Cloudflare Sandbox vs Fly.io Machines

Both run your code in Firecracker microVMs with their own kernel. Cloudflare Sandbox is a sandbox SDK inside Workers, built for short sessions that sleep and wake on request; Fly.io Machines are the VMs under an app hosting platform, with a Volume for lasting files and 17 regions to run in.

The companies and products

Cloudflare Sandbox

Cloudflare Sandbox SDK runs untrusted or AI-generated code in Linux containers on Cloudflare's network, driven from a Cloudflare Worker.

Each sandbox is a Cloudflare Container backed by a Durable Object, and each container runs in its own Firecracker microVM with its own kernel and network. You build a linux/amd64 image, pick an instance type of up to 4 vCPU and 12 GiB, and reach the sandbox through your own Worker. It suits teams already on Workers who want short-lived sandboxes that sleep when idle; for code that only calls known methods, Cloudflare also offers Dynamic Workers, which run JavaScript in V8 isolates.

Isolation: Firecracker microVM per container, own kernel and network
Largest instance: 4 vCPU, 12 GiB memory, 20 GB disk (defaults, can be raised)
Disk: Ephemeral by default: a container that sleeps starts again from a fresh disk
Plan needed: Workers Paid, $5 a month account minimum; not on the Free plan
Account limits: 1,500 vCPU, 6 TiB memory and 30 TB disk running at once
Placement: Instances spread across several regions of Cloudflare's network, nearest free one picked
Compliance: Cloudflare holds a SOC 2 Type II report

Fly.io Machines

Fly.io is an app hosting platform, and Machines are the microVMs underneath it that you can also start and stop through a REST API.

A Fly Machine boots your Docker image as a Firecracker microVM on Fly's own servers, in one of 17 regions. You pick a shared or performance CPU preset, attach at most one Volume for data that must last, and Fly Proxy can stop, suspend and wake Machines as traffic comes and goes. It is built for teams that host web apps and services worldwide; it is not a sandbox product, so this page compares the parts that overlap with agent work.

Kind of product: App hosting platform; Machines are its VM building block with a REST API
Isolation: Firecracker microVMs with hardware virtualization, on Fly's own servers
Regions: 17 regions in North America, Europe, Asia, Oceania, South America and Africa
CPU classes: Shared vCPUs guarantee 6.25% of each core with a burst balance; performance vCPUs get the full core
Storage: Root file system is ephemeral; one Volume of up to 500GB per Machine for lasting data
Free trial: 2 Machine hours or 7 days, up to 10 Machines of 2 vCPU / 4GB that stop after 5 minutes
Compliance: Lists SOC 2 Type II; a HIPAA package with a pre-signed BAA is sold as an add-on

Which use cases each one fits

For each use case, Battleships prices every sandbox provider on the same workload and sorts them from the cheapest monthly bill up. “13th cheapest of 345” means 12 of the other 344 providers run that workload, with every feature it needs, for less. “With limits” means the provider runs it but misses something, so it is listed after every full match. Open a use case for its whole ranking and what each provider misses.

