boat vs PPIO Agent Sandbox
Both give an AI agent its own isolated Linux machine. boat gives it a full VM in the EU that runs Docker and emulators and comes with coding agents built in, while PPIO is an E2B-compatible sandbox that runs in mainland China and can pause with its memory.
Where boat stands out
A whole machine, not just a runtime
A boat sandbox is a full VM with root, systemd, Docker and /dev/kvm, so an agent can run compose stacks, Android emulators and VMs. Machines go up to 16 vCPU / 32 GB, and you can SSH straight in or open raw TCP ports.
Coding agents you drive from outside
Claude Code, Codex and five other agents come preinstalled, and you prompt, steer and follow them through one API. Real API keys stay in a credentials proxy outside the sandbox, and a credential can switch to another account when one runs out of credits.
Your data stays in the EU
boat runs only in the EU, in Germany, Finland and France, and keeps zero data retention. PPIO's sandboxes run only in Shanghai and Beijing.
The companies and products
boat
boat.dev runs sandboxes for AI agents: each one is a full Linux VM with its own kernel.
You start a machine with one command or one API call, then SSH in, run Docker, open a desktop, or let a built-in agent (Claude Code, Codex, OpenCode and others) work in it. The disk stays between sessions, and a stopped sandbox costs nothing.
- Isolation
- Full VM per sandbox, own kernel
- Regions
- EU: Germany, Finland, France
PPIO Agent Sandbox
PPIO is a Chinese AI cloud that also sells GPUs and model APIs; Agent Sandbox is its sandbox service for AI agents.
Each PPIO sandbox is an isolated machine with its own filesystem and runtime, built from a template that can start from a Docker image or Dockerfile. It speaks the E2B API, so the E2B SDK works with a PPIO key, and it adds pause and resume with memory, snapshots, a VNC desktop and a browser template. It runs in two regions in mainland China and suits teams whose agents and users are there.
Which use cases each one fits
For each use case, Battleships prices every sandbox provider on the same workload and sorts them from the cheapest monthly bill up. “3rd cheapest of 367” means 2 of the other 366 providers run that workload, with every feature it needs, for less. “With limits” means the provider runs it but misses something, so it is listed after every full match. Open a use case for its whole ranking and what each provider misses.
| Use case and its workload | boat: price rank | PPIO Agent Sandbox: price rank |
|---|---|---|
| Software factory 100 at once · 4 vCPU / 8 GB · 2,200 sessions of 8 h a month A software factory needs Docker for databases and services; boat runs it inside the sandbox, and PPIO does not document it. | 3rd cheapest of 367 $634 a month | 164th of 367, with limits $1,566 a month |
| Always-on AI employees 50 machines 24/7 · 2 vCPU / 4 GB An assistant that lives on its machine all month fits boat's sessions with no cap; on PPIO you turn on long-running mode, restart it after 7 days and watch the idle timeout. | 5th cheapest of 366 $657 a month | 38th of 366, with limits $2,021 a month |
| Code interpreter bursts 100 at once · 1 vCPU / 2 GB · 200,000 sessions of 1 min a month PPIO suits short code runs: sandboxes start fast, bill per second and can pause with their memory between requests. | 186th of 345, with limits $2,000 a month | 80th of 345, with limits $106 a month |
| Sandboxes for your users 300 at once · 2 vCPU / 4 GB · 30,000 sessions of 23 min a month Both can host sandboxes for your users; PPIO allows 50 at once by default, and boat's paid plans start at 100. | Cheapest of 361 $209 a month | 76th of 361, with limits $668 a month |
