Cloudflare Sandbox vs Modal VM Sandboxes
Both give each sandbox its own kernel. Cloudflare runs a container inside your Workers app that sleeps when idle and wakes on the next request, while Modal runs a full Linux VM with Docker and systemd that lasts up to 24 hours.
The companies and products
Cloudflare Sandbox
Cloudflare Sandbox SDK runs untrusted or AI-generated code in Linux containers on Cloudflare's network, driven from a Cloudflare Worker.
Each sandbox is a Cloudflare Container backed by a Durable Object, and each container runs in its own Firecracker microVM with its own kernel and network. You build a linux/amd64 image, pick an instance type of up to 4 vCPU and 12 GiB, and reach the sandbox through your own Worker. It suits teams already on Workers who want short-lived sandboxes that sleep when idle; for code that only calls known methods, Cloudflare also offers Dynamic Workers, which run JavaScript in V8 isolates.
- Largest instance
- 4 vCPU, 12 GiB memory, 20 GB disk (defaults, can be raised)
- Account limits
- 1,500 vCPU, 6 TiB memory and 30 TB disk running at once
- Compliance
- Cloudflare holds a SOC 2 Type II report
Modal VM Sandboxes
Modal is a serverless cloud for AI work, and VM Sandboxes are the version of its sandboxes that run in a virtual machine with their own Linux kernel.
You create a VM Sandbox from Python, TypeScript or Go code with runtime="vm", run commands in it, and terminate it when the job is done. Modal built the runtime on the Rust-based Cloud Hypervisor, so Docker, FUSE, systemd and nested cgroups work, with the same API, images and prices as its gVisor sandboxes. It became generally available on 1 October 2026 and suits teams that want many short-lived agent machines next to Modal's inference and training.
- Funding
- Over $466M raised
- Generally available
- 1 October 2026; early customers launched over 20 million VMs before that
- Session length
- Default 5 minutes, maximum 24 hours
- Compliance
- SOC 2 on every plan; HIPAA on Enterprise
Which use cases each one fits
For each use case, Battleships prices every sandbox provider on the same workload and sorts them from the cheapest monthly bill up. “13th cheapest of 345” means 12 of the other 344 providers run that workload, with every feature it needs, for less. “With limits” means the provider runs it but misses something, so it is listed after every full match. Open a use case for its whole ranking and what each provider misses.
| Use case and its workload | Cloudflare Sandbox: price rank | Modal VM Sandboxes: price rank | boat: price rank |
|---|---|---|---|
| Software factory 100 at once · 4 vCPU / 8 GB · 2,200 sessions of 8 h a month Neither keeps a workday's disk on its own: Cloudflare starts fresh after sleep and Modal ends the VM within 24 hours, while boat keeps the disk and adds a desktop to check the app. | 162nd of 367, with limits $1,543 a month | 84th of 367, with limits $759 a month | 3rd cheapest of 367 $634 a month |
| Always-on AI employees 50 machines 24/7 · 2 vCPU / 4 GB | 207th of 366, with limits $2,188 a month | Can't run it | 5th cheapest of 366 $657 a month |
| Code interpreter bursts 100 at once · 1 vCPU / 2 GB · 200,000 sessions of 1 min a month Short code-interpreter calls suit Cloudflare well, since CPU is billed only while busy and a container wakes on the next request. | 13th cheapest of 345 $144 a month | Can't run it | 186th of 345, with limits $2,000 a month |
| Sandboxes for your users 300 at once · 2 vCPU / 4 GB · 30,000 sessions of 23 min a month Cloudflare fits sandboxes for your users if your app already runs on Workers; boat also fits and keeps each user's disk while a stopped sandbox costs nothing. | 9th cheapest of 361 $731 a month | Can't run it | Cheapest of 361 $209 a month |
