Cloudflare Sandbox vs Koyeb
Both run each sandbox in its own microVM and put it to sleep when idle. Cloudflare Sandbox lives inside Workers, tops out at 4 vCPU and lets you program every outbound request, while Koyeb runs sandboxes as services with GPUs, bigger machines and more ports to the outside.
The companies and products
Cloudflare Sandbox
Cloudflare Sandbox SDK runs untrusted or AI-generated code in Linux containers on Cloudflare's network, driven from a Cloudflare Worker.
Each sandbox is a Cloudflare Container backed by a Durable Object, and each container runs in its own Firecracker microVM with its own kernel and network. You build a linux/amd64 image, pick an instance type of up to 4 vCPU and 12 GiB, and reach the sandbox through your own Worker. It suits teams already on Workers who want short-lived sandboxes that sleep when idle; for code that only calls known methods, Cloudflare also offers Dynamic Workers, which run JavaScript in V8 isolates.
- Largest instance
- 4 vCPU, 12 GiB memory, 20 GB disk (defaults, can be raised)
- Account limits
- 1,500 vCPU, 6 TiB memory and 30 TB disk running at once
- Compliance
- Cloudflare holds a SOC 2 Type II report
Koyeb
Koyeb is a serverless cloud for apps, inference and sandboxes, and in February 2026 it agreed to join Mistral AI.
A Koyeb sandbox is a Koyeb service: a microVM started from any Docker image and driven from Python or JavaScript SDKs that run commands, read files and expose a port. It can scale to zero when idle and wake on the next request, and it can run on CPU or GPU instance types. It is built for teams that run AI agents or untrusted code next to apps they already host on Koyeb.
Which use cases each one fits
For each use case, Battleships prices every sandbox provider on the same workload and sorts them from the cheapest monthly bill up. “13th cheapest of 345” means 12 of the other 344 providers run that workload, with every feature it needs, for less. “With limits” means the provider runs it but misses something, so it is listed after every full match. Open a use case for its whole ranking and what each provider misses.
| Use case and its workload | Cloudflare Sandbox: price rank | Koyeb: price rank | boat: price rank |
|---|---|---|---|
| Software factory 100 at once · 4 vCPU / 8 GB · 2,200 sessions of 8 h a month A software factory needs a disk that survives and room for Docker builds; Cloudflare resets the disk on sleep and Koyeb loses local disk on redeploy, while boat keeps the disk by default. | 162nd of 367, with limits $1,543 a month | 54th of 367, with limits $366 a month | 3rd cheapest of 367 $634 a month |
| Always-on AI employees 50 machines 24/7 · 2 vCPU / 4 GB | 207th of 366, with limits $2,188 a month | 135th of 366, with limits $923 a month | 5th cheapest of 366 $657 a month |
| Code interpreter bursts 100 at once · 1 vCPU / 2 GB · 200,000 sessions of 1 min a month Both suit short code runs: Cloudflare bills CPU only while busy and wakes on the next request, and Koyeb scales to zero after 5 idle minutes. | 13th cheapest of 345 $144 a month | 4th cheapest of 345 $66 a month | 186th of 345, with limits $2,000 a month |
| Sandboxes for your users 300 at once · 2 vCPU / 4 GB · 30,000 sessions of 23 min a month Both fit sandboxes for your users; Cloudflare adds egress rules written as Worker code, Koyeb adds more regions, and boat gives each user a full VM with up to 50 HTTPS ports. | 9th cheapest of 361 $731 a month | 6th cheapest of 361 $495 a month | Cheapest of 361 $209 a month |
| RL rollouts 1,000 at once · 2 vCPU / 4 GB · 1,000,000 sessions of 3 min a month | 144th of 360, with limits $9,428 a month | 237th of 360, with limits $1,631 a month | 34th of 360, with limits $2,000 a month |
