boat vs Sandbox0
Both give an agent a Linux sandbox that keeps its files and can run for as long as you want. boat gives it a whole virtual machine with its own kernel, while Sandbox0 runs it in a gVisor sandbox that pauses on a timeout and wakes on the next request.
Where boat stands out
A real kernel, not a user-space one
A boat sandbox is a full VM with its own Linux kernel, systemd and root. Sandbox0 runs your code in gVisor, which reimplements the kernel in user space, so some kernel features behave differently or are missing.
Docker and emulators that just work
On boat, Docker runs with normal networking and its images stay on the disk across stops. /dev/kvm is there too, so Android emulators, kind and VMs start. On Sandbox0, Docker runs without bridge networking, its images are discarded on every pause, and the docs send kind to a VM.
A desktop agents can use, and hosting
boat streams a 60fps desktop with Chromium and gives agents a computer use API to see the screen and click. It also serves HTTPS on up to 50 ports and raw TCP. Sandbox0's desktop viewer is built for a person watching, and its inbound traffic is HTTP only.
The companies and products
boat
boat.dev runs sandboxes for AI agents: each one is a full Linux VM with its own kernel.
You start a machine with one command or one API call, then SSH in, run Docker, open a desktop, or let a built-in agent (Claude Code, Codex, OpenCode and others) work in it. The disk stays between sessions, and a stopped sandbox costs nothing.
- Isolation
- Full VM per sandbox, own kernel
- Regions
- EU: Germany, Finland, France
Sandbox0
Sandbox0 calls itself a long-running agent sandbox: each sandbox keeps a durable disk and pauses and resumes on demand.
Every Sandbox0 sandbox runs inside gVisor, a kernel written in user space, on dedicated Nomad nodes, with a copy-on-write root disk stored in S3. You claim sandboxes from templates built on OCI images and drive them with a CLI and Go, Python and TypeScript SDKs. The core is open source, and a sister product called Sandpi runs coding agents on top of it.
Which use cases each one fits
For each use case, Battleships prices every sandbox provider on the same workload and sorts them from the cheapest monthly bill up. “3rd cheapest of 367” means 2 of the other 366 providers run that workload, with every feature it needs, for less. “With limits” means the provider runs it but misses something, so it is listed after every full match. Open a use case for its whole ranking and what each provider misses.
| Use case and its workload | boat: price rank | Sandbox0: price rank |
|---|---|---|
| Software factory 100 at once · 4 vCPU / 8 GB · 2,200 sessions of 8 h a month A software factory runs Docker builds, emulators and test servers, which want a real kernel; Sandbox0's Docker has no bridge network and loses its images on every pause. | 3rd cheapest of 367 $634 a month | 156th of 367, with limits $1,447 a month |
| Always-on AI employees 50 machines 24/7 · 2 vCPU / 4 GB Both can keep an assistant's files all month; boat keeps the whole machine running, while Sandbox0 pauses on a timeout by default and wakes on the next request. | 5th cheapest of 366 $657 a month | 72nd of 366, with limits $1,883 a month |
| Code interpreter bursts 100 at once · 1 vCPU / 2 GB · 200,000 sessions of 1 min a month | 186th of 345, with limits $2,000 a month | 219th of 345, with limits $98 a month |
| Sandboxes for your users 300 at once · 2 vCPU / 4 GB · 30,000 sessions of 23 min a month Sandbox0's wake on request and outbound rules suit sandboxes for your users, but its default quota is 20 running sandboxes per team until a request is approved. | Cheapest of 361 $209 a month | 220th of 361, with limits $617 a month |
| RL rollouts 1,000 at once · 2 vCPU / 4 GB · 1,000,000 sessions of 3 min a month | 34th of 360, with limits $2,000 a month | 344th of 360, with limits $2,983 a month |
