Cloudflare Sandbox vs Agent 37
Cloudflare Sandbox gives you containers inside the Workers platform that sleep when idle and start again from a fresh disk. Agent 37 gives each user an always-on agent machine that keeps its disk and can sleep with its memory saved.
The companies and products
Cloudflare Sandbox
Cloudflare Sandbox SDK runs untrusted or AI-generated code in Linux containers on Cloudflare's network, driven from a Cloudflare Worker.
Each sandbox is a Cloudflare Container backed by a Durable Object, and each container runs in its own Firecracker microVM with its own kernel and network. You build a linux/amd64 image, pick an instance type of up to 4 vCPU and 12 GiB, and reach the sandbox through your own Worker. It suits teams already on Workers who want short-lived sandboxes that sleep when idle; for code that only calls known methods, Cloudflare also offers Dynamic Workers, which run JavaScript in V8 isolates.
- Largest instance
- 4 vCPU, 12 GiB memory, 20 GB disk (defaults, can be raised)
- Account limits
- 1,500 vCPU, 6 TiB memory and 30 TB disk running at once
- Compliance
- Cloudflare holds a SOC 2 Type II report
Agent 37
Agent 37 hosts AI agents, one isolated, always-on sandbox per user, behind one API.
You create an instance from a template (Hermes, OpenClaw, Claude Code, Codex, OpenCode, Pi, Grok or your own Docker image) and talk to it through a chat API, files, exec, SSH and HTTPS URLs. The default instance is a container enforced by gVisor; a VM type gives a full Linux machine with its own kernel for Docker, Kubernetes and Android emulators. It is built for companies that give each of their customers an agent.
- Where it runs
- Dedicated servers in the United States
- Instance types
- Default (shared), Performance (dedicated cores), VM
- Compliance
- SOC 2 Type I, Type II in progress
Which use cases each one fits
For each use case, Battleships prices every sandbox provider on the same workload and sorts them from the cheapest monthly bill up. “13th cheapest of 345” means 12 of the other 344 providers run that workload, with every feature it needs, for less. “With limits” means the provider runs it but misses something, so it is listed after every full match. Open a use case for its whole ranking and what each provider misses.
| Use case and its workload | Cloudflare Sandbox: price rank | Agent 37: price rank | boat: price rank |
|---|---|---|---|
| Software factory 100 at once · 4 vCPU / 8 GB · 2,200 sessions of 8 h a month A long coding session needs its files to stay put; Agent 37 and boat keep the disk, while Cloudflare starts from a fresh disk after sleep unless your code saves a snapshot. | 162nd of 367, with limits $1,543 a month | 2nd cheapest of 367 $551 a month | 3rd cheapest of 367 $634 a month |
| Always-on AI employees 50 machines 24/7 · 2 vCPU / 4 GB Agent 37 is built for always-on assistants that sleep with their memory kept; Cloudflare wipes the disk on sleep, and boat keeps the disk but reboots on resume. | 207th of 366, with limits $2,188 a month | Cheapest of 366 $279 a month | 5th cheapest of 366 $657 a month |
| Code interpreter bursts 100 at once · 1 vCPU / 2 GB · 200,000 sessions of 1 min a month Both suit short code runs: Cloudflare bills CPU only while busy and Agent 37's small default sandboxes are cheap, while boat's start limits make large bursts a poor fit. | 13th cheapest of 345 $144 a month | Cheapest of 345 $22 a month | 186th of 345, with limits $2,000 a month |
| Sandboxes for your users 300 at once · 2 vCPU / 4 GB · 30,000 sessions of 23 min a month Cloudflare limits an account by resources (1,500 vCPU at once), not sandbox count; Agent 37 stops at 200 instances, counting sleeping and stopped ones; boat plans go up to 2,000 at once. | 9th cheapest of 361 $731 a month | 30th of 361, with limits $79 a month | Cheapest of 361 $209 a month |
