM | Restricted to the sidecar's default allowlist; permissions deny-by-default |
| Inbound access | Closed by default; opt-in public HTTPS URL, plus API-authenticated shell and port tunnels | Hosted: expiring, revocable signed preview URLs per port; library VMs have none |
| Largest size | 8 vCPU / 16 GB on Enterprise (Pro 8 vCPU / 8 GB, Beginner 4 / 4, Free 1 / 1) | 0.08 to 8 vCPU (1 vCPU = half a physical core); memory 128 MiB to 4 GiB |
| Billing | Per second: $0.03616363/vCPU-hr, $0.01159025/GiB-hr, storage $0.0001584/GB-hr; no egress fees, 50 GiB bandwidth budget per sandbox | Per second active execution from $0.0000330/vCPU-s and $0.0000029/GiB-s, plus actor hours and egress |
| SDKs and interfaces | TypeScript, Go, Python, Rust, C#, Java (all but TypeScript pre-1.0), CLI, MCP, REST | TypeScript hosted client and library, HTTP, RivetKit, MCP; Sandbox Agent API |
| Self-host or BYOC | Enterprise only, onboarded by our team; not open source | agentOS open source under Apache-2.0; Rivet can be fully self-hosted or BYOC |
| GPU | No GPU shapes | No |
Common Questions
Does Rivet agentOS run a real Linux kernel?
No. agentOS is a virtual POSIX kernel with its own filesystem, process and socket tables, running JavaScript in V8 and WASM or Python in managed executors. It cannot run apt, arbitrary binaries, Docker or Go and Rust toolchains; CreateOS Sandbox runs a full guest kernel in a micro-VM.
When does Rivet recommend a full sandbox instead?
For browsers, native builds and dev servers, per Rivet's own docs. Its Sandbox Agent adapter runs Claude Code, Codex and other agents inside third-party sandboxes for those cases. CreateOS Sandbox's devbox:1 image already carries Docker and five coding agents.
Is outbound traffic open by default in Rivet agentOS?
No. agentOS restricts outbound traffic to the sidecar's default allowlist unless the network permission scope allows more. CreateOS Sandbox leaves outbound open until you add a rule, then denies everything not listed, enforced on the host.
Sources
Checked 17 October 2026.
See CreateOS Sandbox for yourself
Book a demo, or explore the Sandbox and its pricing.