Cloudflare Sandbox vs Deno Sandbox

Both run code in its own Firecracker microVM. Cloudflare Sandbox gives you up to 4 vCPU with no fixed time limit, driven from a Worker and asleep when idle, while Deno Sandbox gives you 2 vCPU that starts in under 200 ms, locks down outbound traffic and lives up to 30 minutes.

The companies and products

Cloudflare Sandbox

Cloudflare Sandbox SDK runs untrusted or AI-generated code in Linux containers on Cloudflare's network, driven from a Cloudflare Worker.

Each sandbox is a Cloudflare Container backed by a Durable Object, and each container runs in its own Firecracker microVM with its own kernel and network. You build a linux/amd64 image, pick an instance type of up to 4 vCPU and 12 GiB, and reach the sandbox through your own Worker. It suits teams already on Workers who want short-lived sandboxes that sleep when idle; for code that only calls known methods, Cloudflare also offers Dynamic Workers, which run JavaScript in V8 isolates.

Isolation: Firecracker microVM per container, own kernel and network
Largest instance: 4 vCPU, 12 GiB memory, 20 GB disk (defaults, can be raised)
Disk: Ephemeral by default: a container that sleeps starts again from a fresh disk
Plan needed: Workers Paid, $5 a month account minimum; not on the Free plan
Account limits: 1,500 vCPU, 6 TiB memory and 30 TB disk running at once
Placement: Instances spread across several regions of Cloudflare's network, nearest free one picked
Compliance: Cloudflare holds a SOC 2 Type II report

Deno Sandbox

Deno Sandbox is part of Deno Deploy, the hosting platform from the company behind the Deno runtime, and runs untrusted or AI-generated code in Linux microVMs.

Each sandbox is a Firecracker microVM with 2 vCPU, up to 4 GB of memory and a 10 GB disk that is wiped when it ends, created from a TypeScript or Python SDK. Outbound traffic goes through a proxy that can enforce a host allowlist and swap placeholder secrets for real ones. It is built for short runs of agent or user code, and a sandbox can be promoted to a Deno Deploy app.

Isolation: Firecracker microVM per sandbox
Machine size: 2 vCPU, 768 MB to 4 GB memory, 10 GB ephemeral disk
Lifetime: Bound to a session, up to 30 minutes
Regions: Amsterdam and Chicago; volumes only in Chicago
Plans: Sandboxes on Pro and Builder; 3 or 20 at once per region
Compliance: Deno Deploy states SOC2 and ISO27001; HIPAA BAA for enterprise contracts

Which use cases each one fits

For each use case, Battleships prices every sandbox provider on the same workload and sorts them from the cheapest monthly bill up. “13th cheapest of 345” means 12 of the other 344 providers run that workload, with every feature it needs, for less. “With limits” means the provider runs it but misses something, so it is listed after every full match. Open a use case for its whole ranking and what each provider misses.

