Cloudflare Sandbox vs Blaxel
Both run each sandbox in a Firecracker microVM with its own kernel, and both sleep when idle. A Cloudflare sandbox comes back from sleep with a fresh disk, while a Blaxel sandbox comes back in under 25 ms with its memory and running processes in place.
The companies and products
Cloudflare Sandbox
Cloudflare Sandbox SDK runs untrusted or AI-generated code in Linux containers on Cloudflare's network, driven from a Cloudflare Worker.
Each sandbox is a Cloudflare Container backed by a Durable Object, and each container runs in its own Firecracker microVM with its own kernel and network. You build a linux/amd64 image, pick an instance type of up to 4 vCPU and 12 GiB, and reach the sandbox through your own Worker. It suits teams already on Workers who want short-lived sandboxes that sleep when idle; for code that only calls known methods, Cloudflare also offers Dynamic Workers, which run JavaScript in V8 isolates.
- Largest instance
- 4 vCPU, 12 GiB memory, 20 GB disk (defaults, can be raised)
- Account limits
- 1,500 vCPU, 6 TiB memory and 30 TB disk running at once
- Compliance
- Cloudflare holds a SOC 2 Type II report
Blaxel
Blaxel is a San Francisco company that runs cloud infrastructure for AI agents, and since September 2026 it is part of Baseten.
You get sandboxes, batch jobs, MCP server hosting and a model gateway. Each sandbox is a Firecracker microVM with its own kernel that drops to standby when nothing is connected and resumes in under 25 ms with its memory and running processes. It is built for agent products that start many sandboxes and want them asleep most of the time.
- Headquarters
- San Francisco, founded 2024
Which use cases each one fits
For each use case, Battleships prices every sandbox provider on the same workload and sorts them from the cheapest monthly bill up. “13th cheapest of 345” means 12 of the other 344 providers run that workload, with every feature it needs, for less. “With limits” means the provider runs it but misses something, so it is listed after every full match. Open a use case for its whole ranking and what each provider misses.
| Use case and its workload | Cloudflare Sandbox: price rank | Blaxel: price rank | boat: price rank |
|---|---|---|---|
| Software factory 100 at once · 4 vCPU / 8 GB · 2,200 sessions of 8 h a month Long agent sessions need files that stay; Blaxel keeps memory and files in standby, Cloudflare starts from a fresh disk after sleep, and boat keeps a real disk with Docker and /dev/kvm. | 162nd of 367, with limits $1,543 a month | 10th cheapest of 367 $2,373 a month | 3rd cheapest of 367 $634 a month |
| Always-on AI employees 50 machines 24/7 · 2 vCPU / 4 GB | 207th of 366, with limits $2,188 a month | 12th cheapest of 366 $2,832 a month | 5th cheapest of 366 $657 a month |
| Code interpreter bursts 100 at once · 1 vCPU / 2 GB · 200,000 sessions of 1 min a month Short code-interpreter calls suit both: Cloudflare bills CPU only while busy and Blaxel sleeps right after the last connection, so they rank 13th and 14th, far ahead of boat. | 13th cheapest of 345 $144 a month | 14th cheapest of 345 $144 a month | 186th of 345, with limits $2,000 a month |
| Sandboxes for your users 300 at once · 2 vCPU / 4 GB · 30,000 sessions of 23 min a month Cloudflare fits 300 user sandboxes at once on Workers Paid, while Blaxel's public tiers stop at 200 at once; boat fits it on a self-serve plan and ranks first. | 9th cheapest of 361 $731 a month | 101st of 361, with limits $926 a month | Cheapest of 361 $209 a month |
| RL rollouts 1,000 at once · 2 vCPU / 4 GB · 1,000,000 sessions of 3 min a month | 144th of 360, with limits $9,428 a month | 77th of 360, with limits $4,378 a month | 34th of 360, with limits $2,000 a month |
