boat vs Microsoft Foundry
Foundry hosted agents run your own agent code inside a small managed sandbox on Azure, next to its models, identity and Teams. boat gives each agent a whole Linux machine with root, Docker, a disk that keeps everything, and coding agents already installed.
Where boat stands out
A whole machine, not a locked-down container
A boat sandbox is a full VM with root, systemd, Docker and /dev/kvm, and you can SSH into it. A Foundry session runs your image as a non-privileged container with no documented shell access.
Room to work, and a disk that keeps it
boat machines go up to 16 vCPU / 32 GB, and the whole disk is saved every minute, so a stopped sandbox comes back with every package installed. You can also fork a running sandbox to try two ideas at once.
Coding agents ready to drive from outside
Claude Code, Codex and five other agents come preinstalled, and you prompt, steer and follow them through one API. Real API keys stay outside the sandbox in a credentials proxy that works with any HTTPS API.
The companies and products
boat
boat.dev runs sandboxes for AI agents: each one is a full Linux VM with its own kernel.
You start a machine with one command or one API call, then SSH in, run Docker, open a desktop, or let a built-in agent (Claude Code, Codex, OpenCode and others) work in it. The disk stays between sessions, and a stopped sandbox costs nothing.
- Isolation
- Full VM per sandbox, own kernel
- Regions
- EU: Germany, Finland, France
Microsoft Foundry
Microsoft Foundry Agent Service is Azure's managed platform for building and running AI agents; hosted agents are the part that runs your own agent code.
You package your agent as a container image, push it to Azure Container Registry, and Foundry runs it in a per-session VM-isolated sandbox behind one agent endpoint (Responses, Invocations, WebSocket or A2A). The sandbox scales to zero after an idle timeout and keeps only $HOME and uploaded files. It is a hyperscaler agent platform, not a general sandbox: it is built for teams on Azure who want their agent wired to Foundry models, Entra ID, private networks and Microsoft 365.
Which use cases each one fits
For each use case, Battleships prices every sandbox provider on the same workload and sorts them from the cheapest monthly bill up. “3rd cheapest of 367” means 2 of the other 366 providers run that workload, with every feature it needs, for less. “With limits” means the provider runs it but misses something, so it is listed after every full match. Open a use case for its whole ranking and what each provider misses.
| Use case and its workload | boat: price rank | Microsoft Foundry: price rank |
|---|---|---|
| Software factory 100 at once · 4 vCPU / 8 GB · 2,200 sessions of 8 h a month A software factory needs Docker, a 4 vCPU / 8 GB machine and a disk that keeps installed packages; Foundry sessions top out at 2 vCPU / 4 GiB and keep only $HOME. | 3rd cheapest of 367 $634 a month | 301st of 367, with limits $5,932 a month |
| Always-on AI employees 50 machines 24/7 · 2 vCPU / 4 GB An assistant that lives in Teams fits Foundry's channel bridge well, but one that works on its own machine all month needs the whole disk to persist, which boat gives it. | 5th cheapest of 366 $657 a month | 80th of 366, with limits $7,722 a month |
| Code interpreter bursts 100 at once · 1 vCPU / 2 GB · 200,000 sessions of 1 min a month Short code bursts suit Foundry: a session scales to zero after the idle timeout and you pay only while it is active. | 186th of 345, with limits $2,000 a month | 274th of 345, with limits $403 a month |
| Sandboxes for your users 300 at once · 2 vCPU / 4 GB · 30,000 sessions of 23 min a month Both give each user an isolated machine; boat gives them a bigger one with SSH and hosting, while Foundry wakes a session on its next request. | Cheapest of 361 $209 a month | 298th of 361, with limits $2,532 a month |
