Cloudflare Sandbox vs Replit

Cloudflare Sandbox is a sandbox SDK: your Worker starts containers that run code, sleep when idle and wake on the next request. Replit is an AI app builder where Replit Agent writes an app from a description and Replit hosts it.

The companies and products

Cloudflare Sandbox

Cloudflare Sandbox SDK runs untrusted or AI-generated code in Linux containers on Cloudflare's network, driven from a Cloudflare Worker.

Each sandbox is a Cloudflare Container backed by a Durable Object, and each container runs in its own Firecracker microVM with its own kernel and network. You build a linux/amd64 image, pick an instance type of up to 4 vCPU and 12 GiB, and reach the sandbox through your own Worker. It suits teams already on Workers who want short-lived sandboxes that sleep when idle; for code that only calls known methods, Cloudflare also offers Dynamic Workers, which run JavaScript in V8 isolates.

Isolation: Firecracker microVM per container, own kernel and network
Largest instance: 4 vCPU, 12 GiB memory, 20 GB disk (defaults, can be raised)
Disk: Ephemeral by default: a container that sleeps starts again from a fresh disk
Plan needed: Workers Paid, $5 a month account minimum; not on the Free plan
Account limits: 1,500 vCPU, 6 TiB memory and 30 TB disk running at once
Placement: Instances spread across several regions of Cloudflare's network, nearest free one picked
Compliance: Cloudflare holds a SOC 2 Type II report

Replit

Replit is an AI app builder and hosting platform: you describe an app in chat, Replit Agent writes it, and Replit publishes it.

You work in a browser workspace where Replit Agent sets up the project, writes the code, tests it and fixes problems, with system packages managed by Nix. When the app is ready you publish it as an Autoscale, Static, Scheduled or Reserved VM deployment, with Postgres and object storage next to it. It is built for people and teams who want a working app, not for programs that need to create many machines by API, so this page compares the parts where the two overlap.

Kind of product: AI app builder with workspaces and app hosting, not a sandbox API
Hosting: Data is hosted mainly in Google Cloud data centers in the United States, with an optional India region
Regions for published apps: North America, Europe, Asia, South America and Australia on Core, Pro and Enterprise; the free plan publishes to North America
Isolation: Not documented: the security page promises strong logical separation between users but does not say containers or VMs
Plans: Starter (free), Core $20 a month, Pro from $100 a month, Enterprise custom; plan fees come back as usage credits
Compliance: Says it has a SOC 2 Type 2 attestation

Which use cases each one fits

For each use case, Battleships prices every sandbox provider on the same workload and sorts them from the cheapest monthly bill up. “13th cheapest of 345” means 12 of the other 344 providers run that workload, with every feature it needs, for less. “With limits” means the provider runs it but misses something, so it is listed after every full match. Open a use case for its whole ranking and what each provider misses.

