Limits & defaults
The numbers a buyer needs before choosing CreateOS Sandbox for a workload, on one page, each with the API field it comes from. The historical plan, image and pricing figures below were recorded from the live control plane (https://api.sb.createos.sh) on 2026-09-07 and re-verified on 2026-09-08. Snapshot and label limits, explicit image selection and regional routing were reviewed against control-plane source on 2026-11-04. Where a value is per-account, the page names the call that returns yours.
Sizes (shapes)
GET /v1/shapes is public and is the source of truth. As of 2026-09-07:
| Shape | vCPU | Memory | Default disk |
|---|---|---|---|
s-0.25vcpu-512mb | 1 (25% quota) | 512 MiB | 10 GiB |
s-0.5vcpu-1gb | 1 (50% quota) | 1 GiB | 10 GiB |
s-1vcpu-256mb | 1 | 256 MiB | 10 GiB |
s-1vcpu-1gb | 1 | 1 GiB | 10 GiB |
s-1vcpu-2gb | 1 | 2 GiB | 10 GiB |
s-2vcpu-2gb | 2 | 2 GiB | 10 GiB |
s-2vcpu-4gb | 2 | 4 GiB | 10 GiB |
s-4vcpu-4gb | 4 | 4 GiB | 10 GiB |
s-4vcpu-8gb | 4 | 8 GiB | 10 GiB |
Disk can be raised per sandbox with disk_mib at create time, up to the plan's maximum disk (see below). The largest shapes (4 vCPU / 8 GB and 8 vCPU / 8 GB on Pro, 8 vCPU / 16 GB on Enterprise) unlock with the plan. No GPU shapes are offered.
Images (rootfs)
GET /v1/rootfs is public. Five first-party images are kept warm on every host:
| Image | What is in it |
|---|---|
devbox:1 | Ubuntu 24.04 LTS · Python 3.12 with pip and uv and the common data and AI packages preinstalled (verified by exec on 2026-09-08: pandas 2.3, numpy 2.4, scipy 1.17, matplotlib 3.10, pyarrow 21, openpyxl, scikit-learn 1.8, plus openai, anthropic, langchain, llama-index, transformers, requests; 374 packages in total) · Node.js 24 · Bun 1.4 · Go 1.26 · Rust 1.83 · Docker 29 · SSH · five preinstalled coding agents, each on PATH: OpenCode (opencode), Claude Code (claude), Pi coding agent (pi), Cursor CLI (agent, also cursor-agent), Codex (codex). PyPI is reachable under the default egress policy for anything else. |
desktop:1 | Graphical desktop with XFCE, Google Chrome, remote desktop and computer-use APIs. The same five preinstalled coding agents as devbox:1. |
ubuntu:26.04 | Ubuntu 26.04 LTS, minimal. |
debian:13 | Debian 13, minimal. |
alpine:3.20 | Alpine 3.20, minimal. Ordinary API creates require an explicit rootfs; pass devbox:1 for a development toolchain. Snapshot restores instead require snapshot_id and omit rootfs. |
Need a package set beyond what devbox:1 ships, or a pinned one? Build it once from a Dockerfile with Templates and boot every sandbox from it.
Lifetime, idle and cleanup
| Behaviour | Value | Field |
|---|---|---|
| Maximum session length | None. A sandbox runs until you destroy it, pause it, or it auto-pauses. There is no lifetime cap to fit a job inside. | — |
| Auto-pause on idle | Off by default. Set auto_pause_after_seconds (60–86,400) to pause after that long with no exec, file transfer or tunnel activity. | auto_pause_after_seconds |
| What "pause" means | A Firecracker snapshot to durable storage: memory, registers and device state. vCPU billing stops, while memory and disk are still billed; the sandbox is not destroyed and keeps its disk. | Pause, Resume & Fork |
| Destroy | Explicit DELETE /v1/sandboxes/{id}. Idempotent on an already-terminal sandbox. For one-sandbox-per-run workloads, call it in a finally block; do not rely on idle pause as cleanup. | DELETE /v1/sandboxes/{id} |
| Time to interactive | ~210 ms median, ~250 ms p95 (create plus first command), on CreateOS-managed infrastructure. | Sandboxes |
Concurrency and plan limits
Caps are set by plan (source: the control plane's plan table, 2026-09-08). The concurrent cap counts every sandbox that is not destroyed or failed: paused ones count, and only destroying one frees a slot. GET /v1/whoami returns running, paused and other counts, which together are measured against the cap. A create over the cap fails with 429 rather than queueing. There is no queue and no burst pool: size the plan to your peak.
