boat vs PandaStack
Both give each agent its own VM with its own kernel. boat gives it a whole workstation, with a desktop, SSH, nested virtualization and agents you drive by API, while PandaStack is an open-source microVM platform built around fast boots, memory forks and hosting apps and Postgres.
Where boat stands out
A desktop your agent can see and use
Every boat sandbox can run a full Linux desktop streamed at 60fps, with Chromium and computer use built in. You can embed the stream in your app so a person can watch or take over. PandaStack's browser template is headless Chromium, with no desktop template.
Agents you drive from outside, keys kept out
Claude Code, Codex and five other agents come preinstalled, and you prompt, steer and follow them through one API. Real API keys stay outside the sandbox in a credentials proxy, and a credential can switch to another account when one runs out of credits.
A whole workstation, sized for the job
You pick the machine size, up to 16 vCPU / 32 GB, and get nested virtualization for Android emulators and VMs, standard SSH, raw TCP and HTTPS URLs that need a token by default. PandaStack pins every sandbox at 8 vCPUs and treats the preview URL itself as the password.
The companies and products
boat
boat.dev runs sandboxes for AI agents: each one is a full Linux VM with its own kernel.
You start a machine with one command or one API call, then SSH in, run Docker, open a desktop, or let a built-in agent (Claude Code, Codex, OpenCode and others) work in it. The disk stays between sessions, and a stopped sandbox costs nothing.
- Isolation
- Full VM per sandbox, own kernel
- Regions
- EU: Germany, Finland, France
PandaStack
PandaStack calls itself the cloud for AI agents: open-source Firecracker microVMs for sandboxes, apps, Postgres and functions.
Every PandaStack sandbox, app and database runs in its own Firecracker microVM with its own Linux 5.10 kernel, booted from a template snapshot. Every template gets 8 burstable vCPUs, with RAM baked into the template, and you can build your own template from a Dockerfile. It is built for teams that want agent sandboxes, git-driven app hosting and managed Postgres on one platform, and its core is Apache-2.0 so you can run it yourself.
Which use cases each one fits
For each use case, Battleships prices every sandbox provider on the same workload and sorts them from the cheapest monthly bill up. “3rd cheapest of 367” means 2 of the other 366 providers run that workload, with every feature it needs, for less. “With limits” means the provider runs it but misses something, so it is listed after every full match. Open a use case for its whole ranking and what each provider misses.
| Use case and its workload | boat: price rank | PandaStack: price rank |
|---|---|---|
| Software factory 100 at once · 4 vCPU / 8 GB · 2,200 sessions of 8 h a month A software factory needs Docker, long builds and sometimes emulators; boat adds nested virtualization, SSH and machines up to 16 vCPU / 32 GB. | 3rd cheapest of 367 $634 a month | 91st of 367, with limits $832 a month |
| Always-on AI employees 50 machines 24/7 · 2 vCPU / 4 GB An assistant that lives on its machine all month fits both; PandaStack hibernates it after 5 idle minutes and wakes it on the next request, while boat keeps it running. | 5th cheapest of 366 $657 a month | 37th of 366, with limits $1,778 a month |
| Code interpreter bursts 100 at once · 1 vCPU / 2 GB · 200,000 sessions of 1 min a month PandaStack suits short code runs: templates boot from a snapshot, it bills only active CPU seconds, and idle sandboxes hibernate. | 186th of 345, with limits $2,000 a month | 143rd of 345, with limits $341 a month |