Use case and its workload	Cloudflare Sandbox: price rank	Replit: price rank	boat: price rank
Software factory 100 at once · 4 vCPU / 8 GB · 2,200 sessions of 8 h a month A software factory starts many agents from code; Cloudflare wipes the disk on sleep, Replit drives only its own Agent, and boat keeps the disk and runs Docker and a desktop.	162nd of 367, with limits $1,543 a month	181st of 367, with limits $2,000 a month	3rd cheapest of 367 $634 a month
Always-on AI employees 50 machines 24/7 · 2 vCPU / 4 GB An always-on assistant needs its files to stay put; Cloudflare starts from a fresh disk after sleep, Replit means one Reserved VM billed all month, and boat keeps the disk across stops.	207th of 366, with limits $2,188 a month	202nd of 366, with limits $2,033 a month	5th cheapest of 366 $657 a month
Code interpreter bursts 100 at once · 1 vCPU / 2 GB · 200,000 sessions of 1 min a month Cloudflare fits short code-interpreter calls well, since CPU is billed only while busy and a container wakes on the next request; Replit is a web host, not a code runner.	13th cheapest of 345 $144 a month	228th of 345, with limits $146 a month	186th of 345, with limits $2,000 a month
Sandboxes for your users 300 at once · 2 vCPU / 4 GB · 30,000 sessions of 23 min a month Cloudflare and boat both fit sandboxes for your users; on Replit each machine is a published app and it does not publish how many can run at once.	9th cheapest of 361 $731 a month	233rd of 361, with limits $825 a month	Cheapest of 361 $209 a month
RL rollouts 1,000 at once · 2 vCPU / 4 GB · 1,000,000 sessions of 3 min a month	144th of 360, with limits $9,428 a month	258th of 360, with limits $4,226 a month	34th of 360, with limits $2,000 a month
Agent evals 250 at once · 4 vCPU / 8 GB · 15,000 sessions of 20 min a month	45th cheapest of 364 $818 a month	265th of 364, with limits $685 a month	10th cheapest of 364 $200 a month
CI runners 40 at once · 8 vCPU / 16 GB · 6,000 sessions of 12 min a month CI jobs that build images need full Docker; Cloudflare runs Docker with iptables turned off and 20 GB of disk by default, Replit does not document Docker, and boat has it on every machine.	301st of 377, with limits $704 a month	275th of 377, with limits $425 a month	4th cheapest of 377 $86 a month
24/7 dev boxes 1 machine 24/7 · 4 vCPU / 8 GB Replit's workspace is good for coding by hand, Cloudflare starts from a fresh disk after sleep, and boat stops at no cost and resumes with its disk.	70th cheapest of 368 $93 a month	165th of 368, with limits $109 a month	18th cheapest of 368 $26 a month
Computer-use agents 50 at once · 4 vCPU / 8 GB · 20,000 sessions of 15 min a month Neither Cloudflare nor Replit has a computer-use API: Cloudflare removed its built-in desktop and Replit's VNC pane is for a person; boat ships a 60fps desktop with computer use.	166th of 369, with limits $460 a month	190th of 369, with limits $619 a month	6th cheapest of 369 $200 a month
Browser-use agents 50 at once · 2 vCPU / 4 GB · 30,000 sessions of 10 min a month	210th of 367, with limits $233 a month	229th of 367, with limits $317 a month	7th cheapest of 367 $200 a month
Scraping & bots (startup scale) 50 at once · 1 vCPU / 2 GB · 100,000 sessions of 3 min a month	250th of 346, with limits $286 a month	234th of 346, with limits $217 a month	6th cheapest of 346 $90 a month
Mass scraping & bots (undetectable) 1,000 at once · 1 vCPU / 2 GB · 3,000,000 sessions of 2 min a month	169th of 338, with limits $5,741 a month	150th of 338, with limits $4,378 a month	71st of 338, with limits $1,800 a month
Parallel red teaming 200 at once · 2 vCPU / 4 GB · 5,000 sessions of 30 min a month Red-team runs need root networking and raw TCP; Cloudflare containers cannot change iptables or take raw TCP, Replit does not document either, and boat has both.	239th of 360, with limits $325 a month	208th of 360, with limits $215 a month	2nd cheapest of 360 $200 a month
GPU eval jobs 10 at once · 8 vCPU / 32 GB · 500 sessions of 30 min a month	Can't run it	Can't run it	Can't run it
macOS agents 5 at once · 4 vCPU / 8 GB · 1,000 sessions of 20 min a month	Can't run it	Can't run it	Can't run it

