Cloudflare Sandbox vs Azure Container Apps Sandboxes
Both run each sandbox in its own microVM with its own kernel. Cloudflare's sandbox lives inside Workers and starts from a fresh disk after it sleeps, while Azure's sandbox lives in your Azure subscription and suspends with its memory and disk, then resumes in under a second.
The companies and products
Cloudflare Sandbox
Cloudflare Sandbox SDK runs untrusted or AI-generated code in Linux containers on Cloudflare's network, driven from a Cloudflare Worker.
Each sandbox is a Cloudflare Container backed by a Durable Object, and each container runs in its own Firecracker microVM with its own kernel and network. You build a linux/amd64 image, pick an instance type of up to 4 vCPU and 12 GiB, and reach the sandbox through your own Worker. It suits teams already on Workers who want short-lived sandboxes that sleep when idle; for code that only calls known methods, Cloudflare also offers Dynamic Workers, which run JavaScript in V8 isolates.
- Largest instance
- 4 vCPU, 12 GiB memory, 20 GB disk (defaults, can be raised)
- Account limits
- 1,500 vCPU, 6 TiB memory and 30 TB disk running at once
- Compliance
- Cloudflare holds a SOC 2 Type II report
Azure Container Apps Sandboxes
Azure Container Apps Sandboxes is a service inside Microsoft Azure that gives each agent or user an isolated microVM you create, suspend and resume through an SDK.
It is part of Azure Container Apps, the hyperscaler's serverless container platform, and lives in your Azure subscription as a sandbox group resource. Each sandbox boots from an OCI image or a snapshot, has its own kernel, and can be suspended with its memory and resumed in under a second. It is built for teams already on Azure that want stateful code execution with Azure networking, identity and billing.
Which use cases each one fits
For each use case, Battleships prices every sandbox provider on the same workload and sorts them from the cheapest monthly bill up. “13th cheapest of 345” means 12 of the other 344 providers run that workload, with every feature it needs, for less. “With limits” means the provider runs it but misses something, so it is listed after every full match. Open a use case for its whole ranking and what each provider misses.
| Use case and its workload | Cloudflare Sandbox: price rank | Azure Container Apps Sandboxes: price rank | boat: price rank |
|---|---|---|---|
| Software factory 100 at once · 4 vCPU / 8 GB · 2,200 sessions of 8 h a month Hours of installs and Docker builds need a disk that stays; Azure keeps it, Cloudflare resets it on sleep, and only boat adds /dev/kvm, SSH and a desktop. | 162nd of 367, with limits $1,543 a month | 288th of 367, with limits $5,276 a month | 3rd cheapest of 367 $634 a month |
| Always-on AI employees 50 machines 24/7 · 2 vCPU / 4 GB | 207th of 366, with limits $2,188 a month | 302nd of 366, with limits $6,544 a month | 5th cheapest of 366 $657 a month |
| Code interpreter bursts 100 at once · 1 vCPU / 2 GB · 200,000 sessions of 1 min a month Both fit short code-interpreter calls; Cloudflare bills CPU only while it is busy, and Azure suspends with memory and resumes in under a second. | 13th cheapest of 345 $144 a month | 34th cheapest of 345 $354 a month | 186th of 345, with limits $2,000 a month |
| Sandboxes for your users 300 at once · 2 vCPU / 4 GB · 30,000 sessions of 23 min a month Both fit sandboxes for your users; Cloudflare is the lower estimate, Azure keeps an idle user's memory, and boat is lower than both with hosting on up to 50 ports. | 9th cheapest of 361 $731 a month | 22nd cheapest of 361 $2,260 a month | Cheapest of 361 $209 a month |
| RL rollouts 1,000 at once · 2 vCPU / 4 GB · 1,000,000 sessions of 3 min a month | 144th of 360, with limits $9,428 a month | 153rd of 360, with limits $10,740 a month | 34th of 360, with limits $2,000 a month |
