Cloudflare Sandbox vs CodeSandbox SDK

Both run each sandbox in its own Firecracker microVM. A Cloudflare sandbox lives inside your Workers app and starts from a fresh disk after it sleeps, while a CodeSandbox SDK sandbox keeps its disk and hibernates with its memory, so it wakes with processes still running.

The companies and products

Cloudflare Sandbox

Cloudflare Sandbox SDK runs untrusted or AI-generated code in Linux containers on Cloudflare's network, driven from a Cloudflare Worker.

Each sandbox is a Cloudflare Container backed by a Durable Object, and each container runs in its own Firecracker microVM with its own kernel and network. You build a linux/amd64 image, pick an instance type of up to 4 vCPU and 12 GiB, and reach the sandbox through your own Worker. It suits teams already on Workers who want short-lived sandboxes that sleep when idle; for code that only calls known methods, Cloudflare also offers Dynamic Workers, which run JavaScript in V8 isolates.

Isolation: Firecracker microVM per container, own kernel and network
Largest instance: 4 vCPU, 12 GiB memory, 20 GB disk (defaults, can be raised)
Disk: Ephemeral by default: a container that sleeps starts again from a fresh disk
Plan needed: Workers Paid, $5 a month account minimum; not on the Free plan
Account limits: 1,500 vCPU, 6 TiB memory and 30 TB disk running at once
Placement: Instances spread across several regions of Cloudflare's network, nearest free one picked
Compliance: Cloudflare holds a SOC 2 Type II report

CodeSandbox SDK

CodeSandbox SDK is an API from CodeSandbox, now a Together AI company, that starts sandboxed development VMs on the same infrastructure as the CodeSandbox editor.

Each sandbox is a Firecracker microVM built from a template or any Dockerfile. When it goes idle it hibernates with a memory snapshot, and it resumes or forks from that snapshot in seconds. You drive it from a TypeScript SDK through terminals, commands, files and HTTPS hosts. Together's docs now call it the legacy offering and point new users to its successor, the together-sandbox SDK.

Isolation: Firecracker microVM per sandbox
Status: Together's docs call it the deprecated code sandbox SDK; together-sandbox is the successor. Self-serve sign-up still runs through CodeSandbox
Machine size: 2 to 16 cores self-serve (up to 32 GB RAM on Scale); up to 64 cores and 128 GB on Enterprise
Regions: A country hint steers scheduling, for example to a cluster in Europe, but placement is not guaranteed
Self-hosting: Not offered
Compliance: SOC 2 Type II listed on the Enterprise plan

Which use cases each one fits

For each use case, Battleships prices every sandbox provider on the same workload and sorts them from the cheapest monthly bill up. “13th cheapest of 345” means 12 of the other 344 providers run that workload, with every feature it needs, for less. “With limits” means the provider runs it but misses something, so it is listed after every full match. Open a use case for its whole ranking and what each provider misses.

