boat vs AWS CodeBuild
AWS CodeBuild is a CI service: each build or debug sandbox starts fresh, runs your commands and ends within 36 hours. boat gives each agent its own VM that keeps its disk, can be reached from the internet and comes with coding agents built in.
Where boat stands out
A machine that stays, not a build that ends
A boat sandbox is a full VM with its own kernel. It keeps its disk, takes a snapshot every minute, and has no session cap on paid plans. A CodeBuild build or sandbox starts from a fresh container and ends within 36 hours.
Reachable from the internet
boat gives every sandbox HTTPS URLs for up to 50 ports, raw TCP and its own IP, so an agent can run an app and you or your users can open it. CodeBuild builds take no inbound traffic and cannot get a public IP; you reach them only through SSH over SSM Session Manager.
Coding agents built in, keys kept out
boat ships Claude Code, Codex, OpenCode and other agents in each sandbox, and you drive them from outside with a prompt, steer and events API. Its credentials proxy keeps real AI keys out of the sandbox and can switch to another account when one runs out of credits. CodeBuild runs shell commands and passes secrets in as environment variables.
The companies and products
boat
boat.dev runs sandboxes for AI agents: each one is a full Linux VM with its own kernel.
You start a machine with one command or one API call, then SSH in, run Docker, open a desktop, or let a built-in agent (Claude Code, Codex, OpenCode and others) work in it. The disk stays between sessions, and a stopped sandbox costs nothing.
- Isolation
- Full VM per sandbox, own kernel
- Regions
- EU: Germany, Finland, France
AWS CodeBuild
AWS CodeBuild is Amazon's managed CI service: it compiles code, runs tests and builds packages inside your AWS account.
You define a build project, and each build runs in a fresh environment, by default a Linux container on hosts that CodeBuild manages, or on Lambda or reserved EC2 fleets. A debug sandbox mode lets you open an SSH session or run shell commands inside a build environment. It is built for teams that already use AWS and want builds wired into IAM, VPCs and CodePipeline. It is a different kind of product from boat, so this page compares the parts that overlap: running code an agent wrote on a remote machine.
- Kind of product
- Managed continuous integration service
Which use cases each one fits
For each use case, Battleships prices every sandbox provider on the same workload and sorts them from the cheapest monthly bill up. “3rd cheapest of 367” means 2 of the other 366 providers run that workload, with every feature it needs, for less. “With limits” means the provider runs it but misses something, so it is listed after every full match. Open a use case for its whole ranking and what each provider misses.
| Use case and its workload | boat: price rank | AWS CodeBuild: price rank |
|---|---|---|
| Software factory 100 at once · 4 vCPU / 8 GB · 2,200 sessions of 8 h a month A software factory needs a machine that keeps its work between sessions; CodeBuild starts every build fresh and keeps files only in an EFS mount. | 3rd cheapest of 367 $634 a month | 189th of 367, with limits $2,170 a month |
| Always-on AI employees 50 machines 24/7 · 2 vCPU / 4 GB Always-on assistants hit CodeBuild's 36-hour cap on every build, so they would restart from a fresh machine at least every 36 hours. | 5th cheapest of 366 $657 a month | 225th of 366, with limits $2,628 a month |
| Code interpreter bursts 100 at once · 1 vCPU / 2 GB · 200,000 sessions of 1 min a month CodeBuild's Lambda compute starts fast and bills per second, which suits short code runs better than boat's start limits do. | 186th of 345, with limits $2,000 a month | 120th of 345, with limits $236 a month |
