boat vs LangSmith Sandboxes
Both give an agent its own Linux microVM with a disk that survives a stop. boat gives it a whole machine with open internet, a desktop and coding agents built in, while LangSmith Sandboxes are headless tool backends tied closely to LangSmith tracing and its egress proxy.
Where boat stands out
Open internet and real hosting
A boat sandbox can reach any site or API from its first second. It serves HTTPS on up to 50 ports, takes raw TCP and has its own IP. LangSmith limits non-Enterprise sandboxes to an allowlist of package, Git and model hosts, and reaches ports through tokens that expire within 24 hours.
A whole machine with a screen
boat gives each sandbox nested virtualization through /dev/kvm, Docker, systemd and root, plus a 60fps Linux desktop with Chromium for computer use. LangSmith sandboxes are headless, and its computer use means running code and files.
Coding agents you drive from outside
Claude Code, Codex and five other agents come preinstalled. You drive agents inside from outside with one API to prompt, steer and follow their events, and real keys stay in boat's credentials proxy.
The companies and products
boat
boat.dev runs sandboxes for AI agents: each one is a full Linux VM with its own kernel.
You start a machine with one command or one API call, then SSH in, run Docker, open a desktop, or let a built-in agent (Claude Code, Codex, OpenCode and others) work in it. The disk stays between sessions, and a stopped sandbox costs nothing.
- Isolation
- Full VM per sandbox, own kernel
- Regions
- EU: Germany, Finland, France
LangSmith Sandboxes
LangSmith Sandboxes are isolated machines for agent-generated code, sold as part of LangChain's LangSmith platform.
Each sandbox is a Firecracker microVM with its own guest kernel, booted from a snapshot built from a Docker image or captured from a running sandbox. You drive it through the LangSmith SDK, CLI or REST API with exec, file calls, service URLs and TCP tunnels, and an egress proxy outside the sandbox controls traffic and injects credentials. It is built for teams already using LangSmith, LangGraph or Deep Agents, where the agent loop runs outside and uses the sandbox as a tool.
Which use cases each one fits
For each use case, Battleships prices every sandbox provider on the same workload and sorts them from the cheapest monthly bill up. “3rd cheapest of 367” means 2 of the other 366 providers run that workload, with every feature it needs, for less. “With limits” means the provider runs it but misses something, so it is listed after every full match. Open a use case for its whole ranking and what each provider misses.
| Use case and its workload | boat: price rank | LangSmith Sandboxes: price rank |
|---|---|---|
| Software factory 100 at once · 4 vCPU / 8 GB · 2,200 sessions of 8 h a month A software factory needs open internet, Docker and long builds; LangSmith only reaches PyPI, npm, GitHub and a few model APIs until support grants an exemption. | 3rd cheapest of 367 $634 a month | 273rd of 367, with limits $4,579 a month |
| Always-on AI employees 50 machines 24/7 · 2 vCPU / 4 GB An assistant that lives on its machine needs any website and API; LangSmith's default allowlist blocks most of them, and a stopped sandbox is deleted after at most 30 days. | 5th cheapest of 366 $657 a month | 289th of 366, with limits $6,015 a month |
| Code interpreter bursts 100 at once · 1 vCPU / 2 GB · 200,000 sessions of 1 min a month LangSmith fits short code runs well: sandboxes stop after 10 idle minutes, wake on the next request and can keep their memory. | 186th of 345, with limits $2,000 a month | 137th of 345, with limits $304 a month |
| Sandboxes for your users 300 at once · 2 vCPU / 4 GB · 30,000 sessions of 23 min a month LangSmith wakes a stopped sandbox on the next request, while boat gives each user open internet, hosting and a bigger default machine. | Cheapest of 361 $209 a month | 359th of 361, with limits $1,950 a month |