Use case and its workload	Cloudflare Sandbox: price rank	Deno Sandbox: price rank	boat: price rank
Software factory 100 at once · 4 vCPU / 8 GB · 2,200 sessions of 8 h a month A software factory runs builds and Docker for hours; Deno stops at 30 minutes and 2 vCPU, Cloudflare wipes the disk on sleep, and boat keeps a full VM and its disk.	162nd of 367, with limits $1,543 a month	290th of 367, with limits $5,665 a month	3rd cheapest of 367 $634 a month
Always-on AI employees 50 machines 24/7 · 2 vCPU / 4 GB	207th of 366, with limits $2,188 a month	287th of 366, with limits $5,803 a month	5th cheapest of 366 $657 a month
Code interpreter bursts 100 at once · 1 vCPU / 2 GB · 200,000 sessions of 1 min a month Short code-interpreter calls suit both, since both bill CPU only while it is busy; Cloudflare fits fully here, and Deno starts in under 200 ms but is a compromise in this table.	13th cheapest of 345 $144 a month	141st of 345, with limits $329 a month	186th of 345, with limits $2,000 a month
Sandboxes for your users 300 at once · 2 vCPU / 4 GB · 30,000 sessions of 23 min a month Cloudflare fits sandboxes for your users, with egress rules you write as Worker code; Deno Builder allows 20 sandboxes at once per region, and boat ranks first here with per-sandbox spend limits.	9th cheapest of 361 $731 a month	148th of 361, with limits $1,863 a month	Cheapest of 361 $209 a month
RL rollouts 1,000 at once · 2 vCPU / 4 GB · 1,000,000 sessions of 3 min a month RL rollouts are a compromise on both; Deno edges Cloudflare in this table, and boat ranks higher than either.	144th of 360, with limits $9,428 a month	122nd of 360, with limits $7,963 a month	34th of 360, with limits $2,000 a month
Agent evals 250 at once · 4 vCPU / 8 GB · 15,000 sessions of 20 min a month Cloudflare fits agent evals fully, while Deno's 30-minute lifetime and 20 sandboxes at once per region on Builder make it a compromise.	45th cheapest of 364 $818 a month	296th of 364, with limits $1,563 a month	10th cheapest of 364 $200 a month
CI runners 40 at once · 8 vCPU / 16 GB · 6,000 sessions of 12 min a month CI jobs that build Docker images need room and full Docker; Cloudflare caps disk at 20 GB and runs Docker with iptables off, and Deno does not document Docker at all.	301st of 377, with limits $704 a month	304th of 377, with limits $731 a month	4th cheapest of 377 $86 a month
24/7 dev boxes 1 machine 24/7 · 4 vCPU / 8 GB A dev box needs its files after you log off; Cloudflare starts from a fresh disk after sleep, Deno wipes the root disk after 30 minutes, and boat stops at no cost with its disk kept.	70th cheapest of 368 $93 a month	179th of 368, with limits $200 a month	18th cheapest of 368 $26 a month
Computer-use agents 50 at once · 4 vCPU / 8 GB · 20,000 sessions of 15 min a month Neither has a desktop: Cloudflare removed its built-in one and Deno never had one, while boat ships a 60fps desktop with Chromium and a computer-use API.	166th of 369, with limits $460 a month	280th of 369, with limits $1,583 a month	6th cheapest of 369 $200 a month
Browser-use agents 50 at once · 2 vCPU / 4 GB · 30,000 sessions of 10 min a month	210th of 367, with limits $233 a month	284th of 367, with limits $783 a month	7th cheapest of 367 $200 a month
Scraping & bots (startup scale) 50 at once · 1 vCPU / 2 GB · 100,000 sessions of 3 min a month	250th of 346, with limits $286 a month	286th of 346, with limits $573 a month	6th cheapest of 346 $90 a month
Mass scraping & bots (undetectable) 1,000 at once · 1 vCPU / 2 GB · 3,000,000 sessions of 2 min a month	169th of 338, with limits $5,741 a month	247th of 338, with limits $11,923 a month	71st of 338, with limits $1,800 a month
Parallel red teaming 200 at once · 2 vCPU / 4 GB · 5,000 sessions of 30 min a month	239th of 360, with limits $325 a month	251st of 360, with limits $367 a month	2nd cheapest of 360 $200 a month
GPU eval jobs 10 at once · 8 vCPU / 32 GB · 500 sessions of 30 min a month	Can't run it	Can't run it	Can't run it
macOS agents 5 at once · 4 vCPU / 8 GB · 1,000 sessions of 20 min a month	Can't run it	Can't run it	Can't run it

