boat vs CreateOS Sandbox
Both give each agent its own Linux machine with its own kernel. boat gives the agent a bigger machine with a coding agent you drive by API and real hosting, while CreateOS is strongest at pausing a sandbox with its memory and waking it on the next request.
Where boat stands out
Coding agents you drive from outside
boat ships seven coding agents in every sandbox, and you drive agents inside from outside with one API: prompt them, steer them mid-task and follow their events. Real API keys stay in a credentials proxy outside the sandbox, and a credential can switch to another account when one runs out of credits.
A bigger, fuller machine
A boat sandbox goes up to 16 vCPU / 32 GB, exposes /dev/kvm for Android emulators and nested VMs, and runs systemd with root. You can fork it while it runs, without pausing it first.
Hosting and room for a fleet
Every boat sandbox can serve HTTPS on up to 50 ports with a token in front by default, take raw TCP, and get its own IP. The $20 plan runs 100 sandboxes at once, and higher plans run up to 2,000.
The companies and products
boat
boat.dev runs sandboxes for AI agents: each one is a full Linux VM with its own kernel.
You start a machine with one command or one API call, then SSH in, run Docker, open a desktop, or let a built-in agent (Claude Code, Codex, OpenCode and others) work in it. The disk stays between sessions, and a stopped sandbox costs nothing.
- Isolation
- Full VM per sandbox, own kernel
- Regions
- EU: Germany, Finland, France
CreateOS Sandbox
CreateOS Sandbox is the agent sandbox from NodeOps: an API that gives each AI agent its own Firecracker microVM.
Each sandbox is a Firecracker microVM with its own Linux kernel, booted from images like devbox:1 (Ubuntu with Docker and five coding agent CLIs) or desktop:1 (an XFCE desktop with Chrome). You drive it from a TypeScript SDK, a CLI, MCP or REST, pause it to a memory snapshot, fork the paused copy, and lock its outbound traffic to an allowlist. It is one product inside the wider CreateOS platform, which also sells an AI gateway, app deploys and an agent builder.
- Machine size
- Up to 4 vCPU / 4 GB on Beginner, 8 vCPU / 8 GB on Pro, 8 vCPU / 16 GB on Enterprise; no GPUs
- Concurrency
- 1, 5, 20 or 30 sandboxes at once by plan, and 10 to 300 creates per day; paused sandboxes count
- Your own infrastructure
- Enterprise only: sandboxes on your hardware or cloud account, control plane run by CreateOS
Which use cases each one fits
For each use case, Battleships prices every sandbox provider on the same workload and sorts them from the cheapest monthly bill up. “3rd cheapest of 367” means 2 of the other 366 providers run that workload, with every feature it needs, for less. “With limits” means the provider runs it but misses something, so it is listed after every full match. Open a use case for its whole ranking and what each provider misses.
| Use case and its workload | boat: price rank | CreateOS Sandbox: price rank |
|---|---|---|
| Software factory 100 at once · 4 vCPU / 8 GB · 2,200 sessions of 8 h a month A software factory needs many agents at once on big machines; CreateOS Pro stops at 20 sandboxes and 8 vCPU / 8 GB, while boat goes to 16 vCPU / 32 GB with nested virtualization. | 3rd cheapest of 367 $634 a month | 26th of 367, with limits $3,122 a month |
| Always-on AI employees 50 machines 24/7 · 2 vCPU / 4 GB An always-on assistant needs its agent driven by API and its keys kept safe; boat has both built in, while on CreateOS you run the agent CLI yourself and its keys sit inside the VM. | 5th cheapest of 366 $657 a month | 44th of 366, with limits $3,841 a month |
| Code interpreter bursts 100 at once · 1 vCPU / 2 GB · 200,000 sessions of 1 min a month CreateOS fits short code runs better: small shapes from a quarter of a vCPU, per-second billing, and a pause that keeps memory between calls. | 186th of 345, with limits $2,000 a month | 108th of 345, with limits $197 a month |
