boat vs Baponi
Baponi runs one piece of code per API call in a locked-down Linux jail and throws it away. boat gives each agent a whole machine with root, Docker and a desktop that stays up as long as the work needs.
Where boat stands out
A whole machine with root, Docker and /dev/kvm
Each boat sandbox is a full VM with its own kernel on dedicated AMD Ryzen 9 9950X hosts. The agent is root, can run systemd and Docker, and can start Android emulators or VMs through /dev/kvm.
It keeps running, and you can reach it
A boat sandbox has no session cap on paid plans and stays up between tasks, with its whole disk saved every minute. It can host a dev server on HTTPS for up to 50 ports, take raw TCP and SSH, and show a 60fps desktop with Chromium.
Agents you drive from outside, keys kept out
Claude Code, Codex and five other agents come preinstalled, and you prompt, steer and follow them through one API. Real API keys stay outside the sandbox in a credentials proxy that works for any HTTPS API.
The companies and products
boat
boat.dev runs sandboxes for AI agents: each one is a full Linux VM with its own kernel.
You start a machine with one command or one API call, then SSH in, run Docker, open a desktop, or let a built-in agent (Claude Code, Codex, OpenCode and others) work in it. The disk stays between sessions, and a stopped sandbox costs nothing.
- Isolation
- Full VM per sandbox, own kernel
- Regions
- EU: Germany, Finland, France
Baponi
Baponi is a sandboxed code execution API for AI agents: send Python, Node or Bash, get the output back.
Every call starts a fresh sandbox built on a hardened build of Google's nsjail, runs the code as an unprivileged user and tears it down, so nothing runs between calls. Pass a thread_id and the home directory is saved as a diff and restored on the next call. It is driven by a REST API, a Python SDK or as an MCP server, and is built for teams that want agents to run short bits of code safely.
Which use cases each one fits
For each use case, Battleships prices every sandbox provider on the same workload and sorts them from the cheapest monthly bill up. “3rd cheapest of 367” means 2 of the other 366 providers run that workload, with every feature it needs, for less. “With limits” means the provider runs it but misses something, so it is listed after every full match. Open a use case for its whole ranking and what each provider misses.
| Use case and its workload | boat: price rank | Baponi: price rank |
|---|---|---|
| Software factory 100 at once · 4 vCPU / 8 GB · 2,200 sessions of 8 h a month A software factory needs Docker, long builds and a dev server, and Baponi runs as an unprivileged user with no Docker and a one-hour limit per call. | 3rd cheapest of 367 $634 a month | 302nd of 367, with limits $5,935 a month |
| Always-on AI employees 50 machines 24/7 · 2 vCPU / 4 GB An assistant that lives on its machine all month cannot stay up on Baponi, where every call ends and nothing runs in between. | 5th cheapest of 366 $657 a month | 315th of 366, with limits $7,721 a month |
| Code interpreter bursts 100 at once · 1 vCPU / 2 GB · 200,000 sessions of 1 min a month Baponi is built for this: short Python, Node or Bash runs that start in under 20ms and stop billing when they end. | 186th of 345, with limits $2,000 a month | 41st cheapest of 345 $489 a month |
| Sandboxes for your users 300 at once · 2 vCPU / 4 GB · 30,000 sessions of 23 min a month Baponi's scoped API keys and blocked-by-default network suit running user code, but each user gets a jail per call rather than a machine with hosting. | Cheapest of 361 $209 a month | 167th of 361, with limits $2,631 a month |
