Cloudflare Sandbox vs Unikraft Cloud

Both run each sandbox in its own Firecracker microVM and both sleep when idle. Cloudflare bills per use inside its Workers platform and wipes the disk on sleep, while Unikraft sells flat pools of running capacity and snapshots memory so instances wake in milliseconds with their state.

The companies and products

Cloudflare Sandbox

Cloudflare Sandbox SDK runs untrusted or AI-generated code in Linux containers on Cloudflare's network, driven from a Cloudflare Worker.

Each sandbox is a Cloudflare Container backed by a Durable Object, and each container runs in its own Firecracker microVM with its own kernel and network. You build a linux/amd64 image, pick an instance type of up to 4 vCPU and 12 GiB, and reach the sandbox through your own Worker. It suits teams already on Workers who want short-lived sandboxes that sleep when idle; for code that only calls known methods, Cloudflare also offers Dynamic Workers, which run JavaScript in V8 isolates.

Isolation: Firecracker microVM per container, own kernel and network
Largest instance: 4 vCPU, 12 GiB memory, 20 GB disk (defaults, can be raised)
Disk: Ephemeral by default: a container that sleeps starts again from a fresh disk
Plan needed: Workers Paid, $5 a month account minimum; not on the Free plan
Account limits: 1,500 vCPU, 6 TiB memory and 30 TB disk running at once
Placement: Instances spread across several regions of Cloudflare's network, nearest free one picked
Compliance: Cloudflare holds a SOC 2 Type II report

Unikraft Cloud

Unikraft Cloud is a microVM cloud from Unikraft Inc. that runs any Dockerfile-based workload as a minimal Linux microVM with millisecond cold starts and scale-to-zero.

Your Dockerfile becomes the VM image at build time, and each instance runs on a heavily customized Firecracker VMM, so it boots in milliseconds and can go into standby when no traffic arrives. It is a general compute platform built for dense, bursty work such as HTTP services, headless browsers and agent fleets, sold as flat self-serve plans plus Enterprise dedicated hosts, on-prem and bring your own cloud. It is not a dev machine you log into: instances are reached through services, the CLI and a sandbox plugin for commands and files.

Isolation: Linux microVM per instance on a customized Firecracker VMM; full VMs on Enterprise
Plans: Hobby free, Team $39/mo, Pro $199/mo, Enterprise custom; each caps running instances, vCPUs and memory
Running capacity: 2 / 8 / 24 running instances with 4 / 8 / 32 GiB memory in total on Hobby / Team / Pro
Regions: Dallas, Frankfurt, San Francisco, Singapore and Washington DC by default; more metros on request
Self-hosting: Dedicated host fleet, on-prem and BYOC on Enterprise
Compliance: SOC2, HIPAA and audit logs listed on Enterprise
Open source: The unikraft CLI is open source; the cloud platform is commercial

Which use cases each one fits

For each use case, Battleships prices every sandbox provider on the same workload and sorts them from the cheapest monthly bill up. “13th cheapest of 345” means 12 of the other 344 providers run that workload, with every feature it needs, for less. “With limits” means the provider runs it but misses something, so it is listed after every full match. Open a use case for its whole ranking and what each provider misses.