Key features

Feature	Cloudflare Sandbox	Replit	boat
Kind of product	Sandbox SDK: containers your Worker creates and drives by code	AI app builder with browser workspaces and app hosting	Sandboxes you create, stop and fork by API, SDK or CLI
Isolation	Firecracker microVM per container, own kernel and network	Not documented; the security page says strong logical separation between users	Full VM with its own kernel on dedicated AMD Ryzen 9 9950X hosts
Creating machines from code	Yes, from a Worker, each sandbox backed by a Durable Object	MCP server tools to create, update and publish apps; no API to start many machines	API, SDK and CLI to create, stop, resume and fork many sandboxes
Largest machine	4 vCPU / 12 GiB / 20 GB disk by default (can be raised)	Reserved VM sizes such as 4 vCPU / 16 GB; workspace sizes no longer published	Up to 16 vCPU / 32 GB, depending on plan
Files between sessions	Disk is fresh after sleep; snapshots (public beta, 30 days) or R2 backups when your code saves them	Workspace files and Agent checkpoints; published apps should not rely on their filesystem	Disk kept; snapshot every minute and on stop; a stopped sandbox costs nothing
Fork a running sandbox	No fork; restore a saved snapshot or backup into a new sandbox	No fork of a running machine documented	Yes, without stopping it
Docker and nested virtualization	docker:dind with iptables and IP forwarding turned off; nested virtualization not documented	System packages come from Nix; the docs do not describe Docker, systemd or /dev/kvm	Full Docker, root, systemd and /dev/kvm on every machine
Desktop and computer use	Built-in desktop removed in SDK 0.10.2; bring your own	VNC pane that streams a desktop to your browser; no computer-use API	60fps desktop and Chromium, computer-use API, embeddable stream
Coding agents	Run Claude Code, Codex, OpenCode or Pi in your image; OpenCode has an SDK helper	Replit Agent, which you can also drive from an MCP client	Claude Code, Codex, OpenCode and more built in, with a prompt, steer and events API
Keeping keys out of the sandbox	Your outbound handler adds the token for any HTTP or HTTPS host; you write the code	Managed keys for OpenAI, Anthropic, Google and OpenRouter models; other keys are secrets in the app	Managed proxy for model providers and any HTTPS API you register; switch a credential to another account
Egress control	allowedHosts deny-by-default list plus outbound handlers in Worker code	No egress allowlist documented	No provider-side allowlist
Inbound traffic	HTTP and WebSocket previews routed through your Worker; no raw TCP or public IP	Published apps on HTTPS domains and custom domains; SSH into the workspace on paid plans	HTTPS URLs for up to 50 ports, token-protected; raw TCP; own IPv6 or IPv4; SSH
Sleep when idle	Stops after inactivity and wakes on the next request	Autoscale apps wake on the first request and go idle after 15 minutes	TTL based (1 h default, changeable); no wake on request
Regions	Several regions across Cloudflare's network, nearest free one picked	North America, Europe, Asia, South America and Australia for published apps on Core and up	EU only: Germany, Finland, France

Every feature Battleships tracks (43)

Feature	Cloudflare Sandbox	Replit	boat
Full VM (own kernel)	Yes	Yes	Yes
Docker inside	Yes	No	Yes
Nested virtualization	No	No	Yes
Root	Yes	Not published	Yes
Systemd	Not published	No	Yes
Desktop GUI	No	Yes	Yes
Browser	No	No	Yes
Computer-use API	No	No	Yes
SSH	Yes	Yes	Yes
Persistent disk	No	Yes	Yes
Pause/resume	No	No	Yes
Automatic snapshots	No	Yes	Yes
Fork/clone	No	Yes	Yes
Live fork (no pause)	No	No	Yes
Memory fork	No	No	No
Custom image (Docker or snapshot)	Yes	Yes	Yes
≥24 h sessions	Yes	Yes	Yes
Idle auto-stop	Yes	Yes	No
Wake on request	Yes	Yes	No
HTTPS preview URLs	Yes	Yes	Yes
Raw TCP inbound	No	Not published	Yes
Public IPv4	No	No	No
Egress allowlist	Yes	No	No
Secret proxy	Yes	Yes	Yes
Secret proxy for any API	Yes	No	Yes
Preinstalled agents	Yes	Yes	Yes
Agent harness API	Yes	Yes	Yes
MCP server	No	Yes	No
GPU	No	No	No
Windows	No	No	No
Arm64	No	Not published	No
Self-hosting	No	No	No
BYOC	No	No	No
Open source	Yes	No	No
Scoped API keys	Not published	Not published	Yes
Spend limits	No	Yes	Yes
Usage per sandbox (API)	Not published	Yes	Yes
Audit logs	Yes	Yes	No
SSO	Yes	Yes	No
SOC 2	Yes	Yes	No
HIPAA	Yes	No	No
EU data residency	Yes	Yes	Yes
Zero data retention	Not published	Not published	Yes

Performance

Cloudflare SandboxNot measured

ReplitNot measured

boat26.69 runs/s

There is no comparable measurement between these two. Neither Cloudflare Sandbox nor Replit has a result on StarSling's hpc-sandbox-benchmarks Node.js build-and-test loop. boat did 26.69 runs per second there at 4 vCPU / 8 GB, so we cannot say how much faster or slower either one is.