| RL rollouts 1,000 at once · 2 vCPU / 4 GB · 1,000,000 sessions of 3 min a month | 34th of 360, with limits $2,000 a month | 159th of 360, with limits $12,155 a month |
| Agent evals 250 at once · 4 vCPU / 8 GB · 15,000 sessions of 20 min a month | 10th cheapest of 364 $200 a month | 306th of 364, with limits $2,018 a month |
| CI runners 40 at once · 8 vCPU / 16 GB · 6,000 sessions of 12 min a month CI jobs that build containers or run emulators need Docker and /dev/kvm, which boat has and Baponi's nsjail sandboxes do not. | 4th cheapest of 377 $86 a month | 328th of 377, with limits $1,252 a month |
| 24/7 dev boxes 1 machine 24/7 · 4 vCPU / 8 GB A dev box has to stay running and be reachable over SSH, and Baponi has no SSH and no running machine between calls. | 18th cheapest of 368 $26 a month | 342nd of 368, with limits $393 a month |
| Computer-use agents 50 at once · 4 vCPU / 8 GB · 20,000 sessions of 15 min a month Computer-use agents need a desktop and a browser, which boat streams at 60fps and Baponi does not offer. | 6th cheapest of 369 $200 a month | 299th of 369, with limits $1,857 a month |
| Browser-use agents 50 at once · 2 vCPU / 4 GB · 30,000 sessions of 10 min a month | 7th cheapest of 367 $200 a month | 309th of 367, with limits $1,052 a month |
| Scraping & bots (startup scale) 50 at once · 1 vCPU / 2 GB · 100,000 sessions of 3 min a month | 6th cheapest of 346 $90 a month | 297th of 346, with limits $675 a month |
| Mass scraping & bots (undetectable) 1,000 at once · 1 vCPU / 2 GB · 3,000,000 sessions of 2 min a month | 71st of 338, with limits $1,800 a month | 245th of 338, with limits $11,854 a month |
| Parallel red teaming 200 at once · 2 vCPU / 4 GB · 5,000 sessions of 30 min a month Red teaming often needs root, raw network tools and Docker, and Baponi drops every Linux capability by design. | 2nd cheapest of 360 $200 a month | 296th of 360, with limits $676 a month |
| GPU eval jobs 10 at once · 8 vCPU / 32 GB · 500 sessions of 30 min a month | Can't run it | Can't run it |
| macOS agents 5 at once · 4 vCPU / 8 GB · 1,000 sessions of 20 min a month | Can't run it | Can't run it |
Key features
| Feature | boat | Baponi |
|---|---|---|
| Isolation | Full VM with its own kernel on dedicated AMD Ryzen 9 9950X hosts | Hardened nsjail on a shared kernel: namespaces, seccomp, cgroups, zero capabilities |
| Root and Docker | Root, systemd and Docker inside the sandbox | Runs as unprivileged UID 1000 with zero capabilities, so no Docker |
| Nested virtualization | Yes, /dev/kvm for Android emulators and VMs | No; isolation is kernel-level, not hardware virtualization |
| Run length | No cap on paid plans; you set the time to live | 60 seconds per execution on Free, 1 hour on Pro, unlimited on Enterprise |
| Biggest machine | Up to 16 vCPU / 32 GB on the $100 plan and above | Up to 4 CPU / 4 GiB on Pro; more on self-hosted Enterprise |
| Start time | A VM boot per start | Under 20ms to set up each sandbox, on every call |
| State between runs | The whole disk stays, saved every minute and on stop; fork a running sandbox | Diff of /home/baponi saved per thread_id; nothing runs between calls, no fork |
| Inbound access | HTTPS URLs for up to 50 ports, token-protected by default; raw TCP; SSH | None; outbound only, no ports, preview URLs or SSH |
| Outbound network | Open internet, no provider-side allowlist | Blocked by default (no network interface) or unrestricted, set per sandbox; a key can only narrow it |
| Desktop and browser | 60fps Linux desktop with Chromium and computer use | Not offered; code execution only |
| Coding agents | Seven agents preinstalled, with a prompt, steer and events API | Claude Code runs headless through the execute endpoint; you parse its output |