Use case and its workload	Cloudflare Sandbox: price rank	CodeSandbox SDK: price rank	boat: price rank
Software factory 100 at once · 4 vCPU / 8 GB · 2,200 sessions of 8 h a month A long build session needs its files to stay; CodeSandbox SDK keeps its disk, Cloudflare starts fresh after sleep, and boat keeps the disk and adds /dev/kvm and coding agents.	162nd of 367, with limits $1,543 a month	178th of 367, with limits $1,939 a month	3rd cheapest of 367 $634 a month
Always-on AI employees 50 machines 24/7 · 2 vCPU / 4 GB	207th of 366, with limits $2,188 a month	215th of 366, with limits $2,478 a month	5th cheapest of 366 $657 a month
Code interpreter bursts 100 at once · 1 vCPU / 2 GB · 200,000 sessions of 1 min a month Both fit short code-interpreter calls; Cloudflare bills CPU only while busy and wakes on the next request, CodeSandbox SDK wakes a hibernated VM with its memory.	13th cheapest of 345 $144 a month	46th cheapest of 345 $642 a month	186th of 345, with limits $2,000 a month
Sandboxes for your users 300 at once · 2 vCPU / 4 GB · 30,000 sessions of 23 min a month Cloudflare fits sandboxes for your users at 300 at once; CodeSandbox SDK's Scale plan stops at 250 VMs at once, and boat fits with SSH, raw TCP and a desktop too.	9th cheapest of 361 $731 a month	140th of 361, with limits $1,707 a month	Cheapest of 361 $209 a month
RL rollouts 1,000 at once · 2 vCPU / 4 GB · 1,000,000 sessions of 3 min a month CodeSandbox SDK's memory forks let many rollouts branch from one warm state; Cloudflare has no fork, only restoring a saved snapshot.	144th of 360, with limits $9,428 a month	348th of 360, with limits $3,861 a month	34th of 360, with limits $2,000 a month
Agent evals 250 at once · 4 vCPU / 8 GB · 15,000 sessions of 20 min a month	45th cheapest of 364 $818 a month	64th cheapest of 364 $1,335 a month	10th cheapest of 364 $200 a month
CI runners 40 at once · 8 vCPU / 16 GB · 6,000 sessions of 12 min a month CodeSandbox SDK runs Docker with root on a disk that stays; Cloudflare runs docker:dind with iptables turned off and 20 GB of disk by default.	301st of 377, with limits $704 a month	92nd cheapest of 377 $860 a month	4th cheapest of 377 $86 a month
24/7 dev boxes 1 machine 24/7 · 4 vCPU / 8 GB	70th cheapest of 368 $93 a month	310th of 368, with limits $240 a month	18th cheapest of 368 $26 a month
Computer-use agents 50 at once · 4 vCPU / 8 GB · 20,000 sessions of 15 min a month Neither ships a desktop: Cloudflare removed its built-in one and CodeSandbox SDK has a headless Chromium template, while boat streams a 60fps desktop.	166th of 369, with limits $460 a month	206th of 369, with limits $691 a month	6th cheapest of 369 $200 a month
Browser-use agents 50 at once · 2 vCPU / 4 GB · 30,000 sessions of 10 min a month	210th of 367, with limits $233 a month	251st of 367, with limits $443 a month	7th cheapest of 367 $200 a month
Scraping & bots (startup scale) 50 at once · 1 vCPU / 2 GB · 100,000 sessions of 3 min a month	250th of 346, with limits $286 a month	281st of 346, with limits $508 a month	6th cheapest of 346 $90 a month
Mass scraping & bots (undetectable) 1,000 at once · 1 vCPU / 2 GB · 3,000,000 sessions of 2 min a month	169th of 338, with limits $5,741 a month	193rd of 338, with limits $7,390 a month	71st of 338, with limits $1,800 a month
Parallel red teaming 200 at once · 2 vCPU / 4 GB · 5,000 sessions of 30 min a month Red-team runs often need raw TCP, full root networking and nested VMs; neither Cloudflare nor CodeSandbox SDK takes raw TCP from outside, and boat has all three.	239th of 360, with limits $325 a month	240th of 360, with limits $326 a month	2nd cheapest of 360 $200 a month
GPU eval jobs 10 at once · 8 vCPU / 32 GB · 500 sessions of 30 min a month	Can't run it	Can't run it	Can't run it
macOS agents 5 at once · 4 vCPU / 8 GB · 1,000 sessions of 20 min a month	Can't run it	Can't run it	Can't run it