| RL rollouts 1,000 at once · 2 vCPU / 4 GB · 1,000,000 sessions of 3 min a month | 34th of 360, with limits $2,000 a month | 145th of 360, with limits $9,451 a month |
| Agent evals 250 at once · 4 vCPU / 8 GB · 15,000 sessions of 20 min a month | 10th cheapest of 364 $200 a month | 172nd of 364, with limits $1,514 a month |
| CI runners 40 at once · 8 vCPU / 16 GB · 6,000 sessions of 12 min a month CI that builds Android apps or VM images needs /dev/kvm inside the sandbox, which boat exposes and LangSmith does not. | 4th cheapest of 377 $86 a month | 184th of 377, with limits $911 a month |
| 24/7 dev boxes 1 machine 24/7 · 4 vCPU / 8 GB A dev box needs a stable address and open internet; LangSmith reaches ports through short-lived service URL tokens and local tunnels. | 18th cheapest of 368 $26 a month | 308th of 368, with limits $234 a month |
| Computer-use agents 50 at once · 4 vCPU / 8 GB · 20,000 sessions of 15 min a month Computer use needs a screen; boat streams a 60fps desktop, while LangSmith's computer use means code and files on a headless machine. | 6th cheapest of 369 $200 a month | 266th of 369, with limits $1,362 a month |
| Browser-use agents 50 at once · 2 vCPU / 4 GB · 30,000 sessions of 10 min a month boat ships Chromium on its desktop; LangSmith provides no browser, so you install one in your own image and stay inside its egress allowlist. | 7th cheapest of 367 $200 a month | 274th of 367, with limits $677 a month |
| Scraping & bots (startup scale) 50 at once · 1 vCPU / 2 GB · 100,000 sessions of 3 min a month | 6th cheapest of 346 $90 a month | 276th of 346, with limits $456 a month |
| Mass scraping & bots (undetectable) 1,000 at once · 1 vCPU / 2 GB · 3,000,000 sessions of 2 min a month | 71st of 338, with limits $1,800 a month | 228th of 338, with limits $9,266 a month |
| Parallel red teaming 200 at once · 2 vCPU / 4 GB · 5,000 sessions of 30 min a month | 2nd cheapest of 360 $200 a month | 268th of 360, with limits $447 a month |
| GPU eval jobs 10 at once · 8 vCPU / 32 GB · 500 sessions of 30 min a month | Can't run it | Can't run it |
| macOS agents 5 at once · 4 vCPU / 8 GB · 1,000 sessions of 20 min a month | Can't run it | Can't run it |
Key features
| Feature | boat | LangSmith Sandboxes |
|---|---|---|
| Isolation | Full VM with its own kernel on dedicated AMD Ryzen 9 9950X hosts | Firecracker microVM with its own guest kernel |
| Internet access | Open internet from the start | Managed allowlist (PyPI, npm, GitHub, OpenAI, Anthropic, LangSmith) unless you are on Enterprise or support approves an exemption |
| Outbound rules | No provider-side allowlist | Per-sandbox allow or deny lists by host, port, wildcard, regex or CIDR, plus request callbacks |
| Nested virtualization | Yes, /dev/kvm for Android emulators and VMs | Not documented inside the sandbox; /dev/kvm is a host requirement |
| Desktop and browser | 60fps Linux desktop with Chromium and computer use | Headless; no desktop or browser provided |
| Coding agents | Seven agents preinstalled, with a prompt, steer and events API | None preinstalled; Deep Agents run outside and use the sandbox as a tool |
| Inbound access | HTTPS URLs for up to 50 ports, token-protected by default; raw TCP; dedicated IPv4 or IPv6 | HTTPS service URL per port with tokens of 10 minutes to 24 hours; TCP only through a local CLI tunnel; no public IP |
| Stop and resume | Disk saved every minute and on stop; a stopped sandbox keeps its disk for free; resume boots again | Stops after 10 idle minutes by default and wakes on the next request; memory can be kept on stop |
| How long a stopped sandbox lives | Kept, with its latest snapshot, for the life of the sandbox at no charge | Deleted after about 14 days by default, 30 days at most |
| Fork | Fork a running sandbox with its disk | Capture a running sandbox as a snapshot, optionally with memory, and boot copies from it |