| RL rollouts 1,000 at once · 2 vCPU / 4 GB · 1,000,000 sessions of 3 min a month | 34th of 360, with limits $2,000 a month | 160th of 360, with limits $12,232 a month |
| Agent evals 250 at once · 4 vCPU / 8 GB · 15,000 sessions of 20 min a month | 10th cheapest of 364 $200 a month | 304th of 364, with limits $1,968 a month |
| CI runners 40 at once · 8 vCPU / 16 GB · 6,000 sessions of 12 min a month CI runners that build containers need Docker inside the sandbox, which Foundry's non-privileged containers do not allow. | 4th cheapest of 377 $86 a month | 324th of 377, with limits $1,181 a month |
| 24/7 dev boxes 1 machine 24/7 · 4 vCPU / 8 GB A dev box needs SSH, root and a disk that keeps everything you install, none of which a Foundry session offers. | 18th cheapest of 368 $26 a month | 329th of 368, with limits $309 a month |
| Computer-use agents 50 at once · 4 vCPU / 8 GB · 20,000 sessions of 15 min a month boat has a 60fps desktop with Chromium inside the sandbox; Foundry's computer use tool is in preview and needs you to bring the machine it controls. | 6th cheapest of 369 $200 a month | 293rd of 369, with limits $1,771 a month |
| Browser-use agents 50 at once · 2 vCPU / 4 GB · 30,000 sessions of 10 min a month Foundry has a managed browser automation tool that runs in a separately billed Playwright Workspace; boat runs Chromium inside the agent's own machine, so the agent and its browser share files and sessions. | 7th cheapest of 367 $200 a month | 32nd cheapest of 367 $886 a month |
| Scraping & bots (startup scale) 50 at once · 1 vCPU / 2 GB · 100,000 sessions of 3 min a month | 6th cheapest of 346 $90 a month | 63rd cheapest of 346 $600 a month |
| Mass scraping & bots (undetectable) 1,000 at once · 1 vCPU / 2 GB · 3,000,000 sessions of 2 min a month | 71st of 338, with limits $1,800 a month | 249th of 338, with limits $11,993 a month |
| Parallel red teaming 200 at once · 2 vCPU / 4 GB · 5,000 sessions of 30 min a month | 2nd cheapest of 360 $200 a month | 8th cheapest of 360 $584 a month |
| GPU eval jobs 10 at once · 8 vCPU / 32 GB · 500 sessions of 30 min a month | Can't run it | Can't run it |
| macOS agents 5 at once · 4 vCPU / 8 GB · 1,000 sessions of 20 min a month | Can't run it | Can't run it |
Key features
| Feature | boat | Microsoft Foundry |
|---|---|---|
| Kind of product | Agent sandbox: a full Linux VM per agent, driven by API, SSH or the built-in agents | Managed agent platform on Azure: your agent's container runs behind a Foundry endpoint |
| Isolation | Full VM with its own kernel on dedicated AMD Ryzen 9 9950X hosts | Per-session VM-isolated sandbox running your container image |
| Biggest machine | Up to 16 vCPU / 32 GB on the $100 plan and above | 2 vCPU / 4 GiB per session |
| Docker and nested virtualization | Docker, systemd and root; /dev/kvm for Android emulators and VMs | No privileged containers, so no Docker or nested virtualization inside |
| Shell access | SSH and a root shell into every sandbox | No SSH documented; you reach your code through the agent endpoint |
| What persists | The whole disk, saved every minute and on stop; a stopped sandbox costs nothing | $HOME and uploaded files only, within a 20 GiB disk budget; sessions deleted after 30 days idle |
| Scale to zero and wake | You stop and start sandboxes by API; no wake on request | Compute is released after an idle timeout and comes back on the session's next request |
| Fork | Fork a running sandbox with its disk | No fork; versions snapshot configuration, not machines |
| Inbound access | HTTPS URLs for up to 50 ports, raw TCP, dedicated IPv4 or IPv6 | One Entra ID protected agent endpoint over HTTPS or WebSocket |
| Outbound control | Open internet, no provider-side allowlist | Your own Azure virtual network, with Azure Firewall and network security group rules |
| Browser and desktop | 60fps Linux desktop with Chromium inside the sandbox, ready for computer use | Managed browser automation tool outside the sandbox, billed separately as a Playwright Workspace; computer use tool in preview, on a machine you supply |
