Running untrusted, AI-generated code: why we built CreateOS Sandbox on Firecracker

Short summary

AI agents now execute code at scale on shared infrastructure, requiring isolation stronger than containers provide. CreateOS Sandbox runs untrusted AI-generated code in isolated Firecracker micro-VMs with eBPF egress control, private overlay networking, and kernel-level blast radius containment. Unlike container namespaces, Firecracker's real kernel boundary prevents escapes from compromising the host; sandboxes boot in seconds and support self-hosting with your own storage volumes.

• •AI agents executing code at scale require isolation stronger than container namespaces; Firecracker micro-VMs provide kernel-level boundaries.
• •eBPF egress firewall blocks code from calling unapproved destinations by default; private overlay networks enable inter-sandbox connectivity without exposing to the public internet.
• •Fast boot times (seconds), pause/resume for cost control, and self-hosting support make it practical for agent loops and untrusted CI workloads.

Generated with AI, which can make mistakes.