| RL rollouts 1,000 at once · 2 vCPU / 4 GB · 1,000,000 sessions of 3 min a month Huge bursts of short rollouts are where Modal shines, with 5,000 containers at once on Team, while Cloudflare is capped at 1,500 vCPU per account by default. | 144th of 360, with limits $9,428 a month | 171st of 360, with limits $16,322 a month | 34th of 360, with limits $2,000 a month |
| Agent evals 250 at once · 4 vCPU / 8 GB · 15,000 sessions of 20 min a month | 45th cheapest of 364 $818 a month | Can't run it | 10th cheapest of 364 $200 a month |
| CI runners 40 at once · 8 vCPU / 16 GB · 6,000 sessions of 12 min a month Docker builds run more fully on Modal's VM than on Cloudflare, where iptables is off and disk is 20 GB by default; boat adds /dev/kvm on every plan. | 301st of 377, with limits $704 a month | 188th of 377, with limits $1,064 a month | 4th cheapest of 377 $86 a month |
| 24/7 dev boxes 1 machine 24/7 · 4 vCPU / 8 GB A dev box should keep its files when you log off: Cloudflare wipes the disk on sleep, Modal stops within 24 hours, and boat stops for free with its disk. | 70th cheapest of 368 $93 a month | Can't run it | 18th cheapest of 368 $26 a month |
| Computer-use agents 50 at once · 4 vCPU / 8 GB · 20,000 sessions of 15 min a month Neither ships a desktop: Cloudflare removed its built-in one and Modal only has an Xvfb and VNC example, while boat has a 60fps desktop and a computer-use API. | 166th of 369, with limits $460 a month | Can't run it | 6th cheapest of 369 $200 a month |
| Browser-use agents 50 at once · 2 vCPU / 4 GB · 30,000 sessions of 10 min a month | 210th of 367, with limits $233 a month | Can't run it | 7th cheapest of 367 $200 a month |
| Scraping & bots (startup scale) 50 at once · 1 vCPU / 2 GB · 100,000 sessions of 3 min a month | 250th of 346, with limits $286 a month | Can't run it | 6th cheapest of 346 $90 a month |
| Mass scraping & bots (undetectable) 1,000 at once · 1 vCPU / 2 GB · 3,000,000 sessions of 2 min a month | 169th of 338, with limits $5,741 a month | Can't run it | 71st of 338, with limits $1,800 a month |
| Parallel red teaming 200 at once · 2 vCPU / 4 GB · 5,000 sessions of 30 min a month Modal's VM gives raw TCP tunnels and nested virtualization on request, Cloudflare blocks iptables changes and raw TCP, and boat has full root networking and /dev/kvm. | 239th of 360, with limits $325 a month | 294th of 360, with limits $642 a month | 2nd cheapest of 360 $200 a month |
| GPU eval jobs 10 at once · 8 vCPU / 32 GB · 500 sessions of 30 min a month | Can't run it | Can't run it | Can't run it |
| macOS agents 5 at once · 4 vCPU / 8 GB · 1,000 sessions of 20 min a month | Can't run it | Can't run it | Can't run it |
Key features
| Feature | Cloudflare Sandbox | Modal VM Sandboxes | boat |
|---|---|---|---|
| Isolation | Firecracker microVM per container, own kernel and network | VM with its own Linux 7.2 kernel on Cloud Hypervisor | Full VM with its own kernel on dedicated AMD Ryzen 9 9950X hosts |
| CPU benchmark (4 vCPU / 8 GB) | No result on this benchmark | 15.54 runs/s | 26.69 runs/s |
| Longest session | No fixed maximum, but no guaranteed runtime; stops after an inactivity timeout | 24 hours (default 5 minutes) | No cap on paid plans; you set the time to live |
| Files between sessions | Fresh disk after sleep; snapshots (public beta, 30 days) or R2 backups your code saves | Gone when the VM ends; only Volumes and filesystem snapshots keep files | Disk kept; saved every minute and on stop; a stopped sandbox costs nothing |
| Fork | No fork; restore a saved snapshot or backup into a new sandbox | Snapshot the filesystem into an image and boot many new sandboxes; memory snapshots in alpha | Fork a running sandbox with its disk, without stopping it |