Use case and its workload	Cloudflare Sandbox: price rank	Fly.io Machines: price rank	boat: price rank
Software factory 100 at once · 4 vCPU / 8 GB · 2,200 sessions of 8 h a month Long agent sessions need their files: Cloudflare's disk resets after sleep and Fly's root disk is ephemeral outside its one Volume, while boat keeps the whole disk with Docker and a desktop.	162nd of 367, with limits $1,543 a month	92nd of 367, with limits $836 a month	3rd cheapest of 367 $634 a month
Always-on AI employees 50 machines 24/7 · 2 vCPU / 4 GB	207th of 366, with limits $2,188 a month	125th of 366, with limits $816 a month	5th cheapest of 366 $657 a month
Code interpreter bursts 100 at once · 1 vCPU / 2 GB · 200,000 sessions of 1 min a month Cloudflare fits short code-interpreter calls well: CPU is billed only while busy and a sandbox wakes on the next request, while Fly is a compromise on shared CPU.	13th cheapest of 345 $144 a month	75th of 345, with limits $94 a month	186th of 345, with limits $2,000 a month
Sandboxes for your users 300 at once · 2 vCPU / 4 GB · 30,000 sessions of 23 min a month Cloudflare fits sandboxes for your users with egress rules in Worker code; Fly's API creates about one Machine per second per app, and boat fits with per-sandbox usage and spend limits.	9th cheapest of 361 $731 a month	69th of 361, with limits $600 a month	Cheapest of 361 $209 a month
RL rollouts 1,000 at once · 2 vCPU / 4 GB · 1,000,000 sessions of 3 min a month	144th of 360, with limits $9,428 a month	48th of 360, with limits $2,838 a month	34th of 360, with limits $2,000 a month
Agent evals 250 at once · 4 vCPU / 8 GB · 15,000 sessions of 20 min a month Cloudflare fits agent evals as short sessions that sleep between runs; on Fly the shared CPU baseline makes it a compromise, and boat fits with a full VM per run.	45th cheapest of 364 $818 a month	117th of 364, with limits $457 a month	10th cheapest of 364 $200 a month
CI runners 40 at once · 8 vCPU / 16 GB · 6,000 sessions of 12 min a month CI jobs keep the CPU busy, which drains a shared Fly vCPU's burst balance, and Cloudflare caps disk at 20 GB by default with iptables blocked for Docker; boat has full Docker on every machine.	301st of 377, with limits $704 a month	152nd of 377, with limits $288 a month	4th cheapest of 377 $86 a month
24/7 dev boxes 1 machine 24/7 · 4 vCPU / 8 GB A dev box should keep its files when you log off; Cloudflare starts from a fresh disk after sleep, Fly keeps only its Volume, and boat stops at no cost with its disk.	70th cheapest of 368 $93 a month	118th of 368, with limits $53 a month	18th cheapest of 368 $26 a month
Computer-use agents 50 at once · 4 vCPU / 8 GB · 20,000 sessions of 15 min a month Neither Cloudflare nor Fly ships a desktop today, so you build one into your own image; boat ships a 60fps desktop with Chromium and a computer-use API.	166th of 369, with limits $460 a month	95th of 369, with limits $173 a month	6th cheapest of 369 $200 a month
Browser-use agents 50 at once · 2 vCPU / 4 GB · 30,000 sessions of 10 min a month	210th of 367, with limits $233 a month	160th of 367, with limits $90 a month	7th cheapest of 367 $200 a month
Scraping & bots (startup scale) 50 at once · 1 vCPU / 2 GB · 100,000 sessions of 3 min a month	250th of 346, with limits $286 a month	161st of 346, with limits $67 a month	6th cheapest of 346 $90 a month
Mass scraping & bots (undetectable) 1,000 at once · 1 vCPU / 2 GB · 3,000,000 sessions of 2 min a month Fly ranks well here: it can spread scrapers across 17 regions and pay only for the seconds they run.	169th of 338, with limits $5,741 a month	44th of 338, with limits $1,232 a month	71st of 338, with limits $1,800 a month
Parallel red teaming 200 at once · 2 vCPU / 4 GB · 5,000 sessions of 30 min a month	239th of 360, with limits $325 a month	118th of 360, with limits $63 a month	2nd cheapest of 360 $200 a month
GPU eval jobs 10 at once · 8 vCPU / 32 GB · 500 sessions of 30 min a month	Can't run it	Can't run it	Can't run it
macOS agents 5 at once · 4 vCPU / 8 GB · 1,000 sessions of 20 min a month	Can't run it	Can't run it	Can't run it