Use case and its workload	Cloudflare Sandbox: price rank	Unikraft Cloud: price rank	boat: price rank
Software factory 100 at once · 4 vCPU / 8 GB · 2,200 sessions of 8 h a month A software factory needs Docker and files that last a whole day; Cloudflare wipes the disk on sleep and runs Docker with iptables off, and Unikraft documents no container runtime inside.	162nd of 367, with limits $1,543 a month	Can't run it	3rd cheapest of 367 $634 a month
Always-on AI employees 50 machines 24/7 · 2 vCPU / 4 GB	207th of 366, with limits $2,188 a month	Can't run it	5th cheapest of 366 $657 a month
Code interpreter bursts 100 at once · 1 vCPU / 2 GB · 200,000 sessions of 1 min a month Short code-interpreter calls suit Cloudflare well, since CPU is billed only while busy; Unikraft fits the shape too but has no ranked fit here, and self-serve plans cap you at 24 running instances.	13th cheapest of 345 $144 a month	Can't run it	186th of 345, with limits $2,000 a month
Sandboxes for your users 300 at once · 2 vCPU / 4 GB · 30,000 sessions of 23 min a month Cloudflare fits sandboxes for your users on Workers Paid, while Unikraft Pro runs only 24 instances at once, so hundreds of active users need an Enterprise contract; boat fits on paid plans.	9th cheapest of 361 $731 a month	Can't run it	Cheapest of 361 $209 a month
RL rollouts 1,000 at once · 2 vCPU / 4 GB · 1,000,000 sessions of 3 min a month	144th of 360, with limits $9,428 a month	Can't run it	34th of 360, with limits $2,000 a month
Agent evals 250 at once · 4 vCPU / 8 GB · 15,000 sessions of 20 min a month	45th cheapest of 364 $818 a month	Can't run it	10th cheapest of 364 $200 a month
CI runners 40 at once · 8 vCPU / 16 GB · 6,000 sessions of 12 min a month CI jobs that build images or run emulators need full Docker and /dev/kvm; Cloudflare caps disk at 20 GB by default, Unikraft keeps nested virtualization for Enterprise, and boat has both on every plan.	301st of 377, with limits $704 a month	Can't run it	4th cheapest of 377 $86 a month
24/7 dev boxes 1 machine 24/7 · 4 vCPU / 8 GB Unikraft keeps a box in standby with its state but has no SSH yet, and Cloudflare starts from a fresh disk after sleep; boat keeps the disk and lets you SSH in.	70th cheapest of 368 $93 a month	219th of 368, with limits $39 a month	18th cheapest of 368 $26 a month
Computer-use agents 50 at once · 4 vCPU / 8 GB · 20,000 sessions of 15 min a month Neither Cloudflare nor Unikraft ships a desktop, so computer-use agents need one built into your image; boat streams a 60fps desktop with a computer-use API.	166th of 369, with limits $460 a month	Can't run it	6th cheapest of 369 $200 a month
Browser-use agents 50 at once · 2 vCPU / 4 GB · 30,000 sessions of 10 min a month Unikraft is used for headless Chrome at scale and Cloudflare leaves the browser to your image; boat gives each sandbox Chromium on a desktop.	210th of 367, with limits $233 a month	Can't run it	7th cheapest of 367 $200 a month
Scraping & bots (startup scale) 50 at once · 1 vCPU / 2 GB · 100,000 sessions of 3 min a month	250th of 346, with limits $286 a month	Can't run it	6th cheapest of 346 $90 a month
Mass scraping & bots (undetectable) 1,000 at once · 1 vCPU / 2 GB · 3,000,000 sessions of 2 min a month	169th of 338, with limits $5,741 a month	Can't run it	71st of 338, with limits $1,800 a month
Parallel red teaming 200 at once · 2 vCPU / 4 GB · 5,000 sessions of 30 min a month Red-team runs want raw TCP and full root networking; Cloudflare containers cannot change iptables or take raw TCP from outside, and Unikraft reaches instances only through its load balancer.	239th of 360, with limits $325 a month	Can't run it	2nd cheapest of 360 $200 a month
GPU eval jobs 10 at once · 8 vCPU / 32 GB · 500 sessions of 30 min a month	Can't run it	Can't run it	Can't run it
macOS agents 5 at once · 4 vCPU / 8 GB · 1,000 sessions of 20 min a month	Can't run it	Can't run it	Can't run it