| Docker inside | docker:dind with iptables and IP forwarding turned off | Docker, systemd and root; start dockerd yourself as the entrypoint | Full Docker, root and systemd in every sandbox |
| Nested virtualization | Not documented | Team and Enterprise plans only, on request | Yes, /dev/kvm on every plan |
| Desktop and browser | Built-in desktop removed in SDK 0.10.2; bring your own | Not offered; an example sets up Xvfb and VNC yourself | 60fps desktop, Chromium and computer-use API built in |
| Coding agents and API keys | Run agents in your image; your outbound handler adds tokens for any HTTP or HTTPS host | Examples only; secrets are environment variables, or your own proxy in a sidecar | Claude Code, Codex and others preinstalled with a prompt, steer and events API; managed proxy keeps real keys out |
| Inbound traffic | HTTP and WebSocket previews through your Worker; no raw TCP or public IP | Encrypted and raw TCP tunnels, connect tokens, inbound IP allowlist | HTTPS URLs for up to 50 ports, token-protected; raw TCP |
| Outbound network rules | allowedHosts deny-by-default list plus outbound handlers you write in Worker code | Block all, IP-range allowlist, domain allowlist (beta) | Open internet, no provider-side allowlist |
| Sleep when idle | Stops after inactivity and wakes on the next request | No paused state; you terminate the sandbox or it times out | TTL based (1 h default, changeable); stop for free and resume with the disk |
| Running at once | 1,500 vCPU per account by default, can be raised | 100 containers on Starter, 5,000 on Team | Start limits per plan: the $2,000 plan starts up to 90 a minute and 600 an hour |
| Regions | Several regions across Cloudflare's network, nearest free one picked | US, EU and Asia-Pacific; pinning a region costs 1.15x to 1.75x | EU only: Germany, Finland, France |
Every feature Battleships tracks (43)
| Feature | Cloudflare Sandbox | Modal VM Sandboxes | boat |
|---|---|---|---|
| Full VM (own kernel) | Yes | Yes | Yes |
| Docker inside | Yes | Yes | Yes |
| Nested virtualization | No | Yes | Yes |
| Root | Yes | Yes | Yes |
| Systemd | Not published | Yes | Yes |
| Desktop GUI | No | No | Yes |
| Browser | No | No | Yes |
| Computer-use API | No | No | Yes |
| SSH | Yes | Yes | Yes |
| Persistent disk | No | Yes | Yes |
| Pause/resume | No | No | Yes |
| Automatic snapshots | No | No | Yes |
| Fork/clone | No | Yes | Yes |
| Live fork (no pause) | No | Yes | Yes |
| Memory fork | No | Yes | No |
| Custom image (Docker or snapshot) | Yes | Yes | Yes |
| ≥24 h sessions | Yes | Yes | Yes |
| Idle auto-stop | Yes | Yes | No |
| Wake on request | Yes | No | No |
| HTTPS preview URLs | Yes | Yes | Yes |
| Raw TCP inbound | No | Yes | Yes |
| Public IPv4 | No | No | No |
| Egress allowlist | Yes | Yes | No |
| Secret proxy | Yes | No | Yes |
| Secret proxy for any API | Yes | No | Yes |
| Preinstalled agents | Yes | No | Yes |
| Agent harness API | Yes | No | Yes |
| MCP server | No | No | No |
| GPU | No | No | No |
| Windows | No | No | No |
| Arm64 | No | No | No |
| Self-hosting | No | No | No |
| BYOC | No | No | No |
| Open source | Yes | No | No |
| Scoped API keys | Not published | Not published | Yes |
| Spend limits | No | Not published | Yes |
| Usage per sandbox (API) | Not published | Not published | Yes |
| Audit logs | Yes | Yes | No |
| SSO | Yes | Yes | No |
| SOC 2 | Yes | Yes | No |
| HIPAA | Yes | Yes | No |
| EU data residency | Yes | Yes | Yes |
| Zero data retention | Not published | Not published | Yes |
Performance
On the hpc-sandbox-benchmarks Node.js build-and-test loop at 4 vCPU / 8 GB, boat did 26.69 runs per second and Modal's VM runtime did 15.54, so boat did about 1.7 times the CPU work in the same time. Cloudflare has no result on that benchmark, so there is no comparable CPU number for it. This measures CPU speed only, not start time.
