Cloudflare Sandbox vs AWS AgentCore

Cloudflare Sandbox runs a container per sandbox inside the Workers platform, sleeps it when idle and wakes it on the next request. AWS AgentCore is an AWS platform for hosting agents, with short microVM sessions, managed Code Interpreter and Browser tools, and longer sessions on EC2 in your own account.

The companies and products

Cloudflare Sandbox

Cloudflare Sandbox SDK runs untrusted or AI-generated code in Linux containers on Cloudflare's network, driven from a Cloudflare Worker.

Each sandbox is a Cloudflare Container backed by a Durable Object, and each container runs in its own Firecracker microVM with its own kernel and network. You build a linux/amd64 image, pick an instance type of up to 4 vCPU and 12 GiB, and reach the sandbox through your own Worker. It suits teams already on Workers who want short-lived sandboxes that sleep when idle; for code that only calls known methods, Cloudflare also offers Dynamic Workers, which run JavaScript in V8 isolates.

Isolation: Firecracker microVM per container, own kernel and network
Largest instance: 4 vCPU, 12 GiB memory, 20 GB disk (defaults, can be raised)
Disk: Ephemeral by default: a container that sleeps starts again from a fresh disk
Plan needed: Workers Paid, $5 a month account minimum; not on the Free plan
Account limits: 1,500 vCPU, 6 TiB memory and 30 TB disk running at once
Placement: Instances spread across several regions of Cloudflare's network, nearest free one picked
Compliance: Cloudflare holds a SOC 2 Type II report

AWS AgentCore

Amazon Bedrock AgentCore is a set of AWS services to deploy and run AI agents: a Runtime that hosts your agent code, plus built-in Code Interpreter and Browser tools.

AgentCore is not a sandbox product first. It is a hyperscaler's agent platform: you push a container image or code, and each Runtime session gets its own Firecracker microVM that you reach through AgentCore APIs. Around it sit managed tools (Code Interpreter, Browser) and services for memory, identity, gateways and evaluations, and an Instances compute type runs longer sessions on EC2 in your own account. It is built for teams who already build on AWS and want agents to stay inside their account, IAM and VPC.

Isolation: Runtime: a dedicated microVM per session; Code Interpreter and Browser run in a containerized environment
Session size: Runtime and Code Interpreter up to 2 vCPU / 8 GB, Browser 1 vCPU / 4 GB, not adjustable
Session length: Up to 8 hours per lifecycle on microVMs, 15 minutes idle by default; up to 14 days on Instances
Compute types: Serverless microVMs (arm64 Linux containers) or Instances: AWS-managed EC2 in your account, x86_64 or arm64, GPUs available
Regions: 17 commercial AWS regions across the US, EU, Asia Pacific, Canada and South America, plus GovCloud
Compliance: Listed as a HIPAA eligible AWS service

Which use cases each one fits

For each use case, Battleships prices every sandbox provider on the same workload and sorts them from the cheapest monthly bill up. “13th cheapest of 345” means 12 of the other 344 providers run that workload, with every feature it needs, for less. “With limits” means the provider runs it but misses something, so it is listed after every full match. Open a use case for its whole ranking and what each provider misses.