The per-day cap counts sandboxes created in the rolling last 24 hours, destroyed ones included. Plans also set the largest shape and disk, and how many disks and templates you can hold. Per-second rates below are the same on every plan; plans differ in top-up bonus credits (see Account & Billing).
| Plan | Concurrent sandboxes | Sandboxes per day | Networks (concurrent / day) | Disks (concurrent / day) | Templates (concurrent / day) | Max disk | Largest shape |
|---|---|---|---|---|---|---|---|
| Free | 1 | 10 | 1 / 10 | 0 / 0 | 0 / 0 | 10 GiB | 1 vCPU / 1 GB |
| Beginner | 5 | 50 | 5 / 50 | 5 / 50 | 5 / 50 | 30 GiB | 4 vCPU / 4 GB |
| Pro | 20 | 200 | 20 / 200 | 20 / 200 | 20 / 200 | 50 GiB | 8 vCPU / 8 GB |
| Enterprise | 30 | 300 | 30 / 300 | 30 / 300 | 30 / 300 | 60 GiB | 8 vCPU / 16 GB |
Sizing rule of thumb: a workload of ten concurrent five-minute runs needs Pro. Free is for trying the API (one sandbox at a time, no disks or templates); Beginner covers a small service; Enterprise caps are the starting point for a negotiated limit, not a ceiling. Plan prices are on the pricing page.
Snapshots and labels
Up to five snapshots per user across disk and full types, counting creating, ready and deleting. Captures require a running source with no external disks. Full restores retain captured sizing; disk restores can change shape and grow the root disk. See Snapshots.
Sandbox labels allow 100 string pairs, with keys up to 128 bytes, values up to 1,024 bytes and 65,536 bytes total including overhead. List filters match all supplied labels; PATCH merges them. See Sandboxes.
Checkpoints
Checkpoints are local directory history, with up to 128 records per directory and an active layer chain bounded to 32 layers (mount-option limits can be reached earlier). Their storage counts against sandbox disk space; file-level copy-on-write can copy an entire file for a small edit. No automatic compaction is implemented. These limits are source-reviewed on November 5, 2026; rollout is pending as described in the reference.
Network
| Behaviour | Default | Field |
|---|---|---|
| Inbound (ingress) | Closed. Nothing reaches a sandbox unless ingress_enabled: true, which exposes one HTTPS URL per sandbox. | ingress_enabled |
| Outbound (egress) | Open when the rule list is empty: the sandbox can reach any external host. Set an allowlist before running untrusted or model-generated code. Once any rule is present, only listed destinations pass; everything else is dropped in-kernel on the host, outside the VM, and cannot be changed from inside it. Rules take host, host:port, *.host, ip, ip:port and cidr[:port], and apply live. | egress on create, Egress |
| Sandbox-to-sandbox | Private overlay networks, opt-in per sandbox. | networks |
| Bandwidth budget | 50 GiB per sandbox by default; grow it with POST /v1/sandboxes/{id}/bandwidth/recharge. | bandwidth_quota_bytes |
A deny-by-default Python job needs exactly two rules:
{ "shape": "s-1vcpu-1gb", "rootfs": "devbox:1",
"egress": ["pypi.org:443", "*.pythonhosted.org:443"] }Secrets and environment
envs at create time: up to 64 keys, 4 KiB per value, 64 KiB total. Values are write-only (GET returns key names). Per-exec overrides may change a declared key's value but cannot introduce new keys, so a sandbox can never receive a secret you did not declare when you created it. Keep production credentials on the caller's side; the sandbox only needs the data file and non-secret configuration.
Regions and residency
region at create time: eu or us; requests for another configured region are forwarded there. Set it explicitly when location matters. Eligible accounts may otherwise use cross-region capacity fallback for unpinned ordinary creates. For data that must not leave your boundary, run on your own infrastructure and bring your own storage.
Billing
Per-second, while running: $0.03616363 per vCPU-hour plus $0.01159025 per GiB-RAM-hour and $0.0001584 per GB-hour of storage, no egress fees. A paused sandbox is still charged for memory and storage, but not for vCPU. New accounts start with 500 free credits. Full rate card: pricing.
Status and compliance
ISO 27001 certified and SOC 2 Type II attested. For regulated workloads that need data to stay in your environment, use self-hosting. Reliability behaviour under OOM, CPU spin and runaway processes is documented in Reliability.
Related
- Pricing for the per-second rates behind the plan table, and Account & Billing for tiers and top-ups.
- Egress, Pause, Resume & Fork and Templates for the fields referenced above.
- How the same limits compare on other providers: vs E2B, vs Modal, vs Daytona.