boat vs Azure Container Apps
Azure Container Apps runs your containers and scales them to zero inside Azure. boat gives each agent a whole machine instead, with Docker, nested virtualization, a disk that keeps its files and coding agents built in.
Where boat stands out
A whole machine with Docker and KVM
A boat sandbox is a full VM with its own kernel, root, systemd, Docker and /dev/kvm for Android emulators and nested VMs. You can SSH in and open raw TCP ports. Container Apps runs your code as a container and does not allow privileged mode.
A disk that remembers, and forks
boat saves the whole disk every minute and when the sandbox stops, and a stopped sandbox costs nothing and keeps its files. You can fork a running sandbox to try two ideas from the same point. On Container Apps the container's own files vanish on restart or scale to zero.
Agents and keys built in
Claude Code, Codex and five other agents come preinstalled, and you prompt, steer and follow them from outside through one API. Real API keys stay in a credentials proxy outside the sandbox, and a credential can switch to another account when one runs out of credits.
The companies and products
boat
boat.dev runs sandboxes for AI agents: each one is a full Linux VM with its own kernel.
You start a machine with one command or one API call, then SSH in, run Docker, open a desktop, or let a built-in agent (Claude Code, Codex, OpenCode and others) work in it. The disk stays between sessions, and a stopped sandbox costs nothing.
- Isolation
- Full VM per sandbox, own kernel
- Regions
- EU: Germany, Finland, France
Azure Container Apps
Azure Container Apps is Microsoft's serverless container platform: you deploy a container image and Azure runs, scales and routes traffic to it.
It is a hyperscaler service, not an agent sandbox. Apps and jobs run as Linux containers on a managed Kubernetes platform that can scale to zero, with an optional Dynamic Sessions feature that hands out Hyper-V isolated sessions from prewarmed pools to run untrusted or AI-written code. It is built for teams already on Azure that host APIs, background jobs and AI workloads with Azure networking, identity and billing.
Which use cases each one fits
For each use case, Battleships prices every sandbox provider on the same workload and sorts them from the cheapest monthly bill up. “3rd cheapest of 367” means 2 of the other 366 providers run that workload, with every feature it needs, for less. “With limits” means the provider runs it but misses something, so it is listed after every full match. Open a use case for its whole ranking and what each provider misses.
| Use case and its workload | boat: price rank | Azure Container Apps: price rank |
|---|---|---|
| Software factory 100 at once · 4 vCPU / 8 GB · 2,200 sessions of 8 h a month A software factory runs Docker builds, tests and emulators; Container Apps does not allow privileged containers, so Docker inside and /dev/kvm are off the table there. | 3rd cheapest of 367 $634 a month | 57th of 367, with limits $408 a month |
| Always-on AI employees 50 machines 24/7 · 2 vCPU / 4 GB An assistant that lives on its machine all month needs files that survive restarts; on Azure only an Azure Files mount keeps them, while boat keeps the whole disk. | 5th cheapest of 366 $657 a month | 137th of 366, with limits $936 a month |
| Code interpreter bursts 100 at once · 1 vCPU / 2 GB · 200,000 sessions of 1 min a month Azure fits this well: code interpreter sessions come from prewarmed pools, sit behind Hyper-V and plug into LangChain, LlamaIndex and Semantic Kernel. | 186th of 345, with limits $2,000 a month | 146th of 345, with limits $349 a month |
| Sandboxes for your users 300 at once · 2 vCPU / 4 GB · 30,000 sessions of 23 min a month Giving each user a machine fits boat better: Azure's sessions are deleted after at most an hour idle, and its apps lose their local files on restart. | Cheapest of 361 $209 a month | 235th of 361, with limits $912 a month |