| Agent evals 250 at once · 4 vCPU / 8 GB · 15,000 sessions of 20 min a month | 10th cheapest of 364 $200 a month | 259th of 364, with limits $480 a month |
| CI runners 40 at once · 8 vCPU / 16 GB · 6,000 sessions of 12 min a month CI jobs that use kind, Android emulators or VM images need nested virtualization, which boat has; Sandbox0's own docs say to use a VM for kind. | 4th cheapest of 377 $86 a month | 263rd of 377, with limits $288 a month |
| 24/7 dev boxes 1 machine 24/7 · 4 vCPU / 8 GB Both work as a dev box that keeps its disk; boat adds raw TCP, hosting on up to 50 ports and a full systemd machine. | 18th cheapest of 368 $26 a month | 58th cheapest of 368 $75 a month |
| Computer-use agents 50 at once · 4 vCPU / 8 GB · 20,000 sessions of 15 min a month boat streams a 60fps desktop with a computer use API; Sandbox0 ships a VNC viewer for people while agents drive the browser through CDP. | 6th cheapest of 369 $200 a month | 62nd of 369, with limits $432 a month |
| Browser-use agents 50 at once · 2 vCPU / 4 GB · 30,000 sessions of 10 min a month | 7th cheapest of 367 $200 a month | 125th of 367, with limits $216 a month |
| Scraping & bots (startup scale) 50 at once · 1 vCPU / 2 GB · 100,000 sessions of 3 min a month | 6th cheapest of 346 $90 a month | 121st of 346, with limits $146 a month |
| Mass scraping & bots (undetectable) 1,000 at once · 1 vCPU / 2 GB · 3,000,000 sessions of 2 min a month | 71st of 338, with limits $1,800 a month | 104th of 338, with limits $2,925 a month |
| Parallel red teaming 200 at once · 2 vCPU / 4 GB · 5,000 sessions of 30 min a month Red teaming tools often need raw sockets, packet filters and a real kernel, which a full VM gives and gVisor does not. | 2nd cheapest of 360 $200 a month | 161st of 360, with limits $143 a month |
| GPU eval jobs 10 at once · 8 vCPU / 32 GB · 500 sessions of 30 min a month | Can't run it | Can't run it |
| macOS agents 5 at once · 4 vCPU / 8 GB · 1,000 sessions of 20 min a month | Can't run it | Can't run it |
Key features
Every feature Battleships tracks (43)
| Feature | boat | Sandbox0 |
|---|---|---|
| Full VM (own kernel) | Yes | No |
| Docker inside | Yes | Yes |
| Nested virtualization | Yes | No |
| Root | Yes | Yes |
| Systemd | Yes | Not published |
| Desktop GUI | Yes | Yes |
| Browser | Yes | Yes |
| Computer-use API | Yes | No |
| SSH | Yes | Yes |
| Persistent disk | Yes | Yes |
| Pause/resume | Yes | Yes |
| Automatic snapshots | Yes | Yes |
| Fork/clone | Yes | Yes |
| Live fork (no pause) | Yes | Yes |
| Memory fork | No | Yes |
| Custom image (Docker or snapshot) | Yes | Yes |
| ≥24 h sessions | Yes | Yes |
| Idle auto-stop | No | Yes |
| Wake on request | No | Yes |
| HTTPS preview URLs | Yes | Yes |
| Raw TCP inbound | Yes | No |
| Public IPv4 | No | No |
| Egress allowlist | No | Yes |
| Secret proxy | Yes | Yes |
| Secret proxy for any API | Yes | Yes |
| Preinstalled agents | Yes | Yes |
| Agent harness API | Yes | Yes |
| MCP server | No | No |
| GPU | No | No |
| Windows | No | No |
| Arm64 | No | No |
| Self-hosting | No | Yes |
| BYOC | No | No |
| Open source | No | Yes |
| Scoped API keys | Yes | Not published |
| Spend limits | Yes | Not published |
| Usage per sandbox (API) | Yes | No |
| Audit logs | No | Yes |
| SSO | No | No |
| SOC 2 | No | No |
| HIPAA | No | No |
| EU data residency | Yes | No |
| Zero data retention | Yes | Not published |
Performance
There is no comparable measurement. boat did 26.69 runs per second on the StarSling hpc-sandbox-benchmarks Node.js build-and-test loop at 4 vCPU / 8 GB, and Sandbox0 has not been run on that benchmark. Sandbox0 also does not let you pick a vCPU count; CPU follows the memory you set.
Node.js build-and-test loop at 4 vCPU / 8 GB, higher is better. Measured with the open hpc-sandbox-benchmarks suite. Sandbox0 has no published run in this suite yet, so there is no like-for-like number to compare.