Use case and its workload	Cloudflare Sandbox: price rank	AWS AgentCore: price rank	boat: price rank
Software factory 100 at once · 4 vCPU / 8 GB · 2,200 sessions of 8 h a month Neither fits a coding agent fully: Cloudflare wipes the disk on sleep and AgentCore keeps only a small storage mount, while boat ranks 3rd with a full machine that keeps its disk.	162nd of 367, with limits $1,543 a month	100th of 367, with limits $888 a month	3rd cheapest of 367 $634 a month
Always-on AI employees 50 machines 24/7 · 2 vCPU / 4 GB AWS AgentCore ranks 64th against Cloudflare's 207th because Instances sessions can run up to 14 days, but both reset files outside what you save; boat ranks 5th and keeps its whole disk.	207th of 366, with limits $2,188 a month	64th of 366, with limits $1,300 a month	5th cheapest of 366 $657 a month
Code interpreter bursts 100 at once · 1 vCPU / 2 GB · 200,000 sessions of 1 min a month Both fit short code runs well and bill CPU only while it is busy; AWS AgentCore ranks 7th and Cloudflare Sandbox ranks 13th.	13th cheapest of 345 $144 a month	7th cheapest of 345 $114 a month	186th of 345, with limits $2,000 a month
Sandboxes for your users 300 at once · 2 vCPU / 4 GB · 30,000 sessions of 23 min a month Cloudflare Sandbox ranks 9th because previews and egress rules come through your Worker, while AgentCore sessions have no open ports for your users; boat ranks 1st.	9th cheapest of 361 $731 a month	210th of 361, with limits $506 a month	Cheapest of 361 $209 a month
RL rollouts 1,000 at once · 2 vCPU / 4 GB · 1,000,000 sessions of 3 min a month	144th of 360, with limits $9,428 a month	125th of 360, with limits $8,075 a month	34th of 360, with limits $2,000 a month
Agent evals 250 at once · 4 vCPU / 8 GB · 15,000 sessions of 20 min a month	45th cheapest of 364 $818 a month	33rd cheapest of 364 $650 a month	10th cheapest of 364 $200 a month
CI runners 40 at once · 8 vCPU / 16 GB · 6,000 sessions of 12 min a month Cloudflare caps disk at 20 GB by default and runs Docker with iptables turned off, so it fits CI less well than AgentCore; boat ranks 4th with full Docker and /dev/kvm.	301st of 377, with limits $704 a month	52nd cheapest of 377 $399 a month	4th cheapest of 377 $86 a month
24/7 dev boxes 1 machine 24/7 · 4 vCPU / 8 GB Cloudflare fits a dev box better than AgentCore, which has no SSH and resets packages outside its storage mount, though Cloudflare still starts from a fresh disk after sleep.	70th cheapest of 368 $93 a month	228th of 368, with limits $52 a month	18th cheapest of 368 $26 a month
Computer-use agents 50 at once · 4 vCPU / 8 GB · 20,000 sessions of 15 min a month Neither ships a full desktop: Cloudflare removed its built-in one and AgentCore Browser drives only a browser; boat ranks 6th with a 60fps desktop and computer use.	166th of 369, with limits $460 a month	104th of 369, with limits $202 a month	6th cheapest of 369 $200 a month
Browser-use agents 50 at once · 2 vCPU / 4 GB · 30,000 sessions of 10 min a month AWS AgentCore ranks 4th with a managed Chromium, live view and session replay, while Cloudflare has no built-in browser; boat ranks 7th with Chromium on a full machine.	210th of 367, with limits $233 a month	4th cheapest of 367 $144 a month	7th cheapest of 367 $200 a month
Scraping & bots (startup scale) 50 at once · 1 vCPU / 2 GB · 100,000 sessions of 3 min a month	250th of 346, with limits $286 a month	27th cheapest of 346 $287 a month	6th cheapest of 346 $90 a month
Mass scraping & bots (undetectable) 1,000 at once · 1 vCPU / 2 GB · 3,000,000 sessions of 2 min a month	169th of 338, with limits $5,741 a month	165th of 338, with limits $5,458 a month	71st of 338, with limits $1,800 a month
Parallel red teaming 200 at once · 2 vCPU / 4 GB · 5,000 sessions of 30 min a month	239th of 360, with limits $325 a month	62nd of 360, with limits $294 a month	2nd cheapest of 360 $200 a month
GPU eval jobs 10 at once · 8 vCPU / 32 GB · 500 sessions of 30 min a month	Can't run it	Can't run it	Can't run it
macOS agents 5 at once · 4 vCPU / 8 GB · 1,000 sessions of 20 min a month	Can't run it	Can't run it	Can't run it

