Cloudflare Sandbox vs Islo

Both run each sandbox in a microVM with its own kernel. Cloudflare Sandbox lives inside Workers and comes back with a fresh disk after it sleeps, while Islo keeps files, processes and memory when it pauses and checks every outbound call at a gateway.

The companies and products

Cloudflare Sandbox

Cloudflare Sandbox SDK runs untrusted or AI-generated code in Linux containers on Cloudflare's network, driven from a Cloudflare Worker.

Each sandbox is a Cloudflare Container backed by a Durable Object, and each container runs in its own Firecracker microVM with its own kernel and network. You build a linux/amd64 image, pick an instance type of up to 4 vCPU and 12 GiB, and reach the sandbox through your own Worker. It suits teams already on Workers who want short-lived sandboxes that sleep when idle; for code that only calls known methods, Cloudflare also offers Dynamic Workers, which run JavaScript in V8 isolates.

Isolation: Firecracker microVM per container, own kernel and network
Largest instance: 4 vCPU, 12 GiB memory, 20 GB disk (defaults, can be raised)
Disk: Ephemeral by default: a container that sleeps starts again from a fresh disk
Plan needed: Workers Paid, $5 a month account minimum; not on the Free plan
Account limits: 1,500 vCPU, 6 TiB memory and 30 TB disk running at once
Placement: Instances spread across several regions of Cloudflare's network, nearest free one picked
Compliance: Cloudflare holds a SOC 2 Type II report

Islo

Islo is an agent sandbox from Incredibuild: each coding agent gets its own microVM, with network rules and credentials handled at a gateway.

An Islo sandbox is a Linux microVM with its own kernel, built from a container image, with Claude Code, Cursor CLI and Codex preinstalled. Outbound traffic can pass through a gateway that allows or blocks hosts, injects credentials and logs every request. It is built for teams that run coding agents, evals and RL rollouts in the background, on Islo's cloud or in their own cloud account.

Maker: Incredibuild, a build acceleration company based in Tel Aviv
Launched: May 4, 2026
Isolation: A microVM with its own kernel for each agent computer
Regions: US West on Islo's cloud; BYOC puts the control plane and sandboxes in your own cloud account
Billing: CPU per core, memory per GB and disk per GB while a sandbox runs, billed per hour; signup credits with no card
Compliance: No certification named on its site; compliance documents on request from support

Which use cases each one fits

For each use case, Battleships prices every sandbox provider on the same workload and sorts them from the cheapest monthly bill up. “13th cheapest of 345” means 12 of the other 344 providers run that workload, with every feature it needs, for less. “With limits” means the provider runs it but misses something, so it is listed after every full match. Open a use case for its whole ranking and what each provider misses.