Node.js build-and-test loop at 4 vCPU / 8 GB, higher is better. Measured with the open hpc-sandbox-benchmarks suite. Cloudflare Sandbox and Replit have no published run in this suite yet, so there is no like-for-like number to compare.

Pricing in five scenarios

Each bill is priced from the providers' public price lists by the open Battleships engine, with the cheapest plan that runs the scenario.

Scenario	Cloudflare Sandbox, a month	Replit, a month	boat, a month
One coding agent, workdays 4 vCPU / 8 GB, 50 GB disk, 8 hours a day, 22 days a month, files kept between days	$39 · Workers Paid · with limits	$122 · Pro $100 (annual) · with limits	$20 · $20/mo
One agent that never stops 4 vCPU / 8 GB, 50 GB disk, running 24/7 all month	$148 · Workers Paid · with limits	$122 · Pro $100 (annual) · with limits	$26 · $20/mo
50 agents in parallel 50 machines of 4 vCPU / 8 GB at once, 8-hour sessions, 1,100 sessions a month, Docker inside	$1,660 · Workers Paid · with limits	$1,330 · Pro $1,000 (annual) · with limits	$317 · $20/mo × 3 seats
Sandboxes for your users 2 vCPU / 4 GB, 30,000 sessions of 10 minutes a month, up to 300 at once	$476 · Workers Paid	$403 · Pro $250 (annual) · with limits	$200 · $100/mo × 2 seats
1,000 short jobs at once 2 vCPU / 4 GB, 1,000 at once, 3 minutes each, 200,000 jobs a month	$1,889 · Workers Paid · with limits	$825 · Pro $1,000 (annual) · with limits	$2,000 · $2000/mo · with limits

Cloudflare Sandbox: You need Workers Paid ($5 a month minimum). CPU is billed only while busy, memory and disk on the instance size you picked until the container sleeps, and 4 vCPU always comes with 12 GiB.

Replit: Plans (Core $20, Pro from $100) turn into monthly credits for Agent work and hosting. A Reserved VM has a fixed monthly price per size and bills whether busy or idle; Autoscale bills only while it serves requests.

Replit: A monthly plan from $20 is all usage credit, billed per second while a sandbox runs. A stopped sandbox costs nothing and keeps its disk.

Limits in those scenarios

Cloudflare's disk resets after sleep, so any scenario that keeps 50 GB of files between sessions does not fit without your own snapshot code, and its 1,500 vCPU account limit is short of the 2,000 vCPU the 1,000-job burst needs. Replit is not a fit in any scenario because it is an app platform: each always-on agent is a Reserved VM billed all month, and it does not publish how many can run at once. On boat, the 1,000-job burst is queued above 90 starts a minute and needs more starts per day than the $2,000 plan allows.

Scenario	Cloudflare Sandbox	Replit	boat
One coding agent, workdays	missing persistent disk	different kind of product: app platform monthly / always-on product: priced as 1 machines kept on and reused	None that bite
One agent that never stops	missing persistent disk	different kind of product: app platform	None that bite
50 agents in parallel	missing persistent disk	adjacent product, not a like-for-like sandbox missing persistent disk, Docker inside different kind of product: app platform how many machines can run at once: limit not published, probably fine at 50 (the typical published limit is 50)	None that bite
Sandboxes for your users	None that bite	adjacent product, not a like-for-like sandbox different kind of product: app platform not confirmed: how many machines can run at once (you need 300; the typical published limit is 50)	None that bite
1,000 short jobs at once	Workers Paid: max 1,500 vCPU running at once (needs 2,000)	adjacent product, not a like-for-like sandbox different kind of product: app platform not confirmed: how many machines can run at once (you need 1,000; the typical published limit is 50)	max 2,400 starts/day (needs ~6,667) max 600 starts/hour (needs ~1,000) bursts above 90 starts/min are queued (a burst of 333 takes ~4 min to start)

Which one should you use?

