CreateOS Sandbox

i run coding agents most of the day and the thing that always makes me nervous is what they can touch. hardware isolation with egress enforced inside the sandbox feels like the right way round. does the 30ms spin up hold once you're pulling real dependencies in, or is that a bare box number?

A native MCP server for the sandbox so agents can spin up isolated environments on the fly without bolting on extra glue code. Would make the CLI and SDK even more plug and play for Claude and other MCP clients.

The 30ms cold start is genuinely impressive for hardware isolation, basically unheard of in that category. Loving that you threw in the Claude plugins and SDK examples right out of the gate too, makes it way less of a chore to actually try it.

The 30ms cold start actually held up when I spun up a few sandboxes back to back, no weird warm-up lag. Loved having the SDK examples handy instead of digging through docs.

The 30ms cold start actually held up in my testing, which is wild for hardware isolated sandboxes. The claude plugin integration made spinning up agents feel almost frictionless.

The 30ms cold start is genuinely impressive for hardware isolated sandboxes. Whoever tuned that cold boot path clearly obsessed over it.

The ~30ms cold start is genuinely impressive, especially for agent loops where latency compounds. One thing that would save me a lot of time: a local dev mode that spins up a fake sandbox emulator so I can iterate on agent logic and exception handling without burning real compute credits during testing.

The 30ms cold start is genuinely impressive, especially the p90 timing. One thing that would help me as a builder is a built-in state diff or snapshot viewer in the CLI. Being able to compare filesystem and env changes between two sandbox runs without having to write custom diff scripts would make iterating on agent behavior much faster. Maybe something like `sandbox diff run-123 run-124` that outputs a clean summary.

Super useful for a whole host of scenarios!Curious if you plan to give more integration options for the plug-n-play style agents? Looks like currently we just would connect / control with Telegram?

Hardware-isolated sandboxes are a strong direction for agent work. The practical question I always look for is whether the environment makes rollback, artifacts, network access, and final-state evidence obvious enough that a small team can trust the result without babysitting it.

30ms startup is great, but for agent workloads I'd also want a teardown receipt: which egress rules fired, what credentials were present, and whether the writable layer was actually destroyed. Is that available per sandbox today?

As AI agents become more autonomous, we kept running into the same problem: how do you let them execute arbitrary code without putting the rest of your infrastructure at risk? We built CreateOS Sandbox to answer that. Every agent gets its own isolated environment with a dedicated guest kernel, and network access is enforced externally through eBPF, so the policy still holds even if the code inside the sandbox is fully compromised.Beyond isolation, we focused on making it practical for real workloads. You can fork running sandboxes in milliseconds, mount your own S3-compatible storage across environments, connect securely through encrypted networking, or even run everything on your own infrastructure if that's what your deployment requires.

been using this from last couple of weeks and the best thing about this is that its insanely fast, agents can spin up the sandbox in sub-millisecondsgreat work by team

Congrats on your product and the launch. This sounds interesting. But how does it compare to Docker or Firecracker?

The in-kernel eBPF egress enforced from outside the sandbox is what makes this actually trustworthy to me — most sandboxes run policy in a userspace proxy that compromised code can just route around. Since eBPF sees packets at L3/L4, how does the host allowlist resolve names: is DNS resolved outside the box and the resulting IPs pinned to the rule, or can a compromised process inside do its own resolution and point an allowlisted hostname at an attacker-controlled IP? And on Fork, does the clone inherit the parent egress policy the instant it snapshots, or is there a window before the eBPF rules attach to the new sandbox?