Key features

Feature	Cloudflare Sandbox	CodeSandbox SDK	boat
Isolation	Firecracker microVM per container, own kernel and network	Firecracker microVM per sandbox, own kernel	Full VM with its own kernel on dedicated AMD Ryzen 9 9950X hosts
Biggest machine	4 vCPU / 12 GiB / 20 GB disk by default (can be raised)	Up to 16 cores / 32 GB on Scale, 64 cores / 128 GB on Enterprise	Up to 16 vCPU / 32 GB on the $100 plan and above
Files between sessions	Fresh disk after sleep; snapshots (public beta, 30 days) or R2 backups when your code saves them	Disk kept; hibernates with a memory snapshot	Disk kept; saved every minute and on stop; a stopped sandbox costs nothing
Pause and resume	No paused state; a stop wipes disk and processes	Resumes from a memory snapshot with processes still running	Resume boots the machine again with its disk in place
Fork	No fork; restore a saved snapshot or backup into a new sandbox	Fork a hibernated sandbox, or a running one sharing its memory	Fork a running sandbox with its disk, without stopping it
Wake on request	Yes; stops after inactivity and wakes on the next request	Yes; an HTTP request to a host wakes a hibernated VM	No; a stopped sandbox is started by API
Docker inside	docker:dind with iptables and IP forwarding turned off	Docker and root; built from any Dockerfile	Full Docker, root and systemd
Nested virtualization	Not documented	Not documented	Yes, /dev/kvm for Android emulators and VMs
Inbound traffic	HTTP and WebSocket previews routed through your Worker; no raw TCP or public IP	HTTPS host per port, public by default, signed tokens for private hosts; no raw TCP or public IP	HTTPS URLs for up to 50 ports, token-protected; raw TCP; own IPv6 or IPv4
Egress control	allowedHosts deny-by-default list plus outbound handlers in Worker code	No provider-side allowlist	No provider-side allowlist
Keeping keys out of the sandbox	Your outbound handler adds the token for any HTTP or HTTPS host; you write the code	Secrets passed in as environment variables	Managed proxy for model providers and any HTTPS API; switch a credential to another account
Desktop and browser	Built-in desktop removed in SDK 0.10.2; bring your own	No desktop; a headless Chromium template	60fps desktop and Chromium, computer-use API, embeddable stream
Coding agents	Run Claude Code, Codex, OpenCode or Pi in your image; OpenCode has an SDK helper	Run your own agent through the command API	Claude Code, Codex and others preinstalled, with a prompt, steer and events API
Regions	Several regions across Cloudflare's network, nearest free one picked	A country hint steers scheduling; placement not guaranteed	EU only: Germany, Finland, France

Every feature Battleships tracks (43)

Feature	Cloudflare Sandbox	CodeSandbox SDK	boat
Full VM (own kernel)	Yes	Yes	Yes
Docker inside	Yes	Yes	Yes
Nested virtualization	No	No	Yes
Root	Yes	Yes	Yes
Systemd	Not published	Not published	Yes
Desktop GUI	No	No	Yes
Browser	No	No	Yes
Computer-use API	No	No	Yes
SSH	Yes	No	Yes
Persistent disk	No	Yes	Yes
Pause/resume	No	Yes	Yes
Automatic snapshots	No	Yes	Yes
Fork/clone	No	Yes	Yes
Live fork (no pause)	No	Yes	Yes
Memory fork	No	Yes	No
Custom image (Docker or snapshot)	Yes	Yes	Yes
≥24 h sessions	Yes	Yes	Yes
Idle auto-stop	Yes	Yes	No
Wake on request	Yes	Yes	No
HTTPS preview URLs	Yes	Yes	Yes
Raw TCP inbound	No	No	Yes
Public IPv4	No	No	No
Egress allowlist	Yes	No	No
Secret proxy	Yes	No	Yes
Secret proxy for any API	Yes	No	Yes
Preinstalled agents	Yes	No	Yes
Agent harness API	Yes	No	Yes
MCP server	No	No	No
GPU	No	No	No
Windows	No	No	No
Arm64	No	No	No
Self-hosting	No	No	No
BYOC	No	No	No
Open source	Yes	No	No
Scoped API keys	Not published	Not published	Yes
Spend limits	No	Not published	Yes
Usage per sandbox (API)	Not published	No	Yes
Audit logs	Yes	Not published	No
SSO	Yes	Yes	No
SOC 2	Yes	Yes	No
HIPAA	Yes	No	No
EU data residency	Yes	No	Yes
Zero data retention	Not published	Not published	Yes

Performance

Cloudflare SandboxNot measured

CodeSandbox SDKNot measured

boat26.69 runs/s

Neither Cloudflare Sandbox nor CodeSandbox SDK has a result on the StarSling hpc-sandbox-benchmarks Node.js loop, so there is no comparable CPU number between them. boat did 26.69 runs per second on that loop at 4 vCPU / 8 GB, on dedicated AMD Ryzen 9 9950X hosts.