| RL rollouts 1,000 at once · 2 vCPU / 4 GB · 1,000,000 sessions of 3 min a month | 144th of 360, with limits $9,428 a month | 6th of 360, with limits $363 a month | 34th of 360, with limits $2,000 a month |
| Agent evals 250 at once · 4 vCPU / 8 GB · 15,000 sessions of 20 min a month | 45th cheapest of 364 $818 a month | 90th of 364, with limits $58 a month | 10th cheapest of 364 $200 a month |
| CI runners 40 at once · 8 vCPU / 16 GB · 6,000 sessions of 12 min a month Docker builds need room and full Docker; Cloudflare caps disk at 20 GB by default and turns off iptables, Agent 37 needs its VM type, and boat runs Docker in every sandbox. | 301st of 377, with limits $704 a month | 2nd cheapest of 377 $84 a month | 4th cheapest of 377 $86 a month |
| 24/7 dev boxes 1 machine 24/7 · 4 vCPU / 8 GB Agent 37 and boat keep a machine and its disk around the clock; Cloudflare starts from a fresh disk after sleep. | 70th cheapest of 368 $93 a month | 3rd cheapest of 368 $12 a month | 18th cheapest of 368 $26 a month |
| Computer-use agents 50 at once · 4 vCPU / 8 GB · 20,000 sessions of 15 min a month Cloudflare removed its built-in desktop, Agent 37 adds a noVNC desktop through a template build, and boat streams a 60fps desktop out of the box. | 166th of 369, with limits $460 a month | Cheapest of 369 $53 a month | 6th cheapest of 369 $200 a month |
| Browser-use agents 50 at once · 2 vCPU / 4 GB · 30,000 sessions of 10 min a month | 210th of 367, with limits $233 a month | 48th of 367, with limits $29 a month | 7th cheapest of 367 $200 a month |
| Scraping & bots (startup scale) 50 at once · 1 vCPU / 2 GB · 100,000 sessions of 3 min a month | 250th of 346, with limits $286 a month | Cheapest of 346 $32 a month | 6th cheapest of 346 $90 a month |
| Mass scraping & bots (undetectable) 1,000 at once · 1 vCPU / 2 GB · 3,000,000 sessions of 2 min a month | 169th of 338, with limits $5,741 a month | 36th of 338, with limits $648 a month | 71st of 338, with limits $1,800 a month |
| Parallel red teaming 200 at once · 2 vCPU / 4 GB · 5,000 sessions of 30 min a month Neither Cloudflare nor Agent 37 can fork a running sandbox; boat can, and adds raw TCP and nested VMs, which Cloudflare containers cannot offer. | 239th of 360, with limits $325 a month | Cheapest of 360 $43 a month | 2nd cheapest of 360 $200 a month |
| GPU eval jobs 10 at once · 8 vCPU / 32 GB · 500 sessions of 30 min a month | Can't run it | Can't run it | Can't run it |
| macOS agents 5 at once · 4 vCPU / 8 GB · 1,000 sessions of 20 min a month | Can't run it | Can't run it | Can't run it |
Key features
| Feature | Cloudflare Sandbox | Agent 37 | boat |
|---|---|---|---|
| Isolation | Firecracker microVM per container, own kernel and network | gVisor by default; full VM as an opt-in instance type | Every sandbox is a full VM with its own kernel, on dedicated AMD Ryzen 9 9950X hosts |
| Largest machine | 4 vCPU / 12 GiB / 20 GB disk by default (can be raised) | Up to 16 vCPU / 32 GB after a first top-up | Up to 16 vCPU / 32 GB, depending on plan |
| Files between sessions | Fresh disk after sleep; snapshots (public beta, 30 days) or R2 backups when your code saves them | Disk kept until you delete the instance | Disk kept; snapshot every minute and on stop; a stopped sandbox costs nothing |
| Sleep when idle | Stops after inactivity and wakes on the next request | Opt-in auto-sleep (default 15 minutes) with memory checkpointed, wakes on the next request | No idle timer; a time limit you set (default 1 hour), or no limit |
| Fork a running sandbox | No fork; restore a saved snapshot or backup into a new sandbox | No fork; daily backups plus one on-demand backup, restored in place only | Yes, without stopping it; named snapshots as shareable templates |