| Agent evals 250 at once · 4 vCPU / 8 GB · 15,000 sessions of 20 min a month Cloudflare runs many eval sandboxes at once within its 1,500 vCPU account cap, while Blaxel's public tiers cap them at 200 and count sleeping ones toward that. | 45th cheapest of 364 $818 a month | 136th of 364, with limits $704 a month | 10th cheapest of 364 $200 a month |
| CI runners 40 at once · 8 vCPU / 16 GB · 6,000 sessions of 12 min a month CI that builds Docker images needs disk and full Docker; Cloudflare caps disk at 20 GB by default and turns off iptables, Blaxel fits, and boat gives a full VM. | 301st of 377, with limits $704 a month | 57th cheapest of 377 $431 a month | 4th cheapest of 377 $86 a month |
| 24/7 dev boxes 1 machine 24/7 · 4 vCPU / 8 GB A dev box should keep its files when you log off; Cloudflare wipes the disk on sleep, Blaxel has no native SSH, and boat is a VM you SSH into that stops at no cost. | 70th cheapest of 368 $93 a month | 265th of 368, with limits $114 a month | 18th cheapest of 368 $26 a month |
| Computer-use agents 50 at once · 4 vCPU / 8 GB · 20,000 sessions of 15 min a month Blaxel ships a desktop and browser for computer use, Cloudflare removed its built-in desktop, and boat streams a 60fps desktop with a computer-use API. | 166th of 369, with limits $460 a month | 14th cheapest of 369 $634 a month | 6th cheapest of 369 $200 a month |
| Browser-use agents 50 at once · 2 vCPU / 4 GB · 30,000 sessions of 10 min a month | 210th of 367, with limits $233 a month | 16th cheapest of 367 $317 a month | 7th cheapest of 367 $200 a month |
| Scraping & bots (startup scale) 50 at once · 1 vCPU / 2 GB · 100,000 sessions of 3 min a month | 250th of 346, with limits $286 a month | 16th cheapest of 346 $215 a month | 6th cheapest of 346 $90 a month |
| Mass scraping & bots (undetectable) 1,000 at once · 1 vCPU / 2 GB · 3,000,000 sessions of 2 min a month | 169th of 338, with limits $5,741 a month | 147th of 338, with limits $4,292 a month | 71st of 338, with limits $1,800 a month |
| Parallel red teaming 200 at once · 2 vCPU / 4 GB · 5,000 sessions of 30 min a month Blaxel ranks 3rd here with provider-side egress rules, and boat 2nd with root, raw TCP and nested VMs; Cloudflare containers cannot change iptables or take raw TCP from outside. | 239th of 360, with limits $325 a month | 3rd cheapest of 360 $217 a month | 2nd cheapest of 360 $200 a month |
| GPU eval jobs 10 at once · 8 vCPU / 32 GB · 500 sessions of 30 min a month | Can't run it | Can't run it | Can't run it |
| macOS agents 5 at once · 4 vCPU / 8 GB · 1,000 sessions of 20 min a month | Can't run it | Can't run it | Can't run it |
Key features
| Feature | Cloudflare Sandbox | Blaxel | boat |
|---|---|---|---|
| Isolation | Firecracker microVM per container, own kernel and network | Firecracker microVM per sandbox, own kernel | Full VM with its own kernel on dedicated AMD Ryzen 9 9950X hosts |
| Largest machine | 4 vCPU / 12 GiB / 20 GB disk by default (can be raised) | Sized by RAM, CPU included (8 GB comes with 4 cores); up to 256 GB on Custom | Up to 16 vCPU / 32 GB, depending on plan |
| Sleep and wake | Stops after inactivity and wakes on the next request, with a fresh disk | Standby seconds after the last connection, wakes in under 25 ms with memory and processes | Stop keeps the disk and costs nothing; resume boots the VM again |
| Files between sessions | Fresh disk after sleep; snapshots (public beta, 30 days) or R2 backups when your code saves them | Files live in memory (about half the RAM) and stay in standby; one block volume can be attached at creation | A real disk that stays, snapshotted every minute and on stop |
| Fork | No fork; restore a saved snapshot or backup into a new sandbox | Fork with memory and running processes (private preview) | Fork a running sandbox (disk) without stopping it |