| Agent evals 250 at once · 4 vCPU / 8 GB · 15,000 sessions of 20 min a month Both fit agent evals; Cloudflare's estimate is about half of Azure's, and boat's is lower than both. | 45th cheapest of 364 $818 a month | 75th cheapest of 364 $1,728 a month | 10th cheapest of 364 $200 a month |
| CI runners 40 at once · 8 vCPU / 16 GB · 6,000 sessions of 12 min a month Azure fits CI runners while Cloudflare is a compromise, with a 20 GB default disk and Docker that runs with iptables turned off; boat has full Docker and nested virtualization. | 301st of 377, with limits $704 a month | 103rd cheapest of 377 $1,046 a month | 4th cheapest of 377 $86 a month |
| 24/7 dev boxes 1 machine 24/7 · 4 vCPU / 8 GB Cloudflare fits a dev box here and Azure is a compromise for a box that runs around the clock; boat stops at no cost and keeps its disk. | 70th cheapest of 368 $93 a month | 322nd of 368, with limits $262 a month | 18th cheapest of 368 $26 a month |
| Computer-use agents 50 at once · 4 vCPU / 8 GB · 20,000 sessions of 15 min a month Neither ships a desktop: Cloudflare removed its built-in one and Azure's sandboxes are headless, while boat streams a Linux desktop at 60fps. | 166th of 369, with limits $460 a month | 279th of 369, with limits $1,573 a month | 6th cheapest of 369 $200 a month |
| Browser-use agents 50 at once · 2 vCPU / 4 GB · 30,000 sessions of 10 min a month | 210th of 367, with limits $233 a month | 288th of 367, with limits $795 a month | 7th cheapest of 367 $200 a month |
| Scraping & bots (startup scale) 50 at once · 1 vCPU / 2 GB · 100,000 sessions of 3 min a month | 250th of 346, with limits $286 a month | 284th of 346, with limits $561 a month | 6th cheapest of 346 $90 a month |
| Mass scraping & bots (undetectable) 1,000 at once · 1 vCPU / 2 GB · 3,000,000 sessions of 2 min a month | 169th of 338, with limits $5,741 a month | 239th of 338, with limits $10,956 a month | 71st of 338, with limits $1,800 a month |
| Parallel red teaming 200 at once · 2 vCPU / 4 GB · 5,000 sessions of 30 min a month Neither takes raw TCP from outside or offers nested virtualization; boat has both, with full root networking. | 239th of 360, with limits $325 a month | 278th of 360, with limits $517 a month | 2nd cheapest of 360 $200 a month |
| GPU eval jobs 10 at once · 8 vCPU / 32 GB · 500 sessions of 30 min a month | Can't run it | Can't run it | Can't run it |
| macOS agents 5 at once · 4 vCPU / 8 GB · 1,000 sessions of 20 min a month | Can't run it | Can't run it | Can't run it |
Key features
| Feature | Cloudflare Sandbox | Azure Container Apps Sandboxes | boat |
|---|---|---|---|
| Isolation | Firecracker microVM per container, own kernel and network | MicroVM per sandbox with its own kernel | Full VM with its own kernel on dedicated AMD Ryzen 9 9950X hosts |
| Largest machine | 4 vCPU / 12 GiB / 20 GB disk by default (can be raised) | Tiers up to 4 cores / 8 GB; up to 16 vCPU / 32 GB by API | Up to 16 vCPU / 32 GB, depending on plan |
| Files after a stop | Fresh disk after sleep; snapshots (public beta, 30 days) or R2 backups if your code saves them | Disk kept when a sandbox suspends | Disk saved every minute and on stop; a stopped sandbox costs nothing |
| Memory and wake | No paused state; a sleeping container wakes on the next request with a fresh start | Suspends with memory; resumes in under a second with processes running, on traffic or a start command | Resume boots the machine again; a stopped sandbox is started by API |
| Fork | No fork; restore a saved snapshot or backup into a new sandbox | Snapshot a running sandbox with its memory and create new sandboxes from it | Fork a running sandbox with its disk, without stopping it |
| Docker and nested virtualization | docker:dind with iptables and IP forwarding turned off; nested virtualization not documented | Docker on the azure-dev image, Buildah only on the default ubuntu image; nested virtualization not documented | Full Docker, root and systemd on every sandbox, plus /dev/kvm for emulators and VMs |
