boat vs Declaw
Both give each agent its own Linux VM and keep real API keys out of it. boat gives the agent a whole machine with coding agents, a desktop and no time limit, while Declaw wraps short sandboxes in guardrails that scan and filter what the agent sends.
Where boat stands out
A machine that runs as long as the work
A boat sandbox has no session cap on paid plans, and its disk is saved every minute and kept through free stops. Declaw stops a Pro sandbox at 72 hours, and by default a timed-out sandbox is killed with its files.
Coding agents you drive from outside
Claude Code, Codex and five other agents come preinstalled in every boat sandbox. You prompt, steer and follow the agents inside from outside through one API, and real model keys stay in boat's credentials proxy.
A whole computer, not a headless box
boat gives the agent a 60fps Linux desktop with Chromium and computer use, nested virtualization for Android emulators and VMs, SSH, raw TCP and up to 32 GB of RAM. Declaw sandboxes are headless and reached through its API.
The companies and products
boat
boat.dev runs sandboxes for AI agents: each one is a full Linux VM with its own kernel.
You start a machine with one command or one API call, then SSH in, run Docker, open a desktop, or let a built-in agent (Claude Code, Codex, OpenCode and others) work in it. The disk stays between sessions, and a stopped sandbox costs nothing.
- Isolation
- Full VM per sandbox, own kernel
- Regions
- EU: Germany, Finland, France
Declaw
Declaw calls itself the secure sandbox for AI agents: Firecracker microVMs with guardrails and policy controls in one SDK.
Each Declaw sandbox is a Firecracker microVM with its own kernel that boots in about 125 ms and runs until it times out or is killed. Around it sits a security layer: outbound rules, a credential vault, PII redaction, prompt injection and toxicity scans, custom OPA policies and audit logs. It is built for teams shipping agents in production who want those controls in front of every call, and it runs as a managed cloud or inside your own cloud or data center.
- Session length
- 1 hour on Free, 72 hours on Pro, 7 days on Enterprise
Which use cases each one fits
For each use case, Battleships prices every sandbox provider on the same workload and sorts them from the cheapest monthly bill up. “3rd cheapest of 367” means 2 of the other 366 providers run that workload, with every feature it needs, for less. “With limits” means the provider runs it but misses something, so it is listed after every full match. Open a use case for its whole ranking and what each provider misses.
| Use case and its workload | boat: price rank | Declaw: price rank |
|---|---|---|
| Software factory 100 at once · 4 vCPU / 8 GB · 2,200 sessions of 8 h a month A software factory needs long builds, Docker and coding agents; Declaw stops a Pro sandbox at 72 hours and ships no coding agent to drive. | 3rd cheapest of 367 $634 a month | 300th of 367, with limits $5,882 a month |
| Always-on AI employees 50 machines 24/7 · 2 vCPU / 4 GB An assistant that lives on its machine all month hits Declaw's 72-hour cap, while boat can simply keep running. | 5th cheapest of 366 $657 a month | 295th of 366, with limits $6,154 a month |
| Code interpreter bursts 100 at once · 1 vCPU / 2 GB · 200,000 sessions of 1 min a month Declaw fits short code runs well: fast boots, memory pause that costs nothing while paused, and scans on what the code sends out. | 186th of 345, with limits $2,000 a month | 29th cheapest of 345 $279 a month |
| Sandboxes for your users 300 at once · 2 vCPU / 4 GB · 30,000 sessions of 23 min a month Both fit; boat gives each user a bigger machine with hosting and a desktop, while Declaw adds per-sandbox outbound rules and content scans. | Cheapest of 361 $209 a month | 21st cheapest of 361 $1,943 a month |