| Keeping API keys out of the sandbox | Credentials proxy for model providers and any HTTPS API; real keys never enter the machine | Connectors inject keys into the sandbox for each run (ANTHROPIC_API_KEY, GH_TOKEN) and wipe them after; bucket credentials stay outside |
| MCP server | No hosted MCP endpoint | Native MCP server at api.baponi.ai/mcp |
| Self-hosting | No | Enterprise runs in your Kubernetes cluster, including air-gapped |
| Compliance and transparency | SOC 2 is in progress. We're open about where we stand: live status and data retention policy. | No SOC 2 report published |
Every feature Battleships tracks (43)
| Feature | boat | Baponi |
|---|---|---|
| Full VM (own kernel) | Yes | No |
| Docker inside | Yes | No |
| Nested virtualization | Yes | No |
| Root | Yes | No |
| Systemd | Yes | Not published |
| Desktop GUI | Yes | No |
| Browser | Yes | No |
| Computer-use API | Yes | No |
| SSH | Yes | No |
| Persistent disk | Yes | Yes |
| Pause/resume | Yes | No |
| Automatic snapshots | Yes | Yes |
| Fork/clone | Yes | No |
| Live fork (no pause) | Yes | No |
| Memory fork | No | No |
| Custom image (Docker or snapshot) | Yes | Yes |
| ≥24 h sessions | Yes | No |
| Idle auto-stop | No | Yes |
| Wake on request | No | Yes |
| HTTPS preview URLs | Yes | No |
| Raw TCP inbound | Yes | Not published |
| Public IPv4 | No | No |
| Egress allowlist | No | No |
| Secret proxy | Yes | No |
| Secret proxy for any API | Yes | No |
| Preinstalled agents | Yes | Yes |
| Agent harness API | Yes | No |
| MCP server | No | Yes |
| GPU | No | No |
| Windows | No | No |
| Arm64 | No | Not published |
| Self-hosting | No | Yes |
| BYOC | No | Yes |
| Open source | No | No |
| Scoped API keys | Yes | Yes |
| Spend limits | Yes | Not published |
| Usage per sandbox (API) | Yes | No |
| Audit logs | No | Yes |
| SSO | No | Yes |
| SOC 2 | No | No |
| HIPAA | No | No |
| EU data residency | Yes | No |
| Zero data retention | Yes | Not published |
Performance
There is no comparable measurement for Baponi: it was not part of the hpc-sandbox-benchmarks run. boat did 26.69 runs per second on that Node.js build-and-test loop at 4 vCPU / 8 GB, on dedicated AMD Ryzen 9 9950X hosts. Baponi's largest self-serve size is 4 CPU / 4 GiB, so the same shape could not be tested there.
Node.js build-and-test loop at 4 vCPU / 8 GB, higher is better. Measured with the open hpc-sandbox-benchmarks suite. Baponi has no published run in this suite yet, so there is no like-for-like number to compare.
Pricing in five scenarios
Each bill is priced from the providers' public price lists by the open Battleships engine, with the cheapest plan that runs the scenario.
| Scenario | boat, a month | Baponi, a month |
|---|---|---|
| One coding agent, workdays 4 vCPU / 8 GB, 50 GB disk, 8 hours a day, 22 days a month, files kept between days | $20 · $20/mo | $164 · Pro · with limits |
| One agent that never stops 4 vCPU / 8 GB, 50 GB disk, running 24/7 all month | $26 · $20/mo | $407 · Pro · with limits |
| 50 agents in parallel 50 machines of 4 vCPU / 8 GB at once, 8-hour sessions, 1,100 sessions a month, Docker inside | $317 · $20/mo × 3 seats | $3,910 · Pro · with limits |
| Sandboxes for your users 2 vCPU / 4 GB, 30,000 sessions of 10 minutes a month, up to 300 at once | $200 · $100/mo × 2 seats | $1,173 · Pro · with limits |
| 1,000 short jobs at once 2 vCPU / 4 GB, 1,000 at once, 3 minutes each, 200,000 jobs a month | $2,000 · $2000/mo · with limits | $2,501 · Pro · with limits |
boat: Plans start at $20 a month, and the whole fee is usage credit. You pay per second while a sandbox runs, and a stopped sandbox costs nothing and keeps its disk.