Node.js build-and-test loop at 4 vCPU / 8 GB, higher is better. Measured with the open hpc-sandbox-benchmarks suite. Cloudflare Sandbox and CodeSandbox SDK have no published run in this suite yet, so there is no like-for-like number to compare.

Pricing in five scenarios

Each bill is priced from the providers' public price lists by the open Battleships engine, with the cheapest plan that runs the scenario.

Scenario	Cloudflare Sandbox, a month	CodeSandbox SDK, a month	boat, a month
One coding agent, workdays 4 vCPU / 8 GB, 50 GB disk, 8 hours a day, 22 days a month, files kept between days	$39 · Workers Paid · with limits	$193 · Scale	$20 · $20/mo
One agent that never stops 4 vCPU / 8 GB, 50 GB disk, running 24/7 all month	$148 · Workers Paid · with limits	$341 · Scale	$26 · $20/mo
50 agents in parallel 50 machines of 4 vCPU / 8 GB at once, 8-hour sessions, 1,100 sessions a month, Docker inside	$1,660 · Workers Paid · with limits	$2,500 · Scale	$317 · $20/mo × 3 seats
Sandboxes for your users 2 vCPU / 4 GB, 30,000 sessions of 10 minutes a month, up to 300 at once	$476 · Workers Paid	$815 · Scale · with limits	$200 · $100/mo × 2 seats
1,000 short jobs at once 2 vCPU / 4 GB, 1,000 at once, 3 minutes each, 200,000 jobs a month	$1,889 · Workers Paid · with limits	$1,632 · Scale · with limits	$2,000 · $2000/mo · with limits

Cloudflare Sandbox: You need Workers Paid ($5 a month minimum). CPU is billed only while busy, memory and disk on the instance size until the container sleeps, and 4 vCPU always comes with 12 GiB; Durable Object and Worker requests are billed on top.

CodeSandbox SDK: You buy VM credits that each size burns per hour, billed per started minute while the VM runs, including idle time before it hibernates. Scale adds a $170 monthly platform fee that is not usage credit, and a hibernated VM costs nothing.

CodeSandbox SDK: Plans start at $20 a month, all of it usage credit, billed per second while a sandbox runs. A stopped sandbox costs nothing and keeps its disk.

Limits in those scenarios

Cloudflare's disk resets after sleep and tops out at 20 GB by default, so the three scenarios that keep files between sessions do not fit without your own snapshot or backup code. CodeSandbox SDK's Scale plan caps at 250 VMs at once, so it misses the 300-at-once user sandboxes, and its price for egress and extra disk is not published. For 1,000 short jobs at once nothing fits: Cloudflare's account limit is 1,500 vCPU running at once against the 2,000 needed, CodeSandbox SDK stops at 250, and boat's $2,000 plan queues starts above 90 a minute.

Scenario	Cloudflare Sandbox	CodeSandbox SDK	boat
One coding agent, workdays	missing persistent disk	disk beyond 20 GiB: price unknown egress price not published	None that bite
One agent that never stops	missing persistent disk	disk beyond 20 GiB: price unknown egress price not published	None that bite
50 agents in parallel	missing persistent disk	egress price not published	None that bite
Sandboxes for your users	None that bite	Scale: max 250 concurrent egress price not published	None that bite
1,000 short jobs at once	Workers Paid: max 1,500 vCPU running at once (needs 2,000)	Scale: max 250 concurrent egress price not published	max 2,400 starts/day (needs ~6,667) max 600 starts/hour (needs ~1,000) bursts above 90 starts/min are queued (a burst of 333 takes ~4 min to start)

Which one should you use?

Use Cloudflare Sandbox when

your app already runs on Workers, your sessions are short and spiky, and you want to program exactly which hosts a sandbox can reach.