| RL rollouts 1,000 at once · 2 vCPU / 4 GB · 1,000,000 sessions of 3 min a month Declaw can snapshot a running sandbox with its memory and start many copies from it, which suits rollouts that branch from one state. | 34th of 360, with limits $2,000 a month | 137th of 360, with limits $8,355 a month |
| Agent evals 250 at once · 4 vCPU / 8 GB · 15,000 sessions of 20 min a month | 10th cheapest of 364 $200 a month | 73rd cheapest of 364 $1,671 a month |
| CI runners 40 at once · 8 vCPU / 16 GB · 6,000 sessions of 12 min a month CI that builds Android apps or VM images needs nested virtualization, which boat has and Declaw does not document. | 4th cheapest of 377 $86 a month | 90th cheapest of 377 $809 a month |
| 24/7 dev boxes 1 machine 24/7 · 4 vCPU / 8 GB A dev box that runs all month needs no session cap and SSH; Declaw has a 72-hour cap and a terminal over its API instead of SSH. | 18th cheapest of 368 $26 a month | 317th of 368, with limits $247 a month |
| Computer-use agents 50 at once · 4 vCPU / 8 GB · 20,000 sessions of 15 min a month Computer-use agents need a desktop and a browser, which boat streams at 60fps and Declaw does not offer. | 6th cheapest of 369 $200 a month | 286th of 369, with limits $1,671 a month |
| Browser-use agents 50 at once · 2 vCPU / 4 GB · 30,000 sessions of 10 min a month | 7th cheapest of 367 $200 a month | 293rd of 367, with limits $836 a month |
| Scraping & bots (startup scale) 50 at once · 1 vCPU / 2 GB · 100,000 sessions of 3 min a month | 6th cheapest of 346 $90 a month | 271st of 346, with limits $418 a month |
| Mass scraping & bots (undetectable) 1,000 at once · 1 vCPU / 2 GB · 3,000,000 sessions of 2 min a month | 71st of 338, with limits $1,800 a month | 217th of 338, with limits $8,355 a month |
| Parallel red teaming 200 at once · 2 vCPU / 4 GB · 5,000 sessions of 30 min a month | 2nd cheapest of 360 $200 a month | 263rd of 360, with limits $422 a month |
| GPU eval jobs 10 at once · 8 vCPU / 32 GB · 500 sessions of 30 min a month | Can't run it | Can't run it |
| macOS agents 5 at once · 4 vCPU / 8 GB · 1,000 sessions of 20 min a month | Can't run it | Can't run it |
Key features
| Feature | boat | Declaw |
|---|---|---|
| Isolation | Full VM with its own kernel on dedicated AMD Ryzen 9 9950X hosts | Firecracker microVM with its own kernel |
| CPU benchmark (4 vCPU / 8 GB) | 26.69 runs/s | No comparable measurement |
| Biggest machine | Up to 16 vCPU / 32 GB on the $100 plan and above | Up to 16 vCPU / 16 GB on Pro, 4 vCPU / 4 GB on Free |
| Session length | No cap on paid plans; you set the time to live | 1 hour on Free, 72 hours on Pro, 7 days on Enterprise; killed on timeout unless set to pause |
| Pause and resume | Disk is saved every minute and on stop; resume boots the machine again | Pause keeps memory and disk, paused time is not billed; resume is an explicit API call |
| Fork | Fork a running sandbox with its disk | Snapshot a running sandbox with its memory, then start many copies from it |
| Nested virtualization | Yes, /dev/kvm for Android emulators and VMs | Not documented |
| Desktop and browser | 60fps Linux desktop with Chromium and computer use | Headless; no desktop or browser |
| Inbound access | HTTPS URLs for up to 50 ports, token-protected by default; raw TCP; SSH | HTTP and WebSocket through an API URL per port, behind your API key; no SSH or raw TCP documented |
| Outbound rules | Open internet, no provider-side allowlist | Allow and deny lists by domain, IP or CIDR; cloud metadata and private ranges always blocked |
| Guardrails on traffic | None built in | PII redaction, prompt injection, toxicity and code security scans, custom OPA policies, audit logs |