Key features

Feature	Cloudflare Sandbox	AWS AgentCore	boat
Isolation	Firecracker microVM per container, own kernel and network	Firecracker microVM per Runtime session; Code Interpreter and Browser in a containerized environment	Full VM with its own kernel on dedicated AMD Ryzen 9 9950X hosts
Biggest machine	4 vCPU / 12 GiB / 20 GB disk by default (can be raised)	2 vCPU / 8 GB per microVM session, not adjustable; bigger EC2 types only on Instances	Up to 16 vCPU / 32 GB on the $100 plan and above
Session length	No fixed maximum; stops after inactivity, and host restarts can stop it at any time	Up to 8 hours per lifecycle on microVMs, 15 idle minutes by default; up to 14 days on Instances	No cap on paid plans; you set the time to live
What survives a stop	Nothing by default: the disk is fresh after sleep unless your code saves a snapshot or an R2 backup	One storage mount under /mnt, up to 1 GB, in preview; EBS volumes on Instances; the rest resets	The whole disk, saved every minute and on stop; a stopped sandbox costs nothing
Snapshots and fork	On-demand snapshots (public beta, kept 30 days); no fork	No user snapshots or fork of a session	Automatic snapshots every minute; fork a running sandbox with its disk
Docker inside	docker:dind with iptables and IP forwarding turned off	Root inside the microVM with arm64 images; Docker not documented	Full Docker, root and systemd
Nested virtualization	Not documented	Not documented	Yes, /dev/kvm for Android emulators and VMs
Browser and desktop	Built-in desktop removed in SDK 0.10.2; bring your own	Managed Chromium with live view, session recording and replay, profiles and proxies; no full desktop	Full Linux desktop streamed at 60fps, with Chromium and a computer-use API
Inbound traffic	HTTP and WebSocket previews routed through your Worker; no raw TCP or public IP	No open ports or SSH; sessions reached only through AgentCore APIs with IAM or JWT	HTTPS URLs for up to 50 ports, token-protected; raw TCP; SSH
Egress rules	allowedHosts deny-by-default list plus outbound handlers you write in Worker code	Security groups in VPC mode; no per-request HTTP rules	Open internet, no provider-side allowlist
Private networking	No private network into your own cloud	VPC mode with security groups, PrivateLink and a NAT gateway for a fixed outbound IP	Open internet with its own IPv6 or IPv4
Keeping API keys out of the sandbox	Your outbound handler adds the token for any HTTP or HTTPS host; you write the code	AgentCore Identity stores OAuth tokens and API keys and hands them to your agent code	Managed proxy for model providers and any HTTPS API; switch a credential to another account when credits run out
Coding agents	Run Claude Code, Codex, OpenCode or Pi in your image; OpenCode has an SDK helper	AWS's own managed harness built on Strands Agents, or your own agent code	Claude Code, Codex, OpenCode and more preinstalled, with a prompt, steer and events API
GPUs	No	NVIDIA G-series and Inferentia2 on the Instances type	No

Every feature Battleships tracks (43)

Feature	Cloudflare Sandbox	AWS AgentCore	boat
Full VM (own kernel)	Yes	Yes	Yes
Docker inside	Yes	Not published	Yes
Nested virtualization	No	No	Yes
Root	Yes	Yes	Yes
Systemd	Not published	No	Yes
Desktop GUI	No	No	Yes
Browser	No	Yes	Yes
Computer-use API	No	Yes	Yes
SSH	Yes	No	Yes
Persistent disk	No	Yes	Yes
Pause/resume	No	No	Yes
Automatic snapshots	No	No	Yes
Fork/clone	No	No	Yes
Live fork (no pause)	No	No	Yes
Memory fork	No	No	No
Custom image (Docker or snapshot)	Yes	Yes	Yes
≥24 h sessions	Yes	No	Yes
Idle auto-stop	Yes	Yes	No
Wake on request	Yes	Yes	No
HTTPS preview URLs	Yes	No	Yes
Raw TCP inbound	No	No	Yes
Public IPv4	No	No	No
Egress allowlist	Yes	Yes	No
Secret proxy	Yes	No	Yes
Secret proxy for any API	Yes	No	Yes
Preinstalled agents	Yes	No	Yes
Agent harness API	Yes	No	Yes
MCP server	No	Yes	No
GPU	No	Yes	No
Windows	No	No	No
Arm64	No	Yes	No
Self-hosting	No	No	No
BYOC	No	Yes	No
Open source	Yes	No	No
Scoped API keys	Not published	Not published	Yes
Spend limits	No	Yes	Yes
Usage per sandbox (API)	Not published	No	Yes
Audit logs	Yes	Yes	No
SSO	Yes	Yes	No
SOC 2	Yes	Yes	No
HIPAA	Yes	Yes	No
EU data residency	Yes	Yes	Yes
Zero data retention	Not published	Not published	Yes

Performance

Cloudflare SandboxNot measured

AWS AgentCoreNot measured

boat26.69 runs/s

Neither Cloudflare Sandbox nor AWS AgentCore has a result on the hpc-sandbox-benchmarks Node.js build-and-test loop, so there is no CPU number to compare between them. boat did 26.69 runs per second on that loop at 4 vCPU / 8 GB.

