boat vs GKE Agent Sandbox
GKE Agent Sandbox turns Pods on your own Google Kubernetes Engine cluster into isolated sandboxes for agents. boat gives each agent a whole Linux machine with Docker, a desktop and coding agents built in, with no cluster to run.
Where boat stands out
A full VM, so Docker and emulators just work
A boat sandbox is a full VM with its own kernel, root, systemd, Docker and /dev/kvm. GKE Agent Sandbox runs each sandbox as a gVisor Pod, and Google's docs say gVisor does not support privileged containers or kernel-level virtualization.
Nothing to operate
On boat you call an API and get a machine. With Agent Sandbox you create and run a GKE cluster, turn the add-on on, and write templates, warm pools, routing and ingress before the first agent starts.
Agents, desktop and keys built in
boat ships Claude Code, Codex and five more agents that you prompt, steer and follow through one API, a 60fps Linux desktop with Chromium for computer use, and HTTPS URLs on up to 50 ports. Real API keys stay outside the sandbox in a credentials proxy.
The companies and products
boat
boat.dev runs sandboxes for AI agents: each one is a full Linux VM with its own kernel.
You start a machine with one command or one API call, then SSH in, run Docker, open a desktop, or let a built-in agent (Claude Code, Codex, OpenCode and others) work in it. The disk stays between sessions, and a stopped sandbox costs nothing.
- Isolation
- Full VM per sandbox, own kernel
- Regions
- EU: Germany, Finland, France
GKE Agent Sandbox
GKE Agent Sandbox is a feature of Google Kubernetes Engine that runs AI agents and AI-generated code in isolated Pods on your own GKE cluster.
It is not a hosted sandbox service: it is a Kubernetes add-on on a hyperscaler. You create a GKE cluster, turn on Agent Sandbox, and describe sandboxes with Kubernetes resources (Sandbox, SandboxTemplate, SandboxClaim, SandboxWarmPool); each one is a Pod that runs under gVisor, a user-space kernel. It is built on the open-source agent-sandbox project from Kubernetes SIG Apps and fits teams that already run on Google Cloud and Kubernetes.
Which use cases each one fits
For each use case, Battleships prices every sandbox provider on the same workload and sorts them from the cheapest monthly bill up. “3rd cheapest of 367” means 2 of the other 366 providers run that workload, with every feature it needs, for less. “With limits” means the provider runs it but misses something, so it is listed after every full match. Open a use case for its whole ranking and what each provider misses.
| Use case and its workload | boat: price rank | GKE Agent Sandbox: price rank |
|---|---|---|
| Software factory 100 at once · 4 vCPU / 8 GB · 2,200 sessions of 8 h a month A coding agent that builds and tests apps usually needs Docker and root; gVisor Pods block privileged containers, while boat gives the agent a full VM where Docker just works. | 3rd cheapest of 367 $634 a month | 130th of 367, with limits $1,148 a month |
| Always-on AI employees 50 machines 24/7 · 2 vCPU / 4 GB Both can run all month with no session cap, but on GKE you keep a cluster running and build the agent harness yourself; boat ships the agents preinstalled. | 5th cheapest of 366 $657 a month | 160th of 366, with limits $1,185 a month |
| Code interpreter bursts 100 at once · 1 vCPU / 2 GB · 200,000 sessions of 1 min a month Agent Sandbox fits short code runs well: a warm pool hands out a ready gVisor Pod in under a second, and Autopilot bills only the resources each Pod requests. | 186th of 345, with limits $2,000 a month | 76th of 345, with limits $96 a month |
| Sandboxes for your users 300 at once · 2 vCPU / 4 GB · 30,000 sessions of 23 min a month To give your users their own sandbox on GKE you build the templates, routing and ingress; boat gives each user a machine with HTTPS URLs from one API call. | Cheapest of 361 $209 a month | 77th of 361, with limits $683 a month |
| RL rollouts 1,000 at once · 2 vCPU / 4 GB · 1,000,000 sessions of 3 min a month For rollouts at very large scale, a GKE cluster can grow to thousands of nodes within your Google Cloud quotas, and memory snapshots can restore a prepared state. | 34th of 360, with limits $2,000 a month | 30th of 360, with limits $1,624 a month |
| Agent evals 250 at once · 4 vCPU / 8 GB · 15,000 sessions of 20 min a month | 10th cheapest of 364 $200 a month | 105th of 364, with limits $324 a month |
| CI runners 40 at once · 8 vCPU / 16 GB · 6,000 sessions of 12 min a month CI jobs that run Docker builds or Android emulators need privileged containers or /dev/kvm, which gVisor does not allow and boat provides. | 4th cheapest of 377 $86 a month | 151st of 377, with limits $280 a month |