Use Cloudflare Sandbox when

your app runs on Workers and needs short sandboxes, started by code, that sleep when idle and only reach hosts you allow.

Sandboxes your code starts. Useful for apps that need many short sandboxes: your Worker creates each one by code, and it sleeps when idle.
Egress rules you can program. Useful when sandboxes run untrusted code: block every host except the ones you list, and run your own code on each request.
Fits next to Workers. If your app already runs on Workers, sandboxes sit next to Durable Objects and R2, in several regions.

Use Replit when

you want Replit Agent to build a web app from a description and host it for you, with Postgres and storage built in.

An app built and hosted for you. Useful if you want a working app from a description: Replit Agent builds, tests and publishes it for you.
Databases and storage built in. Useful for full web apps: each app gets Postgres and App Storage next to it, with no setup.
A workspace for people. Useful for teams that code by hand in the browser, with Replit Agent and collaborators in the same workspace.

Where boat fits

If what you are really running is coding agents that work for hours, neither one is built for it: Cloudflare containers forget their disk when they sleep, and Replit hosts apps rather than handing your code machines. boat gives each agent a full VM that keeps its files, runs Docker and a desktop, and comes with agents you drive from outside.

A machine that keeps its files

On Cloudflare a sleeping sandbox wakes with a fresh disk unless your code saves a snapshot or R2 backup first. On Replit an always-on machine is a Reserved VM app. boat saves the disk every minute and on stop, and can fork a running sandbox.

Full Docker, root and /dev/kvm

Cloudflare runs Docker with iptables turned off and 20 GB of disk by default; Replit's Nix setup does not document Docker or systemd at all. boat's full VM runs docker compose, systemd services and Android emulators.

Agents and keys handled for you

On Cloudflare you bake each agent into your image and write the outbound handler for every token. Replit drives only Replit Agent. boat ships Claude Code, Codex and more with a steer and events API, plus a credentials proxy for any HTTPS API.

Use boat when your agents work for hours on a machine that keeps its files, with full Docker, a desktop and coding agents you drive from outside. Compare it one to one: boat vs Cloudflare Sandbox and boat vs Replit.

Questions people ask

Is Cloudflare Sandbox cheaper than Replit?

It depends on the job. One coding agent on workdays is $39 on Cloudflare and $122 on Replit, but for an agent that never stops Replit is lower at $122 against $148. Neither fits our agent scenarios as is: Cloudflare loses its disk on sleep, and Replit is an app platform. boat comes to $20 and $26 for those two.

Which is faster, Cloudflare Sandbox or Replit?

We cannot say. Neither has a result on the public benchmark we use, where boat did 26.69 Node.js build-and-test runs per second at 4 vCPU / 8 GB.

Can I run Docker on Cloudflare Sandbox or Replit?

On Cloudflare, yes, as docker:dind with iptables and IP forwarding turned off. Replit's docs set up environments with Nix packages and do not describe running Docker. Every boat sandbox runs full Docker with root and systemd.

Do they keep my files?

A Cloudflare sandbox keeps files only while it runs; after sleep it starts from a fresh disk unless your code saved a snapshot or R2 backup. Replit keeps workspace files and Agent checkpoints, but published apps should not rely on their filesystem. boat keeps the disk on its own.

Is Replit a sandbox for AI agents like Cloudflare Sandbox?

Not in the same sense. Cloudflare Sandbox gives your code containers to run work in, while Replit is an app builder whose outside entry point is an MCP server that drives Replit Agent one app at a time.

Where do they run?

Cloudflare places containers in several regions of its network. Replit hosts data mainly in the United States and publishes apps on five continents on Core and up. boat runs only in the EU, in Germany, Finland and France.

Try boat

Install the CLI, then run boat new.

7-day free trial