Node.js build-and-test loop at 4 vCPU / 8 GB, higher is better. Measured with the open hpc-sandbox-benchmarks suite. Modal VM Sandboxes measured on: VM Sandbox, request = size. Cloudflare Sandbox has no published run in this suite yet, so there is no like-for-like number to compare.
Pricing in five scenarios
Each bill is priced from the providers' public price lists by the open Battleships engine, with the cheapest plan that runs the scenario.
| Scenario | Cloudflare Sandbox, a month | Modal VM Sandboxes, a month | boat, a month |
|---|---|---|---|
| One coding agent, workdays 4 vCPU / 8 GB, 50 GB disk, 8 hours a day, 22 days a month, files kept between days | $39 · Workers Paid · with limits | $15 · Starter · with limits | $20 · $20/mo |
| One agent that never stops 4 vCPU / 8 GB, 50 GB disk, running 24/7 all month | $148 · Workers Paid · with limits | $178 · Starter · with limits | $26 · $20/mo |
| 50 agents in parallel 50 machines of 4 vCPU / 8 GB at once, 8-hour sessions, 1,100 sessions a month, Docker inside | $1,660 · Workers Paid · with limits | $2,229 · Starter · with limits | $317 · $20/mo × 3 seats |
| Sandboxes for your users 2 vCPU / 4 GB, 30,000 sessions of 10 minutes a month, up to 300 at once | $476 · Workers Paid | $792 · Team | $200 · $100/mo × 2 seats |
| 1,000 short jobs at once 2 vCPU / 4 GB, 1,000 at once, 3 minutes each, 200,000 jobs a month | $1,889 · Workers Paid · with limits | $3,193 · Team · with limits | $2,000 · $2000/mo · with limits |
Cloudflare Sandbox: You need Workers Paid ($5 a month minimum). CPU is billed only while busy, and memory and disk are billed on the instance size in 10 ms steps until the container sleeps; 4 vCPU always comes with 12 GiB.
Modal VM Sandboxes: Modal bills by the second for the higher of what you request or use, until the sandbox ends. Starter is free with $30 of monthly credit, Team is $250 a month with $100 of credit, and pinning a region costs 1.15x to 1.75x.
Modal VM Sandboxes: Plans start at $20 a month and the whole fee becomes usage credit, billed per second while a sandbox runs. A stopped sandbox costs nothing and keeps its disk.
Limits in those scenarios
Cloudflare's disk resets after sleep, and Modal's VM keeps files only in Volumes or snapshots, so neither fits the workday, always-on or 50-agent scenarios as priced; Modal's Starter plan also caps a session at 24 hours. For 1,000 jobs at once, Cloudflare's 1,500 vCPU account cap is short of the 2,000 needed, and Modal's Team price relies on shared vCPUs that other tenants can slow. On boat that burst hits start limits: the $2,000 plan starts 600 sandboxes an hour and queues bursts above 90 a minute.
| Scenario | Cloudflare Sandbox | Modal VM Sandboxes | boat |
|---|---|---|---|
| One coding agent, workdays |
|
| None that bite |
| One agent that never stops |
|
| None that bite |
| 50 agents in parallel |
|
| None that bite |
| Sandboxes for your users | None that bite | None that bite | None that bite |
| 1,000 short jobs at once |
|
|
|
Which one should you use?
Use Cloudflare Sandbox when
your app already runs on Workers and you want short sandboxes that sleep when idle, wake on the next request, and follow egress rules you write as code.
- Sleeps when idle, wakes on request. Useful for many short, spiky sessions: a sandbox sleeps when quiet, wakes on the next request, and bills CPU only while busy.
- Egress rules you can program. Cloudflare can block every host except the ones you list, and run your own Worker code on each outbound request.
- Built into the Workers platform. If your app already runs on Workers, sandboxes sit next to Durable Objects and R2 with little to wire up.