| Coding agents | Seven agents preinstalled, with a prompt, steer and events API | None preinstalled; SDK backends for agent frameworks that run in your own process |
| Keeping API keys out of the sandbox | Credentials proxy for model providers and any HTTPS API; switch a credential to another account when credits run out | Credential vault for any HTTP host, plus Postgres, MySQL, Redis, SMTP and MongoDB logins |
| Self-hosting | No | Enterprise install in your own cloud account or data center, run by Declaw |
| Compliance and transparency | SOC 2 is in progress. We're open about where we stand: live status and data retention policy. | No SOC 2 report published |
Every feature Battleships tracks (43)
| Feature | boat | Declaw |
|---|---|---|
| Full VM (own kernel) | Yes | Yes |
| Docker inside | Yes | Yes |
| Nested virtualization | Yes | No |
| Root | Yes | Yes |
| Systemd | Yes | Not published |
| Desktop GUI | Yes | No |
| Browser | Yes | No |
| Computer-use API | Yes | No |
| SSH | Yes | No |
| Persistent disk | Yes | Yes |
| Pause/resume | Yes | Yes |
| Automatic snapshots | Yes | Yes |
| Fork/clone | Yes | Yes |
| Live fork (no pause) | Yes | Yes |
| Memory fork | No | Yes |
| Custom image (Docker or snapshot) | Yes | Yes |
| ≥24 h sessions | Yes | Yes |
| Idle auto-stop | No | No |
| Wake on request | No | No |
| HTTPS preview URLs | Yes | Yes |
| Raw TCP inbound | Yes | No |
| Public IPv4 | No | No |
| Egress allowlist | No | Yes |
| Secret proxy | Yes | Yes |
| Secret proxy for any API | Yes | Yes |
| Preinstalled agents | Yes | No |
| Agent harness API | Yes | No |
| MCP server | No | Yes |
| GPU | No | No |
| Windows | No | No |
| Arm64 | No | Not published |
| Self-hosting | No | Yes |
| BYOC | No | Yes |
| Open source | No | No |
| Scoped API keys | Yes | Not published |
| Spend limits | Yes | Yes |
| Usage per sandbox (API) | Yes | No |
| Audit logs | No | Yes |
| SSO | No | No |
| SOC 2 | No | No |
| HIPAA | No | No |
| EU data residency | Yes | Yes |
| Zero data retention | Yes | Not published |
Performance
boat did 26.69 runs per second on the StarSling hpc-sandbox-benchmarks Node.js build-and-test loop at 4 vCPU / 8 GB, on dedicated AMD Ryzen 9 9950X hosts. Declaw has no comparable measurement on that benchmark, so there is no fair CPU speed comparison yet. Declaw's docs say a sandbox boots in about 125 ms.
Node.js build-and-test loop at 4 vCPU / 8 GB, higher is better. Measured with the open hpc-sandbox-benchmarks suite. Declaw has no published run in this suite yet, so there is no like-for-like number to compare.
Pricing in five scenarios
Each bill is priced from the providers' public price lists by the open Battleships engine, with the cheapest plan that runs the scenario.
| Scenario | boat, a month | Declaw, a month |
|---|---|---|
| One coding agent, workdays 4 vCPU / 8 GB, 50 GB disk, 8 hours a day, 22 days a month, files kept between days | $20 · $20/mo | $100 · Pro |
| One agent that never stops 4 vCPU / 8 GB, 50 GB disk, running 24/7 all month | $26 · $20/mo | $247 · Pro · with limits |
| 50 agents in parallel 50 machines of 4 vCPU / 8 GB at once, 8-hour sessions, 1,100 sessions a month, Docker inside | $317 · $20/mo × 3 seats | $2,941 · Pro |
| Sandboxes for your users 2 vCPU / 4 GB, 30,000 sessions of 10 minutes a month, up to 300 at once | $200 · $100/mo × 2 seats | $836 · Pro |
| 1,000 short jobs at once 2 vCPU / 4 GB, 1,000 at once, 3 minutes each, 200,000 jobs a month | $2,000 · $2000/mo · with limits | $1,671 · Pro · with limits |
boat: Plans start at $20 a month, and the whole fee is usage credit. You pay per second while a sandbox runs, and a stopped sandbox costs nothing and keeps its disk.