Key features

Feature	Cloudflare Sandbox	Fly.io Machines	boat
Kind of product	Sandbox SDK: containers you start and drive from a Cloudflare Worker	App hosting platform; Machines are its microVMs, with a REST API	Agent sandbox: a full VM per agent, ready to use
Isolation	Firecracker microVM per container, own kernel and network	Firecracker microVM with its own kernel, on Fly's own servers	Full VM with its own kernel on dedicated AMD Ryzen 9 9950X hosts
Files after a stop	Fresh disk after sleep; snapshots (public beta, kept 30 days) or R2 backups when your code saves them	Root file system is ephemeral; lasting data goes on one Volume of up to 500GB, billed for its full size around the clock	Whole disk kept, with snapshots every minute and on stop; a stopped sandbox costs nothing
Sleep, wake and memory	Stops after inactivity and wakes on the next request; a stop wipes processes and disk	Fly Proxy stops or suspends idle Machines and wakes them on request; suspend keeps memory for Machines up to 2GB	You start and stop machines through the API (TTL, 1 h by default); resume reboots from disk
Fork	No fork; restore a saved snapshot or backup into a new sandbox	Clone copies a Machine's config; a cloned Volume starts empty	Fork a running sandbox, disk included, without stopping it
Docker and systemd	docker:dind with iptables and IP forwarding turned off	Root and Docker you install yourself; Fly's own init, no systemd	Full Docker, root and systemd on every machine
Nested virtualization	Not documented	/dev/kvm not offered	Yes, /dev/kvm (Android emulators, VMs)
Largest machine and CPU	4 vCPU / 12 GiB / 20 GB disk by default (can be raised); CPU billed only while busy	Shared vCPUs guarantee 6.25% of a core plus bursts; performance vCPUs get the full core at a higher rate	Up to 16 vCPU / 32 GB, depending on plan; one CPU class with no baseline quota or burst balance
Desktop and browser	Built-in desktop removed in SDK 0.10.2; bring your own	None built in; you add a desktop and browser to your own image	60fps desktop and Chromium, computer use and browser control, embeddable stream
Coding agents	Run Claude Code, Codex, OpenCode or Pi in your image; OpenCode has an SDK helper	None built in; you install and run agents yourself	Claude Code, Codex, OpenCode and more preinstalled, with a prompt, steer and events API
Keeping keys out of the sandbox	Your outbound handler adds the token for any HTTP or HTTPS host; you write the code	Secrets arrive as environment variables; the open-source tokenizer proxy can be deployed yourself	AI credentials proxy for model providers and any HTTPS API; switch a credential to another account when credits run out
Reaching the sandbox	HTTP and WebSocket previews routed through your Worker; no raw TCP or public IP	Public HTTPS and TCP through Fly Proxy, Anycast IPs, custom domains, private network between Machines	HTTPS URLs for up to 50 ports, token-protected; raw TCP; own IPv6 or IPv4
Outbound rules	allowedHosts deny-by-default list plus outbound handlers that run your code on each HTTP request	Network policies allow chosen ports and protocols and deny the rest	Open internet on every plan; no provider-side allowlist
Regions	Several regions across Cloudflare's network, nearest free instance picked	17 regions on six continents	EU only: Germany, Finland, France

Every feature Battleships tracks (43)

Feature	Cloudflare Sandbox	Fly.io Machines	boat
Full VM (own kernel)	Yes	Yes	Yes
Docker inside	Yes	Yes	Yes
Nested virtualization	No	No	Yes
Root	Yes	Yes	Yes
Systemd	Not published	No	Yes
Desktop GUI	No	No	Yes
Browser	No	No	Yes
Computer-use API	No	No	Yes
SSH	Yes	Yes	Yes
Persistent disk	No	Yes	Yes
Pause/resume	No	Yes	Yes
Automatic snapshots	No	Yes	Yes
Fork/clone	No	Yes	Yes
Live fork (no pause)	No	Yes	Yes
Memory fork	No	No	No
Custom image (Docker or snapshot)	Yes	Yes	Yes
≥24 h sessions	Yes	Yes	Yes
Idle auto-stop	Yes	Yes	No
Wake on request	Yes	Yes	No
HTTPS preview URLs	Yes	Yes	Yes
Raw TCP inbound	No	Yes	Yes
Public IPv4	No	Yes	No
Egress allowlist	Yes	Yes	No
Secret proxy	Yes	No	Yes
Secret proxy for any API	Yes	No	Yes
Preinstalled agents	Yes	No	Yes
Agent harness API	Yes	No	Yes
MCP server	No	Yes	No
GPU	No	No	No
Windows	No	No	No
Arm64	No	No	No
Self-hosting	No	No	No
BYOC	No	No	No
Open source	Yes	Yes	No
Scoped API keys	Not published	Not published	Yes
Spend limits	No	No	Yes
Usage per sandbox (API)	Not published	No	Yes
Audit logs	Yes	Not published	No
SSO	Yes	No	No
SOC 2	Yes	Yes	No
HIPAA	Yes	Yes	No
EU data residency	Yes	Yes	Yes
Zero data retention	Not published	Not published	Yes

Performance

Cloudflare SandboxNot measured

Fly.io MachinesNot measured

boat26.69 runs/s

boat did 26.69 Node.js build-and-test runs per second at 4 vCPU / 8 GB on the public StarSling hpc-sandbox-benchmarks run. Neither Cloudflare Sandbox nor Fly.io Machines has a result on that benchmark, so there is no comparable CPU number for them. On Fly the answer would also depend on the CPU class: shared vCPUs guarantee only 6.25% of a core, performance vCPUs get the full core.