| Getting a shell | SSH documented for Containers, plus exec through the SDK | Interactive shell through the aca CLI, SDK or portal; no SSH | SSH on every sandbox, plus CLI and API exec |
| Desktop and browser | Built-in desktop removed in SDK 0.10.2; bring your own | Headless; no desktop or managed browser | Linux desktop at 60fps, Chromium and a computer-use API, embeddable stream |
| Inbound traffic | HTTP and WebSocket previews routed through your Worker; no raw TCP or public IP | Public HTTPS routes per published port; private endpoint from your VNet; no public IP | HTTPS URLs for up to 50 ports, token-protected; raw TCP; own IPv4 or IPv6 |
| Outbound rules | allowedHosts deny-by-default list plus outbound handlers you write in Worker code | Egress policy with allow, deny, rewrite and header rules by host, path and method; VNet integration | Open internet, no provider-side allowlist |
| Keeping keys out of the sandbox | Your outbound handler adds the token for any HTTP or HTTPS host; you write the code | Group secrets in egress header rules; Copilot and Anthropic tokens are injected into the sandbox at startup | Managed proxy for model keys and any HTTPS API you register; switch a credential to another account |
| Coding agents | Run Claude Code, Codex, OpenCode or Pi in your image; OpenCode has an SDK helper | Copilot CLI and Claude Code images, run through the exec API | Seven agents preinstalled, with a prompt, steer and events API |
| Fleet size | 1,500 vCPU running at once per account by default, can be raised | 500 concurrent active cores by default; more by Azure support request | Concurrency set by plan, up to 2,000 sandboxes, self-serve |
| Regions | Several regions across Cloudflare's network, nearest free instance picked | 40 Azure regions, 9 of them in the EU | EU only: Germany, Finland, France |
Every feature Battleships tracks (43)
| Feature | Cloudflare Sandbox | Azure Container Apps Sandboxes | boat |
|---|---|---|---|
| Full VM (own kernel) | Yes | Yes | Yes |
| Docker inside | Yes | Yes | Yes |
| Nested virtualization | No | No | Yes |
| Root | Yes | Yes | Yes |
| Systemd | Not published | Yes | Yes |
| Desktop GUI | No | No | Yes |
| Browser | No | No | Yes |
| Computer-use API | No | No | Yes |
| SSH | Yes | No | Yes |
| Persistent disk | No | Yes | Yes |
| Pause/resume | No | Yes | Yes |
| Automatic snapshots | No | Yes | Yes |
| Fork/clone | No | Yes | Yes |
| Live fork (no pause) | No | Yes | Yes |
| Memory fork | No | Yes | No |
| Custom image (Docker or snapshot) | Yes | Yes | Yes |
| ≥24 h sessions | Yes | Yes | Yes |
| Idle auto-stop | Yes | Yes | No |
| Wake on request | Yes | Yes | No |
| HTTPS preview URLs | Yes | Yes | Yes |
| Raw TCP inbound | No | No | Yes |
| Public IPv4 | No | No | No |
| Egress allowlist | Yes | Yes | No |
| Secret proxy | Yes | Yes | Yes |
| Secret proxy for any API | Yes | Yes | Yes |
| Preinstalled agents | Yes | Yes | Yes |
| Agent harness API | Yes | No | Yes |
| MCP server | No | No | No |
| GPU | No | No | No |
| Windows | No | No | No |
| Arm64 | No | No | No |
| Self-hosting | No | No | No |
| BYOC | No | No | No |
| Open source | Yes | No | No |
| Scoped API keys | Not published | Not published | Yes |
| Spend limits | No | Yes | Yes |
| Usage per sandbox (API) | Not published | Yes | Yes |
| Audit logs | Yes | Yes | No |
| SSO | Yes | Yes | No |
| SOC 2 | Yes | Yes | No |
| HIPAA | Yes | Yes | No |
| EU data residency | Yes | Yes | Yes |
| Zero data retention | Not published | Not published | Yes |
Performance
Neither Cloudflare Sandbox nor Azure Container Apps Sandboxes has a result on the StarSling hpc-sandbox-benchmarks Node.js build-and-test loop, so there is no comparable CPU number for either. boat did 26.69 runs per second on that test at 4 vCPU / 8 GB, on dedicated AMD Ryzen 9 9950X hosts. Until both are measured on the same test, this page makes no speed claim between them.