| Sandboxes for your users 300 at once · 2 vCPU / 4 GB · 30,000 sessions of 23 min a month PandaStack's smallest machine is 8 vCPU, so small per-user sandboxes cost more there; boat offers a 2 vCPU / 4 GiB size and token-protected URLs. | Cheapest of 361 $209 a month | 79th of 361, with limits $701 a month |
| RL rollouts 1,000 at once · 2 vCPU / 4 GB · 1,000,000 sessions of 3 min a month PandaStack's fork-tree copies a running sandbox with its memory into up to 16 children at once, which suits rollouts that branch from one state. | 34th of 360, with limits $2,000 a month | 184th of 360, with limits $21,864 a month |
| Agent evals 250 at once · 4 vCPU / 8 GB · 15,000 sessions of 20 min a month | 10th cheapest of 364 $200 a month | 44th cheapest of 364 $814 a month |
| CI runners 40 at once · 8 vCPU / 16 GB · 6,000 sessions of 12 min a month | 4th cheapest of 377 $86 a month | 68th cheapest of 377 $517 a month |
| 24/7 dev boxes 1 machine 24/7 · 4 vCPU / 8 GB A dev box wants real SSH for VS Code Remote and scp; PandaStack gives a WebSocket terminal, while boat gives standard SSH. | 18th cheapest of 368 $26 a month | 221st of 368, with limits $40 a month |
| Computer-use agents 50 at once · 4 vCPU / 8 GB · 20,000 sessions of 15 min a month PandaStack's browser template is headless Chromium only, while boat gives each agent a full Linux desktop streamed at 60fps with computer use. | 6th cheapest of 369 $200 a month | 92nd of 369, with limits $165 a month |
| Browser-use agents 50 at once · 2 vCPU / 4 GB · 30,000 sessions of 10 min a month Both run Chromium with Playwright; boat can also show the live browser on a desktop so a human can watch or take over. | 7th cheapest of 367 $200 a month | 58th of 367, with limits $158 a month |
| Scraping & bots (startup scale) 50 at once · 1 vCPU / 2 GB · 100,000 sessions of 3 min a month | 6th cheapest of 346 $90 a month | 72nd cheapest of 346 $962 a month |
| Mass scraping & bots (undetectable) 1,000 at once · 1 vCPU / 2 GB · 3,000,000 sessions of 2 min a month | 71st of 338, with limits $1,800 a month | 284th of 338, with limits $19,236 a month |
| Parallel red teaming 200 at once · 2 vCPU / 4 GB · 5,000 sessions of 30 min a month | 2nd cheapest of 360 $200 a month | 45th of 360, with limits $641 a month |
| GPU eval jobs 10 at once · 8 vCPU / 32 GB · 500 sessions of 30 min a month | Can't run it | Can't run it |
| macOS agents 5 at once · 4 vCPU / 8 GB · 1,000 sessions of 20 min a month | Can't run it | Can't run it |
Key features
| Feature | boat | PandaStack |
|---|---|---|
| Isolation | Full VM with its own kernel on dedicated AMD Ryzen 9 9950X hosts | Firecracker microVM with its own Linux 5.10 kernel |
| Machine size | Sizes you choose, up to 16 vCPU / 32 GB on the $100 plan and above | Always 8 burstable vCPUs; RAM is fixed per template |
| Desktop and computer use | Full Linux desktop streamed at 60fps, Chromium, computer use | Headless Chromium with Playwright; no desktop template |
| Nested virtualization | Yes, /dev/kvm for Android emulators and VMs | Not documented for the guest; KVM is a host requirement |
| Shell access | Standard SSH, so ssh, scp and VS Code Remote work | Interactive terminal over WebSocket from the CLI |
| Coding agents | Seven agents preinstalled, with a prompt, steer and events API | Agent template with seven coding agent CLIs, run through exec |
| Keeping API keys out of the sandbox | Credentials proxy for model providers and any HTTPS API; switch a credential to another account when credits run out | Keys go into the sandbox as environment variables or files |
| Inbound access | HTTPS URLs for up to 50 ports, token-protected by default; raw TCP | HTTPS URL for up to 32 ports; the URL itself is the credential |
| Pause and resume | Disk is saved every minute and on stop; resume boots the machine again | Pause keeps memory; hibernate saves memory and disk, and running processes come back |