Use case and its workload	Cloudflare Sandbox: price rank	Islo: price rank	boat: price rank
Software factory 100 at once · 4 vCPU / 8 GB · 2,200 sessions of 8 h a month	162nd of 367, with limits $1,543 a month	326th of 367, with limits $7,402 a month	3rd cheapest of 367 $634 a month
Always-on AI employees 50 machines 24/7 · 2 vCPU / 4 GB Islo fits always-on assistants because a paused sandbox keeps its files and memory; Cloudflare wipes the disk on sleep, and boat keeps the disk across stops at no cost while stopped.	207th of 366, with limits $2,188 a month	30th cheapest of 366 $9,928 a month	5th cheapest of 366 $657 a month
Code interpreter bursts 100 at once · 1 vCPU / 2 GB · 200,000 sessions of 1 min a month Cloudflare fits short code-interpreter calls well, since CPU is billed only while busy and a container wakes on the next request; Islo needs more running sandboxes than its Team plan allows.	13th cheapest of 345 $144 a month	153rd of 345, with limits $503 a month	186th of 345, with limits $2,000 a month
Sandboxes for your users 300 at once · 2 vCPU / 4 GB · 30,000 sessions of 23 min a month Cloudflare fits 300 sandboxes for your users at once under its account vCPU limit, while Islo's Team plan is reported at 50 running sandboxes; boat fits it too and adds per-sandbox spend limits.	9th cheapest of 361 $731 a month	171st of 361, with limits $3,160 a month	Cheapest of 361 $209 a month
RL rollouts 1,000 at once · 2 vCPU / 4 GB · 1,000,000 sessions of 3 min a month	144th of 360, with limits $9,428 a month	167th of 360, with limits $15,265 a month	34th of 360, with limits $2,000 a month
Agent evals 250 at once · 4 vCPU / 8 GB · 15,000 sessions of 20 min a month Cloudflare fits many short eval trials; Islo adds a Harbor integration and gateway rules that stop trials from looking up answers, but caps how many run at once.	45th cheapest of 364 $818 a month	198th of 364, with limits $2,456 a month	10th cheapest of 364 $200 a month
CI runners 40 at once · 8 vCPU / 16 GB · 6,000 sessions of 12 min a month Islo keeps Docker layers on a disk that survives pauses, while Cloudflare starts from a fresh disk and runs Docker with iptables turned off; boat gives full Docker and systemd.	301st of 377, with limits $704 a month	119th cheapest of 377 $1,507 a month	4th cheapest of 377 $86 a month
24/7 dev boxes 1 machine 24/7 · 4 vCPU / 8 GB All three fit a dev box: Islo pauses with memory, Cloudflare needs your code to save a snapshot or backup before sleep, and boat keeps the disk on its own.	70th cheapest of 368 $93 a month	112th cheapest of 368 $402 a month	18th cheapest of 368 $26 a month
Computer-use agents 50 at once · 4 vCPU / 8 GB · 20,000 sessions of 15 min a month Neither ships a desktop: Cloudflare removed its built-in one and Islo sandboxes are headless, while boat streams a 60fps desktop with a computer-use API.	166th of 369, with limits $460 a month	310th of 369, with limits $2,210 a month	6th cheapest of 369 $200 a month
Browser-use agents 50 at once · 2 vCPU / 4 GB · 30,000 sessions of 10 min a month	210th of 367, with limits $233 a month	113th of 367, with limits $1,105 a month	7th cheapest of 367 $200 a month
Scraping & bots (startup scale) 50 at once · 1 vCPU / 2 GB · 100,000 sessions of 3 min a month	250th of 346, with limits $286 a month	66th cheapest of 346 $748 a month	6th cheapest of 346 $90 a month
Mass scraping & bots (undetectable) 1,000 at once · 1 vCPU / 2 GB · 3,000,000 sessions of 2 min a month	169th of 338, with limits $5,741 a month	265th of 338, with limits $14,966 a month	71st of 338, with limits $1,800 a month
Parallel red teaming 200 at once · 2 vCPU / 4 GB · 5,000 sessions of 30 min a month Red-team runs often need raw TCP and nested VMs; neither Cloudflare nor Islo offers raw TCP inbound or documents /dev/kvm, and boat has both.	239th of 360, with limits $325 a month	47th of 360, with limits $746 a month	2nd cheapest of 360 $200 a month
GPU eval jobs 10 at once · 8 vCPU / 32 GB · 500 sessions of 30 min a month	Can't run it	Can't run it	Can't run it
macOS agents 5 at once · 4 vCPU / 8 GB · 1,000 sessions of 20 min a month	Can't run it	Can't run it	Can't run it