Use Modal VM Sandboxes when
you need a real VM with Docker and systemd for jobs that finish within a day, run huge bursts, or already run your models on Modal.
- A real VM with Docker and systemd. Modal's VM runs its own Linux kernel, so Docker, FUSE and systemd work as they would on a normal Linux machine.
- Very large bursts. Useful for huge bursts of short jobs: Team runs 5,000 containers at once, and memory snapshots are in alpha.
- One platform with inference and training. If you already serve or train models on Modal, sandboxes, GPUs and models share one account and one bill.
Where boat fits
Cloudflare and Modal both suit short sandboxes that end and get thrown away. If your agents work for hours or days and come back to the same machine, boat gives them a full VM that keeps its disk, runs a desktop and comes with coding agents ready to drive from outside.
Files that stay put
Cloudflare starts from a fresh disk after sleep, and a Modal VM ends within 24 hours with its root disk. On both you write code to save snapshots, backups or Volumes and restore them. boat saves the disk every minute and on stop.
A full machine for builds and UI checks
Cloudflare runs Docker with iptables off and 20 GB of disk by default, and Modal offers nested virtualization only on Team on request. Neither has a desktop. boat has full Docker, /dev/kvm and a 60fps desktop on every plan.
Agents driven from outside, keys kept out
On Cloudflare you bake each agent into your image and write the outbound handler that adds tokens. Modal has examples only, with keys in environment variables or your own sidecar proxy. boat ships the agents and a managed key proxy.
Use boat when your agents work for hours or days on a machine they come back to: full Docker, /dev/kvm, a desktop and coding agents, on a faster VM that keeps its disk. Compare it one to one: boat vs Cloudflare Sandbox and boat vs Modal VM Sandboxes.
Questions people ask
Is Cloudflare Sandbox cheaper than Modal VM Sandboxes?
Usually, in our scenarios: 300 user sandboxes at once cost $476 a month on Cloudflare against $792 on Modal, and 50 parallel agents $1,660 against $2,229. For one coding agent on workdays Modal is lower ($15 against $39), and one always-on agent is $148 on Cloudflare against $178 on Modal. boat costs $200, $317, $20 and $26 a month for those four.
Which is faster?
Modal's VM runtime did 15.54 runs per second on the hpc-sandbox-benchmarks CPU test at 4 vCPU / 8 GB. Cloudflare has no result on that test. boat did 26.69, about 1.7 times Modal's CPU work in the same time.
Can Cloudflare Sandbox run Docker?
Yes, as docker:dind with the daemon's iptables and IP forwarding turned off, because containers cannot change iptables. Modal's VM runs Docker with systemd and root once you start dockerd as the entrypoint. boat runs full Docker in every sandbox.
How long can each sandbox run?
A Modal VM Sandbox defaults to 5 minutes and stops at 24 hours at most. Cloudflare has no fixed maximum, but it stops an idle container and does not guarantee any runtime. boat has no session cap on paid plans.
Do they keep my files?
Not on their own. Cloudflare starts from a fresh disk after sleep unless your code saved a snapshot or an R2 backup, and Modal keeps only what you put in a Volume or a filesystem snapshot. boat keeps the whole disk across free stops.
Which handles big bursts of short jobs better?
Modal is built for it, with 5,000 containers at once on Team. Cloudflare's account cap is 1,500 vCPU at once by default, though it can be raised. boat queues large bursts because of per-plan start limits.
Try boat
Install the CLI, then run boat new.
7-day free trial
More comparisons
- boat vs Cloudflare Sandbox
- boat vs Modal VM Sandboxes
- E2B vs Cloudflare Sandbox
- Daytona vs Cloudflare Sandbox
- Modal vs Cloudflare Sandbox
- Vercel Sandbox vs Cloudflare Sandbox
- Cloudflare Sandbox vs Blaxel
- Cloudflare Sandbox vs Runloop
- Cloudflare Sandbox vs Tensorlake
- Cloudflare Sandbox vs Morph Cloud
- Cloudflare Sandbox vs CodeSandbox SDK
- Cloudflare Sandbox vs Northflank