| Docker | Docker daemon, systemd and root inside the VM | Snapshots built from Docker images or a Dockerfile with BuildKit |
| Biggest machine | Up to 16 vCPU / 32 GB on the $100 plan and above | Up to 16 vCPU / 64 GiB RAM |
| Keeping API keys out of the sandbox | Credentials proxy for model providers and any HTTPS API; switch a credential to another account when credits run out | Proxy injects headers for any host, with AWS SigV4 and GCP token minting |
| Regions and self-hosting | EU only (Germany, Finland, France); no self-hosting | US, EU and APAC; self-hosting and bring your own cloud on Enterprise |
| Compliance and transparency | SOC 2 is in progress. We're open about where we stand: live status and data retention policy. | SOC 2 |
Every feature Battleships tracks (43)
| Feature | boat | LangSmith Sandboxes |
|---|---|---|
| Full VM (own kernel) | Yes | Yes |
| Docker inside | Yes | Yes |
| Nested virtualization | Yes | No |
| Root | Yes | Yes |
| Systemd | Yes | Not published |
| Desktop GUI | Yes | No |
| Browser | Yes | No |
| Computer-use API | Yes | No |
| SSH | Yes | Yes |
| Persistent disk | Yes | Yes |
| Pause/resume | Yes | Yes |
| Automatic snapshots | Yes | Yes |
| Fork/clone | Yes | Yes |
| Live fork (no pause) | Yes | Yes |
| Memory fork | No | Yes |
| Custom image (Docker or snapshot) | Yes | Yes |
| ≥24 h sessions | Yes | Yes |
| Idle auto-stop | No | Yes |
| Wake on request | No | Yes |
| HTTPS preview URLs | Yes | Yes |
| Raw TCP inbound | Yes | Not published |
| Public IPv4 | No | No |
| Egress allowlist | No | Yes |
| Secret proxy | Yes | Yes |
| Secret proxy for any API | Yes | Yes |
| Preinstalled agents | Yes | No |
| Agent harness API | Yes | No |
| MCP server | No | No |
| GPU | No | No |
| Windows | No | No |
| Arm64 | No | No |
| Self-hosting | No | Yes |
| BYOC | No | Yes |
| Open source | No | No |
| Scoped API keys | Yes | Not published |
| Spend limits | Yes | Not published |
| Usage per sandbox (API) | Yes | No |
| Audit logs | No | Yes |
| SSO | No | Yes |
| SOC 2 | No | Yes |
| HIPAA | No | Yes |
| EU data residency | Yes | Yes |
| Zero data retention | Yes | Not published |
Performance
There is no comparable measurement: LangSmith Sandboxes have not been run on the StarSling hpc-sandbox-benchmarks test boat is measured on. boat did 26.69 runs per second on its Node.js build-and-test loop at 4 vCPU / 8 GB. LangSmith says its sandboxes burst to twice their requested CPU when the host has spare capacity.
Node.js build-and-test loop at 4 vCPU / 8 GB, higher is better. Measured with the open hpc-sandbox-benchmarks suite. LangSmith Sandboxes has no published run in this suite yet, so there is no like-for-like number to compare.
Pricing in five scenarios
Each bill is priced from the providers' public price lists by the open Battleships engine, with the cheapest plan that runs the scenario.
| Scenario | boat, a month | LangSmith Sandboxes, a month |
|---|---|---|
| One coding agent, workdays 4 vCPU / 8 GB, 50 GB disk, 8 hours a day, 22 days a month, files kept between days | $20 · $20/mo | $53 · Developer · with limits |
| One agent that never stops 4 vCPU / 8 GB, 50 GB disk, running 24/7 all month | $26 · $20/mo | $245 · Developer · with limits |
| 50 agents in parallel 50 machines of 4 vCPU / 8 GB at once, 8-hour sessions, 1,100 sessions a month, Docker inside | $317 · $20/mo × 3 seats | $3,005 · Developer · with limits |
| Sandboxes for your users 2 vCPU / 4 GB, 30,000 sessions of 10 minutes a month, up to 300 at once | $200 · $100/mo × 2 seats | $848 · Developer · with limits |
| 1,000 short jobs at once 2 vCPU / 4 GB, 1,000 at once, 3 minutes each, 200,000 jobs a month | $2,000 · $2000/mo · with limits | $1,884 · Developer · with limits |
boat: Plans start at $20 a month, and the whole fee is usage credit. You pay per second while a sandbox runs, and a stopped sandbox costs nothing and keeps its disk.