Key features

Feature	Cloudflare Sandbox	Islo	boat
Isolation	Firecracker microVM per container, own kernel and network	A microVM with its own kernel for each sandbox	Full VM with its own kernel on dedicated AMD Ryzen 9 9950X hosts
Machine size	Fixed instance types up to 4 vCPU / 12 GiB / 20 GB disk by default (can be raised); 4 vCPU always comes with 12 GiB	CPU cores, memory and disk set for each sandbox and billed per core and per GB	Up to 16 vCPU / 32 GB, depending on plan
Files between sessions	Fresh disk after sleep; snapshots (public beta, kept 30 days) or R2 backups when your code saves them	Pause keeps files, processes and memory	Disk kept; snapshot every minute and on stop; a stopped sandbox costs nothing
Idle behavior	Stops after inactivity and wakes on the next request; CPU billed only while busy	Can pause after an idle time set at creation, and resume on the next exec, file access or webhook	TTL based (1 h default, changeable); no idle timer
Fork	No fork; restore a saved snapshot or backup into a new sandbox	Snapshot a running sandbox's files, then start new sandboxes from it	Fork a running sandbox without stopping it
Docker inside	docker:dind with iptables and IP forwarding turned off	Docker inside, with sudo	Full Docker, root and systemd
Nested virtualization	Not documented	No /dev/kvm or nested virtualization documented	Yes, /dev/kvm (Android emulators, VMs)
Desktop and computer use	Built-in desktop removed in SDK 0.10.2; bring your own	A browser inside the sandbox for testing; no desktop or computer-use API	60fps desktop and Chromium, computer-use API, embeddable stream
Reaching the sandbox	HTTP and WebSocket previews routed through your Worker; no raw TCP or public IP	HTTPS share links anyone with the URL can open, expiring after 24 hours by default; SSH and port-forward through the CLI	HTTPS URLs for up to 50 ports, token-protected; raw TCP; its own IP
Outbound internet rules	allowedHosts deny-by-default list plus outbound handlers you write in Worker code	Gateway profiles allow or deny by host, path and HTTP method, with rate limits, content filters and per-request logs	Open internet on every plan; no provider-side allowlist
Keeping keys out of the sandbox	Your outbound handler adds the token for any HTTP or HTTPS host; you write the code	Gateway injects stored credentials into outbound requests for any host	Managed proxy for model providers and any HTTPS API you register; switch a credential to another account when credits run out
Coding agents	Run Claude Code, Codex, OpenCode or Pi in your own image; OpenCode has an SDK helper	Claude Code, Cursor CLI and Codex preinstalled; factory lines run agent steps on a schedule, webhook or GitHub, Slack and Linear events	Claude Code, Codex, OpenCode and more preinstalled, with a prompt, steer and events API
Sandboxes at once	Account limits of 1,500 vCPU, 6 TiB memory and 30 TB disk running at once, not a sandbox count	Free 5 and Team 50 running sandboxes per launch coverage; paused ones do not count	100 to 2,000 running sandboxes by plan, raised by adding seats
Where it runs	Several regions across Cloudflare's network, nearest free instance picked	US West, or inside your own cloud account with BYOC	EU only: Germany, Finland, France; EU data residency

Every feature Battleships tracks (43)

Feature	Cloudflare Sandbox	Islo	boat
Full VM (own kernel)	Yes	Yes	Yes
Docker inside	Yes	Yes	Yes
Nested virtualization	No	No	Yes
Root	Yes	Yes	Yes
Systemd	Not published	Not published	Yes
Desktop GUI	No	No	Yes
Browser	No	Yes	Yes
Computer-use API	No	No	Yes
SSH	Yes	Yes	Yes
Persistent disk	No	Yes	Yes
Pause/resume	No	Yes	Yes
Automatic snapshots	No	Yes	Yes
Fork/clone	No	Yes	Yes
Live fork (no pause)	No	Yes	Yes
Memory fork	No	No	No
Custom image (Docker or snapshot)	Yes	Yes	Yes
≥24 h sessions	Yes	Yes	Yes
Idle auto-stop	Yes	Yes	No
Wake on request	Yes	Yes	No
HTTPS preview URLs	Yes	Yes	Yes
Raw TCP inbound	No	No	Yes
Public IPv4	No	No	No
Egress allowlist	Yes	Yes	No
Secret proxy	Yes	Yes	Yes
Secret proxy for any API	Yes	Yes	Yes
Preinstalled agents	Yes	Yes	Yes
Agent harness API	Yes	Yes	Yes
MCP server	No	No	No
GPU	No	No	No
Windows	No	No	No
Arm64	No	No	No
Self-hosting	No	No	No
BYOC	No	Yes	No
Open source	Yes	No	No
Scoped API keys	Not published	Not published	Yes
Spend limits	No	Not published	Yes
Usage per sandbox (API)	Not published	Yes	Yes
Audit logs	Yes	Yes	No
SSO	Yes	Yes	No
SOC 2	Yes	Not published	No
HIPAA	Yes	Not published	No
EU data residency	Yes	No	Yes
Zero data retention	Not published	Not published	Yes