Node.js build-and-test loop at 4 vCPU / 8 GB, higher is better. Measured with the open hpc-sandbox-benchmarks suite. Cloudflare Sandbox and Azure Container Apps Sandboxes have no published run in this suite yet, so there is no like-for-like number to compare.
Pricing in five scenarios
Each bill is priced from the providers' public price lists by the open Battleships engine, with the cheapest plan that runs the scenario.
| Scenario | Cloudflare Sandbox, a month | Azure Container Apps Sandboxes, a month | boat, a month |
|---|---|---|---|
| One coding agent, workdays 4 vCPU / 8 GB, 50 GB disk, 8 hours a day, 22 days a month, files kept between days | $39 · Workers Paid · with limits | $68 · Pay-as-you-go | $20 · $20/mo |
| One agent that never stops 4 vCPU / 8 GB, 50 GB disk, running 24/7 all month | $148 · Workers Paid · with limits | $262 · Pay-as-you-go · with limits | $26 · $20/mo |
| 50 agents in parallel 50 machines of 4 vCPU / 8 GB at once, 8-hour sessions, 1,100 sessions a month, Docker inside | $1,660 · Workers Paid · with limits | $3,421 · Pay-as-you-go | $317 · $20/mo × 3 seats |
| Sandboxes for your users 2 vCPU / 4 GB, 30,000 sessions of 10 minutes a month, up to 300 at once | $476 · Workers Paid | $989 · Pay-as-you-go | $200 · $100/mo × 2 seats |
| 1,000 short jobs at once 2 vCPU / 4 GB, 1,000 at once, 3 minutes each, 200,000 jobs a month | $1,889 · Workers Paid · with limits | $2,148 · Pay-as-you-go | $2,000 · $2000/mo · with limits |
Cloudflare Sandbox: You need Workers Paid ($5 a month minimum). CPU is billed only while busy; memory and disk are billed on the instance size until the container sleeps, and 4 vCPU always comes with 12 GiB.
Cloudflare Sandbox: Durable Object and Worker requests are billed on top, and egress is free up to 1 TB in North America and Europe, then $0.025 per GB.
Azure Container Apps Sandboxes: There is no plan fee. Azure bills per second on the Container Apps Consumption meters for the tier's vCPU and memory while a sandbox runs, idle time before auto-suspend included, and some regions charge more.
Azure Container Apps Sandboxes: Plans start at $20 a month, all of it usage credit, billed per second while a sandbox runs. A stopped sandbox costs nothing and keeps its disk.
Limits in those scenarios
Cloudflare is the lower estimate in every scenario here, but its disk resets after sleep, so the three agent scenarios that keep files between sessions do not fit without your own snapshot or backup code. Its default 1,500 vCPU account limit is also short of the 2,000 vCPU the 1,000-job burst needs, which Azure handles. Azure bills a running sandbox every second until it suspends, so the always-on agent only gets close with a 3-year commitment. boat fits four of the five; for the burst, the $2,000 plan allows 600 starts an hour and queues bursts above 90 a minute.
| Scenario | Cloudflare Sandbox | Azure Container Apps Sandboxes | boat |
|---|---|---|---|
| One coding agent, workdays |
| None that bite | None that bite |
| One agent that never stops |
|
| None that bite |
| 50 agents in parallel |
| None that bite | None that bite |
| Sandboxes for your users | None that bite | None that bite | None that bite |
| 1,000 short jobs at once |
| None that bite |
|
Which one should you use?
Use Cloudflare Sandbox when
your app already runs on Workers and you want many short, cheap sandboxes that sleep when idle and wake on the next request.
- Built into Workers. If your app already runs on Workers, sandboxes sit next to Durable Objects and R2, and you drive them from your own Worker.
- Pays only for busy CPU. For many short, spiky sessions, CPU is billed only while it is busy, and a sleeping container wakes on the next request.