| Agent evals 250 at once · 4 vCPU / 8 GB · 15,000 sessions of 20 min a month | 45th cheapest of 364 $818 a month | 19th cheapest of 364 $429 a month | 10th cheapest of 364 $200 a month |
| CI runners 40 at once · 8 vCPU / 16 GB · 6,000 sessions of 12 min a month Cloudflare caps disk at 20 GB by default and runs Docker with iptables off, Koyeb does not document /dev/kvm, and boat has full Docker plus /dev/kvm. | 301st of 377, with limits $704 a month | 142nd of 377, with limits $88 a month | 4th cheapest of 377 $86 a month |
| 24/7 dev boxes 1 machine 24/7 · 4 vCPU / 8 GB A dev box should keep its files when you log off; Cloudflare starts from a fresh disk after sleep, Koyeb needs a volume, and boat stops at no cost with its disk kept. | 70th cheapest of 368 $93 a month | 217th of 368, with limits $37 a month | 18th cheapest of 368 $26 a month |
| Computer-use agents 50 at once · 4 vCPU / 8 GB · 20,000 sessions of 15 min a month Neither ships a desktop: Cloudflare removed its built-in one and Koyeb's SDK has none, while boat streams a 60fps desktop with Chromium. | 166th of 369, with limits $460 a month | 81st of 369, with limits $123 a month | 6th cheapest of 369 $200 a month |
| Browser-use agents 50 at once · 2 vCPU / 4 GB · 30,000 sessions of 10 min a month | 210th of 367, with limits $233 a month | 172nd of 367, with limits $123 a month | 7th cheapest of 367 $200 a month |
| Scraping & bots (startup scale) 50 at once · 1 vCPU / 2 GB · 100,000 sessions of 3 min a month | 250th of 346, with limits $286 a month | 172nd of 346, with limits $89 a month | 6th cheapest of 346 $90 a month |
| Mass scraping & bots (undetectable) 1,000 at once · 1 vCPU / 2 GB · 3,000,000 sessions of 2 min a month | 169th of 338, with limits $5,741 a month | 65th of 338, with limits $1,683 a month | 71st of 338, with limits $1,800 a month |
| Parallel red teaming 200 at once · 2 vCPU / 4 GB · 5,000 sessions of 30 min a month Red-team runs often need raw TCP and full root networking; Cloudflare takes no raw TCP from outside, Koyeb offers a TCP proxy to one port, and boat has raw TCP and nested VMs. | 239th of 360, with limits $325 a month | 233rd of 360, with limits $299 a month | 2nd cheapest of 360 $200 a month |
| GPU eval jobs 10 at once · 8 vCPU / 32 GB · 500 sessions of 30 min a month Only Koyeb runs GPUs here, from RTX 4000 cards up to H100 and H200; Cloudflare Sandbox and boat are CPU only. | Can't run it | 3rd cheapest of 98 $628 a month | Can't run it |
| macOS agents 5 at once · 4 vCPU / 8 GB · 1,000 sessions of 20 min a month | Can't run it | Can't run it | Can't run it |
Key features
| Feature | Cloudflare Sandbox | Koyeb | boat |
|---|---|---|---|
| Isolation | Firecracker microVM per container, own kernel and network | MicroVM per instance | Full VM with its own kernel on dedicated AMD Ryzen 9 9950X hosts |
| Biggest machine | 4 vCPU / 12 GiB / 20 GB disk by default (can be raised) | Up to 40 vCPU / 128 GB, and GPU types larger still | Up to 16 vCPU / 32 GB on the $100 plan and above |
| Files between sessions | Fresh disk after sleep; snapshots (public beta, 30 days) or R2 backups when your code saves them | Local disk lost on redeploy; volumes (preview, 1 to 10 GB, two regions) or experimental SDK snapshots | Disk kept across stops and saved every minute; a stopped sandbox costs nothing |
| Fork and snapshots | No fork; restore a saved snapshot or backup into a new sandbox | SDK snapshots of the filesystem or with running processes, then new sandboxes from them (experimental) | Fork a running sandbox without stopping it |
| Sleep and wake | Stops after inactivity and wakes on the next request; CPU billed only while busy | Scales to zero after 5 idle minutes or more and wakes on request; Light Sleep wakes in about 200 ms | Stop and start by API; TTL based, 1 hour by default |