| RL rollouts 1,000 at once · 2 vCPU / 4 GB · 1,000,000 sessions of 3 min a month | 34th of 360, with limits $2,000 a month | 57th of 360, with limits $3,201 a month |
| Agent evals 250 at once · 4 vCPU / 8 GB · 15,000 sessions of 20 min a month | 10th cheapest of 364 $200 a month | 120th of 364, with limits $515 a month |
| CI runners 40 at once · 8 vCPU / 16 GB · 6,000 sessions of 12 min a month CI jobs that build containers or Android apps need Docker and /dev/kvm, which boat has and PPIO does not document. | 4th cheapest of 377 $86 a month | 280th of 377, with limits $464 a month |
| 24/7 dev boxes 1 machine 24/7 · 4 vCPU / 8 GB A dev box needs SSH, Docker and a disk that stays; boat gives direct SSH, while PPIO's SSH goes through a WebSocket tunnel you set up in a template. | 18th cheapest of 368 $26 a month | 123rd of 368, with limits $81 a month |
| Computer-use agents 50 at once · 4 vCPU / 8 GB · 20,000 sessions of 15 min a month Both have a Linux desktop for computer use; boat streams it at 60fps, and PPIO shows it through a VNC page. | 6th cheapest of 369 $200 a month | 11th cheapest of 369 $464 a month |
| Browser-use agents 50 at once · 2 vCPU / 4 GB · 30,000 sessions of 10 min a month | 7th cheapest of 367 $200 a month | 63rd of 367, with limits $232 a month |
| Scraping & bots (startup scale) 50 at once · 1 vCPU / 2 GB · 100,000 sessions of 3 min a month | 6th cheapest of 346 $90 a month | 11th cheapest of 346 $157 a month |
| Mass scraping & bots (undetectable) 1,000 at once · 1 vCPU / 2 GB · 3,000,000 sessions of 2 min a month | 71st of 338, with limits $1,800 a month | 116th of 338, with limits $3,138 a month |
| Parallel red teaming 200 at once · 2 vCPU / 4 GB · 5,000 sessions of 30 min a month PPIO can fork a running sandbox with its memory, which helps when many attackers start from the same state. | 2nd cheapest of 360 $200 a month | 19th of 360, with limits $154 a month |
| GPU eval jobs 10 at once · 8 vCPU / 32 GB · 500 sessions of 30 min a month | Can't run it | Can't run it |
| macOS agents 5 at once · 4 vCPU / 8 GB · 1,000 sessions of 20 min a month | Can't run it | Can't run it |
Key features
| Feature | boat | PPIO Agent Sandbox |
|---|---|---|
| Isolation | Full VM with its own kernel on dedicated AMD Ryzen 9 9950X hosts | Isolated sandbox with its own filesystem and runtime |
| Docker inside | Yes, Docker and compose run inside the sandbox | Not documented; Docker images are only used to build templates |
| Nested virtualization | Yes, /dev/kvm for Android emulators and VMs | Not documented |
| Biggest machine | Up to 16 vCPU / 32 GB on the $100 plan and above | Up to 8 vCPU / 8 GiB, with a 20 GB local disk |
| Session length | No cap on paid plans; you set the time to live | 5 minutes by default, 1 hour at most, or up to 7 days in long-running mode |
| Pause and resume | Disk is saved every minute and on stop; resume boots the machine again | Pause keeps files and memory with running processes; can wake on the next command |
| Snapshots and fork | Fork a running sandbox with its disk | Snapshots with memory to start new sandboxes from, and clone of a running sandbox |
| SSH | Direct SSH to every sandbox | OpenSSH in a custom template, reached through a WebSocket tunnel |
| Inbound access | HTTPS URLs for up to 50 ports, token-protected by default; raw TCP; dedicated IPv4 or IPv6 | HTTPS URL per port, token-protected unless you allow public traffic; no dedicated IP |
| Outbound rules | Open internet, no provider-side allowlist | Allow and deny lists by IP or CIDR, changeable on a running sandbox |
| Coding agents | Seven agents preinstalled, with a prompt, steer and events API | A Codex template, driven through the command API |