| Coding agents | Seven agents preinstalled, with a prompt, steer and events API | You write and deploy the harness in Python or C#; samples wrap the Claude Agent SDK and GitHub Copilot SDK |
| Keeping API keys out of the sandbox | Credentials proxy for model providers and any HTTPS API; switch a credential to another account when credits run out | Agent identity for Azure services; other secrets come from Key Vault and are read by your code inside the sandbox |
| Regions | EU only (Germany, Finland, France) | 31 Azure regions worldwide, including the EU |
| Compliance and transparency | SOC 2 is in progress. We're open about where we stand: live status and data retention policy. | SOC 2 |
Every feature Battleships tracks (43)
| Feature | boat | Microsoft Foundry |
|---|---|---|
| Full VM (own kernel) | Yes | Yes |
| Docker inside | Yes | No |
| Nested virtualization | Yes | No |
| Root | Yes | Not published |
| Systemd | Yes | Not published |
| Desktop GUI | Yes | No |
| Browser | Yes | Yes |
| Computer-use API | Yes | No |
| SSH | Yes | No |
| Persistent disk | Yes | Yes |
| Pause/resume | Yes | Yes |
| Automatic snapshots | Yes | No |
| Fork/clone | Yes | No |
| Live fork (no pause) | Yes | No |
| Memory fork | No | No |
| Custom image (Docker or snapshot) | Yes | Yes |
| ≥24 h sessions | Yes | Yes |
| Idle auto-stop | No | Yes |
| Wake on request | No | Yes |
| HTTPS preview URLs | Yes | Yes |
| Raw TCP inbound | Yes | Not published |
| Public IPv4 | No | No |
| Egress allowlist | No | Yes |
| Secret proxy | Yes | No |
| Secret proxy for any API | Yes | No |
| Preinstalled agents | Yes | Yes |
| Agent harness API | Yes | No |
| MCP server | No | No |
| GPU | No | No |
| Windows | No | No |
| Arm64 | No | No |
| Self-hosting | No | No |
| BYOC | No | No |
| Open source | No | No |
| Scoped API keys | Yes | Not published |
| Spend limits | Yes | Not published |
| Usage per sandbox (API) | Yes | No |
| Audit logs | No | Not published |
| SSO | No | Yes |
| SOC 2 | No | Yes |
| HIPAA | No | Not published |
| EU data residency | Yes | Yes |
| Zero data retention | Yes | Not published |
Performance
There is no comparable measurement. boat did 26.69 runs per second on the hpc-sandbox-benchmarks Node.js build-and-test loop at 4 vCPU / 8 GB, and Foundry hosted agents have not been run on that benchmark. Its largest session is 2 vCPU / 4 GiB, so it cannot run the test at the same size.
Node.js build-and-test loop at 4 vCPU / 8 GB, higher is better. Measured with the open hpc-sandbox-benchmarks suite. Microsoft Foundry has no published run in this suite yet, so there is no like-for-like number to compare.
Pricing in five scenarios
Each bill is priced from the providers' public price lists by the open Battleships engine, with the cheapest plan that runs the scenario.
| Scenario | boat, a month | Microsoft Foundry, a month |
|---|---|---|
| One coding agent, workdays 4 vCPU / 8 GB, 50 GB disk, 8 hours a day, 22 days a month, files kept between days | $20 · $20/mo | $78 · Pay as you go · with limits |
| One agent that never stops 4 vCPU / 8 GB, 50 GB disk, running 24/7 all month | $26 · $20/mo | $323 · Pay as you go · with limits |
| 50 agents in parallel 50 machines of 4 vCPU / 8 GB at once, 8-hour sessions, 1,100 sessions a month, Docker inside | $317 · $20/mo × 3 seats | $3,897 · Pay as you go · with limits |
| Sandboxes for your users 2 vCPU / 4 GB, 30,000 sessions of 10 minutes a month, up to 300 at once | $200 · $100/mo × 2 seats | $1,107 · Pay as you go |
| 1,000 short jobs at once 2 vCPU / 4 GB, 1,000 at once, 3 minutes each, 200,000 jobs a month | $2,000 · $2000/mo · with limits | $2,446 · Pay as you go |
boat: Plans start at $20 a month, and the whole fee is usage credit. You pay per second while a sandbox runs, and a stopped sandbox costs nothing and keeps its disk.