| Sandboxes for your users 300 at once · 2 vCPU / 4 GB · 30,000 sessions of 23 min a month Each user sandbox counts against a CreateOS cap of 20 on Pro even while paused, though wake on request is a real plus for user apps that sleep. | Cheapest of 361 $209 a month | 125th of 361, with limits $1,249 a month |
| RL rollouts 1,000 at once · 2 vCPU / 4 GB · 1,000,000 sessions of 3 min a month CreateOS can fork a paused sandbox with its memory into many branches, which suits rollouts that start from the same state, but its daily create caps limit volume. | 34th of 360, with limits $2,000 a month | 96th of 360, with limits $5,980 a month |
| Agent evals 250 at once · 4 vCPU / 8 GB · 15,000 sessions of 20 min a month | 10th cheapest of 364 $200 a month | 150th of 364, with limits $962 a month |
| CI runners 40 at once · 8 vCPU / 16 GB · 6,000 sessions of 12 min a month CI runners that build Android apps or VM images need /dev/kvm, which boat exposes and CreateOS does not document. | 4th cheapest of 377 $86 a month | 165th of 377, with limits $585 a month |
| 24/7 dev boxes 1 machine 24/7 · 4 vCPU / 8 GB Both run with no session cap; boat adds a dedicated IP, raw TCP and token-protected ports, so a dev box can host real services. | 18th cheapest of 368 $26 a month | 100th cheapest of 368 $155 a month |
| Computer-use agents 50 at once · 4 vCPU / 8 GB · 20,000 sessions of 15 min a month Both ship a Linux desktop with Chrome and computer-use APIs; boat streams it at 60fps and can be embedded in your app. | 6th cheapest of 369 $200 a month | 51st of 369, with limits $866 a month |
| Browser-use agents 50 at once · 2 vCPU / 4 GB · 30,000 sessions of 10 min a month | 7th cheapest of 367 $200 a month | 83rd of 367, with limits $433 a month |
| Scraping & bots (startup scale) 50 at once · 1 vCPU / 2 GB · 100,000 sessions of 3 min a month | 6th cheapest of 346 $90 a month | 93rd of 346, with limits $293 a month |
| Mass scraping & bots (undetectable) 1,000 at once · 1 vCPU / 2 GB · 3,000,000 sessions of 2 min a month | 71st of 338, with limits $1,800 a month | 170th of 338, with limits $5,863 a month |
| Parallel red teaming 200 at once · 2 vCPU / 4 GB · 5,000 sessions of 30 min a month | 2nd cheapest of 360 $200 a month | 29th of 360, with limits $292 a month |
| GPU eval jobs 10 at once · 8 vCPU / 32 GB · 500 sessions of 30 min a month | Can't run it | Can't run it |
| macOS agents 5 at once · 4 vCPU / 8 GB · 1,000 sessions of 20 min a month | Can't run it | Can't run it |
Key features
| Feature | boat | CreateOS Sandbox |
|---|---|---|
| Isolation | Full VM with its own kernel on dedicated AMD Ryzen 9 9950X hosts | Firecracker microVM with its own kernel |
| Biggest machine | Up to 16 vCPU / 32 GB on the $100 plan and above | 4 vCPU / 4 GB on Beginner, 8 vCPU / 8 GB on Pro, 8 vCPU / 16 GB on Enterprise |
| Sandboxes at once | 100 on the $20 plan, up to 2,000 on higher plans | 1, 5, 20 or 30 by plan; paused sandboxes count until destroyed |
| Session length | No cap on paid plans; you set the time to live | No cap; a sandbox runs until you destroy or pause it |
| Pause and resume | Disk is saved every minute and on stop; a stopped sandbox costs nothing; resume boots the machine again | Pause saves memory, registers and disk; resume restores running processes; memory and storage are still billed while paused |
| Wake on request | No; a stopped sandbox is started by API | Yes; hitting a paused sandbox's HTTPS URL resumes it |
| Fork | Fork a running sandbox with its disk, no pause needed | Fork a paused sandbox with its memory into any number of copies; the source must be paused first |
| Nested virtualization | Yes, /dev/kvm for Android emulators and VMs | Not documented inside the sandbox |
| Inbound access | HTTPS URLs for up to 50 ports, token-protected by default; raw TCP; dedicated IPv4 or IPv6 | One HTTPS URL per sandbox when ingress is on, with no auth in front; no public IP |