| Docker inside | docker:dind with iptables and IP forwarding turned off | Only on the VM type, at 2.5x the default compute rate | Full Docker, root and systemd in every sandbox |
| Nested virtualization | Not documented | /dev/kvm on the VM type, with a ready Android template | /dev/kvm in every sandbox, Android emulator works |
| Desktop | Built-in desktop removed in SDK 0.10.2; bring your own | noVNC desktop through a template build or the Ubuntu VM template | 60fps desktop and Chromium, computer-use API, embeddable stream |
| Inbound traffic | HTTP and WebSocket previews routed through your Worker; no raw TCP or public IP | HTTPS URL per port, signed URLs, custom domains; no public IP, SSH through a WebSocket tunnel | HTTPS URLs for up to 50 ports, token-protected; raw TCP; own IPv6 or IPv4 |
| Egress control | allowedHosts deny-by-default list plus outbound handlers you write in Worker code | No provider-side allowlist | No provider-side allowlist |
| Keeping keys out of the sandbox | Your outbound handler adds the token for any HTTP or HTTPS host; you write the code | Managed LLM, search and Composio through a per-instance token; your own keys go in as env vars | Managed proxy for model providers and any HTTPS API you register; switch a credential to another account |
| Coding agents | Run Claude Code, Codex, OpenCode or Pi in your image; OpenCode has an SDK helper | Hermes, OpenClaw, Claude Code, Codex, Grok, OpenCode, Pi templates, with a chat API per instance | Claude Code, Codex, pi, OpenCode and more built in, with a prompt, steer and events API |
| Custom images | Your own linux/amd64 container image | Your own linux/amd64 Docker image as a template | Templates from named snapshots, no Dockerfile builds |
| Regions | Several regions across Cloudflare's network | Dedicated servers in the United States | EU only: Germany, Finland, France, with EU data residency |
Every feature Battleships tracks (43)
| Feature | Cloudflare Sandbox | Agent 37 | boat |
|---|---|---|---|
| Full VM (own kernel) | Yes | No | Yes |
| Docker inside | Yes | No | Yes |
| Nested virtualization | No | No | Yes |
| Root | Yes | Yes | Yes |
| Systemd | Not published | Not published | Yes |
| Desktop GUI | No | Yes | Yes |
| Browser | No | Yes | Yes |
| Computer-use API | No | Yes | Yes |
| SSH | Yes | Yes | Yes |
| Persistent disk | No | Yes | Yes |
| Pause/resume | No | Yes | Yes |
| Automatic snapshots | No | Yes | Yes |
| Fork/clone | No | Yes | Yes |
| Live fork (no pause) | No | Yes | Yes |
| Memory fork | No | No | No |
| Custom image (Docker or snapshot) | Yes | Yes | Yes |
| ≥24 h sessions | Yes | Yes | Yes |
| Idle auto-stop | Yes | Yes | No |
| Wake on request | Yes | Yes | No |
| HTTPS preview URLs | Yes | Yes | Yes |
| Raw TCP inbound | No | Not published | Yes |
| Public IPv4 | No | No | No |
| Egress allowlist | Yes | No | No |
| Secret proxy | Yes | Yes | Yes |
| Secret proxy for any API | Yes | No | Yes |
| Preinstalled agents | Yes | Yes | Yes |
| Agent harness API | Yes | Yes | Yes |
| MCP server | No | No | No |
| GPU | No | No | No |
| Windows | No | No | No |
| Arm64 | No | No | No |
| Self-hosting | No | No | No |
| BYOC | No | No | No |
| Open source | Yes | No | No |
| Scoped API keys | Not published | Not published | Yes |
| Spend limits | No | Yes | Yes |
| Usage per sandbox (API) | Not published | Yes | Yes |
| Audit logs | Yes | Not published | No |
| SSO | Yes | No | No |
| SOC 2 | Yes | Yes | No |
| HIPAA | Yes | No | No |
| EU data residency | Yes | No | Yes |
| Zero data retention | Not published | Not published | Yes |
Performance
boat scores 26.69 runs/s on the hpc-sandbox-benchmarks Node.js build-and-test loop at 4 vCPU / 8 GB. Neither Cloudflare Sandbox nor Agent 37 has a result on that benchmark, so there is no comparable CPU number between the three. Agent 37 says its default instances share host resources and sells dedicated cores on its Performance type.