- Egress you write as code. Outbound handlers run your own Worker code on each HTTP request, outside the sandbox, on top of a deny-by-default host list.
Use Azure Container Apps Sandboxes when
your team runs on Azure and wants stateful sandboxes that suspend with their memory, sit behind strict egress rules, or run outside the EU.
- Suspend with memory. For stateful jobs that sleep between requests, a sandbox suspends with its memory and disk and resumes in under a second.
- Fork from a memory snapshot. A snapshot of a running sandbox, memory included, can seed many new sandboxes that start from the same point.
- Inside your Azure account. Teams already on Azure get Entra ID, Azure billing and VNets, with sandboxes in 40 regions.
Where boat fits
Both Cloudflare and Azure are built for short sandboxes that sleep between requests and wake on traffic. If your agents work for hours, building with Docker, running emulators, using a browser or being driven from outside, boat gives each one a whole computer that keeps its disk and costs nothing while stopped.
A whole computer per agent
Neither documents nested virtualization, so an agent cannot start an Android emulator or a VM. Cloudflare runs Docker with iptables turned off on a 20 GB default disk, and Azure only ships Docker on certain images. boat has full Docker, systemd and /dev/kvm.
A screen, SSH and raw TCP
Cloudflare removed its desktop and Azure is headless, so a computer-use agent needs a display stack you build and maintain. Neither takes raw TCP from outside, and Azure has no SSH. boat streams a 60fps desktop and takes SSH and raw TCP.
Agents and keys handled outside
On Cloudflare you bake each agent into your image and write the handler that adds every token. Azure injects Copilot and Anthropic tokens into the sandbox, where a hijacked agent can read them. boat's proxy keeps keys outside and drives agents through one API.
Use boat when your agents do hours of real work: full Docker, emulators, a desktop and SSH, on a machine that keeps its files and comes with coding agents and a credentials proxy. Compare it one to one: boat vs Cloudflare Sandbox and boat vs Azure Container Apps Sandboxes.
Questions people ask
Is Cloudflare Sandbox cheaper than Azure Container Apps Sandboxes?
In all five scenarios on this page, Cloudflare's estimate is lower than Azure's, often about half. But Cloudflare fits only one of them as written, because its disk resets after sleep, while Azure fits four. boat is lower than both in the four scenarios it fits.
Which is faster?
There is no comparable CPU measurement for either Cloudflare Sandbox or Azure Container Apps Sandboxes. Azure resumes a suspended sandbox in under a second with its processes still running, while a Cloudflare container that slept starts again from a fresh disk.
Which one keeps my files?
Azure keeps the disk, and also the memory, when a sandbox suspends. Cloudflare starts from a fresh disk after sleep unless your code saved a snapshot (public beta, kept 30 days) or a backup to R2. boat saves the disk every minute and on stop.
Can I run Docker inside either one?
Yes, with limits. Cloudflare supports docker:dind with iptables and IP forwarding turned off, and Azure ships Docker on its azure-dev image while the default ubuntu image has only Buildah. boat runs full Docker on every sandbox and adds /dev/kvm.
Can I limit where a sandbox connects to?
Both can. Cloudflare blocks every host not on your allowedHosts list and runs your outbound handlers on each request, and Azure has egress policies by host, path and method plus VNet integration. boat has no provider-side egress allowlist today.
Where does each one run?
Cloudflare places containers in several regions of its network, and Azure runs in 40 regions, 9 of them in the EU. boat runs in the EU only, in Germany, Finland and France.
Try boat
Install the CLI, then run boat new.
7-day free trial
More comparisons
- boat vs Cloudflare Sandbox
- boat vs Azure Container Apps Sandboxes
- E2B vs Cloudflare Sandbox
- Daytona vs Cloudflare Sandbox
- Modal vs Cloudflare Sandbox
- Vercel Sandbox vs Cloudflare Sandbox
- Cloudflare Sandbox vs Blaxel
- Cloudflare Sandbox vs Runloop
- Cloudflare Sandbox vs Tensorlake
- Cloudflare Sandbox vs Morph Cloud
- Cloudflare Sandbox vs CodeSandbox SDK
- Cloudflare Sandbox vs Northflank