| Docker inside | docker:dind with iptables and IP forwarding turned off | Starts from any Docker image; Docker inside is supported | Full Docker, root and systemd |
| Nested virtualization | Not documented | Not documented | Yes, /dev/kvm for Android emulators and VMs |
| Inbound traffic | HTTP and WebSocket previews routed through your Worker; no raw TCP or public IP | One exposed HTTPS port at a time, plus an optional TCP proxy to one port; no dedicated IP | HTTPS URLs for up to 50 ports, token-protected; raw TCP; own IPv6 or IPv4 |
| Egress control | allowedHosts deny-by-default list plus outbound handlers you write in Worker code | Block all outbound traffic, or allow only listed IPs and CIDRs | Open internet, no provider-side allowlist |
| Keeping keys out of the sandbox | Your outbound handler adds the token for any HTTP or HTTPS host; you write the code | Secrets set as environment variables inside the service | Managed proxy for model providers and any HTTPS API; switch a credential to another account |
| Desktop and browser | Built-in desktop removed in SDK 0.10.2; bring your own | No desktop or browser in the sandbox SDK | 60fps desktop with Chromium, computer-use API, embeddable stream |
| Coding agents | Run Claude Code, Codex, OpenCode or Pi in your image; OpenCode has an SDK helper | Tutorials that run agents through the command API; an MCP server lets agents manage Koyeb | Claude Code, Codex and five more preinstalled, with a prompt, steer and events API |
| GPUs | No | RTX 4000 SFF Ada up to H100, H200 and multi-GPU | No |
| Regions | Several regions across Cloudflare's network, nearest free one picked | Frankfurt, Paris, Washington D.C., AWS US East, Singapore, Tokyo | EU only: Germany, Finland, France |
Every feature Battleships tracks (43)
| Feature | Cloudflare Sandbox | Koyeb | boat |
|---|---|---|---|
| Full VM (own kernel) | Yes | Yes | Yes |
| Docker inside | Yes | Yes | Yes |
| Nested virtualization | No | No | Yes |
| Root | Yes | Not published | Yes |
| Systemd | Not published | Not published | Yes |
| Desktop GUI | No | No | Yes |
| Browser | No | No | Yes |
| Computer-use API | No | No | Yes |
| SSH | Yes | No | Yes |
| Persistent disk | No | Yes | Yes |
| Pause/resume | No | Yes | Yes |
| Automatic snapshots | No | Yes | Yes |
| Fork/clone | No | Yes | Yes |
| Live fork (no pause) | No | Not published | Yes |
| Memory fork | No | Yes | No |
| Custom image (Docker or snapshot) | Yes | Yes | Yes |
| ≥24 h sessions | Yes | Yes | Yes |
| Idle auto-stop | Yes | Yes | No |
| Wake on request | Yes | Yes | No |
| HTTPS preview URLs | Yes | Yes | Yes |
| Raw TCP inbound | No | Yes | Yes |
| Public IPv4 | No | No | No |
| Egress allowlist | Yes | Yes | No |
| Secret proxy | Yes | No | Yes |
| Secret proxy for any API | Yes | No | Yes |
| Preinstalled agents | Yes | Yes | Yes |
| Agent harness API | Yes | No | Yes |
| MCP server | No | Yes | No |
| GPU | No | Yes | No |
| Windows | No | No | No |
| Arm64 | No | No | No |
| Self-hosting | No | Yes | No |
| BYOC | No | Yes | No |
| Open source | Yes | No | No |
| Scoped API keys | Not published | Not published | Yes |
| Spend limits | No | No | Yes |
| Usage per sandbox (API) | Not published | No | Yes |
| Audit logs | Yes | Yes | No |
| SSO | Yes | Yes | No |
| SOC 2 | Yes | Yes | No |
| HIPAA | Yes | No | No |
| EU data residency | Yes | Yes | Yes |
| Zero data retention | Not published | Not published | Yes |
Performance
Neither Cloudflare Sandbox nor Koyeb was part of the hpc-sandbox-benchmarks run, so there is no comparable CPU number for either. boat did 26.69 runs per second on that Node.js build-and-test loop at 4 vCPU / 8 GB. Koyeb publishes a CPU share of at least 0.25 dedicated vCPU per GB of memory, bursting to all cores, so its speed depends on how busy the host is.
