boat vs Lizard
Lizard runs sandboxes as Firecracker microVMs next to its app and database hosting, and after a stop it keeps only the files on a /workspace volume. boat gives every agent a full VM with Docker and /dev/kvm, and saves its whole disk every minute.
Where boat stands out
The whole machine survives a stop
boat snapshots a sandbox's whole disk every minute and on stop, and a stopped sandbox costs nothing. On Lizard, only files on a Persistent Volume at /workspace survive a stop. That volume sits on one node, attaches to one sandbox at a time, and a sandbox that has one cannot be forked.
Docker, systemd and /dev/kvm in every sandbox
Every boat sandbox is a full VM with root, systemd, Docker and nested virtualization, so an agent can run docker compose or an Android emulator. Lizard sandboxes run commands as root, but its sandbox docs do not mention Docker, systemd or /dev/kvm, and there is no way to upload your own template.
Real AI keys never enter the sandbox
boat's AI credentials proxy adds your real keys to requests outside the sandbox, for model providers and any HTTPS API you register, and can switch a credential to another account when its credits run out. Lizard passes API keys and the Claude subscription token unchanged into each agent run, and its docs say to assume code in the sandbox can read them.
The companies and products
boat
boat.dev runs sandboxes for AI agents: each one is a full Linux VM with its own kernel.
You start a machine with one command or one API call, then SSH in, run Docker, open a desktop, or let a built-in agent (Claude Code, Codex, OpenCode and others) work in it. The disk stays between sessions, and a stopped sandbox costs nothing.
- Isolation
- Full VM per sandbox, own kernel
- Regions
- EU: Germany, Finland, France
Lizard
Lizard is a cloud for apps built with coding agents: it deploys apps and managed databases, and it also runs sandboxes for AI agents.
Lizard Sandboxes are Firecracker microVMs started from a fixed catalog of templates: base, interpreter, desktop, and templates with Codex, Claude Code, OpenCode, pi or Prime Agent. You drive them with a TypeScript or Python SDK, an HTTP API or the lizard CLI, and the same account can deploy apps, Postgres, Redis and object storage. It is built for teams that want agents to run code and then ship what they build on one platform.
Which use cases each one fits
For each use case, Battleships prices every sandbox provider on the same workload and sorts them from the cheapest monthly bill up. “3rd cheapest of 367” means 2 of the other 366 providers run that workload, with every feature it needs, for less. “With limits” means the provider runs it but misses something, so it is listed after every full match. Open a use case for its whole ranking and what each provider misses.
| Use case and its workload | boat: price rank | Lizard: price rank |
|---|---|---|
| Software factory 100 at once · 4 vCPU / 8 GB · 2,200 sessions of 8 h a month boat keeps the whole disk with Docker and /dev/kvm; on Lizard only a /workspace volume survives a stop, and a sandbox with a volume cannot be forked. | 3rd cheapest of 367 $634 a month | 22nd of 367, with limits $570 a month |
| Always-on AI employees 50 machines 24/7 · 2 vCPU / 4 GB An assistant that runs for weeks keeps its whole machine on boat; on Lizard only /workspace survives a restart, and that volume lives on one node. | 5th cheapest of 366 $657 a month | 62nd of 366, with limits $696 a month |
| Code interpreter bursts 100 at once · 1 vCPU / 2 GB · 200,000 sessions of 1 min a month Lizard suits short Python runs: its interpreter template keeps a Jupyter kernel between calls and starts fast, while boat's start limits make big bursts a compromise. | 186th of 345, with limits $2,000 a month | 60th of 345, with limits $54 a month |
| Sandboxes for your users 300 at once · 2 vCPU / 4 GB · 30,000 sessions of 23 min a month A large user base outgrows Lizard Pro's 100 sandboxes at once and 400 starts a day, so it needs an Enterprise contract. | Cheapest of 361 $209 a month | 36th of 361, with limits $199 a month |