| RL rollouts 1,000 at once · 2 vCPU / 4 GB · 1,000,000 sessions of 3 min a month | 34th of 360, with limits $2,000 a month | 152nd of 360, with limits $10,735 a month |
| Agent evals 250 at once · 4 vCPU / 8 GB · 15,000 sessions of 20 min a month | 10th cheapest of 364 $200 a month | 57th cheapest of 364 $1,226 a month |
| CI runners 40 at once · 8 vCPU / 16 GB · 6,000 sessions of 12 min a month CI that builds containers or Android apps needs Docker and nested virtualization, which boat has and Container Apps does not allow. | 4th cheapest of 377 $86 a month | 252nd of 377, with limits $183 a month |
| 24/7 dev boxes 1 machine 24/7 · 4 vCPU / 8 GB A dev box wants SSH and a disk that keeps installed tools; Container Apps gives a console through the portal or CLI and an ephemeral filesystem. | 18th cheapest of 368 $26 a month | 209th of 368, with limits $13 a month |
| Computer-use agents 50 at once · 4 vCPU / 8 GB · 20,000 sessions of 15 min a month Computer-use agents need a screen; boat streams a Linux desktop at 60fps, while Container Apps is headless. | 6th cheapest of 369 $200 a month | 188th of 369, with limits $612 a month |
| Browser-use agents 50 at once · 2 vCPU / 4 GB · 30,000 sessions of 10 min a month boat ships Chromium on a desktop in every sandbox; on Azure you build and run your own headless browser image. | 7th cheapest of 367 $200 a month | 286th of 367, with limits $790 a month |
| Scraping & bots (startup scale) 50 at once · 1 vCPU / 2 GB · 100,000 sessions of 3 min a month | 6th cheapest of 346 $90 a month | 230th of 346, with limits $209 a month |
| Mass scraping & bots (undetectable) 1,000 at once · 1 vCPU / 2 GB · 3,000,000 sessions of 2 min a month | 71st of 338, with limits $1,800 a month | 137th of 338, with limits $4,021 a month |
| Parallel red teaming 200 at once · 2 vCPU / 4 GB · 5,000 sessions of 30 min a month | 2nd cheapest of 360 $200 a month | 162nd of 360, with limits $145 a month |
| GPU eval jobs 10 at once · 8 vCPU / 32 GB · 500 sessions of 30 min a month | Can't run it | Can't run it |
| macOS agents 5 at once · 4 vCPU / 8 GB · 1,000 sessions of 20 min a month | Can't run it | Can't run it |
Key features
| Feature | boat | Azure Container Apps |
|---|---|---|
| Isolation | Full VM with its own kernel on dedicated AMD Ryzen 9 9950X hosts | Containers for apps and jobs; Hyper-V isolation for each dynamic session |
| Docker and nested virtualization | Docker, systemd and root on every sandbox, plus /dev/kvm for Android emulators and VMs | No privileged containers, so no Docker daemon inside and no /dev/kvm |
| Files after a restart | Whole disk saved every minute and on stop; a stopped sandbox keeps it | Container and replica storage is ephemeral; only Azure Files mounts persist |
| Fork | Fork a running sandbox with its disk | No fork; new replicas start fresh from the image |
| Machine size | Up to 16 vCPU / 32 GB on the $100 plan and above | Up to 4 vCPU / 8 GiB on Consumption; Dedicated profiles are larger |
| Getting a shell | SSH, plus CLI and API exec | Console through the portal or CLI; code execution API for sessions; no SSH |
| Desktop, browser and computer use | Linux desktop streamed at 60fps, Chromium and computer-use tools preinstalled | Headless; you bring your own browser image |
| Inbound access | HTTPS URLs for up to 50 ports, token-protected by default; raw TCP; dedicated IPv4 or IPv6 | HTTPS ingress with custom domains and IP rules; external TCP only in a VNet environment, up to 5 extra ports per app |
| Idle handling and wake | Auto-stop timer you set; a stopped sandbox is started by API | Scales to zero and starts again on the next HTTP request or TCP connection |
| Outbound rules | Open internet, no provider-side allowlist | Sessions have egress off by default; apps can route through Azure Firewall and NSG rules in a VNet |