Node.js build-and-test loop at 4 vCPU / 8 GB, higher is better. Measured with the open hpc-sandbox-benchmarks suite. Cloudflare Sandbox and Fly.io Machines have no published run in this suite yet, so there is no like-for-like number to compare.

Pricing in five scenarios

Each bill is priced from the providers' public price lists by the open Battleships engine, with the cheapest plan that runs the scenario.

Scenario	Cloudflare Sandbox, a month	Fly.io Machines, a month	boat, a month
One coding agent, workdays 4 vCPU / 8 GB, 50 GB disk, 8 hours a day, 22 days a month, files kept between days	$39 · Workers Paid · with limits	$15 · Pay As You Go · with limits	$20 · $20/mo
One agent that never stops 4 vCPU / 8 GB, 50 GB disk, running 24/7 all month	$148 · Workers Paid · with limits	$36 · Pay As You Go · with limits	$26 · $20/mo
50 agents in parallel 50 machines of 4 vCPU / 8 GB at once, 8-hour sessions, 1,100 sessions a month, Docker inside	$1,660 · Workers Paid · with limits	$487 · Pay As You Go · with limits	$317 · $20/mo × 3 seats
Sandboxes for your users 2 vCPU / 4 GB, 30,000 sessions of 10 minutes a month, up to 300 at once	$476 · Workers Paid	$110 · Pay As You Go · with limits	$200 · $100/mo × 2 seats
1,000 short jobs at once 2 vCPU / 4 GB, 1,000 at once, 3 minutes each, 200,000 jobs a month	$1,889 · Workers Paid · with limits	$232 · Pay As You Go · with limits	$2,000 · $2000/mo · with limits

Cloudflare Sandbox: You need Workers Paid ($5 a month minimum). CPU is billed only while in use; memory and disk are billed on the instance size you picked until the container sleeps, and 4 vCPU always comes with 12 GiB.

Fly.io Machines: Fly bills each Machine per second while it runs, with no plan fee; Volumes are billed for their full size all month. The figures here use shared vCPUs bought in 1-year reservation blocks for 40% off, the lowest rate Fly sells.

Fly.io Machines: You pick a monthly plan from $20, and all of it is usage credit spent per second while a sandbox runs. A stopped sandbox costs nothing and keeps its disk.

Limits in those scenarios

Cloudflare does not fit the four scenarios that keep files between sessions or run agents for hours, because its disk resets after sleep; it fits 300 user sandboxes, and the 1,000-job burst needs 2,000 vCPU at once against a default account cap of 1,500. Fly is a compromise in all five: its lowest figures need a 1-year reservation, and its shared vCPUs guarantee 6.25% of each core, so long builds get throttled. Fly's API also creates about one Machine per second per app, so big bursts need pre-created Machines. On boat the 1,000-job burst is queued by start limits even on the $2,000 plan.

Scenario	Cloudflare Sandbox	Fly.io Machines	boat
One coding agent, workdays	missing persistent disk	different kind of product: app platform 1-year commitment burstable CPU: 6.25% of each vCPU guaranteed, throttled above that	None that bite
One agent that never stops	missing persistent disk	different kind of product: app platform 1-year commitment burstable CPU: 6.25% of each vCPU guaranteed, throttled above that	None that bite
50 agents in parallel	missing persistent disk	different kind of product: app platform 1-year commitment burstable CPU: 6.25% of each vCPU guaranteed, throttled above that	None that bite
Sandboxes for your users	None that bite	different kind of product: app platform 1-year commitment burstable CPU: 6.25% of each vCPU guaranteed, throttled above that	None that bite
1,000 short jobs at once	Workers Paid: max 1,500 vCPU running at once (needs 2,000)	different kind of product: app platform 1-year commitment burstable CPU: 6.25% of each vCPU guaranteed, throttled above that	max 2,400 starts/day (needs ~6,667) max 600 starts/hour (needs ~1,000) bursts above 90 starts/min are queued (a burst of 333 takes ~4 min to start)

Which one should you use?