| Outbound rules | Open internet, no provider-side allowlist | Allowlist by host, IP or CIDR, enforced in the host kernel outside the VM |
| Coding agents | Seven agents preinstalled, with a prompt, steer and events API | Five agent CLIs preinstalled (Claude Code, Codex, OpenCode, Cursor, Pi), run through exec or a terminal |
| Keeping API keys out of the sandbox | Credentials proxy for model providers and any HTTPS API; switch a credential to another account when credits run out | Env vars and files only; anything you put in is readable by code inside |
| Desktop and computer use | Linux desktop streamed at 60fps with Chromium and computer use | XFCE desktop with Chrome and computer-use APIs |
| Regions and hosting | EU only (Germany, Finland, France) | EU and US, plus your own hardware or cloud account on Enterprise |
| Compliance and transparency | SOC 2 is in progress. We're open about where we stand: live status and data retention policy. | SOC 2 |
Every feature Battleships tracks (43)
| Feature | boat | CreateOS Sandbox |
|---|---|---|
| Full VM (own kernel) | Yes | Yes |
| Docker inside | Yes | Yes |
| Nested virtualization | Yes | No |
| Root | Yes | Yes |
| Systemd | Yes | No |
| Desktop GUI | Yes | Yes |
| Browser | Yes | Yes |
| Computer-use API | Yes | Yes |
| SSH | Yes | Yes |
| Persistent disk | Yes | Yes |
| Pause/resume | Yes | Yes |
| Automatic snapshots | Yes | Yes |
| Fork/clone | Yes | Yes |
| Live fork (no pause) | Yes | No |
| Memory fork | No | Yes |
| Custom image (Docker or snapshot) | Yes | Yes |
| ≥24 h sessions | Yes | Yes |
| Idle auto-stop | No | Yes |
| Wake on request | No | Yes |
| HTTPS preview URLs | Yes | Yes |
| Raw TCP inbound | Yes | No |
| Public IPv4 | No | No |
| Egress allowlist | No | Yes |
| Secret proxy | Yes | No |
| Secret proxy for any API | Yes | No |
| Preinstalled agents | Yes | Yes |
| Agent harness API | Yes | No |
| MCP server | No | Yes |
| GPU | No | No |
| Windows | No | No |
| Arm64 | No | No |
| Self-hosting | No | Yes |
| BYOC | No | Yes |
| Open source | No | No |
| Scoped API keys | Yes | Yes |
| Spend limits | Yes | Not published |
| Usage per sandbox (API) | Yes | No |
| Audit logs | No | Yes |
| SSO | No | Yes |
| SOC 2 | No | Yes |
| HIPAA | No | No |
| EU data residency | Yes | Yes |
| Zero data retention | Yes | Not published |
Performance
There is no comparable measurement. boat did 26.69 runs per second on the StarSling hpc-sandbox-benchmarks Node.js build-and-test loop at 4 vCPU / 8 GB, and CreateOS has no run on that benchmark yet. CreateOS's own docs give about 210 ms median from create to first command, which measures start time, not CPU speed.
Node.js build-and-test loop at 4 vCPU / 8 GB, higher is better. Measured with the open hpc-sandbox-benchmarks suite. CreateOS Sandbox has no published run in this suite yet, so there is no like-for-like number to compare.
Pricing in five scenarios
Each bill is priced from the providers' public price lists by the open Battleships engine, with the cheapest plan that runs the scenario.
| Scenario | boat, a month | CreateOS Sandbox, a month |
|---|---|---|
| One coding agent, workdays 4 vCPU / 8 GB, 50 GB disk, 8 hours a day, 22 days a month, files kept between days | $20 · $20/mo | $75 · Pro |
| One agent that never stops 4 vCPU / 8 GB, 50 GB disk, running 24/7 all month | $26 · $20/mo | $162 · Pro |
| 50 agents in parallel 50 machines of 4 vCPU / 8 GB at once, 8-hour sessions, 1,100 sessions a month, Docker inside | $317 · $20/mo × 3 seats | $1,996 · Pro · with limits |
| Sandboxes for your users 2 vCPU / 4 GB, 30,000 sessions of 10 minutes a month, up to 300 at once | $200 · $100/mo × 2 seats | $541 · Pro · with limits |
| 1,000 short jobs at once 2 vCPU / 4 GB, 1,000 at once, 3 minutes each, 200,000 jobs a month | $2,000 · $2000/mo · with limits | $1,196 · Pro · with limits |
boat: Plans start at $20 a month, and the whole fee is usage credit. You pay per second while a sandbox runs, and a stopped sandbox costs nothing and keeps its disk.