Baponi: Baponi bills in credits: one credit is 60 seconds at 1 CPU and 1 GiB, and bigger sizes use credits in proportion. Pro is $97 a month with 10,000 credits, then $1 per 1,000 credits; storage past 10 GB is $0.10 per GB a month.
Limits in those scenarios
Baponi Pro stops each execution at 1 hour and tops out at 4 CPU / 4 GiB, so the workday, always-on and fleet scenarios do not fit: the agent has to be cut into one-hour calls on a smaller machine. The fleet scenario also needs Docker inside, which Baponi does not allow. Pro allows 100 runs at once, which is what limits the user-sandbox and burst scenarios; boat's big burst is limited instead by how fast its plans can start machines.
| Scenario | boat | Baponi |
|---|---|---|
| One coding agent, workdays | None that bite |
|
| One agent that never stops | None that bite |
|
| 50 agents in parallel | None that bite |
|
| Sandboxes for your users | None that bite |
|
| 1,000 short jobs at once |
|
|
Which one should you use?
Use Baponi when
your agent only needs to run short Python, Node or Bash snippets with no network by default, or you must self-host the sandbox layer in your own Kubernetes cluster.
- Tiny runs that start in 20ms. Suits agents that run short snippets: each call gets a fresh sandbox in under 20ms and billing stops when it ends.
- Locked-down network and scoped keys. Sandboxes have no network interface by default, and each API key can only narrow what its sandbox may do.
- Your own cluster, and an MCP server. Enterprise deploys the whole platform into your Kubernetes cluster with one Helm chart, air-gapped if needed.
Use boat when
your agents do real work on a real machine: root, Docker, emulators, a browser, dev servers on a URL, and tasks that run for hours without being cut off.
- A whole machine with root, Docker and /dev/kvm. Baponi runs code as an unprivileged user with zero capabilities, so an agent that needs docker build, apt install as root or an emulator simply cannot do it there.
- It keeps running, and you can reach it. On Baponi every call ends within an hour on Pro and nothing runs in between, so a dev server, a watcher or a long build has nowhere to live and no URL to open.
- Agents you drive from outside, keys kept out. On Baponi you run claude -p through the execute call and parse its output yourself, and the Anthropic key is placed inside the sandbox for the run, where the agent can read it.
Questions people ask
Is boat cheaper than Baponi?
In every scenario on this page, yes. A workday agent is $20 a month on boat against $164 on Baponi Pro, and Baponi Pro does not fully fit any of the five scenarios, mostly because of its one-hour limit, its 4 CPU / 4 GiB cap and its 100 runs at once.
Can I run Docker inside Baponi?
No. Baponi runs code as an unprivileged user with zero Linux capabilities and user namespaces turned off, so Docker cannot start. boat gives you root and Docker in every sandbox, plus /dev/kvm for emulators.
How long can a Baponi sandbox run?
Each execution can run up to 60 seconds on Free and 1 hour on Pro, and Enterprise has no limit. Between calls nothing runs; only the home directory is saved if you pass a thread_id. boat has no session cap on paid plans.
Is Baponi a VM?
No. Baponi uses a hardened build of Google's nsjail, which isolates code with Linux namespaces, seccomp and cgroups on a shared kernel. Its docs say this is kernel-level isolation, not hardware virtualization. Each boat sandbox is a full VM with its own kernel.
Can I use Claude Code on both?
Yes. On Baponi you run claude -p in headless mode through the execute call, and a connector places your Anthropic key in the sandbox. On boat, Claude Code and six other agents are preinstalled, you drive them through a prompt and steer API, and real keys stay in a proxy outside the machine.
Is boat SOC 2 compliant?
SOC 2 is in progress. We're open about where we stand: live status at status.ascii.dev and our data retention policy at docs.boat.dev/data-retention.
Start a sandbox
Install the CLI, then run boat new.
7-day free trial