Use Cloudflare Sandbox when

your app already runs on Workers and you want short sandboxes that sleep when idle, wake on request and only reach hosts you allow.

Egress rules you can program. Useful when sandboxed code must only reach known hosts: allowedHosts blocks the rest, and outbound handlers run your code on each request.
Short, spiky sessions. Useful for code-interpreter calls: a sandbox sleeps when idle, wakes on the next request, and bills CPU only while busy.
Part of the Workers platform. If your app already runs on Workers, sandboxes sit next to Durable Objects and R2, with less to wire up.

Use Fly.io Machines when

you host apps or long-lived services that need a lasting Volume, public TCP and regions outside Europe.

17 regions worldwide. Useful when work must run near users on other continents: Fly runs Machines in 17 regions, from the US to Sydney.
Files that last, and memory suspend. Useful for longer-lived services: a Volume keeps data across restarts, and small Machines can suspend with their memory kept.
A full app platform around each Machine. Useful if you host whole apps: Fly adds public TCP, Anycast IPs, custom domains, private networking and port-level network policies.

Where boat fits

If what you are really running is coding agents that work for hours, both options leave you building the sandbox yourself: Cloudflare around short sessions that reset, Fly around an app host. boat gives each agent a full VM that keeps its disk, with Docker, /dev/kvm, a desktop, coding agents and a keys proxy already in place.

A disk that keeps everything

On Cloudflare a sleeping sandbox comes back with an empty disk unless your code saved a snapshot, kept 30 days. On Fly only the one Volume lasts, billed for its full size even while stopped. boat keeps the whole disk, and stops are free.

A whole machine for agent work

Cloudflare runs Docker with iptables turned off on 20 GB of disk by default; Fly has no systemd or /dev/kvm, and its shared vCPUs throttle long builds unless you pay for performance vCPUs. boat has full Docker, systemd, /dev/kvm and a 60fps desktop.

Agents and keys handled from outside

On both you bake agents into your image and write the code that drives them. Cloudflare needs an outbound handler you write to add tokens; Fly passes secrets as environment variables unless you run its tokenizer yourself. boat does both for you.

Use boat when your agents do real work for hours: builds, tests, full Docker and emulators on a full VM whose disk survives every stop, with a desktop, coding agents and a keys proxy built in. Compare it one to one: boat vs Cloudflare Sandbox and boat vs Fly.io Machines.

Questions people ask

Is Cloudflare Sandbox cheaper than Fly.io Machines?

In the five scenarios on this page, Fly's estimate is lower each time, for example $110 on Fly against $476 on Cloudflare for 300 user sandboxes. Fly's figures use shared vCPUs on a 1-year reservation, which assume work that stays near a 6.25% CPU baseline. boat is $200 for the same user sandboxes and $26 for one agent running all month, against $36 on Fly and $148 on Cloudflare.

Which is faster, Cloudflare Sandbox or Fly.io Machines?

There is no comparable measurement: neither has a result on the StarSling Node.js benchmark where boat did 26.69 runs per second. Cloudflare bills CPU only while busy, and Fly's shared vCPUs guarantee 6.25% of a core with bursts, so sustained work on Fly needs performance vCPUs.

Can I run Docker in Cloudflare Sandbox or Fly.io Machines?

Yes, with limits. Cloudflare supports docker:dind with iptables and IP forwarding turned off. On Fly you install Docker yourself inside the microVM, which uses Fly's own init and has no systemd or /dev/kvm. boat has full Docker, systemd and /dev/kvm ready on every machine.

Do they keep my files when a sandbox stops?

Cloudflare starts from a fresh disk after sleep, unless your code saved a snapshot (public beta, kept 30 days) or a backup to R2. Fly keeps only what is on the Machine's one Volume, since the root file system is ephemeral. boat keeps the whole disk, with snapshots every minute and on stop.

Which runs in more places?

Fly runs Machines in 17 regions on six continents. Cloudflare spreads containers across several regions of its network and picks the nearest free instance. boat runs only in the EU, in Germany, Finland and France.

Can I use either one as an AI agent sandbox?

Yes, but you build the sandbox yourself on both: package the tools, browser and agents into an image, handle files that must last, and write the code that drives each agent. boat ships a desktop, coding agents with a prompt and steer API, and a keys proxy in every machine.

Try boat

Install the CLI, then run boat new.

7-day free trial