boat vs Tensorlake
Both give each agent its own kernel. boat gives it a full VM on a dedicated Ryzen 9 host, with nested virtualization, coding agents built in and keys that never enter the machine, while Tensorlake gives it a microVM that can freeze its memory and wake up warm.
Where boat stands out
Run emulators and VMs inside
Every boat sandbox is a full VM with /dev/kvm, so an agent can boot an Android emulator or its own VMs. Tensorlake's sandboxes tell programs that nested virtualization is not available. If your agents test mobile apps or run VMs, this decides it.
Get coding agents with keys kept outside
boat ships Claude Code, Codex, OpenCode and other agents in every machine, and you drive agents inside from outside with one API for prompts, steering and events. Your real API keys stay in a proxy outside the sandbox, so code inside cannot read them. On Tensorlake you install your own agent and pass secrets into the sandbox.
Reach it like a server
A boat sandbox gets HTTPS URLs for up to 50 ports, raw TCP and its own IP address, and it can stay on with no session cap on paid plans. Tensorlake routes HTTP, WebSocket and gRPC through its proxy, which covers web apps but not raw TCP services.
The companies and products
boat
boat.dev runs sandboxes for AI agents: each one is a full Linux VM with its own kernel.
You start a machine with one command or one API call, then SSH in, run Docker, open a desktop, or let a built-in agent (Claude Code, Codex, OpenCode and others) work in it. The disk stays between sessions, and a stopped sandbox costs nothing.
- Isolation
- Full VM per sandbox, own kernel
- Regions
- EU: Germany, Finland, France
Tensorlake
Tensorlake is a San Francisco company that sells infrastructure for AI agents, with sandboxes as its main product.
Tensorlake Sandboxes are microVMs, backed by Firecracker and Cloud Hypervisor, that you create through an API and that boot in a few hundred milliseconds. Named sandboxes suspend when idle and keep their memory and running processes, and you can copy a running sandbox into several warm clones. Around them Tensorlake sells versioned file systems, hosted Git, an orchestration layer and a bring-your-own-cloud option, aimed at teams running coding agents, evals and RL rollouts.
- Headquarters
- San Francisco
- Investors shown
- Redpoint and Amplify Partners
Which use cases each one fits
For each use case, Battleships prices every sandbox provider on the same workload and sorts them from the cheapest monthly bill up. “2nd cheapest of 366” means 1 of the other 365 providers runs that workload, with every feature it needs, for less. “With limits” means the provider runs it but misses something, so it is listed after every full match. Open a use case for its whole ranking and what each provider misses.
| Use case and its workload | boat: price rank | Tensorlake: price rank |
|---|---|---|
| Software factory 100 at once · 4 vCPU / 8 GB · 2,200 sessions of 8 h a month Both fit a full software factory; boat adds nested virtualization for Android emulators and preinstalled coding agents. | 2nd cheapest of 366 $634 a month | 3rd cheapest of 366 $1,010 a month |
| Always-on AI employees 50 machines 24/7 · 2 vCPU / 4 GB Both keep an agent's files between sessions; Tensorlake also keeps its memory while it sleeps, and boat keeps the machine on with no session cap. | 4th cheapest of 362 $657 a month | 8th cheapest of 362 $1,381 a month |
| Code interpreter bursts 100 at once · 1 vCPU / 2 GB · 200,000 sessions of 1 min a month Tensorlake fits lots of one-minute runs better, because boat's start-rate limits queue big bursts of new machines. | 183rd of 342, with limits $2,000 a month | 17th cheapest of 342 $250 a month |