Microsoft Foundry: Foundry bills the vCPU-hours and GiB-hours allocated to every active session, pay as you go. A session stays active until the idle timeout passes after its last request, so each burst bills at least that long, and model calls and tools are billed separately.
Limits in those scenarios
The scenarios that need a 4 vCPU / 8 GB machine do not fit on Foundry, because one session tops out at 2 vCPU / 4 GiB, and only $HOME and /files survive a stop, so packages installed elsewhere reset. The agent fleet also needs Docker inside, which Foundry does not allow. For 1,000 short jobs at once, Foundry's default of 1,000 concurrent sessions per region absorbs the burst, while boat's $2,000 plan queues starts above 90 a minute.
| Scenario | boat | Microsoft Foundry |
|---|---|---|
| One coding agent, workdays | None that bite |
|
| One agent that never stops | None that bite |
|
| 50 agents in parallel | None that bite |
|
| Sandboxes for your users | None that bite |
|
| 1,000 short jobs at once |
|
|
Which one should you use?
Use Microsoft Foundry when
your agent is a chat or webhook service on Azure that talks to Foundry models, ships to Teams, must stay inside your Azure network, or runs outside the EU.
- Built into Azure and Microsoft 365. For teams already on Azure: each agent gets its own Entra ID identity, Foundry models, private networking and a bridge to Teams.
- Scale to zero with outbound rules. Useful for chat-style agents that sit idle between turns and must only reach approved hosts.
- Regions around the world. Hosted agents run in 31 Azure regions, from the US and Brazil to Japan, India, South Africa and Australia.
Use boat when
your agents need a real machine to do the work: installs, builds, Docker, emulators and a browser on up to 16 vCPU, with the disk kept between runs and coding agents ready to drive.
- A whole machine, not a locked-down container. An agent that builds images, runs docker compose for tests or boots an Android emulator cannot do it on Foundry, because Azure Container Apps does not allow privileged containers.
- Room to work, and a disk that keeps it. A Foundry session tops out at 2 vCPU / 4 GiB and keeps only $HOME and /files, so anything installed elsewhere is gone after the idle timeout and must be reinstalled on the next turn.
- Coding agents ready to drive from outside. On Foundry you write, package and deploy the harness yourself, and keys for non-Azure APIs are read by your code inside the sandbox, where a prompt injection can reach them.
Questions people ask
Is boat cheaper than Microsoft Foundry?
boat costs less in all five scenarios on this page, but it fits only four of them. Three need a 4 vCPU / 8 GB machine or Docker, which Foundry cannot provide, and in the per-user sandboxes scenario boat costs much less. For 1,000 short jobs at once, Foundry handles the burst while boat's plans queue the starts, so Foundry fits that one better.
Can I run Docker inside a Foundry hosted agent?
No. Hosted agents run on Azure Container Apps compute, which does not allow privileged containers, so Docker and nested virtualization are not available. boat gives each sandbox Docker, systemd, root and /dev/kvm.
What happens to files when a Foundry session goes idle?
After the idle timeout, 15 minutes by default, Foundry releases the compute and keeps $HOME and files uploaded through /files. Everything else on the filesystem resets, and a session is deleted after 30 days of inactivity. boat keeps the whole disk, saved every minute and on stop.
Can I run Claude Code on Microsoft Foundry?
You can, by writing a harness around the Claude Agent SDK, packaging it as a container and deploying it as a hosted agent; Microsoft publishes samples for this. boat has Claude Code, Codex and five other agents preinstalled, driven through one prompt, steer and events API.
Is boat SOC 2 compliant?
SOC 2 is in progress. We're open about where we stand: live status at status.ascii.dev and our data retention policy at docs.boat.dev/data-retention.
Start a sandbox
Install the CLI, then run boat new.
7-day free trial