LangSmith Sandboxes: LangSmith bills per second for the vCPU and RAM you request, at $0.0576 per vCPU-hour and $0.01845 per GiB-hour, plus storage per GiB-hour, with 8 LSU ($8) of sandbox use free each month. The Plus plan adds $39 per seat per month, and the scenarios here are priced on the Developer plan.
Limits in those scenarios
The limit that bites in every scenario is internet access: outside Enterprise, a LangSmith sandbox only reaches its managed allowlist, so none of the five fits as priced. The Developer plan also allows 10 sandboxes, which rules out the 50-agent fleet, the user sandboxes and the burst of 1,000 jobs, and LangSmith does not publish a sandbox cap for Plus. boat has no session cap, but its start limits are lower: at 1,000 short jobs at once, the $2,000 plan queues starts.
| Scenario | boat | LangSmith Sandboxes |
|---|---|---|
| One coding agent, workdays | None that bite |
|
| One agent that never stops | None that bite |
|
| 50 agents in parallel | None that bite |
|
| Sandboxes for your users | None that bite |
|
| 1,000 short jobs at once |
|
|
Which one should you use?
Use LangSmith Sandboxes when
your agents already run on LangSmith or Deep Agents, only need package registries and model APIs, and you want memory snapshots, wake on request or per-request egress control.
- Memory snapshots and wake on request. Useful for agents that sleep between turns: a stopped sandbox wakes on the next request and can keep its running processes.
- Fine-grained egress control. For teams that must decide exactly which hosts an agent reaches, with a callback that can approve each request.
- More regions, your own cloud and LangSmith in one place. A fit for LangSmith users who need US or APAC regions, or who run LangSmith in their own Kubernetes cluster.
Use boat when
your agents need a whole machine on the open internet: Docker, emulators, a browser and desktop, hosted ports, and coding agents you steer through an API.
- Open internet and real hosting. An agent that reads docs, calls a customer's API or scrapes a page gets blocked on LangSmith until you file a support ticket or move to Enterprise, and a preview link stops working when its token expires.
- A whole machine with a screen. Android emulators, VM builds and agents that click through a website need these. On LangSmith you would build your own image with a browser and a screen stream, and still could not start a VM.
- Coding agents you drive from outside. LangChain's Deep Agents docs say an agent inside the sandbox needs extra infrastructure you add to talk to it. Without that, the agent loop lives on your servers and every tool call crosses the network.
Questions people ask
Is boat cheaper than LangSmith Sandboxes?
In four of the five scenarios on this page, yes: one agent that never stops costs $26 a month on boat and $245 on LangSmith. For 1,000 short jobs at once, LangSmith's estimate is slightly lower, though neither fits as priced.
Can a LangSmith sandbox reach the internet?
Only part of it by default. Non-Enterprise organizations are limited to a managed allowlist that includes PyPI, npm, GitHub, OpenAI, Anthropic and LangSmith, and you file a support ticket to ask for more. boat sandboxes have open internet.
Do LangSmith Sandboxes have a desktop or browser for computer use?
No. LangSmith's computer use gives an agent code, files and authenticated APIs on a headless machine. boat streams a 60fps Linux desktop with Chromium that agents can see and click.
Can I SSH into each one?
Yes. LangSmith's CLI sets up SSH through its tunnel if your image runs sshd on port 22, and it also has an interactive console. boat gives SSH, raw TCP and a dedicated IP.
Can I run Claude Code or Codex inside it?
On boat they come preinstalled, and you prompt and steer them through an API. LangSmith has no preinstalled agents; its Deep Agents keep the agent loop outside and call the sandbox as a tool.
Is boat SOC 2 compliant?
SOC 2 is in progress. We're open about where we stand: live status at status.ascii.dev and our data retention policy at docs.boat.dev/data-retention.
Start a sandbox
Install the CLI, then run boat new.
7-day free trial