| Fork | Fork a running sandbox with its disk | Fork with disk, or fork-tree with memory into 1 to 16 children while the parent keeps running |
| Wake on request | No; a stopped sandbox is started by API | Yes; a hibernated sandbox wakes on the next API request |
| Outbound rules | Open internet, no provider-side allowlist | Open internet, no outbound allowlist |
| Regions | EU only (Germany, Finland, France), with zero data retention | No region choice documented; self-host for data residency |
| Self-hosting | No | Apache-2.0 core, runs on your own cloud or hardware |
| Compliance and transparency | SOC 2 is in progress. We're open about where we stand: live status and data retention policy. | No SOC 2 report published |
Every feature Battleships tracks (43)
| Feature | boat | PandaStack |
|---|---|---|
| Full VM (own kernel) | Yes | Yes |
| Docker inside | Yes | Yes |
| Nested virtualization | Yes | No |
| Root | Yes | Yes |
| Systemd | Yes | Not published |
| Desktop GUI | Yes | No |
| Browser | Yes | Yes |
| Computer-use API | Yes | No |
| SSH | Yes | No |
| Persistent disk | Yes | Yes |
| Pause/resume | Yes | Yes |
| Automatic snapshots | Yes | Yes |
| Fork/clone | Yes | Yes |
| Live fork (no pause) | Yes | Yes |
| Memory fork | No | Yes |
| Custom image (Docker or snapshot) | Yes | Yes |
| ≥24 h sessions | Yes | Yes |
| Idle auto-stop | No | Yes |
| Wake on request | No | Yes |
| HTTPS preview URLs | Yes | Yes |
| Raw TCP inbound | Yes | Not published |
| Public IPv4 | No | No |
| Egress allowlist | No | No |
| Secret proxy | Yes | No |
| Secret proxy for any API | Yes | No |
| Preinstalled agents | Yes | Yes |
| Agent harness API | Yes | No |
| MCP server | No | Yes |
| GPU | No | No |
| Windows | No | No |
| Arm64 | No | No |
| Self-hosting | No | Yes |
| BYOC | No | Yes |
| Open source | No | Yes |
| Scoped API keys | Yes | Not published |
| Spend limits | Yes | Yes |
| Usage per sandbox (API) | Yes | No |
| Audit logs | No | Not published |
| SSO | No | Yes |
| SOC 2 | No | No |
| HIPAA | No | No |
| EU data residency | Yes | No |
| Zero data retention | Yes | Not published |
Performance
There is no comparable measurement for PandaStack yet: it is not in the StarSling hpc-sandbox-benchmarks run where boat did 26.69 runs per second at 4 vCPU / 8 GB. PandaStack publishes its own boot times (about 49 ms at p50), which measure start time, not CPU speed.
Node.js build-and-test loop at 4 vCPU / 8 GB, higher is better. Measured with the open hpc-sandbox-benchmarks suite. PandaStack has no published run in this suite yet, so there is no like-for-like number to compare.
Pricing in five scenarios
Each bill is priced from the providers' public price lists by the open Battleships engine, with the cheapest plan that runs the scenario.
| Scenario | boat, a month | PandaStack, a month |
|---|---|---|
| One coding agent, workdays 4 vCPU / 8 GB, 50 GB disk, 8 hours a day, 22 days a month, files kept between days | $20 · $20/mo | $40 · Pro |
| One agent that never stops 4 vCPU / 8 GB, 50 GB disk, running 24/7 all month | $26 · $20/mo | $144 · Pro |
| 50 agents in parallel 50 machines of 4 vCPU / 8 GB at once, 8-hour sessions, 1,100 sessions a month, Docker inside | $317 · $20/mo × 3 seats | $1,789 · Pro |
| Sandboxes for your users 2 vCPU / 4 GB, 30,000 sessions of 10 minutes a month, up to 300 at once | $200 · $100/mo × 2 seats | $801 · Team · with limits |
| 1,000 short jobs at once 2 vCPU / 4 GB, 1,000 at once, 3 minutes each, 200,000 jobs a month | $2,000 · $2000/mo · with limits | $4,244 · Team · with limits |
boat: Plans start at $20 a month, and the whole fee is usage credit. You pay per second for the size you pick while a sandbox runs, and a stopped sandbox costs nothing and keeps its disk.