Declaw: Declaw meters the vCPU, memory and disk you provision every 30 seconds, from a prepaid wallet, and paused time is free. Pro needs at least $100 of deposits each month, which is spent on usage and carries over, and guardrail scans are billed per scan on top.
Limits in those scenarios
Declaw caps a Pro session at 72 hours, so an agent that runs all month has to be paused and resumed, which is why it does not fit the always-on scenario. Declaw's egress price is not published, so its totals leave out traffic. For 1,000 short jobs at once neither fits: Declaw Pro allows 500 sandboxes at a time, and boat's $2,000 plan queues starts above 90 a minute. boat has no session cap, but its start limits are the tighter one for big bursts.
| Scenario | boat | Declaw |
|---|---|---|
| One coding agent, workdays | None that bite |
|
| One agent that never stops | None that bite |
|
| 50 agents in parallel | None that bite |
|
| Sandboxes for your users | None that bite |
|
| 1,000 short jobs at once |
|
|
Which one should you use?
Use Declaw when
every agent call must pass PII redaction, prompt injection scans and outbound rules, or the sandboxes must run inside your own cloud.
- Guardrails on what the agent sends. For teams that must scan agent traffic: PII redaction, prompt injection and toxicity checks, and custom OPA policies come built in.
- Memory pause that costs nothing. Useful for short jobs that sleep between steps: a paused sandbox keeps its memory and running processes, and paused time is free.
- Run it in your own cloud. Enterprise customers can have Declaw installed in their own cloud account or data center, operated by the Declaw team.
Use boat when
your agents do real work for hours or days: coding agents, builds, Docker, emulators and a browser on a whole machine that never cuts them off.
- A machine that runs as long as the work. An agent that works for days, or a dev box that stays up all month, hits Declaw's 72-hour cap. Your code then has to pause and resume it, or lose its state if pause was not set.
- Coding agents you drive from outside. Declaw ships no coding agent, so you install one in each template and build the harness that starts it, feeds it prompts and streams its progress back.
- A whole computer, not a headless box. Agents that click through web apps, run an Android emulator or need a real SSH session have no way to do that on Declaw, which documents no desktop, browser, SSH or /dev/kvm.
Questions people ask
Is boat cheaper than Declaw?
In the first four scenarios on this page, yes: for one agent all workday it is $20 a month on boat against $100 on Declaw Pro. For 1,000 short jobs at once neither fits as is, because Declaw Pro stops at 500 at a time and boat queues the starts.
Can a Declaw sandbox run for days?
Up to 72 hours on Pro and 7 days on Enterprise, then it is killed or paused. Pausing keeps memory and disk for free, but your code must resume it. boat has no session cap on paid plans.
Do both keep API keys out of the sandbox?
Yes. Declaw's vault injects credentials at its egress proxy and also brokers database and SMTP logins. boat's credentials proxy covers model providers and any HTTPS API, and can switch a credential to another account when it runs out of credits.
Can I run Claude Code or Codex in each?
boat preinstalls Claude Code, Codex and five other agents, and gives you an API to prompt, steer and follow them. On Declaw you install the agent in a template yourself and drive it through its command and terminal APIs.
Does Declaw have a browser or desktop for computer use?
No. Declaw sandboxes are headless. boat streams a 60fps Linux desktop with Chromium and supports computer use.
Is boat SOC 2 compliant?
SOC 2 is in progress. We're open about where we stand: live status at status.ascii.dev and our data retention policy at docs.boat.dev/data-retention.
Start a sandbox
Install the CLI, then run boat new.
7-day free trial