| Sandboxes for your users 300 at once · 2 vCPU / 4 GB · 30,000 sessions of 23 min a month CodeBuild builds cannot take inbound traffic or get a public IP, so your users cannot open an app running inside one. | Cheapest of 361 $209 a month | 227th of 361, with limits $741 a month |
| RL rollouts 1,000 at once · 2 vCPU / 4 GB · 1,000,000 sessions of 3 min a month | 34th of 360, with limits $2,000 a month | 117th of 360, with limits $7,160 a month |
| Agent evals 250 at once · 4 vCPU / 8 GB · 15,000 sessions of 20 min a month | 10th cheapest of 364 $200 a month | 181st of 364, with limits $1,680 a month |
| CI runners 40 at once · 8 vCPU / 16 GB · 6,000 sessions of 12 min a month Both fit CI: CodeBuild is a CI service with webhooks and AWS wiring, and boat runs CI jobs on a full VM with Docker and /dev/kvm. | 4th cheapest of 377 $86 a month | 46th cheapest of 377 $389 a month |
| 24/7 dev boxes 1 machine 24/7 · 4 vCPU / 8 GB | 18th cheapest of 368 $26 a month | 171st of 368, with limits $131 a month |
| Computer-use agents 50 at once · 4 vCPU / 8 GB · 20,000 sessions of 15 min a month CodeBuild has no desktop or screen to control; boat streams a 60fps desktop with Chromium for computer use. | 6th cheapest of 369 $200 a month | 198th of 369, with limits $648 a month |
| Browser-use agents 50 at once · 2 vCPU / 4 GB · 30,000 sessions of 10 min a month | 7th cheapest of 367 $200 a month | 218th of 367, with limits $259 a month |
| Scraping & bots (startup scale) 50 at once · 1 vCPU / 2 GB · 100,000 sessions of 3 min a month | 6th cheapest of 346 $90 a month | 263rd of 346, with limits $351 a month |
| Mass scraping & bots (undetectable) 1,000 at once · 1 vCPU / 2 GB · 3,000,000 sessions of 2 min a month | 71st of 338, with limits $1,800 a month | 191st of 338, with limits $7,020 a month |
| Parallel red teaming 200 at once · 2 vCPU / 4 GB · 5,000 sessions of 30 min a month Parallel attacks on CodeBuild start from a fresh container each time, with no fork of a running machine to branch from. | 2nd cheapest of 360 $200 a month | 184th of 360, with limits $171 a month |
| GPU eval jobs 10 at once · 8 vCPU / 32 GB · 500 sessions of 30 min a month | Can't run it | Can't run it |
| macOS agents 5 at once · 4 vCPU / 8 GB · 1,000 sessions of 20 min a month Only CodeBuild fits: it rents Apple M2 Macs through reserved fleets, and boat has no macOS. | Can't run it | 36th of 36, with limits $4,380 a month |
Key features
| Feature | boat | AWS CodeBuild |
|---|---|---|
| Kind of product | Cloud VMs for agents: each one keeps running, keeps its disk and can host services | CI builds and short debug sandboxes inside your AWS account |
| Isolation | Every sandbox is a full VM with its own kernel | Linux container on CodeBuild-managed hosts by default; EC2 instances in reserved fleets |
| Docker and nested virtualization | Docker, root, systemd and /dev/kvm on every machine | Docker through privileged mode (not on Windows); no /dev/kvm documented |
| How long one session runs | No session cap on paid plans | 36 hours at most per build or sandbox |
| Files after a stop | Snapshots every minute and on stop; a stopped sandbox costs nothing | Each build starts fresh; only an EFS mount (needs a VPC, billed by EFS) or build caches carry over |
| Pause, resume and fork | Stop and resume from disk; fork a running sandbox | Start and stop only; no pause, resume or fork |
| Reaching the sandbox | HTTPS URLs for up to 50 ports, token-protected; raw TCP; dedicated IPv6 or IPv4 | SSH through SSM Session Manager; no inbound traffic or public IP |
| Outbound internet | Open internet on every plan; no provider-side allowlist | Open by default; domain or IP allow and deny rules on reserved fleets, or VPC security groups |
| Keeping keys out of the sandbox | AI credentials proxy for model providers and any HTTPS API you register; switch a credential to another account when credits run out | Secrets Manager and Parameter Store values are put into the build as environment variables |