Node.js build-and-test loop at 4 vCPU / 8 GB, higher is better. Measured with the open hpc-sandbox-benchmarks suite. Cloudflare Sandbox and AWS AgentCore have no published run in this suite yet, so there is no like-for-like number to compare.

Pricing in five scenarios

Each bill is priced from the providers' public price lists by the open Battleships engine, with the cheapest plan that runs the scenario.

Scenario	Cloudflare Sandbox, a month	AWS AgentCore, a month	boat, a month
One coding agent, workdays 4 vCPU / 8 GB, 50 GB disk, 8 hours a day, 22 days a month, files kept between days	$39 · Workers Paid · with limits	$26 · Pay-as-you-go (Instances) · with limits	$20 · $20/mo
One agent that never stops 4 vCPU / 8 GB, 50 GB disk, running 24/7 all month	$148 · Workers Paid · with limits	$107 · Pay-as-you-go (Instances) · with limits	$26 · $20/mo
50 agents in parallel 50 machines of 4 vCPU / 8 GB at once, 8-hour sessions, 1,100 sessions a month, Docker inside	$1,660 · Workers Paid · with limits	$1,286 · Pay-as-you-go (Instances) · with limits	$317 · $20/mo × 3 seats
Sandboxes for your users 2 vCPU / 4 GB, 30,000 sessions of 10 minutes a month, up to 300 at once	$476 · Workers Paid	$423 · Pay-as-you-go · with limits	$200 · $100/mo × 2 seats
1,000 short jobs at once 2 vCPU / 4 GB, 1,000 at once, 3 minutes each, 200,000 jobs a month	$1,889 · Workers Paid · with limits	$1,615 · Pay-as-you-go (Instances)	$2,000 · $2000/mo · with limits

Cloudflare Sandbox: You need Workers Paid ($5 a month minimum). CPU is billed only while busy; memory and disk are billed on the instance size until the container sleeps, and 4 vCPU always comes with 12 GiB, with Durable Object and Worker requests on top.

AWS AgentCore: Runtime microVMs, Code Interpreter and Browser bill per second for CPU actually used and for peak memory. The 4 vCPU shape in these scenarios is the Instances type: the EC2 on-demand price plus a 12% fee, with EBS storage and data transfer billed on top.

AWS AgentCore: Plans start at $20 a month, and the whole fee is usage credit. You pay per second while a sandbox runs, and a stopped sandbox costs nothing and keeps its disk.

Limits in those scenarios

Cloudflare's disk resets after sleep and tops out at 20 GB by default, so the scenarios that keep 50 GB of files do not fit, and its 1,500 vCPU account limit is short of the 2,000 vCPU the 1,000-job burst needs unless Cloudflare raises it. AgentCore needs the Instances type for a 4 vCPU agent, where sessions stop at 14 days and only the storage mount or an EBS volume keeps files. For sandboxes your users open, AgentCore is a code interpreter with no open ports, so it does not fit. boat fits every scenario except the burst, where its plan queues starts above 90 a minute.

Scenario	Cloudflare Sandbox	AWS AgentCore	boat
One coding agent, workdays	missing persistent disk	files survive a stop only in the session storage mount: packages installed elsewhere reset disk beyond 0 GiB: price unknown	None that bite
One agent that never stops	missing persistent disk	Pay-as-you-go (Instances): sessions capped at 336 h files survive a stop only in the session storage mount: packages installed elsewhere reset disk beyond 0 GiB: price unknown	None that bite
50 agents in parallel	missing persistent disk	files survive a stop only in the session storage mount: packages installed elsewhere reset disk beyond 0 GiB: price unknown	None that bite
Sandboxes for your users	None that bite	different kind of product: code interpreter	None that bite
1,000 short jobs at once	Workers Paid: max 1,500 vCPU running at once (needs 2,000)	disk beyond 0 GiB: price unknown	max 2,400 starts/day (needs ~6,667) max 600 starts/hour (needs ~1,000) bursts above 90 starts/min are queued (a burst of 333 takes ~4 min to start)

Which one should you use?