Node.js build-and-test loop at 4 vCPU / 8 GB, higher is better. Measured with the open hpc-sandbox-benchmarks suite. Cloudflare Sandbox and Koyeb have no published run in this suite yet, so there is no like-for-like number to compare.
Pricing in five scenarios
Each bill is priced from the providers' public price lists by the open Battleships engine, with the cheapest plan that runs the scenario.
| Scenario | Cloudflare Sandbox, a month | Koyeb, a month | boat, a month |
|---|---|---|---|
| One coding agent, workdays 4 vCPU / 8 GB, 50 GB disk, 8 hours a day, 22 days a month, files kept between days | $39 · Workers Paid · with limits | $29 · Pro | $20 · $20/mo |
| One agent that never stops 4 vCPU / 8 GB, 50 GB disk, running 24/7 all month | $148 · Workers Paid · with limits | $57 · Pro | $26 · $20/mo |
| 50 agents in parallel 50 machines of 4 vCPU / 8 GB at once, 8-hour sessions, 1,100 sessions a month, Docker inside | $1,660 · Workers Paid · with limits | $475 · Pro | $317 · $20/mo × 3 seats |
| Sandboxes for your users 2 vCPU / 4 GB, 30,000 sessions of 10 minutes a month, up to 300 at once | $476 · Workers Paid | $329 · Scale | $200 · $100/mo × 2 seats |
| 1,000 short jobs at once 2 vCPU / 4 GB, 1,000 at once, 3 minutes each, 200,000 jobs a month | $1,889 · Workers Paid · with limits | $485 · Scale · with limits | $2,000 · $2000/mo · with limits |
Cloudflare Sandbox: You need Workers Paid ($5 a month minimum). CPU is billed only while in use, while memory and disk are billed on the instance size until the container sleeps, and there is no 4 vCPU / 8 GB size: 4 vCPU always comes with 12 GiB.
Koyeb: Koyeb bills each instance per second at a fixed price per type, and Deep Sleep costs nothing. Pro is $29 a month with $10 of usage included and Scale $299 with $100 included; the rest of the fee is not credit.
Koyeb: Plans start at $20 a month, and the whole fee is usage credit, billed per second while a sandbox runs. A stopped sandbox costs nothing and keeps its disk.
Limits in those scenarios
Cloudflare does not fit the scenarios that keep 50 GB of files between days, because its disk resets after sleep and tops out at 20 GB. Koyeb fits them, but its priced eco-xlarge shape has a 20 GiB disk with no published price for more. For 1,000 short jobs at once nobody fits as priced: Cloudflare's 1,500 vCPU account cap is short of the 2,000 needed, Koyeb's eco instances guarantee only half of each vCPU, and boat's $2,000 plan queues starts above 90 a minute.
| Scenario | Cloudflare Sandbox | Koyeb | boat |
|---|---|---|---|
| One coding agent, workdays |
|
| None that bite |
| One agent that never stops |
|
| None that bite |
| 50 agents in parallel |
| None that bite | None that bite |
| Sandboxes for your users | None that bite | None that bite | None that bite |
| 1,000 short jobs at once |
|
|
|
Which one should you use?
Use Cloudflare Sandbox when
your app already runs on Workers and you want short sandboxes that sleep when idle, with egress rules you write as code.
- Egress rules you can program. Cloudflare can block every host except the ones you list, and run your own Worker code on each outbound HTTP request.
- CPU billed only while busy. Good for many short, spiky sessions: CPU is billed only while in use, and a sleeping sandbox wakes on the next request.
- Sits next to your Workers. If your app already runs on Workers, sandboxes sit next to Durable Objects and R2, with less to wire up.
Use Koyeb when
your sandboxes need GPUs or bigger machines, should sleep and wake on a request, or must run in the US or Asia.