PandaStack: PandaStack bills CPU only for the active vCPU seconds a sandbox burns and RAM for its resident working set, at $0.054 per active vCPU-hour and $0.0162 per GiB-hour. Pro is $20 and Team $99 a month, each fee returned as usage credit; every sandbox has 8 vCPUs, so the scenarios use 8 vCPU shapes.
Limits in those scenarios
PandaStack has no small machine: every template has 8 vCPUs, and the smallest the scenarios could use is 8 vCPU / 4 GiB, so many small per-user sandboxes do not fit as asked. For 1,000 short jobs at once, Team stops at 500 sandboxes at a time, while boat's largest plan has the slots but queues starts above 90 a minute. Neither fits that burst without talking to sales. boat has no session cap on paid plans, and PandaStack's persistent sandboxes also run as long as you want, though they hibernate after 5 idle minutes.
| Scenario | boat | PandaStack |
|---|---|---|
| One coding agent, workdays | None that bite | None that bite |
| One agent that never stops | None that bite | None that bite |
| 50 agents in parallel | None that bite | None that bite |
| Sandboxes for your users | None that bite |
|
| 1,000 short jobs at once |
|
|
Which one should you use?
Use PandaStack when
you need to self-host an open-source sandbox platform, fork running sandboxes with their memory, or keep agents, apps and Postgres on one platform.
- Memory forks, hibernation and wake on request. Good for jobs that branch from one running state, or sleep between requests and must come back with processes alive.
- Open source you can run yourself. Its Apache-2.0 core runs on your own cloud, on-prem hardware or a laptop, for teams that must keep everything in house.
- Apps and Postgres on the same platform. Useful when the agent's sandbox, the app it ships and its database should live on one platform with one bill.
Use boat when
your agents need a whole machine: a desktop and browser they can see, Docker and emulators, SSH, a size that fits the job, and coding agents you drive by API with keys kept out of the sandbox.
- A desktop your agent can see and use. Agents that click through real apps, or hit a login a human must solve, need a screen. On PandaStack you would build and maintain your own desktop and streaming image.
- Agents you drive from outside, keys kept out. PandaStack's agent template installs the CLIs, but you build the harness on exec yourself, and the keys sit inside a machine the agent controls, where one prompt injection can leak them.
- A whole workstation, sized for the job. Without /dev/kvm an agent cannot boot an emulator or a VM, and a shared preview URL that leaks in a log opens that port to anyone who reads it.
Questions people ask
Is boat cheaper than PandaStack?
boat costs less in all five scenarios, partly because every PandaStack sandbox has 8 vCPUs. A fleet of agents runs $317 a month on boat against $1,789 on PandaStack. For 1,000 short jobs at once, neither fits on a self-serve plan.
Does PandaStack have a desktop for computer use?
Not as a template. Its browser template is headless Chromium with Playwright and crawl4ai. boat gives each sandbox a full Linux desktop streamed at 60fps with computer use built in.
Can I SSH into a PandaStack sandbox?
PandaStack gives you an interactive terminal over WebSocket through its CLI, not the SSH protocol, so ssh, scp and VS Code Remote-SSH do not connect directly. boat sandboxes take standard SSH.
Can boat fork a sandbox with its memory like PandaStack?
No. boat forks a running sandbox with its disk, and the copy boots fresh. PandaStack's fork-tree copies memory too, so up to 16 children start with the parent's processes already running.
Can I self-host PandaStack or boat?
PandaStack's core is Apache-2.0 and runs on your own KVM-capable Linux hosts, in your cloud or on-prem. boat is a hosted service only, run in the EU with zero data retention.
Is boat SOC 2 compliant?
SOC 2 is in progress. We're open about where we stand: live status at status.ascii.dev and our data retention policy at docs.boat.dev/data-retention.
Start a sandbox
Install the CLI, then run boat new.
7-day free trial