Key features

Feature	Cloudflare Sandbox	Deno Sandbox	boat
Isolation	Firecracker microVM per container, own kernel and network	Firecracker microVM per sandbox, own kernel	Full VM with its own kernel on dedicated AMD Ryzen 9 9950X hosts
Largest machine	4 vCPU / 12 GiB / 20 GB disk by default (can be raised)	2 vCPU fixed, 768 MB to 4 GB memory, 10 GB disk	4 vCPU / 8 GB by default, up to 16 vCPU / 32 GB on the $100 plan and above
Session length	No fixed maximum; stops after an inactivity timeout you set	Up to 30 minutes; longer work can be promoted to a Deno Deploy app	No cap on paid plans; you set the time to live
Files between sessions	Disk is fresh after sleep; snapshots (public beta, 30 days) or R2 backups when your code saves them	Root disk wiped when the sandbox ends; opt-in volumes of 300 MB to 20 GB, Chicago only	Whole disk kept, saved every minute and on stop; a stopped sandbox costs nothing
Fork a running sandbox	No; restore a saved snapshot or backup into a new sandbox	No; boot many new sandboxes from a read-only volume snapshot	Yes, with its disk, without stopping it
Docker inside	docker:dind with iptables and IP forwarding turned off	Root access; Docker not documented	Full Docker, root and systemd
Nested virtualization	Not documented	Not documented	Yes, /dev/kvm for Android emulators and VMs
Desktop and browser	Built-in desktop removed in SDK 0.10.2; bring your own	No desktop; a VS Code editor in the browser and SSH	60fps Linux desktop with Chromium, computer-use API, embeddable stream
Inbound traffic	HTTP and WebSocket previews routed through your Worker; no raw TCP or public IP	HTTPS URL per exposed port, public without authentication; SSH	HTTPS URLs for up to 50 ports, token-protected by default; raw TCP
Outbound rules	allowedHosts deny-by-default list plus outbound handlers you write in Worker code	Host allowlist per sandbox (allowNet), enforced by a proxy outside the VM	Open internet, no provider-side allowlist
Keeping API keys out of the sandbox	Your outbound handler adds the token for any HTTP or HTTPS host; you write the code	Placeholder secrets swapped for real ones on requests to approved hosts	Managed proxy for model providers and any HTTPS API; switch a credential to another account when credits run out
Coding agents	Run Claude Code, Codex, OpenCode or Pi in your image; OpenCode has an SDK helper	A root image with Claude Code, run through the shell command API	Claude Code, Codex and five more preinstalled, with a prompt, steer and events API
Start and idle	Sleeps after inactivity and wakes on the next request	Starts in under 200 ms; no sleep and wake	Boots a full VM; TTL based stop (1 h default, changeable)
Regions	Several regions across Cloudflare's network	Amsterdam and Chicago	EU only: Germany, Finland, France

Every feature Battleships tracks (43)

Feature	Cloudflare Sandbox	Deno Sandbox	boat
Full VM (own kernel)	Yes	Yes	Yes
Docker inside	Yes	Not published	Yes
Nested virtualization	No	No	Yes
Root	Yes	Yes	Yes
Systemd	Not published	Not published	Yes
Desktop GUI	No	No	Yes
Browser	No	No	Yes
Computer-use API	No	No	Yes
SSH	Yes	Yes	Yes
Persistent disk	No	Yes	Yes
Pause/resume	No	No	Yes
Automatic snapshots	No	No	Yes
Fork/clone	No	No	Yes
Live fork (no pause)	No	No	Yes
Memory fork	No	No	No
Custom image (Docker or snapshot)	Yes	Yes	Yes
≥24 h sessions	Yes	No	Yes
Idle auto-stop	Yes	No	No
Wake on request	Yes	No	No
HTTPS preview URLs	Yes	Yes	Yes
Raw TCP inbound	No	No	Yes
Public IPv4	No	No	No
Egress allowlist	Yes	Yes	No
Secret proxy	Yes	Yes	Yes
Secret proxy for any API	Yes	Yes	Yes
Preinstalled agents	Yes	Yes	Yes
Agent harness API	Yes	No	Yes
MCP server	No	No	No
GPU	No	No	No
Windows	No	No	No
Arm64	No	No	No
Self-hosting	No	No	No
BYOC	No	No	No
Open source	Yes	No	No
Scoped API keys	Not published	Not published	Yes
Spend limits	No	Yes	Yes
Usage per sandbox (API)	Not published	No	Yes
Audit logs	Yes	Not published	No
SSO	Yes	No	No
SOC 2	Yes	Yes	No
HIPAA	Yes	Yes	No
EU data residency	Yes	Yes	Yes
Zero data retention	Not published	Not published	Yes

Performance

Cloudflare SandboxNot measured

Deno SandboxNot measured

boat26.69 runs/s

There is no comparable CPU measurement between these two. boat did 26.69 runs per second on the StarSling hpc-sandbox-benchmarks Node.js build-and-test loop at 4 vCPU / 8 GB, but neither Cloudflare Sandbox nor Deno Sandbox has a result on that benchmark, and Deno's fixed 2 vCPU shape could not run the 4 vCPU test as set up.