| Docker inside | docker:dind with iptables and IP forwarding turned off | Yes, with a Docker-in-sandbox image | Full Docker, root and systemd |
| Nested virtualization | Not documented | No: Firecracker guests do not get /dev/kvm | Yes, /dev/kvm (Android emulators, VMs) |
| Desktop and browser | Built-in desktop removed in SDK 0.10.2; bring your own | Desktop and browser with computer-use control | 60fps desktop and Chromium, computer-use API, embeddable stream |
| Inbound traffic | HTTP and WebSocket previews routed through your Worker; no raw TCP or public IP | Preview URL per port, public or token-protected; no raw TCP or public IP | HTTPS URLs for up to 50 ports, token-protected; raw TCP; own IPv6 or IPv4 |
| Outbound rules | allowedHosts deny-by-default list plus outbound handlers you write in Worker code | Domain allow and deny lists, method and path rules, static egress IPs | Open internet; filter inside the VM with nftables |
| Keeping keys out of the sandbox | Your outbound handler adds the token for any HTTP or HTTPS host; you write the code | Proxy fills secrets into outbound HTTPS requests (public preview) | Managed proxy for model providers and any HTTPS API you register; switch a credential to another account |
| Coding agents | Run Claude Code, Codex, OpenCode or Pi in your image; OpenCode has an SDK helper | Claude Code image you drive from its terminal or your own harness | Claude Code, Codex, OpenCode, pi and more built in, with a prompt, steer and events API |
| Sandboxes at once | Account cap of 1,500 vCPU running at once (can be raised) | 10, 50 or 200 on self-serve tiers, sleeping ones included | 100 to 2,000 at once depending on plan; starts per minute are limited |
| Regions | Several regions across Cloudflare's network, nearest free one picked | US (Oregon, North Virginia), London, Frankfurt | EU only: Germany, Finland, France |
Every feature Battleships tracks (43)
| Feature | Cloudflare Sandbox | Blaxel | boat |
|---|---|---|---|
| Full VM (own kernel) | Yes | Yes | Yes |
| Docker inside | Yes | Yes | Yes |
| Nested virtualization | No | No | Yes |
| Root | Yes | Yes | Yes |
| Systemd | Not published | No | Yes |
| Desktop GUI | No | Yes | Yes |
| Browser | No | Yes | Yes |
| Computer-use API | No | Yes | Yes |
| SSH | Yes | No | Yes |
| Persistent disk | No | Yes | Yes |
| Pause/resume | No | Yes | Yes |
| Automatic snapshots | No | Yes | Yes |
| Fork/clone | No | Yes | Yes |
| Live fork (no pause) | No | Yes | Yes |
| Memory fork | No | Yes | No |
| Custom image (Docker or snapshot) | Yes | Yes | Yes |
| ≥24 h sessions | Yes | Yes | Yes |
| Idle auto-stop | Yes | Yes | No |
| Wake on request | Yes | Yes | No |
| HTTPS preview URLs | Yes | Yes | Yes |
| Raw TCP inbound | No | No | Yes |
| Public IPv4 | No | No | No |
| Egress allowlist | Yes | Yes | No |
| Secret proxy | Yes | Yes | Yes |
| Secret proxy for any API | Yes | Yes | Yes |
| Preinstalled agents | Yes | Yes | Yes |
| Agent harness API | Yes | No | Yes |
| MCP server | No | Yes | No |
| GPU | No | No | No |
| Windows | No | No | No |
| Arm64 | No | No | No |
| Self-hosting | No | No | No |
| BYOC | No | Yes | No |
| Open source | Yes | No | No |
| Scoped API keys | Not published | Yes | Yes |
| Spend limits | No | No | Yes |
| Usage per sandbox (API) | Not published | Yes | Yes |
| Audit logs | Yes | Not published | No |
| SSO | Yes | Yes | No |
| SOC 2 | Yes | Yes | No |
| HIPAA | Yes | Yes | No |
| EU data residency | Yes | Yes | Yes |
| Zero data retention | Not published | Yes | Yes |
Performance
On the hpc-sandbox-benchmarks Node.js build-and-test loop at 4 vCPU and 8 GB, Blaxel did 19.48 runs per second and boat 26.69, so boat does about 1.4 times the work in the same time. Cloudflare has no result on that benchmark, so there is no comparable CPU number for it.
