CreateOS Sandbox vs Tinfoil
Pick Tinfoil when you must prove to users that neither you nor the host can read their data: its enclaves support remote attestation, and it offers confidential GPUs. Pick CreateOS Sandbox when you need many short-lived machines for agent code, billed per second, with pause and fork and no GPU requirement. Tinfoil optimises for verifiable confidentiality; CreateOS for disposable execution.
Pricing at a Glance
CreateOS rates verified 17 October 2026. Tinfoil pricing as published on 17 October 2026. Rates billed per GB rather than per GiB, or as bundled sizes, are quoted as published rather than converted.
CreateOS Sandbox
- Compute
- $0.0362 /vCPU-hr
- Memory
- $0.0116 /GiB-hr
Tinfoil
Tinfoil Chat is $20/month and the API bills per token; Containers bill hourly for CPU, memory and GPU with no shorter intervals, GPUs need a monthly commitment, and hourly container rates are not listed, as of 17 October 2026.
Where CreateOS Sandbox Fits Better
What CreateOS Sandbox brings to this matchup, with a plain note on where Tinfoil has the edge.
Per-second billing with published rates; Tinfoil bills containers by the hour and does not list hourly rates.
Pause keeps memory state and allows fork. Stopping a Tinfoil container loses in-memory state.
Allowlist rules by wildcard, CIDR or IP as well as hostname; Tinfoil's allowlist is hostname-only, IPv4 only, with no wildcards.
Where Tinfoil is strong
Verifiable confidentiality. Users can check by remote attestation which image is running and that the operator cannot read memory, with AMD SEV or Intel TDX for CPU and NVIDIA confidential computing for GPU.
Which to Pick
Pick CreateOS Sandbox if
- You run many short agent tasks and want per-second billing
- You need to pause a session with memory intact and fork it
- You want wildcard or CIDR egress rules
Pick Tinfoil if
- You must prove to users that the operator cannot read their data
- You need confidential GPU inference
- Your containers deploy from a published, measured config
Head-to-Head Comparison
Every dimension side by side, checked on 17 October 2026 against each vendor's own docs and pricing pages. "Not published" means we could not find it on the vendor's pages, not that the feature is missing.
| Dimension | CreateOS Sandbox | Tinfoil |
|---|---|---|
| Built for | API-created sandboxes for agent-written and untrusted code | Confidential AI inference and privacy-sensitive apps in attested enclaves |
| Isolation | Firecracker micro-VM with its own guest kernel | Hardware confidential-computing enclave: AMD SEV or Intel TDX for CPU, NVIDIA confidential computing for GPU |
| Ephemeral per-run environments | Yes. Create a sandbox per task by API, SDK, CLI or MCP and destroy it after | Ephemeral filesystem lost on stop or update; deployments come from a published, measured config |
| Pause and resume | Yes. Saves disk, memory and CPU state; vCPU stops billing while paused, memory and storage still bill | No; stop does not keep in-memory state |
| Outbound network | Open with no rules; deny-by-default once any rule exists (host, IP, CIDR, wildcard), enforced on the host outside the VM | Closed by default; allowlist by hostname (IPv4 only, no wildcards) or open, with private ranges always blocked |
| Billing | Per second: $0.03616363/vCPU-hr, $0.01159025/GiB-hr, storage $0.0001584/GB-hr; no egress fees (50 GiB bandwidth budget per sandbox by default) | Hourly for CPU, memory and GPU; GPUs need a monthly commitment; hourly rates not listed |
| Run untrusted code | Yes, the core use case; each sandbox is its own micro-VM | Runs your own Docker containers in enclaves; up to 10 instances per organization by default |
Common Questions
Can users verify what Tinfoil is running?
Yes. Tinfoil uses remote attestation so a client can check which image runs inside the enclave and that memory is hidden from the host and from Tinfoil. CreateOS documents Firecracker micro-VM isolation with its own guest kernel per sandbox, not remote attestation.
Does Tinfoil block outbound traffic by default?
Yes. Tinfoil containers cannot reach the internet until you set a per-network policy: closed, an allowlist by hostname (IPv4, no wildcards) or open, with private ranges always blocked. CreateOS works the other way round: outbound is open until you add a rule, then everything unlisted is denied.
Does CreateOS Sandbox offer GPUs like Tinfoil?
No. CreateOS offers no GPU shapes. Tinfoil offers NVIDIA confidential-computing GPUs in gpus: 1 or gpus: 8 shapes, enabled per organization and sold with a monthly commitment.
Sources
Checked 17 October 2026.
See CreateOS Sandbox for yourself
Book a demo, or explore the Sandbox and its pricing.