boat vs Cloudflare Sandbox
Both give each sandbox its own kernel. boat gives you a whole machine that keeps its files, runs a desktop and comes with coding agents; Cloudflare gives you a container inside its Workers platform that sleeps when idle and wakes on the next request.
Where boat stands out
A machine that keeps its files
A boat sandbox saves its disk every minute and when it stops, and it comes back with everything in place. You can also fork a running sandbox. On Cloudflare the disk starts fresh after sleep unless your code saves a snapshot or a backup first.
More fits inside one sandbox
boat gives you a full VM with root, systemd, full Docker, nested virtualization, a 60fps desktop and raw TCP. Cloudflare containers top out at 4 vCPU and 20 GB of disk by default, cannot change iptables, and no longer ship a desktop.
Agents ready to drive from outside
Claude Code, Codex, OpenCode and others come installed, and one API lets you prompt, steer and watch them. Real keys stay outside the sandbox, and a credential can switch to another account when one runs out of credits.
The companies and products
boat
boat.dev runs sandboxes for AI agents: each one is a full Linux VM with its own kernel.
You start a machine with one command or one API call, then SSH in, run Docker, open a desktop, or let a built-in agent (Claude Code, Codex, OpenCode and others) work in it. The disk stays between sessions, and a stopped sandbox costs nothing.
- Isolation
- Full VM per sandbox, own kernel
- Regions
- EU: Germany, Finland, France
Cloudflare Sandbox
Cloudflare Sandbox SDK runs untrusted or AI-generated code in Linux containers on Cloudflare's network, driven from a Cloudflare Worker.
Each sandbox is a Cloudflare Container backed by a Durable Object, and each container runs in its own Firecracker microVM with its own kernel and network. You build a linux/amd64 image, pick an instance type of up to 4 vCPU and 12 GiB, and reach the sandbox through your own Worker. It suits teams already on Workers who want short-lived sandboxes that sleep when idle; for code that only calls known methods, Cloudflare also offers Dynamic Workers, which run JavaScript in V8 isolates.
- Largest instance
- 4 vCPU, 12 GiB memory, 20 GB disk (defaults, can be raised)
- Account limits
- 1,500 vCPU, 6 TiB memory and 30 TB disk running at once
- Compliance
- Cloudflare holds a SOC 2 Type II report
Which use cases each one fits
For each use case, Battleships prices every sandbox provider on the same workload and sorts them from the cheapest monthly bill up. “2nd cheapest of 366” means 1 of the other 365 providers runs that workload, with every feature it needs, for less. “With limits” means the provider runs it but misses something, so it is listed after every full match. Open a use case for its whole ranking and what each provider misses.
| Use case and its workload | boat: price rank | Cloudflare Sandbox: price rank |
|---|---|---|
| Software factory 100 at once · 4 vCPU / 8 GB · 2,200 sessions of 8 h a month boat keeps an 8-hour session's disk and gives agents Docker, a desktop and a browser; on Cloudflare the disk resets when the container sleeps unless your code saves a snapshot, and a 4 vCPU machine has 20 GB of disk at most. | 2nd cheapest of 366 $634 a month | 154th of 366, with limits $1,543 a month |
| Always-on AI employees 50 machines 24/7 · 2 vCPU / 4 GB Always-on assistants need their files and logins to stay put; boat keeps the disk across stops, while Cloudflare wipes it on sleep and has no built-in browser or desktop. | 4th cheapest of 362 $657 a month | 198th of 362, with limits $2,188 a month |
| Code interpreter bursts 100 at once · 1 vCPU / 2 GB · 200,000 sessions of 1 min a month For short code-interpreter calls Cloudflare fits well: CPU is billed only while it is busy, and a container wakes on the next request. | 183rd of 342, with limits $2,000 a month | 8th cheapest of 342 $144 a month |
