CreateOS Sandbox

About CreateOS Sandbox

CreateOS Sandbox is a tool for spinning up hardware-isolated, kernel-level sandboxes for AI agents in about 30ms (p90). It gives each agent its own guest kernel with egress policy enforced via iptables and a transparent proxy, plus eBPF for cross‑tenant isolation. The alpha release includes a CLI, SDK, 51 real‑world examples, a Claude plugin, and an option to run sandboxes on your own infrastructure.

Review

CreateOS Sandbox addresses the need for fast, secure execution environments when AI agents run untrusted code. The kernel-level isolation and egress controls aim to prevent compromised processes from routing around policy. This review examines the features, current limitations, and who the tool suits best based on the alpha release.

Key Features

• eBPF‑based egress control - Egress rules can be defined by hostname, IP, or CIDR. Domain‑based rules on ports 80/443 use a transparent proxy that reads SNI or Host headers, while IP/CIDR rules are enforced through per‑VM iptables chains. eBPF handles cross‑tenant VM‑to‑VM isolation and bandwidth metering.
• Fork and snapshot - A running sandbox can be snapshotted and cloned in milliseconds. The forked sandbox inherits the parent's egress policy automatically.
• Encrypted peer‑to‑peer mesh networking - Sandboxes can communicate over an encrypted mesh, with an optional VPN connection back to your local machine.
• BYO‑S3 and BYO‑Infra - Mount any S3‑compatible service as a shared disk across sandboxes, and run sandboxes on your own hardware. A self‑hosted GitHub Actions integration is also available.
• CLI, SDK, and Claude plugin - The CLI (`createos sandbox create`) provisions projects with credentials written to `.env`. The SDK includes pause, resume, snapshot, and fork primitives. The Claude plugin lets Claude run code in a sandbox that self‑destructs when idle.

Pricing and Value

The alpha release offers 500 free credits with no credit card required. No other pricing tiers have been announced, and the cost model after the alpha period is not yet defined.

Pros

• Spin‑up times around 30ms p90 for hardware‑isolated environments, using a warm pool of pre‑booted micro‑VMs.
• Egress policy is enforced outside the guest kernel, so a compromised process cannot bypass rules by attacking the enforcement layer itself.
• Forking a sandbox clones the entire egress policy and state without needing to reapply rules.
• 51 SDK examples cover multi‑node clusters, batch inference, ffmpeg transcoding, and other real‑world patterns.
• Run on your own infrastructure or mount external S3 storage, avoiding lock‑in to a single cloud.

Cons

• Domain‑based egress rules for HTTP traffic do not enforce certificate validation. A compromised client can accept a self‑signed certificate and connect to an attacker‑controlled IP while still matching an allowed hostname via SNI, which limits the protection for plain HTTP workflows.
• No built‑in CLI command to compare filesystem or environment changes between two sandbox runs. Developers currently need to script their own diff workflow using the file API.
• The product is in alpha. Stability, documentation coverage, and production readiness may not yet meet the requirements of teams with strict uptime or compliance needs, and it is not well‑suited for environments where HTTP plaintext egress must be secured solely through domain rules.

CreateOS Sandbox fits teams building AI agents that need quick, kernel‑isolated sandboxes for running untrusted code, especially when they can rely on HTTPS for domain‑based egress or IP/CIDR rules. The alpha free credits and self‑hosted options lower the barrier to testing, but the lack of HTTP cert validation and state‑diff tooling may slow down iteration for some workflows. As the tool matures, it could become a practical choice for developers who want fine‑grained control over sandbox isolation without managing their own hypervisor layer.

Open 'CreateOS Sandbox' Website