| Keeping API keys out of the sandbox | Credentials proxy for model providers and any HTTPS API; switch a credential to another account when credits run out | Secrets swapped into HTTPS request headers by an outside proxy, Beijing region only |
| Desktop | Linux desktop streamed at 60fps, with Chromium and computer use | VNC desktop and a Chromium browser template |
| Regions | EU only (Germany, Finland, France) | Mainland China only (Shanghai, Beijing) |
| Compliance and transparency | SOC 2 is in progress. We're open about where we stand: live status and data retention policy. | Not published |
Every feature Battleships tracks (43)
| Feature | boat | PPIO Agent Sandbox |
|---|---|---|
| Full VM (own kernel) | Yes | Yes |
| Docker inside | Yes | No |
| Nested virtualization | Yes | No |
| Root | Yes | Not published |
| Systemd | Yes | Not published |
| Desktop GUI | Yes | Yes |
| Browser | Yes | Yes |
| Computer-use API | Yes | Yes |
| SSH | Yes | Yes |
| Persistent disk | Yes | Yes |
| Pause/resume | Yes | Yes |
| Automatic snapshots | Yes | Yes |
| Fork/clone | Yes | Yes |
| Live fork (no pause) | Yes | Yes |
| Memory fork | No | Yes |
| Custom image (Docker or snapshot) | Yes | Yes |
| ≥24 h sessions | Yes | Yes |
| Idle auto-stop | No | Yes |
| Wake on request | No | Yes |
| HTTPS preview URLs | Yes | Yes |
| Raw TCP inbound | Yes | No |
| Public IPv4 | No | No |
| Egress allowlist | No | Yes |
| Secret proxy | Yes | Yes |
| Secret proxy for any API | Yes | Yes |
| Preinstalled agents | Yes | Yes |
| Agent harness API | Yes | No |
| MCP server | No | Yes |
| GPU | No | No |
| Windows | No | No |
| Arm64 | No | No |
| Self-hosting | No | No |
| BYOC | No | No |
| Open source | No | No |
| Scoped API keys | Yes | Not published |
| Spend limits | Yes | Not published |
| Usage per sandbox (API) | Yes | No |
| Audit logs | No | Not published |
| SSO | No | No |
| SOC 2 | No | Not published |
| HIPAA | No | No |
| EU data residency | Yes | No |
| Zero data retention | Yes | Not published |
Performance
There is no comparable measurement for PPIO Agent Sandbox. boat did 26.69 runs per second on the StarSling hpc-sandbox-benchmarks Node.js build-and-test loop at 4 vCPU / 8 GB, on dedicated AMD Ryzen 9 9950X hosts. PPIO has not been run on the same test, so this page does not compare speed.
Node.js build-and-test loop at 4 vCPU / 8 GB, higher is better. Measured with the open hpc-sandbox-benchmarks suite. PPIO Agent Sandbox has no published run in this suite yet, so there is no like-for-like number to compare.
Pricing in five scenarios
Each bill is priced from the providers' public price lists by the open Battleships engine, with the cheapest plan that runs the scenario.
| Scenario | boat, a month | PPIO Agent Sandbox, a month |
|---|---|---|
| One coding agent, workdays 4 vCPU / 8 GB, 50 GB disk, 8 hours a day, 22 days a month, files kept between days | $20 · $20/mo | $20 · Pay as you go |
| One agent that never stops 4 vCPU / 8 GB, 50 GB disk, running 24/7 all month | $26 · $20/mo | $85 · Pay as you go · with limits |
| 50 agents in parallel 50 machines of 4 vCPU / 8 GB at once, 8-hour sessions, 1,100 sessions a month, Docker inside | $317 · $20/mo × 3 seats | $1,020 · Pay as you go · with limits |
| Sandboxes for your users 2 vCPU / 4 GB, 30,000 sessions of 10 minutes a month, up to 300 at once | $200 · $100/mo × 2 seats | $290 · Pay as you go · with limits |
| 1,000 short jobs at once 2 vCPU / 4 GB, 1,000 at once, 3 minutes each, 200,000 jobs a month | $2,000 · $2000/mo · with limits | $640 · Pay as you go · with limits |
boat: Plans start at $20 a month, and the whole fee is usage credit. You pay per second while a sandbox runs, and a stopped sandbox costs nothing and keeps its disk.