| RL rollouts 1,000 at once · 2 vCPU / 4 GB · 1,000,000 sessions of 3 min a month Lizard can fork a running sandbox with its memory, which suits branching rollouts, but 400 starts a day caps large runs without Enterprise. | 34th of 360, with limits $2,000 a month | 14th of 360, with limits $858 a month |
| Agent evals 250 at once · 4 vCPU / 8 GB · 15,000 sessions of 20 min a month | 10th cheapest of 364 $200 a month | 96th of 364, with limits $162 a month |
| CI runners 40 at once · 8 vCPU / 16 GB · 6,000 sessions of 12 min a month | 4th cheapest of 377 $86 a month | 3rd cheapest of 377 $85 a month |
| 24/7 dev boxes 1 machine 24/7 · 4 vCPU / 8 GB Lizard pauses a sandbox with its memory for free, but only /workspace survives a full stop; boat keeps the whole machine between sessions. | 18th cheapest of 368 $26 a month | 214th of 368, with limits $28 a month |
| Computer-use agents 50 at once · 4 vCPU / 8 GB · 20,000 sessions of 15 min a month Both have a desktop: Lizard's desktop template gives a browser link and VNC, and boat streams a 60fps desktop with Chromium and computer use. | 6th cheapest of 369 $200 a month | 42nd of 369, with limits $162 a month |
| Browser-use agents 50 at once · 2 vCPU / 4 GB · 30,000 sessions of 10 min a month | 7th cheapest of 367 $200 a month | 52nd of 367, with limits $86 a month |
| Scraping & bots (startup scale) 50 at once · 1 vCPU / 2 GB · 100,000 sessions of 3 min a month | 6th cheapest of 346 $90 a month | 5th cheapest of 346 $81 a month |
| Mass scraping & bots (undetectable) 1,000 at once · 1 vCPU / 2 GB · 3,000,000 sessions of 2 min a month | 71st of 338, with limits $1,800 a month | 31st of 338, with limits $1,620 a month |
| Parallel red teaming 200 at once · 2 vCPU / 4 GB · 5,000 sessions of 30 min a month | 2nd cheapest of 360 $200 a month | 14th of 360, with limits $48 a month |
| GPU eval jobs 10 at once · 8 vCPU / 32 GB · 500 sessions of 30 min a month | Can't run it | Can't run it |
| macOS agents 5 at once · 4 vCPU / 8 GB · 1,000 sessions of 20 min a month | Can't run it | Can't run it |
Key features
Every feature Battleships tracks (43)
| Feature | boat | Lizard |
|---|---|---|
| Full VM (own kernel) | Yes | Yes |
| Docker inside | Yes | Not published |
| Nested virtualization | Yes | No |
| Root | Yes | Yes |
| Systemd | Yes | Not published |
| Desktop GUI | Yes | Yes |
| Browser | Yes | Yes |
| Computer-use API | Yes | Yes |
| SSH | Yes | No |
| Persistent disk | Yes | Yes |
| Pause/resume | Yes | Yes |
| Automatic snapshots | Yes | No |
| Fork/clone | Yes | Yes |
| Live fork (no pause) | Yes | Yes |
| Memory fork | No | Yes |
| Custom image (Docker or snapshot) | Yes | Yes |
| ≥24 h sessions | Yes | Yes |
| Idle auto-stop | No | No |
| Wake on request | No | No |
| HTTPS preview URLs | Yes | Yes |
| Raw TCP inbound | Yes | No |
| Public IPv4 | No | No |
| Egress allowlist | No | Not published |
| Secret proxy | Yes | No |
| Secret proxy for any API | Yes | No |
| Preinstalled agents | Yes | Yes |
| Agent harness API | Yes | Yes |
| MCP server | No | Not published |
| GPU | No | No |
| Windows | No | No |
| Arm64 | No | Not published |
| Self-hosting | No | No |
| BYOC | No | No |
| Open source | No | No |
| Scoped API keys | Yes | Not published |
| Spend limits | Yes | Not published |
| Usage per sandbox (API) | Yes | Not published |
| Audit logs | No | No |
| SSO | No | No |
| SOC 2 | No | No |
| HIPAA | No | No |
| EU data residency | Yes | Yes |
| Zero data retention | Yes | Not published |
Performance
There is no comparable CPU measurement for Lizard. boat did 26.69 Node.js build-and-test runs per second at 4 vCPU / 8 GB in StarSling's public benchmark, and Lizard was not part of that run. Lizard publishes its own start-time test, a 228 ms median to first Python output, which measures how fast a sandbox starts, not how fast it works.
Node.js build-and-test loop at 4 vCPU / 8 GB, higher is better. Measured with the open hpc-sandbox-benchmarks suite. Lizard has no published run in this suite yet, so there is no like-for-like number to compare.