| Sandboxes for your users 300 at once · 2 vCPU / 4 GB · 30,000 sessions of 23 min a month Both create a sandbox per user through an API; boat also hands each one HTTPS URLs, raw TCP and a per-sandbox usage API. | Cheapest of 361 $209 a month | 5th cheapest of 361 $471 a month |
| RL rollouts 1,000 at once · 2 vCPU / 4 GB · 1,000,000 sessions of 3 min a month Tensorlake is built for RL rollouts at a thousand at a time, and boat's start-rate limits make that a compromise. | 33rd of 358, with limits $2,000 a month | Cheapest of 358 $5,637 a month |
| Agent evals 250 at once · 4 vCPU / 8 GB · 15,000 sessions of 20 min a month | 9th cheapest of 363 $200 a month | 22nd cheapest of 363 $506 a month |
| CI runners 40 at once · 8 vCPU / 16 GB · 6,000 sessions of 12 min a month Both run fresh build machines; boat's Ryzen 9 9950X hosts are the fastest measured on the CPU benchmark. | 4th cheapest of 377 $86 a month | 49th cheapest of 377 $424 a month |
| 24/7 dev boxes 1 machine 24/7 · 4 vCPU / 8 GB boat fits a box that stays on all day better, since Tensorlake's model is built around suspending idle sandboxes. | 17th cheapest of 369 $26 a month | 179th of 369, with limits $250 a month |
| Computer-use agents 50 at once · 4 vCPU / 8 GB · 20,000 sessions of 15 min a month | 5th cheapest of 367 $200 a month | 8th cheapest of 367 $294 a month |
| Browser-use agents 50 at once · 2 vCPU / 4 GB · 30,000 sessions of 10 min a month | 5th cheapest of 363 $200 a month | 9th cheapest of 363 $250 a month |
| Scraping & bots (startup scale) 50 at once · 1 vCPU / 2 GB · 100,000 sessions of 3 min a month | 4th cheapest of 341 $90 a month | 17th cheapest of 341 $250 a month |
| Mass scraping & bots (undetectable) 1,000 at once · 1 vCPU / 2 GB · 3,000,000 sessions of 2 min a month | 65th of 337, with limits $1,800 a month | 115th of 337, with limits $3,484 a month |
| Parallel red teaming 200 at once · 2 vCPU / 4 GB · 5,000 sessions of 30 min a month Both give root in a real kernel; boat adds raw TCP inbound and nested virtualization for tools that need them. | 3rd cheapest of 357 $200 a month | 5th cheapest of 357 $250 a month |
| GPU eval jobs 10 at once · 8 vCPU / 32 GB · 500 sessions of 30 min a month | Can't run it | Can't run it |
| macOS agents 5 at once · 4 vCPU / 8 GB · 1,000 sessions of 20 min a month | Can't run it | Can't run it |
Key features
| Feature | boat | Tensorlake |
|---|---|---|
| Isolation | Full VM with its own kernel on dedicated AMD Ryzen 9 9950X hosts | Firecracker and Cloud Hypervisor microVMs with their own kernel; GPU sandboxes use gVisor |
| Nested virtualization | Yes, /dev/kvm inside, so Android emulators and VMs run | No: sandboxes set SANDBOX_KVM_AVAILABLE=0 |
| Docker inside | Yes, with root and systemd | Yes, on the tensorlake/ubuntu-systemd image |
| Memory snapshots | No: disk is kept, resume reboots the machine | Yes: memory snapshots and suspend keep running processes and restore warm |
| Clone a running sandbox | Fork a running sandbox (disk) | Copy a running or suspended sandbox into N warm clones with memory |
| Keeping state | Snapshots every minute and on stop; a stopped sandbox costs nothing | Named sandboxes suspend with memory, billed as snapshot storage; ephemeral ones end on timeout |
| Idle handling | Time-to-live (1 h by default, changeable or off); no idle timer | Idle timeout, 600 s by default, then suspend or terminate |
| Desktop and computer use | 60fps desktop and Chromium, computer-use and browser control, embeddable stream | XFCE desktop with Firefox over VNC, with screenshot, mouse and keyboard calls |
| Built-in agents | Claude Code, Codex, OpenCode and more preinstalled, with a prompt, steer and events API | You bring and run your own agent; managed images are plain OS bases |
