CreateOS Sandbox

Instant, hardware Isolated Sandboxes for AI agents

SaaS

Developer Tools

Artificial Intelligence

GitHub

Visit WebsiteSee on Product HuntGithub ⧉Twitter ⧉

hardware isolated sandboxes is the missing peice for agents 👏 30ms is wild

@pratikbin — the property that actually matters here, and that most "sandbox" pitches quietly skip: egress enforced from outside the guest, so even fully compromised code can't reroute around its own policy.

We run agent workloads behind a per-tenant egress layer ourselves, and "the thing being restricted is also the thing enforcing the restriction" is the failure mode you spend forever designing out. Appreciated that the thread was precise about where that actually lives — iptables plus an out-of-guest SNI proxy for domain rules, eBPF for the cross-tenant mesh — instead of hand-waving "kernel magic."

Fork-clone-in-milliseconds with the policy attached before the sandbox is even reachable, plus BYO-Infra, is the combo that makes this usable for real fleets rather than a demo. Nice work.

the 30ms p90 spin-up claim is what stands out to me here, and also what I'd want to poke at first. a full guest kernel per sandbox usually means real VM boot overhead, so is the speed coming from keeping a pool of pre-booted kernels warm and just attaching workloads to them, or is there something about the fork/snapshot approach that makes cold starts basically free? and if it's the snapshot route, does a forked sandbox inherit the parent's eBPF egress rules automatically or do you have to reapply the policy each time?

30ms p90 for hardware-isolated spin-up is a serious number — most sandbox stacks I've tried are an order of magnitude slower, and it changes what you can do per-task vs per-session. Curious about the lifecycle model: when an agent needs state to persist across runs (a working directory it comes back to tomorrow), do you snapshot/restore, or is the intended pattern ephemeral-always with external storage? Building long-running agents, that's the decision that shapes everything downstream.

i run coding agents most of the day and the thing that always makes me nervous is what they can touch. hardware isolation with egress enforced inside the sandbox feels like the right way round. does the 30ms spin up hold once you're pulling real dependencies in, or is that a bare box number?

A native MCP server for the sandbox so agents can spin up isolated environments on the fly without bolting on extra glue code. Would make the CLI and SDK even more plug and play for Claude and other MCP clients.

The 30ms cold start is genuinely impressive for hardware isolation, basically unheard of in that category. Loving that you threw in the Claude plugins and SDK examples right out of the gate too, makes it way less of a chore to actually try it.

The 30ms cold start actually held up when I spun up a few sandboxes back to back, no weird warm-up lag. Loved having the SDK examples handy instead of digging through docs.

The 30ms cold start actually held up in my testing, which is wild for hardware isolated sandboxes. The claude plugin integration made spinning up agents feel almost frictionless.

The 30ms cold start is genuinely impressive for hardware isolated sandboxes. Whoever tuned that cold boot path clearly obsessed over it.

The ~30ms cold start is genuinely impressive, especially for agent loops where latency compounds. One thing that would save me a lot of time: a local dev mode that spins up a fake sandbox emulator so I can iterate on agent logic and exception handling without burning real compute credits during testing.

The 30ms cold start is genuinely impressive, especially the p90 timing. One thing that would help me as a builder is a built-in state diff or snapshot viewer in the CLI. Being able to compare filesystem and env changes between two sandbox runs without having to write custom diff scripts would make iterating on agent behavior much faster. Maybe something like `sandbox diff run-123 run-124` that outputs a clean summary.

Super useful for a whole host of scenarios!

Curious if you plan to give more integration options for the plug-n-play style agents? Looks like currently we just would connect / control with Telegram?

Spun up a sandbox in around 30ms like they claim, the CLI felt snappy and the SDK examples actually made sense for once.

A built-in cost dashboard would be super helpful, especially showing compute time per sandbox session and monthly burn. With cold starts at 30ms there's a real risk of accidentally spinning up thousands of sandboxes during testing, and right now there's no easy way to see what's running or set spend alerts.

Spun up a sandbox in about 30 seconds and the hardware isolation gave me real peace of mind for running untrusted agent code. The CLI felt snappy and the SDK examples made it easy to wire into my existing flow without much fuss.

Hardware-isolated sandboxes are a strong direction for agent work. The practical question I always look for is whether the environment makes rollback, artifacts, network access, and final-state evidence obvious enough that a small team can trust the result without babysitting it.

30ms startup is great, but for agent workloads I'd also want a teardown receipt: which egress rules fired, what credentials were present, and whether the writable layer was actually destroyed. Is that available per sandbox today?

As AI agents become more autonomous, we kept running into the same problem: how do you let them execute arbitrary code without putting the rest of your infrastructure at risk? We built CreateOS Sandbox to answer that. Every agent gets its own isolated environment with a dedicated guest kernel, and network access is enforced externally through eBPF, so the policy still holds even if the code inside the sandbox is fully compromised.

Beyond isolation, we focused on making it practical for real workloads. You can fork running sandboxes in milliseconds, mount your own S3-compatible storage across environments, connect securely through encrypted networking, or even run everything on your own infrastructure if that's what your deployment requires.