| GPUs | CPU only | Serverless NVIDIA T4 and A100, one per replica |
| Coding agents | Seven agents preinstalled, with a prompt, steer and events API | None built in; LangChain, LlamaIndex and Semantic Kernel tools call code interpreter sessions |
| Keeping API keys out of the sandbox | Credentials proxy for model providers and any HTTPS API; switch a credential to another account when credits run out | Secrets arrive as environment variables or mounted files inside the container |
| Regions | EU only (Germany, Finland, France) | About 40 Azure regions on six continents |
| Compliance and transparency | SOC 2 is in progress. We're open about where we stand: live status and data retention policy. | SOC 2 |
Every feature Battleships tracks (43)
| Feature | boat | Azure Container Apps |
|---|---|---|
| Full VM (own kernel) | Yes | No |
| Docker inside | Yes | No |
| Nested virtualization | Yes | No |
| Root | Yes | Yes |
| Systemd | Yes | No |
| Desktop GUI | Yes | No |
| Browser | Yes | No |
| Computer-use API | Yes | No |
| SSH | Yes | No |
| Persistent disk | Yes | Yes |
| Pause/resume | Yes | No |
| Automatic snapshots | Yes | No |
| Fork/clone | Yes | No |
| Live fork (no pause) | Yes | No |
| Memory fork | No | No |
| Custom image (Docker or snapshot) | Yes | Yes |
| ≥24 h sessions | Yes | Yes |
| Idle auto-stop | No | Yes |
| Wake on request | No | Yes |
| HTTPS preview URLs | Yes | Yes |
| Raw TCP inbound | Yes | Yes |
| Public IPv4 | No | No |
| Egress allowlist | No | Yes |
| Secret proxy | Yes | No |
| Secret proxy for any API | Yes | No |
| Preinstalled agents | Yes | No |
| Agent harness API | Yes | No |
| MCP server | No | Yes |
| GPU | No | Yes |
| Windows | No | No |
| Arm64 | No | No |
| Self-hosting | No | No |
| BYOC | No | No |
| Open source | No | No |
| Scoped API keys | Yes | Not published |
| Spend limits | Yes | No |
| Usage per sandbox (API) | Yes | Yes |
| Audit logs | No | Yes |
| SSO | No | Yes |
| SOC 2 | No | Yes |
| HIPAA | No | Yes |
| EU data residency | Yes | Yes |
| Zero data retention | Yes | Not published |
Performance
There is no comparable measurement for Azure Container Apps yet. boat did 26.69 runs per second on the StarSling hpc-sandbox-benchmarks Node.js build-and-test loop at 4 vCPU / 8 GB, on dedicated AMD Ryzen 9 9950X hosts. Until Container Apps is measured on the same test, this page makes no speed claim either way.
Node.js build-and-test loop at 4 vCPU / 8 GB, higher is better. Measured with the open hpc-sandbox-benchmarks suite. Azure Container Apps has no published run in this suite yet, so there is no like-for-like number to compare.
Pricing in five scenarios
Each bill is priced from the providers' public price lists by the open Battleships engine, with the cheapest plan that runs the scenario.
| Scenario | boat, a month | Azure Container Apps, a month |
|---|---|---|
| One coding agent, workdays 4 vCPU / 8 GB, 50 GB disk, 8 hours a day, 22 days a month, files kept between days | $20 · $20/mo | $0 · Pay-as-you-go · with limits |
| One agent that never stops 4 vCPU / 8 GB, 50 GB disk, running 24/7 all month | $26 · $20/mo | $14 · Pay-as-you-go · with limits |
| 50 agents in parallel 50 machines of 4 vCPU / 8 GB at once, 8-hour sessions, 1,100 sessions a month, Docker inside | $317 · $20/mo × 3 seats | $259 · Pay-as-you-go · with limits |
| Sandboxes for your users 2 vCPU / 4 GB, 30,000 sessions of 10 minutes a month, up to 300 at once | $200 · $100/mo × 2 seats | $912 · Pay-as-you-go · with limits |
| 1,000 short jobs at once 2 vCPU / 4 GB, 1,000 at once, 3 minutes each, 200,000 jobs a month | $2,000 · $2000/mo · with limits | $2,143 · Pay-as-you-go · with limits |
boat: Plans start at $20 a month, and the whole fee is usage credit. You pay per second while a sandbox runs, and a stopped sandbox costs nothing and keeps its disk.