Pricing in five scenarios
Each bill is priced from the providers' public price lists by the open Battleships engine, with the cheapest plan that runs the scenario.
| Scenario | boat, a month | Lizard, a month |
|---|---|---|
| One coding agent, workdays 4 vCPU / 8 GB, 50 GB disk, 8 hours a day, 22 days a month, files kept between days | $20 · $20/mo | $19 · Pro · with limits |
| One agent that never stops 4 vCPU / 8 GB, 50 GB disk, running 24/7 all month | $26 · $20/mo | $28 · Pro · with limits |
| 50 agents in parallel 50 machines of 4 vCPU / 8 GB at once, 8-hour sessions, 1,100 sessions a month, Docker inside | $317 · $20/mo × 3 seats | $285 · Pro · with limits |
| Sandboxes for your users 2 vCPU / 4 GB, 30,000 sessions of 10 minutes a month, up to 300 at once | $200 · $100/mo × 2 seats | $86 · Pro · with limits |
| 1,000 short jobs at once 2 vCPU / 4 GB, 1,000 at once, 3 minutes each, 200,000 jobs a month | $2,000 · $2000/mo · with limits | $172 · Pro · with limits |
boat: You pick a monthly plan from $20, and all of it becomes usage credit spent per second on running sandboxes. A stopped sandbox costs nothing and keeps its whole disk.
Lizard: Lizard Pro costs $19 a month and includes $19 of credit for sandboxes, apps, databases, volumes and traffic. Each sandbox size has a flat hourly price billed per second while it runs, idle time included; a paused sandbox is free, and volumes bill by used space while you keep them.
Limits in those scenarios
Lizard Pro runs up to 100 sandboxes at once and starts up to 24 a minute, 120 an hour and 400 a day, counted across all your workspaces. That is why sandboxes for your users and 1,000 short jobs at once need an Enterprise contract there. On boat the 1,000-job burst is also held back by start limits and gets queued. For the coding-agent scenarios, what bites on Lizard is that only /workspace survives a stop, so packages installed anywhere else must be installed again.
| Scenario | boat | Lizard |
|---|---|---|
| One coding agent, workdays | None that bite |
|
| One agent that never stops | None that bite |
|
| 50 agents in parallel | None that bite |
|
| Sandboxes for your users | None that bite |
|
| 1,000 short jobs at once |
|
|
Which one should you use?
Use Lizard when
your agents need to pause and resume with memory intact, must run in the US, or should deploy what they build to managed apps and databases on the same account.
- Pause with memory, and fork with it. Useful if agents must stop mid-task and come back with their processes still running: Lizard pauses for free and forks with memory.
- A US region. Useful if your users or data are in North America: Lizard runs sandboxes in US East as well as EU West.
- Apps and databases on the same account. Useful if you want agents to deploy what they build to managed hosting with Postgres, Redis and object storage.
Use boat when
your agents work for hours on a real machine: installing system packages, running Docker or emulators, keeping the whole disk between sessions, and calling AI APIs without the real keys inside.
- The whole machine survives a stop. An agent that installs system packages and tools over hours starts again from a bare template after each stop on Lizard, unless everything lives under /workspace. A paused Lizard sandbox also loses its state if its node fails.
- Docker, systemd and /dev/kvm in every sandbox. Many repos need docker compose up before their tests pass. Without a documented Docker daemon, an agent on Lizard has to find a workaround for every repo that needs one.
- Real AI keys never enter the sandbox. An agent running with permissions skipped can print or send any key it can read. On Lizard the guard is using keys you can revoke and rotating them after a leak; only ChatGPT logins get a short-lived token.
Questions people ask
Are Lizard sandboxes containers or VMs?
Mostly VMs. Lizard says each sandbox is a Firecracker microVM with its own kernel. A sandbox that attaches an older pod-backed volume or restores a pod snapshot runs as a Kubernetes pod and shares the host kernel. On boat, every sandbox is a full VM.
What survives when a Lizard sandbox stops?
Only files on a Persistent Volume mounted at /workspace. Without a volume, /workspace is temporary too. A paused sandbox keeps its memory and files, but only on its own node. On boat, the whole disk is snapshotted every minute and kept when the sandbox stops.
Can I run Docker in a Lizard sandbox?
Lizard's sandbox docs do not say. Commands run as root, but Docker, systemd and /dev/kvm are not mentioned, and you cannot upload a custom template. boat ships Docker, systemd and nested virtualization on every sandbox.
Is boat cheaper than Lizard?
Not per hour: for the same vCPU and memory, Lizard's sandbox sizes cost a little less than boat's, and its plan is $19 a month against boat's $20. The five scenarios above show what each fits and what it costs, including where Lizard's limits stop a workload. boat's default size also comes with a larger disk that is kept for free while stopped.
Where does my data run?
boat runs only in the EU (Germany, Finland and France), with EU data residency and a zero data retention option. Lizard runs in US East (Virginia) and EU West (Limburg).
Is boat SOC 2 compliant?
SOC 2 is in progress. We're open about where we stand: live status at status.ascii.dev and our data retention policy at docs.boat.dev/data-retention. Lizard lists a SOC 2 report as coming soon on its Enterprise plan.
Start a sandbox
Install the CLI, then run boat new.
7-day free trial