| 24/7 dev boxes 1 machine 24/7 · 4 vCPU / 8 GB A dev box wants SSH, systemd and a disk that saves itself; Agent Sandbox is reached through kubectl or its router, and you pick the volumes it keeps. | 18th cheapest of 368 $26 a month | 239th of 368, with limits $73 a month |
| Computer-use agents 50 at once · 4 vCPU / 8 GB · 20,000 sessions of 15 min a month Agent Sandbox ships no desktop or browser; boat streams a full Linux desktop at 60fps with Chromium and computer use built in. | 6th cheapest of 369 $200 a month | 135th of 369, with limits $324 a month |
| Browser-use agents 50 at once · 2 vCPU / 4 GB · 30,000 sessions of 10 min a month | 7th cheapest of 367 $200 a month | 190th of 367, with limits $161 a month |
| Scraping & bots (startup scale) 50 at once · 1 vCPU / 2 GB · 100,000 sessions of 3 min a month | 6th cheapest of 346 $90 a month | 169th of 346, with limits $80 a month |
| Mass scraping & bots (undetectable) 1,000 at once · 1 vCPU / 2 GB · 3,000,000 sessions of 2 min a month | 71st of 338, with limits $1,800 a month | 61st of 338, with limits $1,624 a month |
| Parallel red teaming 200 at once · 2 vCPU / 4 GB · 5,000 sessions of 30 min a month | 2nd cheapest of 360 $200 a month | 128th of 360, with limits $80 a month |
| GPU eval jobs 10 at once · 8 vCPU / 32 GB · 500 sessions of 30 min a month | Can't run it | Can't run it |
| macOS agents 5 at once · 4 vCPU / 8 GB · 1,000 sessions of 20 min a month | Can't run it | Can't run it |
Key features
Every feature Battleships tracks (43)
| Feature | boat | GKE Agent Sandbox |
|---|---|---|
| Full VM (own kernel) | Yes | No |
| Docker inside | Yes | No |
| Nested virtualization | Yes | No |
| Root | Yes | No |
| Systemd | Yes | Not published |
| Desktop GUI | Yes | No |
| Browser | Yes | No |
| Computer-use API | Yes | No |
| SSH | Yes | No |
| Persistent disk | Yes | Yes |
| Pause/resume | Yes | Yes |
| Automatic snapshots | Yes | No |
| Fork/clone | Yes | Yes |
| Live fork (no pause) | Yes | Yes |
| Memory fork | No | Yes |
| Custom image (Docker or snapshot) | Yes | Yes |
| ≥24 h sessions | Yes | Yes |
| Idle auto-stop | No | No |
| Wake on request | No | No |
| HTTPS preview URLs | Yes | Yes |
| Raw TCP inbound | Yes | Not published |
| Public IPv4 | No | No |
| Egress allowlist | No | Yes |
| Secret proxy | Yes | No |
| Secret proxy for any API | Yes | No |
| Preinstalled agents | Yes | No |
| Agent harness API | Yes | No |
| MCP server | No | No |
| GPU | No | Yes |
| Windows | No | No |
| Arm64 | No | Yes |
| Self-hosting | No | Yes |
| BYOC | No | Yes |
| Open source | No | Yes |
| Scoped API keys | Yes | Not published |
| Spend limits | Yes | Not published |
| Usage per sandbox (API) | Yes | Yes |
| Audit logs | No | Not published |
| SSO | No | Yes |
| SOC 2 | No | Yes |
| HIPAA | No | Yes |
| EU data residency | Yes | Yes |
| Zero data retention | Yes | Not published |
Performance
There is no comparable measurement: GKE Agent Sandbox was not part of the hpc-sandbox-benchmarks run. boat did 26.69 runs per second on its Node.js build-and-test loop at 4 vCPU / 8 GB. On GKE the speed depends on the machine type your nodes use and on gVisor, so a fair test would have to fix both.
Node.js build-and-test loop at 4 vCPU / 8 GB, higher is better. Measured with the open hpc-sandbox-benchmarks suite. GKE Agent Sandbox has no published run in this suite yet, so there is no like-for-like number to compare.
Pricing in five scenarios
Each bill is priced from the providers' public price lists by the open Battleships engine, with the cheapest plan that runs the scenario.
| Scenario | boat, a month | GKE Agent Sandbox, a month |
|---|---|---|
| One coding agent, workdays 4 vCPU / 8 GB, 50 GB disk, 8 hours a day, 22 days a month, files kept between days | $20 · $20/mo | $73 · Pay as you go (one Autopilot cluster) · with limits |
| One agent that never stops 4 vCPU / 8 GB, 50 GB disk, running 24/7 all month | $26 · $20/mo | $84 · Pay as you go (one Autopilot cluster) · with limits |
| 50 agents in parallel 50 machines of 4 vCPU / 8 GB at once, 8-hour sessions, 1,100 sessions a month, Docker inside | $317 · $20/mo × 3 seats | $1,032 · Pay as you go (one Autopilot cluster) · with limits |
| Sandboxes for your users 2 vCPU / 4 GB, 30,000 sessions of 10 minutes a month, up to 300 at once | $200 · $100/mo × 2 seats | $292 · Pay as you go (one Autopilot cluster) · with limits |
| 1,000 short jobs at once 2 vCPU / 4 GB, 1,000 at once, 3 minutes each, 200,000 jobs a month | $2,000 · $2000/mo · with limits | $586 · Pay as you go (one Autopilot cluster) · with limits |
boat: Plans start at $20 a month, and the whole fee is usage credit. You pay per second while a sandbox runs, and a stopped sandbox costs nothing and keeps its disk.