Performance

Cloudflare SandboxNot measured

IsloNot measured

boat26.69 runs/s

There is no comparable CPU measurement for either one: neither Cloudflare Sandbox nor Islo has a result on StarSling's hpc-sandbox-benchmarks Node.js build-and-test loop. In StarSling's run of 2026-09-29, boat did 26.69 runs per second at 4 vCPU / 8 GB on dedicated AMD Ryzen 9 9950X hosts.

Node.js build-and-test loop at 4 vCPU / 8 GB, higher is better. Measured with the open hpc-sandbox-benchmarks suite. Cloudflare Sandbox and Islo have no published run in this suite yet, so there is no like-for-like number to compare.

Pricing in five scenarios

Each bill is priced from the providers' public price lists by the open Battleships engine, with the cheapest plan that runs the scenario.

Scenario	Cloudflare Sandbox, a month	Islo, a month	boat, a month
One coding agent, workdays 4 vCPU / 8 GB, 50 GB disk, 8 hours a day, 22 days a month, files kept between days	$39 · Workers Paid · with limits	$101 · Free	$20 · $20/mo
One agent that never stops 4 vCPU / 8 GB, 50 GB disk, running 24/7 all month	$148 · Workers Paid · with limits	$420 · Free	$26 · $20/mo
50 agents in parallel 50 machines of 4 vCPU / 8 GB at once, 8-hour sessions, 1,100 sessions a month, Docker inside	$1,660 · Workers Paid · with limits	$4,863 · Team	$317 · $20/mo × 3 seats
Sandboxes for your users 2 vCPU / 4 GB, 30,000 sessions of 10 minutes a month, up to 300 at once	$476 · Workers Paid	$1,382 · Team · with limits	$200 · $100/mo × 2 seats
1,000 short jobs at once 2 vCPU / 4 GB, 1,000 at once, 3 minutes each, 200,000 jobs a month	$1,889 · Workers Paid · with limits	$3,053 · Team · with limits	$2,000 · $2000/mo · with limits

Cloudflare Sandbox: You need Workers Paid ($5 a month minimum). CPU is billed only while busy; memory and disk are billed on the instance size in 10 ms steps until the container sleeps, and 4 vCPU always comes with 12 GiB.

Cloudflare Sandbox: Durable Object and Worker requests are billed on top, and egress is free up to 1 TB in North America and Europe, then $0.025 per GB.

Islo: Islo bills each CPU core and each GB of memory and disk while a sandbox runs, per hour, with no plan fee. An idle sandbox bills until a pause-after-idle timer fires, which can only be set at creation, and egress has no published price.

Islo: You pick a monthly plan from $20, and all of it is usage credit spent per second on running sandboxes. A stopped sandbox costs nothing and keeps its disk.

Limits in those scenarios

Cloudflare starts from a fresh disk after sleep, so the three scenarios that keep 50 GB of files between sessions do not fit without your own snapshot or backup code, and its 1,500 vCPU account limit is short of the 2,000 vCPU the 1,000-job burst needs. Islo's Team plan is reported at 50 running sandboxes, so 300 sandboxes for your users and 1,000 short jobs at once need a custom contract, and every Islo total leaves egress out. On boat, the burst runs into start limits: the $2,000 plan allows 600 starts an hour and queues bursts above 90 starts a minute.

Scenario	Cloudflare Sandbox	Islo	boat
One coding agent, workdays	missing persistent disk	egress price not published	None that bite
One agent that never stops	missing persistent disk	egress price not published	None that bite
50 agents in parallel	missing persistent disk	egress price not published	None that bite
Sandboxes for your users	None that bite	Team: max 50 concurrent egress price not published	None that bite
1,000 short jobs at once	Workers Paid: max 1,500 vCPU running at once (needs 2,000)	Team: max 50 concurrent egress price not published	max 2,400 starts/day (needs ~6,667) max 600 starts/hour (needs ~1,000) bursts above 90 starts/min are queued (a burst of 333 takes ~4 min to start)

Which one should you use?

