boat vs Tinfoil
Tinfoil runs a Docker image you publish inside a confidential-computing enclave, so users can check that nobody, Tinfoil included, can read their data. boat gives each agent a full VM to work in, with root, Docker, a disk saved every minute, a desktop and coding agents you drive from outside.
Where boat stands out
A machine the agent can change
A boat sandbox is a full VM where the agent has root, systemd, Docker and /dev/kvm, and can install whatever the task needs. A Tinfoil container starts with zero Linux capabilities, rejects privileged mode and devices, and runs the image and resources pinned in a published config.
Work that survives a stop
boat keeps the whole disk, saves it every minute and on stop, and lets you fork a running sandbox to try two paths at once. On Tinfoil the enclave filesystem is wiped when the instance stops or updates, and only an encrypted volume you attach, still in beta, keeps data.
Coding agents you drive from outside
boat ships Claude Code, Codex, OpenCode and other agents in every sandbox, with a prompt, steer and events API and a 60fps desktop to watch. Its credentials proxy keeps real AI keys outside the sandbox and can switch to another account when one runs out of credits.
The companies and products
boat
boat.dev runs sandboxes for AI agents: each one is a full Linux VM with its own kernel.
You start a machine with one command or one API call, then SSH in, run Docker, open a desktop, or let a built-in agent (Claude Code, Codex, OpenCode and others) work in it. The disk stays between sessions, and a stopped sandbox costs nothing.
- Isolation
- Full VM per sandbox, own kernel
- Regions
- EU: Germany, Finland, France
Tinfoil
Tinfoil is a private AI company: it sells an encrypted chat app, a private inference API and Tinfoil Containers, a host for your own apps inside secure enclaves.
Tinfoil Containers is a hosting platform, not an agent sandbox. You publish a tinfoil-config.yml in a public GitHub repo that pins a Docker image, its CPU, memory and network rules, and Tinfoil boots it inside an AMD SEV-SNP or Intel TDX enclave whose memory is encrypted in hardware. Clients use remote attestation to check the exact code running, which suits teams that must prove they cannot see their users' data.
Which use cases each one fits
For each use case, Battleships prices every sandbox provider on the same workload and sorts them from the cheapest monthly bill up. “3rd cheapest of 367” means 2 of the other 366 providers run that workload, with every feature it needs, for less. “With limits” means the provider runs it but misses something, so it is listed after every full match. Open a use case for its whole ranking and what each provider misses.
| Use case and its workload | boat: price rank | Tinfoil: price rank |
|---|---|---|
| Software factory 100 at once · 4 vCPU / 8 GB · 2,200 sessions of 8 h a month A software factory needs Docker, root and a disk that keeps installs; Tinfoil containers drop all Linux capabilities and lose local files when they stop. | 3rd cheapest of 367 $634 a month | 309th of 367, with limits $6,252 a month |
| Always-on AI employees 50 machines 24/7 · 2 vCPU / 4 GB An always-on assistant fits Tinfoil only as a fixed app you redeploy to change, while on boat it is a VM the agent can reshape itself. | 5th cheapest of 366 $657 a month | 296th of 366, with limits $6,160 a month |
| Code interpreter bursts 100 at once · 1 vCPU / 2 GB · 200,000 sessions of 1 min a month | 186th of 345, with limits $2,000 a month | 339th of 345, with limits $10,651 a month |
| Sandboxes for your users 300 at once · 2 vCPU / 4 GB · 30,000 sessions of 23 min a month Tinfoil allows 10 instances per organization, so 300 sandboxes for your users need a raised quota through sales. | Cheapest of 361 $209 a month | 325th of 361, with limits $4,943 a month |
| RL rollouts 1,000 at once · 2 vCPU / 4 GB · 1,000,000 sessions of 3 min a month | 34th of 360, with limits $2,000 a month | 335th of 360, with limits $121 a month |
| Agent evals 250 at once · 4 vCPU / 8 GB · 15,000 sessions of 20 min a month | 10th cheapest of 364 $200 a month | 332nd of 364, with limits $4,943 a month |
| CI runners 40 at once · 8 vCPU / 16 GB · 6,000 sessions of 12 min a month CI jobs that build images need Docker inside the machine, which boat has on every VM and Tinfoil does not document. | 4th cheapest of 377 $86 a month | 362nd of 377, with limits $4,057 a month |