| Sandboxes for your users 300 at once · 2 vCPU / 4 GB · 30,000 sessions of 23 min a month Both fit sandboxes for your users; boat adds per-sandbox usage and spend limits, Cloudflare adds egress rules you write as Worker code. | Cheapest of 361 $209 a month | 7th cheapest of 361 $731 a month |
| RL rollouts 1,000 at once · 2 vCPU / 4 GB · 1,000,000 sessions of 3 min a month | 33rd of 358, with limits $2,000 a month | 139th of 358, with limits $9,428 a month |
| Agent evals 250 at once · 4 vCPU / 8 GB · 15,000 sessions of 20 min a month | 9th cheapest of 363 $200 a month | 39th cheapest of 363 $818 a month |
| CI runners 40 at once · 8 vCPU / 16 GB · 6,000 sessions of 12 min a month CI jobs that build Docker images need room and a full Docker setup; boat's VMs have both, while Cloudflare caps disk at 20 GB and blocks iptables changes. | 4th cheapest of 377 $86 a month | 290th of 377, with limits $704 a month |
| 24/7 dev boxes 1 machine 24/7 · 4 vCPU / 8 GB A dev box should keep its files when you log off; boat stops at no cost and resumes with its disk, Cloudflare starts from a fresh disk after sleep. | 17th cheapest of 369 $26 a month | 66th cheapest of 369 $93 a month |
| Computer-use agents 50 at once · 4 vCPU / 8 GB · 20,000 sessions of 15 min a month boat ships a 60fps desktop and a computer-use API; Cloudflare removed its built-in desktop, so you would build one into your own image. | 5th cheapest of 367 $200 a month | 162nd of 367, with limits $460 a month |
| Browser-use agents 50 at once · 2 vCPU / 4 GB · 30,000 sessions of 10 min a month | 5th cheapest of 363 $200 a month | 200th of 363, with limits $233 a month |
| Scraping & bots (startup scale) 50 at once · 1 vCPU / 2 GB · 100,000 sessions of 3 min a month | 4th cheapest of 341 $90 a month | 238th of 341, with limits $286 a month |
| Mass scraping & bots (undetectable) 1,000 at once · 1 vCPU / 2 GB · 3,000,000 sessions of 2 min a month | 65th of 337, with limits $1,800 a month | 165th of 337, with limits $5,741 a month |
| Parallel red teaming 200 at once · 2 vCPU / 4 GB · 5,000 sessions of 30 min a month Red-team runs often need nested VMs, raw TCP and full root networking; boat has these, while Cloudflare containers cannot change iptables and take no raw TCP from outside. | 3rd cheapest of 357 $200 a month | 232nd of 357, with limits $325 a month |
| GPU eval jobs 10 at once · 8 vCPU / 32 GB · 500 sessions of 30 min a month | Can't run it | Can't run it |
| macOS agents 5 at once · 4 vCPU / 8 GB · 1,000 sessions of 20 min a month | Can't run it | Can't run it |
Key features
| Feature | boat | Cloudflare Sandbox |
|---|---|---|
| Isolation | Full VM with its own kernel on dedicated AMD Ryzen 9 9950X hosts | Firecracker microVM per container, own kernel and network |
| Largest machine | Up to 16 vCPU / 32 GB, depending on plan | 4 vCPU / 12 GiB / 20 GB disk by default (can be raised) |
| Files between sessions | Disk kept; snapshot every minute and on stop; a stopped sandbox costs nothing | Disk is fresh after sleep; snapshots (public beta, 30 days) or R2 backups when your code saves them |
| Fork a running sandbox | Yes, without stopping it | No fork; restore a saved snapshot or backup into a new sandbox |
| Docker inside | Full Docker, root and systemd | docker:dind with iptables and IP forwarding turned off |
| Nested virtualization | Yes, /dev/kvm (Android emulators, VMs) | Not documented |
| Desktop and browser | 60fps desktop and Chromium, computer-use API, embeddable stream | Built-in desktop removed in SDK 0.10.2; bring your own |
| Inbound traffic | HTTPS URLs for up to 50 ports, token-protected; raw TCP; own IPv6 or IPv4 | HTTP and WebSocket previews routed through your Worker; no raw TCP or public IP |