| Coding agents | Claude Code, Codex, OpenCode and more preinstalled, with a prompt, steer and events API | None built in; the sandbox API runs shell commands |
| Desktop and computer use | 60fps desktop and Chromium, computer use and browser control, embeddable stream | None; access is a shell |
| Custom images | Named snapshots (templates), shareable by code; no Dockerfile builds | Any Docker image from Amazon ECR, Docker Hub or another registry |
| Windows, macOS and GPUs | Linux only; Wine for Windows apps; no GPUs | Windows builds, Apple M2 Macs and Linux GPU machines |
| Regions | EU only: Germany, Finland, France | Most AWS regions worldwide, eight of them in Europe |
| Compliance and transparency | SOC 2 is in progress. We're open about where we stand: live status and data retention policy. | SOC 2 |
Every feature Battleships tracks (43)
| Feature | boat | AWS CodeBuild |
|---|---|---|
| Full VM (own kernel) | Yes | No |
| Docker inside | Yes | Yes |
| Nested virtualization | Yes | No |
| Root | Yes | Yes |
| Systemd | Yes | Not published |
| Desktop GUI | Yes | No |
| Browser | Yes | No |
| Computer-use API | Yes | No |
| SSH | Yes | Yes |
| Persistent disk | Yes | Yes |
| Pause/resume | Yes | No |
| Automatic snapshots | Yes | No |
| Fork/clone | Yes | No |
| Live fork (no pause) | Yes | No |
| Memory fork | No | No |
| Custom image (Docker or snapshot) | Yes | Yes |
| ≥24 h sessions | Yes | Yes |
| Idle auto-stop | No | Yes |
| Wake on request | No | No |
| HTTPS preview URLs | Yes | No |
| Raw TCP inbound | Yes | No |
| Public IPv4 | No | No |
| Egress allowlist | No | Yes |
| Secret proxy | Yes | No |
| Secret proxy for any API | Yes | No |
| Preinstalled agents | Yes | No |
| Agent harness API | Yes | No |
| MCP server | No | No |
| GPU | No | Yes |
| Windows | No | Yes |
| Arm64 | No | Yes |
| Self-hosting | No | Yes |
| BYOC | No | No |
| Open source | No | No |
| Scoped API keys | Yes | Not published |
| Spend limits | Yes | Not published |
| Usage per sandbox (API) | Yes | Yes |
| Audit logs | No | Not published |
| SSO | No | Yes |
| SOC 2 | No | Yes |
| HIPAA | No | Yes |
| EU data residency | Yes | Yes |
| Zero data retention | Yes | Not published |
Performance
There is no comparable measurement: CodeBuild is not in the public sandbox benchmark we use. In that run, boat did 26.69 Node.js build-and-test runs per second at 4 vCPU / 8 GB on dedicated AMD Ryzen 9 9950X (Zen 5) hosts.
Node.js build-and-test loop at 4 vCPU / 8 GB, higher is better. Measured with the open hpc-sandbox-benchmarks suite. AWS CodeBuild has no published run in this suite yet, so there is no like-for-like number to compare.
Pricing in five scenarios
Each bill is priced from the providers' public price lists by the open Battleships engine, with the cheapest plan that runs the scenario.
| Scenario | boat, a month | AWS CodeBuild, a month |
|---|---|---|
| One coding agent, workdays 4 vCPU / 8 GB, 50 GB disk, 8 hours a day, 22 days a month, files kept between days | $20 · $20/mo | $29 · Pay as you go · with limits |
| One agent that never stops 4 vCPU / 8 GB, 50 GB disk, running 24/7 all month | $26 · $20/mo | $131 · Pay as you go · with limits |
| 50 agents in parallel 50 machines of 4 vCPU / 8 GB at once, 8-hour sessions, 1,100 sessions a month, Docker inside | $317 · $20/mo × 3 seats | $1,426 · Pay as you go · with limits |
| Sandboxes for your users 2 vCPU / 4 GB, 30,000 sessions of 10 minutes a month, up to 300 at once | $200 · $100/mo × 2 seats | $324 · Pay as you go · with limits |
| 1,000 short jobs at once 2 vCPU / 4 GB, 1,000 at once, 3 minutes each, 200,000 jobs a month | $2,000 · $2000/mo · with limits | $716 · Pay as you go · with limits |
boat: You pick a monthly plan from $20, and all of it becomes usage credit spent per second on running sandboxes. A stopped sandbox costs nothing and keeps its disk.