| 24/7 dev boxes 1 machine 24/7 · 4 vCPU / 8 GB A dev box on Tinfoil means an admin container with SSH and an encrypted volume for anything that must survive a stop. | 18th cheapest of 368 $26 a month | 187th of 368, with limits $269 a month |
| Computer-use agents 50 at once · 4 vCPU / 8 GB · 20,000 sessions of 15 min a month Tinfoil has no desktop or browser to drive, so computer-use agents fit only as a compromise there. | 6th cheapest of 369 $200 a month | 358th of 369, with limits $6,584 a month |
| Browser-use agents 50 at once · 2 vCPU / 4 GB · 30,000 sessions of 10 min a month | 7th cheapest of 367 $200 a month | 355th of 367, with limits $4,943 a month |
| Scraping & bots (startup scale) 50 at once · 1 vCPU / 2 GB · 100,000 sessions of 3 min a month | 6th cheapest of 346 $90 a month | 305th of 346, with limits $872 a month |
| Mass scraping & bots (undetectable) 1,000 at once · 1 vCPU / 2 GB · 3,000,000 sessions of 2 min a month | 71st of 338, with limits $1,800 a month | 271st of 338, with limits $17,067 a month |
| Parallel red teaming 200 at once · 2 vCPU / 4 GB · 5,000 sessions of 30 min a month | 2nd cheapest of 360 $200 a month | 307th of 360, with limits $861 a month |
| GPU eval jobs 10 at once · 8 vCPU / 32 GB · 500 sessions of 30 min a month Only Tinfoil fits: it rents H200, B200 and B300 GPUs in confidential mode, and boat has no GPUs. | Can't run it | 98th of 98, with limits $51,201 a month |
| macOS agents 5 at once · 4 vCPU / 8 GB · 1,000 sessions of 20 min a month | Can't run it | Can't run it |
Key features
Every feature Battleships tracks (43)
| Feature | boat | Tinfoil |
|---|---|---|
| Full VM (own kernel) | Yes | Yes |
| Docker inside | Yes | No |
| Nested virtualization | Yes | No |
| Root | Yes | Yes |
| Systemd | Yes | Not published |
| Desktop GUI | Yes | No |
| Browser | Yes | No |
| Computer-use API | Yes | No |
| SSH | Yes | Yes |
| Persistent disk | Yes | Yes |
| Pause/resume | Yes | No |
| Automatic snapshots | Yes | No |
| Fork/clone | Yes | No |
| Live fork (no pause) | Yes | No |
| Memory fork | No | No |
| Custom image (Docker or snapshot) | Yes | Yes |
| ≥24 h sessions | Yes | Yes |
| Idle auto-stop | No | No |
| Wake on request | No | No |
| HTTPS preview URLs | Yes | Yes |
| Raw TCP inbound | Yes | Not published |
| Public IPv4 | No | No |
| Egress allowlist | No | Yes |
| Secret proxy | Yes | No |
| Secret proxy for any API | Yes | No |
| Preinstalled agents | Yes | No |
| Agent harness API | Yes | No |
| MCP server | No | No |
| GPU | No | Yes |
| Windows | No | No |
| Arm64 | No | No |
| Self-hosting | No | No |
| BYOC | No | No |
| Open source | No | Yes |
| Scoped API keys | Yes | Not published |
| Spend limits | Yes | Not published |
| Usage per sandbox (API) | Yes | Yes |
| Audit logs | No | Not published |
| SSO | No | Yes |
| SOC 2 | No | Yes |
| HIPAA | No | Yes |
| EU data residency | Yes | No |
| Zero data retention | Yes | Not published |
Performance
There is no comparable measurement. boat did 26.69 Node.js build-and-test runs per second at 4 vCPU / 8 GB in StarSling's public benchmark, but Tinfoil has no result in that benchmark, so we cannot say which is faster.
Node.js build-and-test loop at 4 vCPU / 8 GB, higher is better. Measured with the open hpc-sandbox-benchmarks suite. Tinfoil has no published run in this suite yet, so there is no like-for-like number to compare.
Pricing in five scenarios
Each bill is priced from the providers' public price lists by the open Battleships engine, with the cheapest plan that runs the scenario.
| Scenario | boat, a month | Tinfoil, a month |
|---|---|---|
| One coding agent, workdays 4 vCPU / 8 GB, 50 GB disk, 8 hours a day, 22 days a month, files kept between days | $20 · $20/mo | $91 · Tinfoil Containers · with limits |
| One agent that never stops 4 vCPU / 8 GB, 50 GB disk, running 24/7 all month | $26 · $20/mo | $269 · Tinfoil Containers · with limits |
| 50 agents in parallel 50 machines of 4 vCPU / 8 GB at once, 8-hour sessions, 1,100 sessions a month, Docker inside | $317 · $20/mo × 3 seats | $3,136 · Tinfoil Containers · with limits |
| Sandboxes for your users 2 vCPU / 4 GB, 30,000 sessions of 10 minutes a month, up to 300 at once | $200 · $100/mo × 2 seats | $4,943 · Tinfoil Containers · with limits |
| 1,000 short jobs at once 2 vCPU / 4 GB, 1,000 at once, 3 minutes each, 200,000 jobs a month | $2,000 · $2000/mo · with limits | $32,842 · Tinfoil Containers · with limits |
boat: You pick a monthly plan from $20, and all of it becomes usage credit spent per second on running sandboxes. A stopped sandbox costs nothing and keeps its disk.