PPIO Agent Sandbox: PPIO bills per second for the vCPU and RAM you set, in CNY from a prepaid balance, with no monthly fee. The 20 GB local disk is free, and templates, snapshots and paused sandboxes use persistent storage that is free up to 60 GB per account and then billed by size.
Limits in those scenarios
The table counts PPIO's long-running mode, which the docs show running a sandbox for 7 days, so an agent that never stops needs a restart each week; the idle timeout still applies, and long-running mode must be set when you create the sandbox. PPIO allows 50 running sandboxes per user by default, so the fleet and burst scenarios need a quota raise through its sales team, and each sandbox has a fixed 20 GB disk. PPIO publishes no egress price. boat has no session cap, but at 1,000 short jobs at once its $2,000 plan queues the starts.
| Scenario | boat | PPIO Agent Sandbox |
|---|---|---|
| One coding agent, workdays | None that bite |
|
| One agent that never stops | None that bite |
|
| 50 agents in parallel | None that bite |
|
| Sandboxes for your users | None that bite |
|
| 1,000 short jobs at once |
|
|
Which one should you use?
Use PPIO Agent Sandbox when
your agents and users are in mainland China, or when you run short E2B-style jobs that pause with their memory between requests.
- Memory pause, snapshots and wake on command. Useful for short jobs that sleep between requests: a paused sandbox keeps its running processes and wakes on the next command.
- Close to users in mainland China. Its sandboxes run in Shanghai and Beijing, close to agents, users and services inside mainland China.
- E2B API and outbound rules. Code written for E2B can move over by changing a domain and key, and outbound traffic can be limited by IP range.
Use boat when
your agents do real work for hours: Docker, emulators, builds and a browser on a full VM in the EU, with coding agents you drive by API.
- A whole machine, not just a runtime. PPIO documents no Docker or /dev/kvm inside a sandbox and caps it at 8 GiB of RAM, so an agent that needs a database container or an emulator has no way to start one.
- Coding agents you drive from outside. PPIO's Codex template is run through the generic command API, so you parse its output and build the harness yourself, and its secrets proxy works only in the Beijing region.
- Your data stays in the EU. Code, logs and customer data an agent touches leave the EU on PPIO, which many European teams and their customers cannot accept, and there is no region outside mainland China to pick instead.
Questions people ask
Is boat cheaper than PPIO Agent Sandbox?
For one agent on workdays they cost about the same, and boat costs less for an agent that never stops, for 50 agents in parallel and for sandboxes for your users. For 1,000 short jobs at once neither fits as listed, but PPIO costs less once it raises your quota.
Can I run Docker in a PPIO sandbox?
PPIO uses Docker images and Dockerfiles to build sandbox templates, but its docs do not describe running Docker inside a sandbox. boat runs Docker and compose inside every sandbox and also exposes /dev/kvm for emulators and VMs.
How long can a PPIO sandbox run?
A new PPIO sandbox lives 5 minutes by default and at most 1 hour, unless you create it in long-running mode, which lifts that cap; PPIO's docs show a 7-day sandbox. boat has no session cap on paid plans.
Does PPIO Agent Sandbox work with the E2B SDK?
Yes. PPIO offers an E2B-compatible API, so the E2B SDK works after you set its domain and use a PPIO key, though PPIO recommends its own SDK for every feature.
Where does each one run?
PPIO runs sandboxes in Shanghai and Beijing in mainland China. boat runs only in the EU, in Germany, Finland and France.
Is boat SOC 2 compliant?
SOC 2 is in progress. We're open about where we stand: live status at status.ascii.dev and our data retention policy at docs.boat.dev/data-retention.
Start a sandbox
Install the CLI, then run boat new.
7-day free trial