AWS CodeBuild: CodeBuild has no plan fee. Builds bill per minute, rounded up, from submission to end; debug sandboxes and Lambda builds bill per second; reserved fleets bill per instance-minute with a 60-minute minimum, and a Mac has a 24-hour minimum. Logs in CloudWatch, artifacts in S3, EFS storage and data transfer are billed on top.
Limits in those scenarios
On CodeBuild every scenario runs into the same wall: it is a CI runner, so files survive only in an EFS mount and anything installed elsewhere resets on the next run. The agent that never stops also hits the 36-hour cap on each build. AWS starts most accounts at one running build per compute type, so 50 agents in parallel need a quota increase first. On boat, the 1,000 short jobs at once get queued: the $2,000 plan allows 2,400 starts a day and 90 a minute, fewer than the burst needs.
| Scenario | boat | AWS CodeBuild |
|---|---|---|
| One coding agent, workdays | None that bite |
|
| One agent that never stops | None that bite |
|
| 50 agents in parallel | None that bite |
|
| Sandboxes for your users | None that bite |
|
| 1,000 short jobs at once |
|
|
Which one should you use?
Use AWS CodeBuild when
you need CI builds inside your AWS account, or builds on Windows, macOS or GPUs.
- Windows, macOS and GPU builds. Useful if you build for Windows, iOS or macOS, or need a GPU: CodeBuild runs Windows, Apple M2 and Linux GPU machines.
- Part of your AWS account. Useful if your stack lives on AWS: builds reach private VPC resources and use IAM, CodePipeline and many regions worldwide.
- Network rules for builds. Useful if builds must reach only approved hosts: reserved fleets can deny all traffic and allow chosen domains or IPs.
Use boat when
your agents need a machine of their own: a full VM that keeps its disk, runs as long as the work takes, serves apps to the internet and comes with coding agents built in.
- A machine that stays, not a build that ends. An agent that installs tools and edits a repo loses all of it when a CodeBuild run ends. The workaround is an EFS mount inside a VPC, which keeps one folder and still resets everything else.
- Reachable from the internet. An agent that builds a web app needs someone to open it. On CodeBuild nobody outside AWS can, so previews, webhooks and user-facing sandboxes need another service in front.
- Coding agents built in, keys kept out. With secrets as environment variables, code an agent wrote can read and leak the key. Without a driving API you write and maintain the code that starts, prompts and watches each agent yourself.
Questions people ask
Is boat cheaper than AWS CodeBuild?
For long-running agents, yes in the scenarios we priced: one agent running all month comes to $26 on boat and $131 on CodeBuild, and 50 agents in parallel come to $317 against $1,426. For 1,000 short jobs at once, CodeBuild comes to $716 against $2,000, but neither fits as is: CodeBuild needs higher quotas and boat queues the starts.
Can I run an AI coding agent in a CodeBuild sandbox?
You can install one and run it with shell commands, but the sandbox is made for debugging builds. It starts fresh, ends within 36 hours, takes no inbound traffic and keeps files only in an EFS mount. boat ships the agents preinstalled and lets you drive them with a prompt, steer and events API.
Do CodeBuild builds run in a VM or a container?
By default a CodeBuild build runs as a Linux container on hosts CodeBuild manages. Reserved fleets run on EC2 instances, and Lambda compute runs without root or Docker. On boat, every sandbox is a full VM with its own kernel, root, systemd, Docker and /dev/kvm.
Does boat run Windows, macOS or GPU builds like CodeBuild?
No. boat runs Linux VMs on dedicated AMD Ryzen 9 9950X hosts, with Wine for Windows apps and no GPUs. For Windows, Apple M2 or GPU builds, CodeBuild has all three.
Where does my data run?
boat runs only in the EU (Germany, Finland and France), with EU data residency and a zero data retention option. CodeBuild runs in the AWS region you choose, which includes eight regions in Europe and many more worldwide.
Is boat SOC 2 compliant?
SOC 2 is in progress. We're open about where we stand: live status at status.ascii.dev and our data retention policy at docs.boat.dev/data-retention. AWS publishes CodeBuild's compliance programs and audit reports through AWS Artifact.
Start a sandbox
Install the CLI, then run boat new.
7-day free trial