- GPUs in the same platform. Useful when an agent or eval needs a GPU: Koyeb runs instances from RTX 4000 cards up to H100 and H200.
- Bigger machines. Koyeb instance types go up to 40 vCPU and 128 GB, while a Cloudflare container tops out at 4 vCPU by default.
- More ways in from outside. A Koyeb sandbox can expose an HTTPS port and a TCP proxy, where Cloudflare routes only HTTP and WebSocket through your Worker.
Where boat fits
Cloudflare Sandbox and Koyeb both shine at sandboxes that sleep between requests. If your agents instead work for hours on one machine, building, testing and running a browser, look at boat: a full VM that keeps its disk, runs nested VMs and a desktop, and comes with coding agents you drive from outside.
A disk that stays without extra code
On Cloudflare a sleeping sandbox wakes with a fresh disk, and on Koyeb local disk is lost on redeploy. Keeping a repo and installs means writing snapshot or backup code, or using Koyeb volumes capped at 10 GB in two regions.
Root, systemd, Docker and /dev/kvm
Cloudflare runs Docker with iptables turned off, and neither documents nested virtualization, so Android emulators and VM builds cannot start. boat gives full Docker, systemd and /dev/kvm on dedicated AMD Ryzen 9 9950X hosts.
Agents, desktop and ports built in
Neither ships a desktop, and Koyeb exposes one HTTPS port at a time with keys as environment variables the agent can read. boat has a 60fps desktop, 50 HTTPS ports and a credentials proxy that keeps real keys outside.
Use boat when your agents do real work for hours on a machine that keeps its disk: builds, full Docker, emulators, a desktop browser and preview servers, with agents and keys handled for you. Compare it one to one: boat vs Cloudflare Sandbox and boat vs Koyeb.
Questions people ask
Is Cloudflare Sandbox cheaper than Koyeb?
In the scenarios on this page, Koyeb costs less: $57 against $148 a month for one agent that never stops, and $329 against $476 for sandboxes for your users. Cloudflare's estimates for the always-on scenarios also do not fit, because its disk resets on sleep.
Which is faster, Cloudflare Sandbox or Koyeb?
There is no comparable measurement: neither ran the hpc-sandbox-benchmarks loop. Koyeb guarantees at least 0.25 dedicated vCPU per GB of memory, and Cloudflare caps a container at 4 vCPU by default. boat scored 26.69 runs per second on that benchmark.
Do Cloudflare Sandbox and Koyeb keep my files?
Not by default. A Cloudflare sandbox starts from a fresh disk after sleep unless your code saved a snapshot or R2 backup, and Koyeb loses local disk on redeploy unless you add a volume or an SDK snapshot. boat keeps the disk across stops and saves it every minute.
Can Cloudflare Sandbox or Koyeb run Docker?
Both start from Docker images. Cloudflare supports docker:dind with iptables and IP forwarding turned off, and neither documents /dev/kvm for emulators. boat runs full Docker with root, systemd and /dev/kvm.
Does either one have GPUs?
Koyeb does, from an RTX 4000 SFF Ada up to H100 and H200, billed per second. Cloudflare Sandbox and boat are CPU only.
Where does each one run?
Cloudflare places containers in several regions of its network and picks the nearest free one. Koyeb runs in Frankfurt, Paris, Washington D.C., Singapore, Tokyo and more. boat runs in the EU only, in Germany, Finland and France.
Try boat
Install the CLI, then run boat new.
7-day free trial
More comparisons
- boat vs Cloudflare Sandbox
- boat vs Koyeb
- E2B vs Cloudflare Sandbox
- Daytona vs Cloudflare Sandbox
- Modal vs Cloudflare Sandbox
- Vercel Sandbox vs Cloudflare Sandbox
- Cloudflare Sandbox vs Blaxel
- Cloudflare Sandbox vs Runloop
- Cloudflare Sandbox vs Tensorlake
- Cloudflare Sandbox vs Morph Cloud
- Cloudflare Sandbox vs CodeSandbox SDK
- Cloudflare Sandbox vs Northflank