GKE Agent Sandbox: Agent Sandbox itself is free; you pay GKE prices. On Autopilot that is per second for the CPU and memory each Pod requests, warm-pool Pods included, plus $0.10 per cluster per hour, which the free tier covers for one cluster. Disks, snapshot storage and network traffic are billed by Google Cloud on top.
Limits in those scenarios
GKE has no plan caps of its own: your limits are your Google Cloud quotas and the cluster's size, up to 200,000 Pods per Autopilot cluster. The table marks it as not fitting because its pricing is marked beta and the model has no price for its disks and network traffic, and because a 50-agent fleet that needs Docker cannot run it under gVisor. boat has no session cap, but its start limits are lower: at 1,000 short jobs at once, the $2,000 plan queues starts above 90 per minute.
| Scenario | boat | GKE Agent Sandbox |
|---|---|---|
| One coding agent, workdays | None that bite |
|
| One agent that never stops | None that bite |
|
| 50 agents in parallel | None that bite |
|
| Sandboxes for your users | None that bite |
|
| 1,000 short jobs at once |
|
|
Which one should you use?
Use GKE Agent Sandbox when
your team already runs GKE and wants agents inside its own VPC, needs GPUs, regions outside the EU or memory snapshots, or wants an open-source system it can run on its own Kubernetes.
- It lives inside your Google Cloud. Teams already on GKE keep agents in their own project, VPC and IAM, with default-deny network rules and many regions.
- Memory snapshots, warm pools and GPUs. Workloads that resume from a saved memory state, need sub-second starts or need an NVIDIA GPU are covered.
- Open source, on any Kubernetes. The agent-sandbox project is Apache-2.0 and runs on any Kubernetes cluster you control, in the cloud or your own racks.
Use boat when
your agents do real work on a whole machine: Docker, builds, emulators, a desktop and a browser, with agents and a key proxy built in and no cluster to run.
- A full VM, so Docker and emulators just work. Coding agents run docker build, docker compose and test databases all day. Under gVisor those need workarounds or a different runtime, and an Android emulator or VM cannot start at all without /dev/kvm.
- Nothing to operate. Someone on your team has to own that cluster: upgrades to the required GKE version, quotas, node pools and networking. Every hour spent there is an hour not spent on the agent.
- Agents, desktop and keys built in. Agent Sandbox gives you the isolated Pod and leaves the rest to you. Without a proxy, keys sit in Kubernetes Secrets inside a Pod the agent controls, where one prompt injection can read them.
Questions people ask
Is boat cheaper than GKE Agent Sandbox?
In four of the five scenarios on this page, yes. For 1,000 short jobs at once GKE costs less in the table, and boat's plans queue starts above 90 per minute, so boat does not fit that one cleanly. GKE's figures also leave out disk and network charges.
Can I run Docker inside GKE Agent Sandbox?
Not in the usual way. Agent Sandbox Pods run under gVisor, and Google's docs say gVisor does not support privileged containers or kernel-level virtualization, which Docker-in-Docker and emulators rely on. boat runs Docker and exposes /dev/kvm in every sandbox.
Do I need a Kubernetes cluster to use GKE Agent Sandbox?
Yes. You create a GKE Autopilot or Standard cluster, turn Agent Sandbox on, and manage sandboxes as Kubernetes resources with kubectl or the Python and Go clients. boat needs only an API key.
Can GKE Agent Sandbox snapshot a running sandbox?
Yes. Pod snapshots save the sandbox's memory and files to a Cloud Storage bucket, triggered by hand or by the workload, and a new sandbox resumes from that point. The managed add-on does not include snapshots yet, so you install the open-source snapshot controller by hand. boat saves the disk automatically every minute and can fork a running sandbox, but it does not save memory.
Is GKE Agent Sandbox open source?
The Sandbox resources come from kubernetes-sigs/agent-sandbox, an Apache-2.0 project you can install on any Kubernetes cluster. The GKE add-on is Google's managed way to turn it on.
Is boat SOC 2 compliant?
SOC 2 is in progress. We're open about where we stand: live status at status.ascii.dev and our data retention policy at docs.boat.dev/data-retention.
Start a sandbox
Install the CLI, then run boat new.
7-day free trial