Tinfoil: Tinfoil Containers costs a $20 monthly base fee on top of usage, not as credit, plus $0.06 per core-hour and $0.01 per GB-hour of memory, billed in whole hours with no shorter intervals. Encrypted volumes cost $0.30 per GB-month of provisioned size until you delete them, even while the container is stopped, and GPUs bill hourly with a monthly commitment.
Limits in those scenarios
Tinfoil does not fit any scenario cleanly because it is an app host, not a sandbox: there is no Docker inside, and only attached volumes survive a stop. Its quota is 10 instances per organization, so 50 agents, 300 sandboxes for your users or 1,000 jobs at once all need a raised limit through sales. Whole-hour billing also makes short jobs costly, since a five-minute run bills a full hour. On boat, the 1,000-job burst is queued above 90 starts a minute and needs more starts per day than the $2,000 plan allows.
| Scenario | boat | Tinfoil |
|---|---|---|
| One coding agent, workdays | None that bite |
|
| One agent that never stops | None that bite |
|
| 50 agents in parallel | None that bite |
|
| Sandboxes for your users | None that bite |
|
| 1,000 short jobs at once |
|
|
Which one should you use?
Use Tinfoil when
you host an app that must prove to its users, by attestation, that no one can read their data, or when you need confidential GPUs for private inference.
- Encrypted memory you can prove. Useful if users must verify that no operator can read their data: Tinfoil runs code in attested, memory-encrypted enclaves.
- Confidential GPUs. Useful for private model inference or training: Tinfoil rents H200, B200 and B300 GPUs inside confidential enclaves.
- Network rules in the attested config. Useful when outbound traffic must be locked down: Tinfoil containers have no internet unless a hostname allowlist opens it.
Use boat when
your agents need a machine to work in: root, Docker and a disk that persists, with forks, a desktop and coding agents you drive from outside while their keys stay out.
- A machine the agent can change. An agent that runs docker compose, apt installs or an emulator hits a wall in a Tinfoil container. The only way to change it is a new release of the config, which is fine for an app and too slow for an agent.
- Work that survives a stop. On Tinfoil every stop throws away installed packages and anything written outside the volume, so an agent pays the setup again on each start. There is no fork, so trying two ideas means two cold deploys.
- Coding agents you drive from outside. Tinfoil has no agent runtime in its containers: you build the image, the control API and the log stream yourself, and secrets arrive inside as environment variables that code the agent runs can read.
Questions people ask
Is boat cheaper than Tinfoil?
In every scenario we priced, yes, though none of them is a clean fit for Tinfoil. One coding agent on workdays comes to $20 a month on boat and $91 on Tinfoil, one agent running all month to $26 versus $269, and 50 agents in parallel to $317 versus $3,136. Tinfoil's numbers include volume storage and assume a quota above its 10 instances.
Is Tinfoil a sandbox for AI agents?
Not really. Tinfoil Containers hosts a Docker app you publish, inside a confidential enclave, with its resources and network rules fixed in a public config. It suits private services and inference servers, while boat gives each agent its own VM to install, build and test in.
Can I run Docker inside a Tinfoil container?
Tinfoil does not document it. Regular containers start with zero Linux capabilities and reject privileged mode and devices; only an admin container runs privileged as root. boat has Docker, root, systemd and /dev/kvm on every machine.
Do files survive a stop on Tinfoil?
Only on an attached encrypted volume, which is in beta. The enclave's own filesystem and memory are lost when it stops or is replaced in an update. A boat sandbox keeps its whole disk, saved every minute and on stop.
Does Tinfoil have GPUs?
Yes. Tinfoil rents NVIDIA H200, B200 and B300 GPUs in confidential-computing mode, hourly with a monthly commitment, once it enables GPU access for your organization. boat has no GPUs.
Is boat SOC 2 compliant?
SOC 2 is in progress. We're open about where we stand: live status at status.ascii.dev and our data retention policy at docs.boat.dev/data-retention. Tinfoil's trust portal lists SOC 2, HIPAA and GDPR.
Start a sandbox
Install the CLI, then run boat new.
7-day free trial