Node.js build-and-test loop at 4 vCPU / 8 GB, higher is better. Measured with the open hpc-sandbox-benchmarks suite. Blaxel measured on: Sandbox (active time, RAM-only pricing, CPU bundled). Cloudflare Sandbox has no published run in this suite yet, so there is no like-for-like number to compare.
Pricing in five scenarios
Each bill is priced from the providers' public price lists by the open Battleships engine, with the cheapest plan that runs the scenario.
| Scenario | Cloudflare Sandbox, a month | Blaxel, a month | boat, a month |
|---|---|---|---|
| One coding agent, workdays 4 vCPU / 8 GB, 50 GB disk, 8 hours a day, 22 days a month, files kept between days | $39 · Workers Paid · with limits | $33 · Pay-as-you-go Tier 1 | $20 · $20/mo |
| One agent that never stops 4 vCPU / 8 GB, 50 GB disk, running 24/7 all month | $148 · Workers Paid · with limits | $120 · Pay-as-you-go Tier 1 | $26 · $20/mo |
| 50 agents in parallel 50 machines of 4 vCPU / 8 GB at once, 8-hour sessions, 1,100 sessions a month, Docker inside | $1,660 · Workers Paid · with limits | $1,489 · Pay-as-you-go Tier 1 | $317 · $20/mo × 3 seats |
| Sandboxes for your users 2 vCPU / 4 GB, 30,000 sessions of 10 minutes a month, up to 300 at once | $476 · Workers Paid | $396 · Pay-as-you-go Tier 2 · with limits | $200 · $100/mo × 2 seats |
| 1,000 short jobs at once 2 vCPU / 4 GB, 1,000 at once, 3 minutes each, 200,000 jobs a month | $1,889 · Workers Paid · with limits | $876 · Pay-as-you-go Tier 2 · with limits | $2,000 · $2000/mo · with limits |
Cloudflare Sandbox: You need Workers Paid ($5 a month minimum). CPU is billed only while busy; memory and disk are billed on the instance size until the container sleeps, and 4 vCPU always comes with 12 GiB.
Blaxel: Blaxel charges for allocated RAM per second while a sandbox has an open connection, with CPU included. In standby you pay only snapshot storage, and volumes are billed on their full size.
Blaxel: Your plan payment (from $20 a month) is all usage credit, billed per second while a machine runs. A stopped sandbox costs nothing and keeps its disk.
Limits in those scenarios
Cloudflare's disk resets after sleep, so the scenarios that keep 50 GB of files between days do not fit without your own snapshot or backup code, and its 1,500 vCPU account cap is short of the 2,000 vCPU the 1,000-job burst needs. Blaxel's Tier 2 allows 200 sandboxes at once, sleeping ones included, so 300 user sandboxes and 1,000 jobs at once need a sales tier. boat fits every scenario but the burst, where it limits starts to 600 an hour on the $2,000 plan.
| Scenario | Cloudflare Sandbox | Blaxel | boat |
|---|---|---|---|
| One coding agent, workdays |
| None that bite | None that bite |
| One agent that never stops |
| None that bite | None that bite |
| 50 agents in parallel |
| None that bite | None that bite |
| Sandboxes for your users | None that bite |
| None that bite |
| 1,000 short jobs at once |
|
|
|
Which one should you use?
Use Cloudflare Sandbox when
your app already runs on Workers and you want many short sandboxes that sleep when idle, with egress rules written in your own code.
- Close to your Workers app. If your app already runs on Workers, sandboxes sit next to Durable Objects and R2, in several regions.