| API keys | Credential proxy: real keys never enter the sandbox | Stored secrets are injected into the sandbox |
| Inbound traffic | HTTPS URLs for up to 50 ports, token-protected, plus raw TCP and a dedicated IP per machine | HTTP, WebSocket and gRPC through an authenticated proxy on exposed ports |
| Outbound rules | No provider-side allowlist; you set your own firewall as root | allow_out and deny_out lists by domain, IP or CIDR, or no internet at all |
| GPUs | None | GPU sandboxes by request (H100 shown in the docs) |
| Where it runs | EU only: Germany, Finland, France | US and EU, or your own cloud account through BYOC |
| Compliance and transparency | SOC 2 is in progress. We're open about where we stand: live status and data retention policy. | SOC 2 |
Every feature Battleships tracks (43)
| Feature | boat | Tensorlake |
|---|---|---|
| Full VM (own kernel) | Yes | Yes |
| Docker inside | Yes | Yes |
| Nested virtualization | Yes | No |
| Root | Yes | Yes |
| Systemd | Yes | Yes |
| Desktop GUI | Yes | Yes |
| Browser | Yes | Yes |
| Computer-use API | Yes | Yes |
| SSH | Yes | Yes |
| Persistent disk | Yes | Yes |
| Pause/resume | Yes | Yes |
| Automatic snapshots | Yes | Yes |
| Fork/clone | Yes | Yes |
| Live fork (no pause) | Yes | Yes |
| Memory fork | No | Yes |
| Custom image (Docker or snapshot) | Yes | Yes |
| ≥24 h sessions | Yes | Yes |
| Idle auto-stop | No | Yes |
| Wake on request | No | Yes |
| HTTPS preview URLs | Yes | Yes |
| Raw TCP inbound | Yes | No |
| Public IPv4 | No | No |
| Egress allowlist | No | Yes |
| Secret proxy | Yes | No |
| Secret proxy for any API | Yes | No |
| Preinstalled agents | Yes | No |
| Agent harness API | Yes | No |
| MCP server | No | No |
| GPU | No | Yes |
| Windows | No | No |
| Arm64 | No | No |
| Self-hosting | No | No |
| BYOC | No | Yes |
| Open source | No | No |
| Scoped API keys | Yes | Not published |
| Spend limits | Yes | Not published |
| Usage per sandbox (API) | Yes | No |
| Audit logs | No | Not published |
| SSO | No | Yes |
| SOC 2 | No | Yes |
| HIPAA | No | Yes |
| EU data residency | Yes | Yes |
| Zero data retention | Yes | Yes |
Performance
boat scores 26.69 runs/s on the hpc-sandbox-benchmarks Node.js build-and-test loop at 4 vCPU / 8 GB, the fastest result measured. Tensorlake has no published result on this benchmark, so there is no comparable CPU measurement between the two. Tensorlake's own docs say its default image starts in a few hundred milliseconds.
Node.js build-and-test loop at 4 vCPU / 8 GB, higher is better. Measured with the open hpc-sandbox-benchmarks suite. Tensorlake has no published run in this suite yet, so there is no like-for-like number to compare.
Pricing in five scenarios
Each bill is priced from the providers' public price lists by the open Battleships engine, with the cheapest plan that runs the scenario.
| Scenario | boat, a month | Tensorlake, a month |
|---|---|---|
| One coding agent, workdays 4 vCPU / 8 GB, 50 GB disk, 8 hours a day, 22 days a month, files kept between days | $20 · $20/mo | $250 · Pro |
| One agent that never stops 4 vCPU / 8 GB, 50 GB disk, running 24/7 all month | $26 · $20/mo | $250 · Pro |
| 50 agents in parallel 50 machines of 4 vCPU / 8 GB at once, 8-hour sessions, 1,100 sessions a month, Docker inside | $317 · $20/mo × 3 seats | $1,030 · Pro |
| Sandboxes for your users 2 vCPU / 4 GB, 30,000 sessions of 10 minutes a month, up to 300 at once | $200 · $100/mo × 2 seats | $293 · Pro |
| 1,000 short jobs at once 2 vCPU / 4 GB, 1,000 at once, 3 minutes each, 200,000 jobs a month | $2,000 · $2000/mo · with limits | $1,127 · Pro |
boat: You pick a monthly plan from $20, and the whole fee becomes usage credit. Running time is billed per second, and a stopped sandbox costs nothing while its disk is kept.