Egress rules you can program. For teams that must control traffic: block every host except the ones you list, and run your own code on each outbound request.
Native to Workers. If your app already runs on Workers, sandboxes sit next to Durable Objects and R2, in several regions of Cloudflare's network.
Billing for spiky sessions. CPU is billed only while busy, and a sandbox sleeps when idle and wakes on the next request.

Use CodeSandbox SDK when

sandboxes sleep between visits and should wake with their memory and files intact, or fork from a warm state, and you are fine building on what Together now calls its legacy SDK.

Hibernation with memory. For sandboxes used in bursts: an idle VM hibernates for free and wakes with its memory and running processes.
Forks from a warm state. Good for branching many runs, such as rollouts or test variants, from one running state instead of booting again.
Bigger machines and a disk that stays. Sizes reach 16 cores and 32 GB on Scale, and files stay on the disk between sessions.

Where boat fits

If your agents do hours of real work, both options leave gaps: Cloudflare forgets the disk when a container sleeps, and CodeSandbox SDK keeps it but gives no SSH, no desktop and no raw TCP. boat gives each agent a full VM that keeps its files, with Docker, /dev/kvm, a desktop and coding agents already installed.

A full machine with its own kernel

Emulator builds and VM tests need /dev/kvm, which neither documents. Cloudflare runs Docker with iptables off, and CodeSandbox SDK has no SSH, so every tool goes through an SDK call. boat has root, systemd, full Docker and /dev/kvm.

A desktop and agents built in

Neither ships a desktop: Cloudflare removed its one and CodeSandbox SDK has headless Chromium only. You bake agents into an image and write the harness yourself. boat streams a 60fps desktop and drives Claude Code or Codex inside from outside.

Hosting beyond HTTP, keys kept outside

Neither takes raw TCP or gives a public IP, so a database or game server an agent starts cannot be reached. Cloudflare needs your own outbound handler code for keys, and CodeSandbox SDK passes them in as environment variables.

Use boat when your agents do real work for hours: builds, full Docker, emulators, a desktop and servers others can reach, on a full machine that keeps its files between sessions. Compare it one to one: boat vs Cloudflare Sandbox and boat vs CodeSandbox SDK.

Questions people ask

Is Cloudflare Sandbox cheaper than CodeSandbox SDK?

On the estimates here Cloudflare comes out lower in four of five scenarios, such as $476 against $815 a month for sandboxes for your users. But Cloudflare does not fit the three scenarios that keep files between sessions, and for 1,000 short jobs at once CodeSandbox SDK's $1,632 a month is below Cloudflare's $1,889, though neither fits. boat is lower than both in four of the five.

Which is faster?

There is no comparable CPU measurement for either Cloudflare Sandbox or CodeSandbox SDK. boat scored 26.69 runs per second on the StarSling hpc-sandbox-benchmarks Node.js loop at 4 vCPU / 8 GB.

Which one keeps my files?

CodeSandbox SDK keeps the disk and hibernates with memory, so a sandbox wakes with its processes running. Cloudflare starts from a fresh disk after sleep unless your code saved a snapshot (public beta, kept 30 days) or an R2 backup. boat keeps the disk and saves it every minute.

Can Cloudflare Sandbox and CodeSandbox SDK run Docker?

Both can. Cloudflare supports docker:dind with iptables and IP forwarding turned off, and CodeSandbox SDK runs Docker with root on VMs built from any Dockerfile. boat runs full Docker with systemd and also exposes /dev/kvm.

Is CodeSandbox SDK still maintained?

CodeSandbox is now part of Together AI. Together's docs call the CodeSandbox-based SDK deprecated and name together-sandbox as its successor, while self-serve sign-up still runs through CodeSandbox.

Can I limit where a sandbox connects to?

On Cloudflare, yes: allowedHosts blocks every host not on your list, and outbound handlers can inspect and change each HTTP request. CodeSandbox SDK and boat do not offer a provider-side egress allowlist.

Try boat

Install the CLI, then run boat new.

7-day free trial