- Egress rules written as code. An outbound handler in your Worker can inspect and change every HTTP request a sandbox makes.
- Room for many at once. Concurrency is an account cap of 1,500 vCPU, not a sandbox count, so many small sandboxes fit.
Use Blaxel when
your sandboxes sit idle most of the time and must wake in milliseconds with their memory, or need a desktop for computer use.
- Wakes with its memory. Useful if sandboxes sit idle most of the time: they wake in under 25 ms with memory and processes intact.
- Desktop and browser included. Computer-use and browser agents get a desktop and browser without building one into your image.
- Forks and egress IPs. Blaxel can fork a sandbox with its memory and give it static egress IPs and domain rules.
Where boat fits
Cloudflare and Blaxel are both built around sandboxes that sleep most of the time. If your agents work for hours on builds, tests, Docker and emulators, boat gives each one a whole Linux machine with a real disk, a faster CPU and agents built in.
A disk that stays
Cloudflare starts from a fresh disk after sleep unless your code saves a snapshot, and Blaxel keeps files in memory, about half the RAM, unless you attach a volume at creation. boat saves a real disk every minute and on stop.
A whole Linux machine
Neither gives you /dev/kvm, so an Android emulator or a VM will not start. Cloudflare runs Docker with iptables off and Blaxel has no native SSH. boat has root, systemd, full Docker, SSH and raw TCP.
Agents driven from outside
On Cloudflare you bake each agent into your image and write the token handler yourself; on Blaxel you build the harness. boat ships Claude Code, Codex and others with one API to prompt, steer and read events.
Use boat when your agents do real work for hours: builds, tests, full Docker, emulators and a desktop, on a machine that keeps its disk and comes with agents built in. Compare it one to one: boat vs Cloudflare Sandbox and boat vs Blaxel.
Questions people ask
Is Cloudflare Sandbox cheaper than Blaxel?
In all five scenarios we priced, Blaxel's estimate is lower: $33 against $39 for one coding agent on workdays and $1,489 against $1,660 for 50 agents in parallel. Cloudflare bills CPU only while busy and Blaxel only while a connection is open, so spiky workloads can pay less than these numbers.
Which is faster?
Blaxel did 19.48 runs per second on the hpc-sandbox-benchmarks Node.js loop at 4 vCPU and 8 GB, and boat 26.69. Cloudflare has no result on that benchmark, so the two cannot be compared on CPU.
Which one keeps my files when the sandbox sleeps?
Blaxel keeps memory, processes and files in standby, though Tier 0 and 1 delete sandboxes after 7 or 30 days. Cloudflare starts from a fresh disk after sleep unless your code saved a snapshot or an R2 backup. boat keeps a real disk across stops.
Can Cloudflare Sandbox or Blaxel run Docker?
Both can. Cloudflare supports docker:dind with iptables and IP forwarding turned off, and Blaxel has a Docker-in-sandbox image. boat runs full Docker with root and systemd.
Can either run an Android emulator?
An Android emulator needs /dev/kvm. Blaxel's Firecracker guests do not get it, and Cloudflare does not document nested virtualization. boat exposes /dev/kvm inside every sandbox.
Where do they run?
Cloudflare places containers in several regions of its network, Blaxel runs in Oregon, North Virginia, London and Frankfurt, and boat runs only in the EU, in Germany, Finland and France.
Try boat
Install the CLI, then run boat new.
7-day free trial
More comparisons
- boat vs Cloudflare Sandbox
- boat vs Blaxel
- E2B vs Cloudflare Sandbox
- Daytona vs Cloudflare Sandbox
- Modal vs Cloudflare Sandbox
- Vercel Sandbox vs Cloudflare Sandbox
- Cloudflare Sandbox vs Runloop
- Cloudflare Sandbox vs Tensorlake
- Cloudflare Sandbox vs Morph Cloud
- Cloudflare Sandbox vs CodeSandbox SDK
- Cloudflare Sandbox vs Northflank
- Cloudflare Sandbox vs Fly.io Machines