Use Cloudflare Sandbox when

your app already runs on Workers and you want short sandboxes that sleep when idle, wake on the next request and follow egress rules you write in code.

Egress rules you can program. Cloudflare can block every host except the ones you list, and run your own code on each outbound HTTP request.
Sleeps when idle, wakes on request. Useful for many short, spiky sessions: a sandbox sleeps when idle, wakes on the next request, and bills CPU only while busy.
Previews and a bigger box than a microVM session. Your users can open a sandbox's app through HTTP previews, and one sandbox can use up to 4 vCPU and 12 GiB.

Use AWS AgentCore when

your agents must stay inside your AWS account and VPC, need a GPU, or are short code and browser tasks that fit its managed tools.

It lives inside your AWS account. Teams built on AWS keep agents behind their own IAM, VPC, security groups and PrivateLink, in 17 commercial regions.
GPUs and two-week sessions on Instances. Agents that need a GPU or a session of up to 14 days can run on EC2 in your account.
A managed browser for agents. AgentCore Browser gives agents a managed Chromium with live view, session recording and replay, saved profiles and proxies.

Where boat fits

Both Cloudflare Sandbox and AgentCore are built around short sessions that start clean. If your agents work for hours on one machine, installing packages, building with Docker and running the app they make, look at boat: each agent gets a full VM that keeps its disk and can be opened from outside.

A disk that stays put

On Cloudflare a sleeping sandbox comes back with a fresh disk unless your code saved a snapshot or backup, and on AgentCore only a 1 GB mount survives. boat saves the whole disk every minute and can fork a running sandbox.

A whole machine, not a small box

Cloudflare tops out at 4 vCPU and 20 GB of disk with iptables off for Docker, and an AgentCore microVM stops at 2 vCPU and 8 hours unless you run EC2 in your account. boat gives up to 16 vCPU with Docker, systemd and /dev/kvm.

Open what the agent builds

Cloudflare previews go through Worker code you write and take no raw TCP, and AgentCore sessions have no open ports at all. boat gives each sandbox HTTPS URLs on up to 50 ports, raw TCP and SSH.

Use boat when your agents do real work on one machine for hours: installs, builds, Docker, emulators and a desktop, with a disk that keeps everything and URLs you can open. Compare it one to one: boat vs Cloudflare Sandbox and boat vs AWS AgentCore.

Questions people ask

Is Cloudflare Sandbox cheaper than AWS AgentCore?

In all five scenarios on this page, AgentCore's estimate is lower, for example $1,286 against $1,660 a month for 50 agents in parallel. Its 4 vCPU shapes use the Instances type, with EBS storage billed on top. boat costs less than both in four of the five.

Which is faster, Cloudflare Sandbox or AWS AgentCore?

There is no comparable measurement: neither was part of the hpc-sandbox-benchmarks run. boat scored 26.69 runs per second there at 4 vCPU / 8 GB.

Can Cloudflare Sandbox or AgentCore run Docker?

Cloudflare supports docker:dind with iptables and IP forwarding turned off, because containers cannot change iptables. AgentCore runs your arm64 image as root, but its docs do not say Docker works inside a session. boat runs full Docker with systemd and /dev/kvm.

Do files survive when a session stops?

On Cloudflare the next start uses a fresh disk unless your code saved a snapshot (public beta, kept 30 days) or an R2 backup. On AgentCore only a storage mount under /mnt, up to 1 GB and in preview, or an EBS volume on Instances survives. boat keeps the whole disk.

How long can a session run?

Cloudflare sets no fixed maximum, but stops a sandbox after inactivity and does not promise any run time. AgentCore microVM sessions last up to 8 hours, and Instances sessions up to 14 days. boat has no session cap on paid plans.

Where do they run?

Cloudflare places containers in several regions of its network and picks the nearest free one. AgentCore runs in 17 commercial AWS regions plus GovCloud. boat runs in the EU only, in Germany, Finland and France.

Try boat

Install the CLI, then run boat new.

7-day free trial