Node.js build-and-test loop at 4 vCPU / 8 GB, higher is better. Measured with the open hpc-sandbox-benchmarks suite. Cloudflare Sandbox and Agent 37 have no published run in this suite yet, so there is no like-for-like number to compare.
Pricing in five scenarios
Each bill is priced from the providers' public price lists by the open Battleships engine, with the cheapest plan that runs the scenario.
| Scenario | Cloudflare Sandbox, a month | Agent 37, a month | boat, a month |
|---|---|---|---|
| One coding agent, workdays 4 vCPU / 8 GB, 50 GB disk, 8 hours a day, 22 days a month, files kept between days | $39 · Workers Paid · with limits | $6 · Wallet (any top-up) | $20 · $20/mo |
| One agent that never stops 4 vCPU / 8 GB, 50 GB disk, running 24/7 all month | $148 · Workers Paid · with limits | $12 · Wallet (any top-up) | $26 · $20/mo |
| 50 agents in parallel 50 machines of 4 vCPU / 8 GB at once, 8-hour sessions, 1,100 sessions a month, Docker inside | $1,660 · Workers Paid · with limits | $329 · Wallet ($100 lifetime top-ups) | $317 · $20/mo × 3 seats |
| Sandboxes for your users 2 vCPU / 4 GB, 30,000 sessions of 10 minutes a month, up to 300 at once | $476 · Workers Paid | $33 · Wallet ($250 lifetime top-ups) · with limits | $200 · $100/mo × 2 seats |
| 1,000 short jobs at once 2 vCPU / 4 GB, 1,000 at once, 3 minutes each, 200,000 jobs a month | $1,889 · Workers Paid · with limits | $73 · Wallet ($250 lifetime top-ups) · with limits | $2,000 · $2000/mo · with limits |
Cloudflare Sandbox: You need Workers Paid ($5 a month minimum). CPU is billed only while busy; memory and disk are billed on the instance size until the container sleeps, and 4 vCPU always comes with 12 GiB.
Agent 37: A prepaid wallet with no plan fee, metered per minute on what you reserve. Disk is billed even while stopped or asleep, and Performance and VM compute cost 4x and 2.5x the default rate.
Agent 37: A monthly plan from $20, all of it usage credit, billed per second while a sandbox runs. A stopped sandbox costs nothing and keeps its disk.
Limits in those scenarios
Cloudflare's disk resets after sleep and tops out at 20 GB by default, so the scenarios that keep 50 GB of files between days do not fit without your own snapshot code. Agent 37 caps instances at 200 on its top self-serve tier, counting sleeping and stopped ones, which is short of the 300 at once that sandboxes for your users need. In the 1,000-job burst Cloudflare's 1,500 vCPU account limit falls short of 2,000, and boat runs into its start limits.
| Scenario | Cloudflare Sandbox | Agent 37 | boat |
|---|---|---|---|
| One coding agent, workdays |
|
| None that bite |
| One agent that never stops |
|
| None that bite |
| 50 agents in parallel |
|
| None that bite |
| Sandboxes for your users | None that bite |
| None that bite |
| 1,000 short jobs at once |
|
|
|
Which one should you use?
Use Cloudflare Sandbox when
your app already runs on Workers and you want short sandboxes that sleep when idle, wake on request and follow egress rules you write.
- Egress rules you can program. Cloudflare can block every host except the ones you list, and run your own code on each outbound request.