| Egress control | No provider-side allowlist | allowedHosts deny-by-default list plus outbound handlers you write in Worker code |
| Keeping keys out of the sandbox | Managed proxy for model providers and any HTTPS API you register; switch a credential to another account | Your outbound handler adds the token for any HTTP or HTTPS host; you write the code |
| Coding agents | Claude Code, Codex, pi, OpenCode and more built in, with a prompt, steer and events API | Run Claude Code, Codex, OpenCode or Pi in your image; OpenCode has an SDK helper |
| Sleep when idle | TTL based (1 h default, changeable); no idle timer | Stops after inactivity and wakes on the next request |
| Regions | EU only: Germany, Finland, France | Several regions across Cloudflare's network |
| Compliance and transparency | SOC 2 is in progress. We're open about where we stand: live status and data retention policy. | SOC 2 |
Every feature Battleships tracks (43)
| Feature | boat | Cloudflare Sandbox |
|---|---|---|
| Full VM (own kernel) | Yes | Yes |
| Docker inside | Yes | Yes |
| Nested virtualization | Yes | No |
| Root | Yes | Yes |
| Systemd | Yes | Not published |
| Desktop GUI | Yes | No |
| Browser | Yes | No |
| Computer-use API | Yes | No |
| SSH | Yes | Yes |
| Persistent disk | Yes | No |
| Pause/resume | Yes | No |
| Automatic snapshots | Yes | No |
| Fork/clone | Yes | No |
| Live fork (no pause) | Yes | No |
| Memory fork | No | No |
| Custom image (Docker or snapshot) | Yes | Yes |
| ≥24 h sessions | Yes | Yes |
| Idle auto-stop | No | Yes |
| Wake on request | No | Yes |
| HTTPS preview URLs | Yes | Yes |
| Raw TCP inbound | Yes | No |
| Public IPv4 | No | No |
| Egress allowlist | No | Yes |
| Secret proxy | Yes | Yes |
| Secret proxy for any API | Yes | Yes |
| Preinstalled agents | Yes | Yes |
| Agent harness API | Yes | Yes |
| MCP server | No | No |
| GPU | No | No |
| Windows | No | No |
| Arm64 | No | No |
| Self-hosting | No | No |
| BYOC | No | No |
| Open source | No | Yes |
| Scoped API keys | Yes | Not published |
| Spend limits | Yes | No |
| Usage per sandbox (API) | Yes | Not published |
| Audit logs | No | Yes |
| SSO | No | Yes |
| SOC 2 | No | Yes |
| HIPAA | No | Yes |
| EU data residency | Yes | Yes |
| Zero data retention | Yes | Not published |
Performance
boat has a CPU score on the hpc-sandbox-benchmarks Node.js build-and-test loop at 4 vCPU / 8 GB. Cloudflare has no result on that benchmark, so there is no comparable CPU number between the two.
Node.js build-and-test loop at 4 vCPU / 8 GB, higher is better. Measured with the open hpc-sandbox-benchmarks suite. Cloudflare Sandbox has no published run in this suite yet, so there is no like-for-like number to compare.
Pricing in five scenarios
Each bill is priced from the providers' public price lists by the open Battleships engine, with the cheapest plan that runs the scenario.
| Scenario | boat, a month | Cloudflare Sandbox, a month |
|---|---|---|
| One coding agent, workdays 4 vCPU / 8 GB, 50 GB disk, 8 hours a day, 22 days a month, files kept between days | $20 · $20/mo | $39 · Workers Paid · with limits |
| One agent that never stops 4 vCPU / 8 GB, 50 GB disk, running 24/7 all month | $26 · $20/mo | $148 · Workers Paid · with limits |
| 50 agents in parallel 50 machines of 4 vCPU / 8 GB at once, 8-hour sessions, 1,100 sessions a month, Docker inside | $317 · $20/mo × 3 seats | $1,660 · Workers Paid · with limits |
| Sandboxes for your users 2 vCPU / 4 GB, 30,000 sessions of 10 minutes a month, up to 300 at once | $200 · $100/mo × 2 seats | $476 · Workers Paid |
| 1,000 short jobs at once 2 vCPU / 4 GB, 1,000 at once, 3 minutes each, 200,000 jobs a month | $2,000 · $2000/mo · with limits | $1,889 · Workers Paid · with limits |
boat: You pay a monthly plan from $20, and all of it is usage credit, billed per second while a sandbox runs. A stopped sandbox costs nothing and keeps its disk.