Node.js build-and-test loop at 4 vCPU / 8 GB, higher is better. Measured with the open hpc-sandbox-benchmarks suite. Cloudflare Sandbox and Deno Sandbox have no published run in this suite yet, so there is no like-for-like number to compare.

Pricing in five scenarios

Each bill is priced from the providers' public price lists by the open Battleships engine, with the cheapest plan that runs the scenario.

Scenario	Cloudflare Sandbox, a month	Deno Sandbox, a month	boat, a month
One coding agent, workdays 4 vCPU / 8 GB, 50 GB disk, 8 hours a day, 22 days a month, files kept between days	$39 · Workers Paid · with limits	$53 · Pro · with limits	$20 · $20/mo
One agent that never stops 4 vCPU / 8 GB, 50 GB disk, running 24/7 all month	$148 · Workers Paid · with limits	$200 · Builder · with limits	$26 · $20/mo
50 agents in parallel 50 machines of 4 vCPU / 8 GB at once, 8-hour sessions, 1,100 sessions a month, Docker inside	$1,660 · Workers Paid · with limits	$2,779 · Builder · with limits	$317 · $20/mo × 3 seats
Sandboxes for your users 2 vCPU / 4 GB, 30,000 sessions of 10 minutes a month, up to 300 at once	$476 · Workers Paid	$783 · Builder · with limits	$200 · $100/mo × 2 seats
1,000 short jobs at once 2 vCPU / 4 GB, 1,000 at once, 3 minutes each, 200,000 jobs a month	$1,889 · Workers Paid · with limits	$1,563 · Builder · with limits	$2,000 · $2000/mo · with limits

Cloudflare Sandbox: You need Workers Paid ($5 a month minimum). CPU is billed only while it is in use; memory and disk are billed on the instance size you picked until the container sleeps, and 4 vCPU always comes with 12 GiB.

Deno Sandbox: Sandboxes need Pro at $20 a month or Builder at $200 a month, which include CPU, memory and egress allowances shared with Deno Deploy apps. Past those, active CPU costs $0.10 an hour and memory $0.025 per GiB-hour for the whole life of the sandbox.

Deno Sandbox: Plans start at $20 a month, and the whole fee is usage credit. You pay per second while a sandbox runs, and a stopped sandbox costs nothing and keeps its disk.

Limits in those scenarios

Cloudflare fits only the sandboxes-for-your-users scenario; elsewhere its disk resets after sleep, and the 1,000-job burst needs 2,000 vCPU against a default account limit of 1,500. Deno fits none of the five: a sandbox lives up to 30 minutes at 2 vCPU and 4 GB, and Builder allows 20 at once per region. boat fits four of the five; at 1,000 short jobs at once its top plan queues starts above 90 a minute.

Scenario	Cloudflare Sandbox	Deno Sandbox	boat
One coding agent, workdays	missing persistent disk	Pro: sessions capped at 0.5 h capped at 2 vCPU / 4 GiB largest size is 2 vCPU / 4 GiB disk beyond 10 GiB: price unknown	None that bite
One agent that never stops	missing persistent disk	Builder: sessions capped at 0.5 h capped at 2 vCPU / 4 GiB largest size is 2 vCPU / 4 GiB disk beyond 10 GiB: price unknown	None that bite
50 agents in parallel	missing persistent disk	Builder: max 20 concurrent Builder: sessions capped at 0.5 h capped at 2 vCPU / 4 GiB largest size is 2 vCPU / 4 GiB	None that bite
Sandboxes for your users	None that bite	Builder: max 20 concurrent	None that bite
1,000 short jobs at once	Workers Paid: max 1,500 vCPU running at once (needs 2,000)	Builder: max 20 concurrent	max 2,400 starts/day (needs ~6,667) max 600 starts/hour (needs ~1,000) bursts above 90 starts/min are queued (a burst of 333 takes ~4 min to start)

Which one should you use?