Pricing in five scenarios
Each bill is priced from the providers' public price lists by the open Battleships engine, with the cheapest plan that runs the scenario.
| Scenario | boat, a month | Sandbox0, a month |
|---|---|---|
| One coding agent, workdays 4 vCPU / 8 GB, 50 GB disk, 8 hours a day, 22 days a month, files kept between days | $20 · $20/mo | $19 · Pay as you go (prepaid top-ups) |
| One agent that never stops 4 vCPU / 8 GB, 50 GB disk, running 24/7 all month | $26 · $20/mo | $79 · Pay as you go (prepaid top-ups) |
| 50 agents in parallel 50 machines of 4 vCPU / 8 GB at once, 8-hour sessions, 1,100 sessions a month, Docker inside | $317 · $20/mo × 3 seats | $950 · Pay as you go (prepaid top-ups) · with limits |
| Sandboxes for your users 2 vCPU / 4 GB, 30,000 sessions of 10 minutes a month, up to 300 at once | $200 · $100/mo × 2 seats | $270 · Pay as you go (prepaid top-ups) · with limits |
| 1,000 short jobs at once 2 vCPU / 4 GB, 1,000 at once, 3 minutes each, 200,000 jobs a month | $2,000 · $2000/mo · with limits | $597 · Pay as you go (prepaid top-ups) · with limits |
boat: Plans start at $20 a month, and the whole fee is usage credit. You pay per second while a sandbox runs, and a stopped sandbox costs nothing and keeps its disk.
Sandbox0: Sandbox0 bills per second for the memory you set, at $0.015 per GiB-hour, with CPU included and no plan fee. Paused sandboxes, disk and snapshots are free, and you pay with prepaid top-ups; when unpaid usage reaches 10% of the last top-up, running sandboxes are paused.
Limits in those scenarios
Sandbox0 runs 20 sandboxes at once per team by default, so 50 agents in parallel, sandboxes for your users and a burst of 1,000 jobs all need an approved quota increase first. Claims are limited to 5 per second. boat's $20 plan already runs 100 at once, but its start limits make the 1,000-job burst queue on every plan.
| Scenario | boat | Sandbox0 |
|---|---|---|
| One coding agent, workdays | None that bite | None that bite |
| One agent that never stops | None that bite | None that bite |
| 50 agents in parallel | None that bite |
|
| Sandboxes for your users | None that bite |
|
| 1,000 short jobs at once |
|
|
Which one should you use?
Use Sandbox0 when
you need strict outbound rules, sandboxes that pause on their own and wake on the next request, or a platform you can host yourself.
- Outbound rules down to the request. Useful when an agent must only reach approved hosts: Sandbox0 filters outbound traffic by domain, CIDR, port and even HTTP path.
- Pause on a timeout, wake on request. Good for sandboxes that sit idle most of the day: they pause on a timeout and wake on the next API call, SSH login or web request.
- Open source you can host yourself. Its Apache-2.0 core can run on your own Nomad, PostgreSQL and S3, for teams that must keep everything in-house.
Use boat when
your agents need a whole machine: a real kernel, Docker that keeps its images, emulators through /dev/kvm, a desktop they can drive, and services reachable over HTTPS or raw TCP.
- A real kernel, not a user-space one. Agents install whatever a task needs. Tools that expect a normal kernel, like packet filters, cgroup tricks or kind, can fail inside gVisor, and the agent loses time working around it.
- Docker and emulators that just work. An agent that pauses and resumes on Sandbox0 must restart dockerd and pull or rebuild every image again, and Android or kind jobs need a second machine somewhere else.
- A desktop agents can use, and hosting. A computer-use agent on Sandbox0 has to bring its own screenshot and click layer on top of VNC, and a game server, database or other TCP service cannot be reached from outside.
Questions people ask
What is the difference between boat and Sandbox0?
boat gives each sandbox a full VM with its own kernel on dedicated AMD Ryzen 9 9950X hosts. Sandbox0 runs each sandbox in gVisor, a kernel written in user space, and focuses on pausing, waking and forking those sandboxes.
Can I run Docker in Sandbox0 and boat?
Both run a Docker daemon inside the sandbox. On Sandbox0 bridge networking is turned off and images are discarded when the sandbox pauses. On boat Docker works as on any Linux machine and its images stay on the disk.
Does Sandbox0 support nested virtualization?
No. Sandbox0's docs say kind and similar tools need a VM or CI runner. boat exposes /dev/kvm, so Android emulators, kind and VMs run inside the sandbox.
Is Sandbox0 open source?
Yes. Its core is published under Apache-2.0 and can be self-hosted on Nomad, PostgreSQL and S3. boat is a hosted service only.
Can a Sandbox0 sandbox run for days?
Yes. It pauses when a 5-minute timeout runs out by default, but you can set the timeout to 0 to keep it running. boat also has no session cap on paid plans, and keeps the machine running until you stop it.
Is boat SOC 2 compliant?
SOC 2 is in progress. We're open about where we stand: live status at status.ascii.dev and our data retention policy at docs.boat.dev/data-retention.
Start a sandbox
Install the CLI, then run boat new.
7-day free trial