Skip to content
INDEPENDENT CONCEPTNOT AN OFFICIAL CREATEOS PAGENO ENDORSEMENT IMPLIED
CreateOS/ SANDBOXGrab 500 credits

Firecracker micro-VMs for AI agents

Give every agent
a computer of its own.

Run untrusted or model-generated code inside a Firecracker micro-VM with its own kernel, governed egress and a lifecycle built for agent work.

Grab 500 free credits Inspect the boundary
DRIVE IT FROMTypeScript SDKCLIMCP
SANDBOX RUNNINGEU / USA
MICROVM / SBX-7F31OWN KERNEL
$ sandbox.runCommand("node")› isolated guest ready› executing model-generated code✓ stdout: v20.x.x_
KERNELguest linuxFILESYSTEMisolatedSTATEpreserved
EGRESS ALLOWLIST
INGRESS BLOCKED
HOST NOT VISIBLE
FIRECRACKER BOUNDARYTEAR DOWN ↗
OWN KERNEL per workloadPRIVATE NETWORK between sandboxesPAUSE TO ZERO with state$0 EGRESS unmetered networking

A real machine boundary

Not a shared kernel you hope holds.

Each workload gets a Firecracker micro-VM with its own guest kernel. Code inside one sandbox cannot see the host or another tenant.

CREATEOS REGIONISOLATED REGION
SANDBOX AFirecracker micro-VM
OWN KERNELISOLATED FS
SANDBOX BFirecracker micro-VM
OWN KERNELISOLATED FS
PRIVATE OVERLAY NETWORK
→ Outbound only× No ingress↘ Disk sync to your bucket

One tool call at a time

Spawn. Run. Release.

The lifecycle maps directly to how an agent works: provision a machine, execute the task, then destroy or preserve it.

  1. SPAWN
    createSandbox()

    Provision the boundary

    Choose a compute shape and root filesystem. The workload receives its own micro-VM.

    01
  2. RUN
    runCommand()

    Execute inside it

    Drive the task from TypeScript, the CLI or MCP and read the result from the guest.

    02
  3. RELEASE
    destroy() / pause()

    End compute cleanly

    Tear it down when finished, or snapshot the working state for the agent’s next step.

    03

State survives the idle gap

Pause the bill.
Keep the machine.

Pausing serializes guest memory and device state to disk, stops compute billing and restores the same working session into a fresh micro-VM when the agent returns.

AGENT RUN / CHECKPOINT 04PAUSED
LIVE MICROVM→STATE SNAPSHOT
MEMORYpreservedPROCESSpreservedCOMPUTE$0 while paused
RESUME IN PLACEOR FORK STATEBRANCH ABRANCH B
ALPHA / HONEST BOUNDARY

Real architecture. Clear stage.

CreateOS Sandbox publicly identifies the product as alpha. Audit logging, RBAC and major compliance certifications are on the roadmap—not claimed as already held.

For teams that need sovereignty now, the documented interim control is self-hosting the control plane and storage inside their own boundary.

Your agent writes the code

Give it somewhere safe to run.

Start with free credits, provision one micro-VM and inspect the boundary from the first command.

Spin up a sandbox