Cloudflare Sandbox: You need Workers Paid ($5 a month minimum). CPU is billed only while it is in use; memory and disk are billed on the instance size you picked, in 10 ms steps, until the container sleeps.
Cloudflare Sandbox: There is no 4 vCPU / 8 GB size: 4 vCPU always comes with 12 GiB. Durable Object and Worker requests are billed on top, and egress is free up to 1 TB in North America and Europe, then $0.025 per GB.
Limits in those scenarios
Cloudflare's disk resets after sleep and tops out at 20 GB, so the scenarios that keep 50 GB of files between days do not fit without your own snapshot or backup code. An account can run 1,500 vCPU at once by default, which is short of the 2,000 vCPU the 1,000-job burst needs, though Cloudflare says the limit can be raised. On boat, that burst runs into start limits: the $2,000 plan allows 600 starts an hour, and bursts above 90 starts a minute wait in a queue.
| Scenario | boat | Cloudflare Sandbox |
|---|---|---|
| One coding agent, workdays | None that bite |
|
| One agent that never stops | None that bite |
|
| 50 agents in parallel | None that bite |
|
| Sandboxes for your users | None that bite | None that bite |
| 1,000 short jobs at once |
|
|
Which one should you use?
Use Cloudflare Sandbox when
your app already runs on Workers and you want short sandboxes that sleep when idle and wake on the next request.
- Egress rules you can program. Cloudflare can block every host except the ones you list, and run your own code on each outbound request.
- Sleeps when idle, wakes on request. Useful for many short, spiky sessions: a sandbox sleeps when idle, wakes on the next request, and bills CPU only while busy.
- Wide footprint inside the Cloudflare platform. If your app already runs on Workers, sandboxes sit next to Durable Objects and R2, in several regions.
Use boat when
your agents do real work for hours: builds, tests, full Docker, emulators and a desktop, on a machine that keeps its files between sessions.
- A machine that keeps its files. On Cloudflare a sandbox that sleeps comes back with an empty disk, so an agent loses its cloned repo, installed packages and half-done work unless your code saves a snapshot or backup first.
- More fits inside one sandbox. Agent builds outgrow a small box fast: 20 GB of disk by default fills after a few Docker images, Docker runs with iptables turned off, and there is no desktop for checking a UI.
- Agents ready to drive from outside. On Cloudflare you bake each agent into your image and write the outbound handler that adds every token yourself, then keep that code working as providers and keys change.
Questions people ask
Is boat cheaper than Cloudflare Sandbox?
In four of the five scenarios on this page, boat costs less, mostly because a stopped boat sandbox costs nothing and keeps its disk. For 1,000 short jobs at once, Cloudflare's estimate is a little lower, and neither fits that scenario without raised limits.
Does Cloudflare Sandbox keep my files?
Only while the container runs. When it sleeps, the next start uses a fresh disk, unless your code saved a snapshot (public beta, kept 30 days) or a directory backup to R2. boat keeps the disk on its own.
Is a Cloudflare sandbox a VM or a container?
Both, in a way. You ship a container image, and Cloudflare runs each container in its own Firecracker microVM with its own kernel. boat sandboxes are full VMs you boot directly, with root and systemd.
Can I run Docker inside either one?
Yes. boat runs full Docker. Cloudflare supports docker:dind with the daemon's iptables and IP forwarding turned off, because containers cannot change iptables.
Can I limit where a sandbox connects to?
On Cloudflare, yes: allowedHosts blocks every host not on your list, and outbound handlers can inspect and change each HTTP request. boat does not offer a provider-side egress allowlist today.
Where does each one run?
boat runs in the EU only, in Germany, Finland and France. Cloudflare places containers in several regions of its network and picks the nearest free instance.
Start a sandbox
Install the CLI, then run boat new.
7-day free trial