- No sandbox count cap. Accounts are limited by resources, 1,500 vCPU at once by default, so many small sandboxes for your users fit.
- Next to the rest of Workers. If your app already runs on Workers, sandboxes sit next to Durable Objects and R2, in several regions.
Use Agent 37 when
you host one mostly idle assistant per customer in the US that should keep its files, sleep with its memory saved and wake on the next message.
- Sleeps and keeps its memory. Useful for assistants that sit idle most of the day: an instance sleeps, keeps its memory and wakes on the next message.
- A machine that keeps its files. An instance keeps its disk across sleeps and stops, so an agent's repo and installed tools are still there.
- Ready agent templates and dedicated cores. Start from Hermes, OpenClaw or Claude Code templates, or your own Docker image, and pick dedicated cores when speed must stay steady.
Where boat fits
Look at boat when your agents do hours of real work: installs, builds, Docker and emulators. Cloudflare resets the disk on sleep and Agent 37 needs a pricier VM type for Docker, while every boat sandbox is a full VM that keeps its files and can be forked while it runs.
A full VM is the default
On Cloudflare, Docker runs with iptables turned off and disk is 20 GB by default. On Agent 37 the default gVisor type cannot run Docker, and the VM type bills 2.5x with no systemd.
Files kept, and forks of running machines
A Cloudflare sandbox loses its repo and packages on sleep unless your code saves a snapshot. Agent 37 keeps the disk but cannot fork, so every parallel try rebuilds its state from the start.
Keys stay outside, for any API
On Cloudflare you write and maintain the outbound handler that adds every token. On Agent 37 your own keys sit as env vars inside a machine the agent controls.
Use boat when your agents do real work for hours on a full VM with Docker, systemd and a desktop, with forks of running machines and keys kept outside for any API. Compare it one to one: boat vs Cloudflare Sandbox and boat vs Agent 37.
Questions people ask
Is Cloudflare Sandbox cheaper than Agent 37?
No. Agent 37's estimate is lower in all five scenarios on this page, for example $12 against $148 a month for one agent that never stops. Agent 37 does not fit sandboxes for your users at 300 at once, because its self-serve tiers stop at 200 instances.
Which is faster?
There is no comparable measurement: neither Cloudflare Sandbox nor Agent 37 has a result on the hpc-sandbox-benchmarks loop. boat scores 26.69 runs/s there at 4 vCPU / 8 GB.
Can I run Docker on Cloudflare Sandbox or Agent 37?
On Cloudflare, docker:dind works with iptables and IP forwarding turned off. On Agent 37, only the VM type runs Docker, at 2.5x the default compute rate. boat runs full Docker in every sandbox.
Which one keeps my files?
Agent 37 keeps an instance's disk until you delete it, and can save its memory when it sleeps. Cloudflare starts from a fresh disk after sleep unless your code saved a snapshot or an R2 backup. boat keeps the disk and saves it every minute.
Where do they run?
Cloudflare places containers in several regions of its network. Agent 37 runs on dedicated servers in the United States. boat runs only in the EU, in Germany, Finland and France.
Can I limit where a sandbox connects to?
On Cloudflare, yes: allowedHosts blocks every host not on your list, and outbound handlers can change each request. Agent 37 and boat do not offer a provider-side egress allowlist.
Try boat
Install the CLI, then run boat new.
7-day free trial
More comparisons
- boat vs Cloudflare Sandbox
- boat vs Agent 37
- E2B vs Cloudflare Sandbox
- Daytona vs Cloudflare Sandbox
- Modal vs Cloudflare Sandbox
- Vercel Sandbox vs Cloudflare Sandbox
- Cloudflare Sandbox vs Blaxel
- Cloudflare Sandbox vs Runloop
- Cloudflare Sandbox vs Tensorlake
- Cloudflare Sandbox vs Morph Cloud
- Cloudflare Sandbox vs CodeSandbox SDK
- Cloudflare Sandbox vs Northflank