Tensorlake: Pro is $250 per billing cycle, which includes 25,000 CU ($250) of usage, then $0.01 per CU. CPU is billed only while it is actively working, RAM and disk are billed on what you allocate while the sandbox runs, and a suspended sandbox pays snapshot storage per GB-month.
Tensorlake: Small users can skip Pro and buy prepaid Usage Credits packs from $5 at higher rates, with no overage: sandboxes stop when the balance hits zero. The table prices the Pro path, so it overstates very small workloads.
Limits in those scenarios
boat's limit that bites is how fast new machines start: even the $2,000/mo plan queues bursts above 90 starts a minute, so 1,000 short jobs at once does not fit. Tensorlake's Pro plan allows 1,000 sandboxes at once with no published start rate, but its prepaid Usage Credits plan caps each sandbox at 4 vCPU / 16 GB and 24-hour sessions. On Tensorlake, CPU, memory and disk are fixed when a sandbox is created, disk is 10 to 100 GiB, and an ephemeral sandbox ends after 10 idle minutes by default.
| Scenario | boat | Tensorlake |
|---|---|---|
| One coding agent, workdays | None that bite | None that bite |
| One agent that never stops | None that bite | None that bite |
| 50 agents in parallel | None that bite | None that bite |
| Sandboxes for your users | None that bite | None that bite |
| 1,000 short jobs at once |
| None that bite |
Which one should you use?
Use Tensorlake when
you fan out about a thousand short rollouts at once from one warm state, or need GPUs, US regions or sandboxes in your own cloud account.
- Memory snapshots and warm clones. Useful when an agent must pick up mid-process: Tensorlake can save a sandbox's memory and copy it into warm clones.
- GPUs and your own cloud. Tensorlake offers GPU sandboxes by request and can run in your own AWS, GCP, Azure, CoreWeave, Nebius or bare-metal account.
- Outbound rules and US regions. Tensorlake can allow or deny outbound traffic by domain, IP or CIDR, and it runs in the US as well as the EU.
Use boat when
your agents do real work for hours: installs, builds, tests, Docker, emulators and a desktop, with coding agents built in and keys kept outside the machine.
- Run emulators and VMs inside. Tensorlake sandboxes have no /dev/kvm, so an Android emulator or a VM does not start at all. An agent that tests a mobile app has nowhere to run it.
- Get coding agents with keys kept outside. On Tensorlake you install and wire up the agent harness yourself, and stored secrets are injected into the sandbox the agent controls, where one prompt injection can leak them.
- Reach it like a server. Tensorlake's proxy carries only HTTP, WebSocket and gRPC, so a database or other raw TCP service an agent starts can't be reached, and an ephemeral sandbox ends after 10 idle minutes by default.
Questions people ask
Is boat cheaper than Tensorlake?
In four of the five scenarios we price, yes: one coding agent on workdays is $20 a month on boat and $250 on Tensorlake Pro, and 50 agents in parallel is $317 against $1,030. For 1,000 short jobs at once Tensorlake fits and boat does not, because of boat's start-rate limits. Very small workloads can be cheaper on Tensorlake's prepaid packs than on its Pro plan.
Does Tensorlake support nested virtualization?
No. Tensorlake sandboxes set SANDBOX_KVM_AVAILABLE=0 and its docs say not to use KVM with QEMU. boat exposes /dev/kvm, so Android emulators and VMs run inside.
Can I keep a sandbox's memory when it stops?
On Tensorlake, yes: named sandboxes suspend with memory and running processes, and memory snapshots restore warm. On boat the disk is kept through snapshots every minute and on stop, but a resume boots the machine again.
Which one has GPUs?
Tensorlake offers GPU sandboxes by request, running on gVisor. boat has no GPUs.
Where do boat and Tensorlake run?
boat runs only in the EU (Germany, Finland, France), with EU data residency and a zero data retention option. Tensorlake runs in the US and the EU, and can also run in your own cloud account through BYOC.
Is boat SOC 2 compliant?
SOC 2 is in progress. We're open about where we stand: live status at https://status.ascii.dev and our data retention policy at https://docs.boat.dev/data-retention. Tensorlake lists SOC 2 Type II on its pricing page.
Start a sandbox
Install the CLI, then run boat new.
7-day free trial