CreateOS Sandbox: CreateOS bills per second for the vCPU and RAM of the shape while it runs, plus storage for the whole month, with no egress fees. A paused sandbox stops paying for vCPU but still pays for memory and storage, and the plan you need is set by machine size and sandbox count: a 4 vCPU / 8 GB machine needs Pro at $75 a month, which comes back as usage credits.
Limits in those scenarios
CreateOS caps how many sandboxes exist at once at 20 on Pro and 30 on Enterprise, and paused ones count until you destroy them, so 50 agents in parallel and a sandbox per user do not fit. It also caps creates at 200 a day on Pro. At 1,000 short jobs at once neither fits: boat's $2,000 plan queues starts and has daily start limits, and CreateOS stops at 20 running. boat has no such low concurrency cap, but its start rate limits are the thing that bites in that burst.
| Scenario | boat | CreateOS Sandbox |
|---|---|---|
| One coding agent, workdays | None that bite | None that bite |
| One agent that never stops | None that bite | None that bite |
| 50 agents in parallel | None that bite |
|
| Sandboxes for your users | None that bite |
|
| 1,000 short jobs at once |
|
|
Which one should you use?
Use CreateOS Sandbox when
your sandboxes sleep between requests and must wake with their memory intact, when untrusted code needs a host-enforced outbound allowlist, or when you must run in the US or on your own infrastructure.
- Memory pause and wake on request. Useful for apps and agents that sleep between requests: a paused sandbox comes back with its processes still running.
- Outbound allowlists enforced on the host. For untrusted code that must only reach a few hosts, rules are enforced outside the VM where code cannot change them.
- US region and your own infrastructure. CreateOS runs in the US as well as the EU, and Enterprise customers can run sandboxes on their own hardware or cloud account.
Use boat when
agents do real work for hours at fleet scale: coding agents you drive by API with keys kept outside, big machines with /dev/kvm, Docker and systemd, and services hosted on your own IP.
- Coding agents you drive from outside. CreateOS installs the agent CLIs but gives you no API to drive them, so you build the harness over exec. Its docs also say every env var and file you put in is readable by code inside, so one prompt injection can leak keys.
- A bigger, fuller machine. On CreateOS Pro the largest machine is 8 vCPU / 8 GB, a fork needs the source paused, and emulators or VMs have no documented /dev/kvm to start on.
- Hosting and room for a fleet. CreateOS gives one HTTPS URL per sandbox with no auth in front and no public IP, and caps a fleet at 20 sandboxes on Pro and 30 on Enterprise, counting paused ones.
Questions people ask
Is boat cheaper than CreateOS Sandbox?
In the scenarios on this page, yes: one workday agent is $20 a month on boat against $75 on CreateOS Pro, and one agent that never stops is $26 against $162. For 50 agents or a sandbox per user, CreateOS's 20-sandbox cap on Pro means it does not fit, and for 1,000 short jobs at once neither fits.
Can boat pause a sandbox with its memory like CreateOS?
No. boat saves the disk every minute and when the sandbox stops, so files survive, but resuming boots the machine again. CreateOS pauses into a memory snapshot and resumes running processes, though it keeps billing memory and storage while paused.
Do both come with coding agents?
Yes. CreateOS's devbox:1 and desktop:1 images include Claude Code, Codex, OpenCode, Cursor CLI and Pi, which you run through exec or a terminal. boat ships seven agents and an API to prompt, steer and follow them from outside, with real keys kept in a credentials proxy.
Can I run Docker and Android emulators in each?
Both run Docker inside the sandbox. boat also exposes /dev/kvm for Android emulators and nested VMs, which CreateOS does not document for its sandboxes.
How many sandboxes can I run at once?
CreateOS allows 1, 5, 20 or 30 at once by plan, counting paused sandboxes, and 10 to 300 creates per day. boat runs 100 at once on the $20 plan and up to 2,000 on higher plans.
Is boat SOC 2 compliant?
SOC 2 is in progress. We're open about where we stand: live status at status.ascii.dev and our data retention policy at docs.boat.dev/data-retention.
Start a sandbox
Install the CLI, then run boat new.
7-day free trial