Key features

Feature	Cloudflare Sandbox	Unikraft Cloud	boat
Isolation	Firecracker microVM per container, own kernel and network	Minimal Linux microVM on a customized Firecracker VMM	Full VM with its own kernel on dedicated AMD Ryzen 9 9950X hosts
Machine size	Up to 4 vCPU / 12 GiB / 20 GB disk per container by default (can be raised)	Plan pool shared by all running instances: 2 vCPU / 4 GiB, 8 vCPU / 8 GiB or 24 vCPU / 32 GiB	4 vCPU / 8 GB by default, up to 16 vCPU / 32 GB per sandbox on the $100 plan and above
Files between sessions	Disk is fresh after sleep; snapshots (public beta, 30 days) or R2 backups when your code saves them	Stateful standby snapshots memory and resumes with warm caches; volumes available	Disk saved every minute and on stop; a stopped sandbox costs nothing
Fork and checkpoints	No fork; restore a saved snapshot or backup into a new sandbox	Checkpoint a running microVM's memory and volumes, then start new instances from it (forking in preview)	Fork a running sandbox with its disk, without stopping it
Docker inside	docker:dind with iptables and IP forwarding turned off	The Dockerfile becomes the VM image; no container runtime inside documented	Full Docker, root and systemd
Nested virtualization	Not documented	Yes, with a per-instance flag, Enterprise only	Yes, /dev/kvm on every plan
SSH	Yes	Not yet; commands and files go through the sandbox plugin and CLI	Yes, into every sandbox
Desktop and browser	Built-in desktop removed in SDK 0.10.2; bring your own	None built in; run your own headless browser from a Dockerfile	60fps desktop and Chromium, computer-use API, embeddable stream
Wake on request	Stops after inactivity and wakes on the next request	Standby after a 1 second idle cooldown by default; traffic wakes it in milliseconds	No idle timer; a stopped sandbox is started by API
Inbound traffic	HTTP and WebSocket previews routed through your Worker; no raw TCP or public IP	Load balancer services: HTTP, HTTPS and TLS-wrapped TCP; no public IP per instance	HTTPS URLs for up to 50 ports, token-protected; raw TCP; own IPv4 or IPv6
Egress control	allowedHosts deny-by-default list plus outbound handlers in Worker code, on Workers Paid	Network shield filters traffic, Enterprise only, limited access	Open internet, no provider-side allowlist
Keeping API keys out of the sandbox	Your outbound handler adds the token for any HTTP or HTTPS host; you write the code	Network shield can inject secrets, Enterprise only	Managed proxy for model providers and any HTTPS API, on every plan; switch a credential to another account
Coding agents	Run Claude Code, Codex, OpenCode or Pi in your image; OpenCode has an SDK helper	None preinstalled; bring the agent in your own image	Claude Code, Codex and more preinstalled, with a prompt, steer and events API
Regions and hosting	Several regions across Cloudflare's network; no self-hosting	Dallas, Frankfurt, San Francisco, Singapore, Washington DC; on-prem and BYOC on Enterprise	EU only: Germany, Finland, France

Every feature Battleships tracks (43)

Feature	Cloudflare Sandbox	Unikraft Cloud	boat
Full VM (own kernel)	Yes	Yes	Yes
Docker inside	Yes	No	Yes
Nested virtualization	No	Yes	Yes
Root	Yes	Yes	Yes
Systemd	Not published	Not published	Yes
Desktop GUI	No	No	Yes
Browser	No	No	Yes
Computer-use API	No	No	Yes
SSH	Yes	No	Yes
Persistent disk	No	Yes	Yes
Pause/resume	No	Yes	Yes
Automatic snapshots	No	Yes	Yes
Fork/clone	No	Yes	Yes
Live fork (no pause)	No	Yes	Yes
Memory fork	No	Yes	No
Custom image (Docker or snapshot)	Yes	Yes	Yes
≥24 h sessions	Yes	Yes	Yes
Idle auto-stop	Yes	Yes	No
Wake on request	Yes	Yes	No
HTTPS preview URLs	Yes	Yes	Yes
Raw TCP inbound	No	Not published	Yes
Public IPv4	No	No	No
Egress allowlist	Yes	Yes	No
Secret proxy	Yes	Yes	Yes
Secret proxy for any API	Yes	Yes	Yes
Preinstalled agents	Yes	No	Yes
Agent harness API	Yes	No	Yes
MCP server	No	No	No
GPU	No	Yes	No
Windows	No	No	No
Arm64	No	Yes	No
Self-hosting	No	Yes	No
BYOC	No	Yes	No
Open source	Yes	No	No
Scoped API keys	Not published	Not published	Yes
Spend limits	No	Not published	Yes
Usage per sandbox (API)	Not published	No	Yes
Audit logs	Yes	Yes	No
SSO	Yes	No	No
SOC 2	Yes	Yes	No
HIPAA	Yes	Yes	No
EU data residency	Yes	Yes	Yes
Zero data retention	Not published	Not published	Yes

Performance

Cloudflare SandboxNot measured

Unikraft CloudNot measured

boat26.69 runs/s

boat scores 26.69 runs per second on the hpc-sandbox-benchmarks Node.js loop at 4 vCPU / 8 GB. Neither Cloudflare Sandbox nor Unikraft Cloud has a result on that benchmark, so there is no comparable CPU number for either. Unikraft states cold starts under 10 ms, which is its own figure for start time, not CPU speed.

Node.js build-and-test loop at 4 vCPU / 8 GB, higher is better. Measured with the open hpc-sandbox-benchmarks suite. Cloudflare Sandbox and Unikraft Cloud have no published run in this suite yet, so there is no like-for-like number to compare.

Pricing in five scenarios

Each bill is priced from the providers' public price lists by the open Battleships engine, with the cheapest plan that runs the scenario.

