Your AI agent is writing code nobody reviewed and running it on your machine. Most teams answer "where does it run" with a container and a hope. Introducing CreateOS Sandbox. Run code you cannot trust, with the networking, egress control, and self-hosting you need. 🧵

2/ Untrusted code is the new normal. Code-gen tools write scripts. Agents run them. The model is the only part everyone trusts, and it is the one part that already works. The open question is the computer underneath. What is that code actually running on?

3/ Start with the obvious one. Speed. A sandbox should spin up in seconds, not on a cold boot; you wait out. CreateOS Sandbox restores from a snapshot instead of booting from scratch, with a pre-warmed network pool and a locality cache doing the work.

4/ The speed feature that matters for agents is fork. Pause a sandbox, then fork it — you branch from the paused R2 snapshot bundle. Run N rollouts in parallel from the same point. Keep the winner. Throw the rest away. Pause when idle so you stop paying for compute.

5/ Now the part that decides whether you can actually run code you don't trust. Every CreateOS Sandbox gets its own guest kernel on a Firecracker micro-VM. The boundary is hardware, not a shared kernel with some namespace flags. Isolation by default, not a setting to remember.

6/ Isolation gets you a box. Governance decides what leaves it. No ingress by default. Egress is allowlist-only, enforced in the kernel with eBPF, so code inside the VM cannot route around it. Bandwidth quotas. Per-sandbox secrets. The code can run. It just cannot phone home.

7/ Here is the part almost nobody else does. Most sandboxes isolate one process and stop. CreateOS Sandbox gives you private overlay networks and private DNS across hosts. Sandboxes can talk to each other, on a network you define, default-deny to everything else.

8/ Which means you can run real systems, not just snippets. Stand up a real k3s or Nomad cluster across multiple nodes, inside isolation. When you want a way in, you ask for it: explicit port-forward, a preview URL, or SSH. Isolated by default. Reachable on request.

9/ Isolation alone is table stakes now. Plenty of sandboxes have it. The combination is the part that is hard to assemble: → per-VM kernel isolation → networking between sandboxes → kernel-level egress you can prove → self-host the whole thing. That is the moat.

10/ Cost, plainly. Pricing: The model is straightforward: compute-based rates, $0 egress, and an undercut of 20–40% in comparison to our competitors. You scale on concurrency, not unit price.

11/ For the teams whose security review is the actual blocker: You can self-host the whole thing. Control plane and storage, in your own cloud. Your data never leaves your boundary. For a lot of regulated teams, that is the difference between yes and no.

12/ If you have agent or AI-generated code you would not run on bare infrastructure, this is the thing to point it at. 500 free credits to start. Run something you don't trust and see.

13/ Try your sandbox now:

🔥🔥

🙏🏼🙏🏼, do try it out and let us know about your feedback ser

trying soon

Sure, let us know about your feedback ser

congrats on launch! howerver, first questions - really cool video, who's the author?

thanks @olegakbarov 🙏🏼 kudos to the design team we have 😉

🔥

🙏

eBPF egress allowlists are the real containment layer: agents can execute, call APIs and write files—but only to approved destinations. Pair that with fork-from-snapshot parallel rollouts: pause, branch N times, keep the winner. That’s proper RL infrastructure.

Deslist???? Why???