Azure Container Apps: Consumption apps bill per second for the vCPU and memory you allocate while a replica runs, at a lower idle rate when it sits at its minimum count, with a monthly free grant and nothing at zero replicas. Code interpreter sessions bill each allocated session in one-hour steps, and custom session pools and Dedicated profiles bill whole instances plus a management fee.
Limits in those scenarios
For every scenario except the 1,000 short jobs, our data picks Azure's code interpreter sessions, which run code through an API, delete a session after at most an hour idle and cap each run at 220 seconds, so they do not fit a coding agent that works for hours. A regular container app could stay up all month, but it tops out at 4 vCPU / 8 GiB on Consumption, cannot run Docker inside, and keeps files across restarts only in an Azure Files share. For 1,000 short jobs at once, neither fits as priced: boat's $2,000 plan queues starts above 90 a minute, and Azure's shared Consumption cores can be slowed by other tenants under heavy load.
| Scenario | boat | Azure Container Apps |
|---|---|---|
| One coding agent, workdays | None that bite |
|
| One agent that never stops | None that bite |
|
| 50 agents in parallel | None that bite |
|
| Sandboxes for your users | None that bite |
|
| 1,000 short jobs at once |
|
|
Which one should you use?
Use Azure Container Apps when
you already run on Azure and need serverless containers that scale to zero, GPUs for inference, short code interpreter calls behind Hyper-V, or regions outside the EU.
- Serverless GPUs. For inference or GPU jobs next to your agents: T4 and A100 GPUs billed per second that scale to zero.
- Scale to zero and wake on traffic. An app with no traffic costs nothing and starts again on the next request, and code sessions come from prewarmed pools.
- Inside Azure, in about 40 regions. Teams already on Azure get Entra ID, VNets, firewall rules and Azure billing, in about 40 regions on six continents.
Use boat when
your agents need a whole computer that keeps its state: Docker, emulators, SSH, a desktop and a browser, with coding agents and a credentials proxy built in.
- A whole machine with Docker and KVM. Agents that build images, run docker compose for tests or start an emulator cannot do it on Container Apps. The workaround is a separate Azure VM per agent, which you then size, patch and pay for yourself.
- A disk that remembers, and forks. An agent that installed packages, cloned repos and half-finished a task loses all of it on Azure when its replica restarts, unless you wire every path it writes to an Azure Files share.
- Agents and keys built in. Azure's own docs warn that untrusted code in a session has full access to its environment variables, secrets and files, so an agent hit by prompt injection can read and leak the keys you passed in.
Questions people ask
Is boat cheaper than Azure Container Apps?
boat fits every scenario on this page except the 1,000 short jobs at once, and Azure fits none of them as priced. Azure's code interpreter sessions show lower totals for a workday agent, an always-on agent and a 50-agent fleet, $259 against $317 for the fleet, but they are short code runs, not machines a coding agent can live on.
Can I run Docker inside Azure Container Apps?
No. Container Apps does not allow privileged containers, which a Docker daemon needs, and it has no /dev/kvm for emulators or VMs. Every boat sandbox runs Docker and exposes /dev/kvm.
How long can an Azure dynamic session last?
A code interpreter session is deleted once it has been idle for its cooldown, which you set between 300 and 3,600 seconds, and each code run stops after 220 seconds. boat has no session cap on paid plans.
Do files survive a restart on Azure Container Apps?
Only in an Azure Files mount. Files written to the container itself vanish when it shuts down or restarts. boat saves the whole disk every minute and on stop, so installed packages and work in progress come back.
Does Azure Container Apps have GPUs?
Yes. Serverless NVIDIA T4 and A100 GPUs can attach to a replica in some regions, billed per second. boat runs on CPUs only, so GPU work belongs on Azure or another GPU cloud.
Is boat SOC 2 compliant?
SOC 2 is in progress. We're open about where we stand: live status at status.ascii.dev and our data retention policy at docs.boat.dev/data-retention.
Start a sandbox
Install the CLI, then run boat new.
7-day free trial