Use Cloudflare Sandbox when

your app already runs on Workers and you want many short sandboxes that sleep when idle and wake on the next request.

Sleeps when idle, wakes on request. Useful for many short, spiky sessions: a sandbox sleeps when quiet, wakes on the next request, and bills CPU only while busy.
Room for many sandboxes at once. Useful for sandboxes you hand to users: the limit is 1,500 vCPU per account, not a count of 50 sandboxes.
Close to the rest of Workers. Useful if your app already runs on Workers: sandboxes sit next to Durable Objects and R2, in several regions.

Use Islo when

your agents must keep their files and memory between tasks, and you need per-host egress rules with a log of every call, in US West or your own cloud.

Pause with files and memory. Useful for agents that wait between tasks: Islo pauses them with files, processes and memory kept, and wakes them on request.
Egress rules without writing code. Useful if you must control what agents reach: gateway profiles allow or block each host, path and method, and log every call.
Your own cloud account. Useful if sandboxes must run in your cloud: with BYOC, Islo puts its control plane and sandboxes in your account.

Where boat fits

Both Cloudflare Sandbox and Islo give an agent a headless Linux box that you reach through a Worker or a share link. If your agents need a whole machine, with nested virtualization, a desktop they can see and ports you can host on, look at boat. It also keeps the disk across stops like Islo, and a stopped sandbox costs nothing.

A full VM with /dev/kvm and systemd

Android emulators and tools that start their own VMs stop at the first boot on both, since neither documents /dev/kvm. Cloudflare also runs Docker with iptables turned off, so container networking breaks in ways boat's full Docker does not.

A desktop agents can see and use

Cloudflare removed its built-in desktop and Islo sandboxes are headless. On either one you install a VNC stack and a control layer in each image yourself, then keep it working; boat ships a 60fps desktop and a computer-use API.

Ports you can host on

Cloudflare routes HTTP previews through Worker code you write, and Islo share links are open to anyone with the URL and expire after 24 hours by default. Neither takes raw TCP; boat serves 50 HTTPS ports with tokens plus raw TCP.

Use boat when your agents need a whole machine for hours: full Docker, /dev/kvm, a desktop and ports you can host on, with a disk that stays put between sessions. Compare it one to one: boat vs Cloudflare Sandbox and boat vs Islo.

Questions people ask

Is Cloudflare Sandbox cheaper than Islo?

In every scenario we priced, Cloudflare's estimate is lower: $148 vs $420 for one agent all month, and $476 vs $1,382 for sandboxes for your users. But Cloudflare does not fit the scenarios that keep files between sessions, because its disk resets after sleep. boat comes to $26 and $200 a month for those two.

Which is faster, Cloudflare Sandbox or Islo?

We cannot say: neither has a result on the public CPU benchmark we use. boat did 26.69 Node.js build-and-test runs per second at 4 vCPU / 8 GB in StarSling's run.

Can Cloudflare Sandbox or Islo run Docker?

Both can. Cloudflare supports docker:dind with iptables and IP forwarding turned off, and Islo runs Docker inside its microVMs with sudo. boat runs full Docker with root, systemd and /dev/kvm.

Do they keep my files?

Islo does: a paused sandbox keeps its files, processes and memory. Cloudflare starts from a fresh disk after sleep unless your code saved a snapshot (public beta, kept 30 days) or a backup to R2. boat keeps the disk on its own and snapshots it every minute.

Can I limit what an agent reaches on the internet?

Yes on both. Cloudflare has an allowedHosts list and outbound handlers you write in Worker code, and Islo has gateway profiles by host, path and method that log each request. boat has open internet with no provider-side allowlist, and its credentials proxy keeps real keys out of the sandbox.

Where do they run?

Cloudflare places containers in several regions of its network. Islo runs in US West, or in your own cloud account with BYOC. boat runs only in the EU, in Germany, Finland and France.

Try boat

Install the CLI, then run boat new.

7-day free trial