Use Cloudflare Sandbox when

your app already runs on Workers and you want sandboxes of up to 4 vCPU that sleep when idle, wake on the next request and have no fixed time limit.

No 30-minute cap and a bigger box. For work that runs longer: no fixed time limit, and up to 4 vCPU and 12 GiB against Deno's 2 vCPU and 4 GB.
Sleeps when idle, wakes on request. Useful for many spiky sessions: a sandbox sleeps after a quiet spell, wakes on the next request, and bills CPU only while busy.
Built into the Workers platform. If your app already runs on Workers, sandboxes sit next to Durable Objects and R2, in several regions, with egress rules written as code.

Use Deno Sandbox when

you run short pieces of untrusted code that must start in milliseconds and reach only the hosts you allow, especially if you deploy on Deno Deploy or need Chicago.

Starts in under 200 ms. Good for one sandbox per request: Deno says a sandbox starts in under 200 ms, and CPU bills only while code runs.
Locked-down outbound traffic, no code to write. Pass a list of allowed hosts and a proxy outside the VM blocks the rest and swaps placeholder secrets for real ones.
A path to Deno Deploy. Fits teams on Deno Deploy: a sandbox can be promoted to a Deploy app, running in Chicago or Amsterdam.

Where boat fits

Both Cloudflare Sandbox and Deno Sandbox are built for short runs that start clean. If your agents work for hours, build Docker images, need a desktop or must find their files again tomorrow, look at boat: a full VM that keeps its disk, with coding agents you drive from outside.

A machine that keeps its files

Cloudflare starts from a fresh disk after sleep unless your code saves a beta snapshot, kept 30 days. Deno stops at 30 minutes and wipes the root disk, with volumes only in Chicago. boat saves the whole disk every minute and on stop.

Room for real builds

Cloudflare tops out at 4 vCPU and 20 GB of disk with Docker's iptables off; Deno is fixed at 2 vCPU and 4 GB with no documented Docker. boat goes to 16 vCPU / 32 GB with full Docker, systemd and /dev/kvm.

Agents and a desktop ready to drive

On Cloudflare you bake agents into your image and build your own desktop; on Deno you run Claude Code through shell commands with no desktop. boat ships seven agents, a prompt and steer API and a 60fps desktop.

Use boat when your agents do real work for hours: builds, tests, full Docker, emulators and a desktop, on a bigger machine whose disk is still there tomorrow. Compare it one to one: boat vs Cloudflare Sandbox and boat vs Deno Sandbox.

Questions people ask

Is Cloudflare Sandbox cheaper than Deno Sandbox?

In four of the five scenarios on this page, Cloudflare's estimate is lower, for example $148 against $200 a month for one agent that never stops. For 1,000 short jobs at once Deno Builder comes to $1,563 against $1,889 for Cloudflare, though neither fits that burst as written.

Which is faster?

Neither has a result on the CPU benchmark used here, so there is no fair speed comparison. Cloudflare offers up to 4 vCPU against Deno's fixed 2 vCPU, and Deno says a sandbox starts in under 200 ms.

How long can each sandbox run?

Cloudflare sets no fixed maximum runtime; a sandbox stops after an inactivity timeout, and host restarts can still stop it. A Deno sandbox lives up to 30 minutes unless you promote it to a Deno Deploy app. A boat sandbox has no cap on paid plans.

Can Cloudflare Sandbox or Deno Sandbox run Docker?

Cloudflare supports docker:dind with iptables and IP forwarding turned off, because containers cannot change iptables. Deno's docs do not say Docker works inside a sandbox. boat runs full Docker and systemd and exposes /dev/kvm.

Do they keep my files?

Not by default. Cloudflare starts from a fresh disk after sleep unless your code saved a snapshot or an R2 backup, and Deno wipes the root disk when the sandbox ends unless you mounted a volume in Chicago. boat keeps the whole disk and saves it every minute.

Can I limit where a sandbox connects to?

Yes, on both. Cloudflare has an allowedHosts list plus outbound handlers you write as Worker code, and Deno takes a host allowlist enforced by a proxy outside the VM. boat does not offer a provider-side egress allowlist today.

Try boat

Install the CLI, then run boat new.

7-day free trial