Scenario	Cloudflare Sandbox, a month	Unikraft Cloud, a month	boat, a month
One coding agent, workdays 4 vCPU / 8 GB, 50 GB disk, 8 hours a day, 22 days a month, files kept between days	$39 · Workers Paid · with limits	$39 · Hobby	$20 · $20/mo
One agent that never stops 4 vCPU / 8 GB, 50 GB disk, running 24/7 all month	$148 · Workers Paid · with limits	$39 · Hobby	$26 · $20/mo
50 agents in parallel 50 machines of 4 vCPU / 8 GB at once, 8-hour sessions, 1,100 sessions a month, Docker inside	$1,660 · Workers Paid · with limits	Can't run it	$317 · $20/mo × 3 seats
Sandboxes for your users 2 vCPU / 4 GB, 30,000 sessions of 10 minutes a month, up to 300 at once	$476 · Workers Paid	Can't run it	$200 · $100/mo × 2 seats
1,000 short jobs at once 2 vCPU / 4 GB, 1,000 at once, 3 minutes each, 200,000 jobs a month	$1,889 · Workers Paid · with limits	Can't run it	$2,000 · $2000/mo · with limits

Cloudflare Sandbox: You need Workers Paid ($5 a month minimum). CPU is billed only while in use, and memory and disk on the instance size you picked until the container sleeps; 4 vCPU always comes with 12 GiB.

Unikraft Cloud: Unikraft charges a flat monthly fee for a pool of running capacity: free for 2 vCPU / 4 GiB, $39 for 8 vCPU / 8 GiB, $199 for 24 vCPU / 32 GiB. It publishes no per-hour rate, so anything bigger is an Enterprise quote.

Unikraft Cloud: Plans start at $20 a month, and the whole fee is usage credit, billed per second while a sandbox runs. A stopped sandbox costs nothing and keeps its disk.

Limits in those scenarios

Cloudflare's disk resets after sleep, so the scenarios that keep 50 GB of files between days do not fit without your own snapshot code, and an account runs 1,500 vCPU at once by default, short of the 2,000 the 1,000-job burst needs. Unikraft's pools are shared by every running instance: one 4 vCPU / 8 GB agent fills the Team pool, so the 50-agent, user-sandbox and burst scenarios need Enterprise. boat fits all but the burst, where the $2,000 plan allows 600 starts an hour and queues the rest.

Scenario	Cloudflare Sandbox	Unikraft Cloud	boat
One coding agent, workdays	missing persistent disk	flat pool: the tier is billed whether used or not disk beyond 0 GiB: price unknown egress price not published	None that bite
One agent that never stops	missing persistent disk	flat pool: the tier is billed whether used or not disk beyond 0 GiB: price unknown egress price not published	None that bite
50 agents in parallel	missing persistent disk	no pool tier with 200 vCPU / 400 GiB for 50 VMs no published per-resource rate	None that bite
Sandboxes for your users	None that bite	no pool tier with 600 vCPU / 1,200 GiB for 300 VMs no published per-resource rate	None that bite
1,000 short jobs at once	Workers Paid: max 1,500 vCPU running at once (needs 2,000)	no pool tier with 2,000 vCPU / 4,000 GiB for 1,000 VMs no published per-resource rate	max 2,400 starts/day (needs ~6,667) max 600 starts/hour (needs ~1,000) bursts above 90 starts/min are queued (a burst of 333 takes ~4 min to start)

Which one should you use?

Use Cloudflare Sandbox when

your app already runs on Workers and you want many short sandboxes, billed per use, with egress rules you write in code.

Pay only while it works. For short, spiky sessions, Cloudflare bills CPU only while busy and scales to many sandboxes without buying a fixed pool.
Egress rules on a self-serve plan. Teams that must lock down outbound traffic get a deny-by-default host list and their own request handlers without an Enterprise contract.
Fits apps already on Workers. If your app runs on Workers, sandboxes sit next to Durable Objects and R2 with little to wire up.

Use Unikraft Cloud when

you run small services or headless browsers that sleep most of the time and must wake in milliseconds, or need on-prem, your own cloud or GPUs under Enterprise.

Wakes in milliseconds with its memory. For services that sleep most of the time, Unikraft snapshots memory and wakes on the next request with warm caches.
A flat bill for small fleets. A fixed monthly pool, with sleeping instances not counted, suits teams that want a known bill for a few always-ready services.
Your own hardware or cloud. Enterprise customers can run it on dedicated hosts, on-prem or in their own cloud, with GPUs and arm64 hosts.

Where boat fits

Cloudflare and Unikraft are both built for sandboxes that sleep often and start fast. If your agents instead work for hours in one place, building with Docker, running emulators or using a desktop, boat gives each one a whole machine that keeps its files, with agents you drive from outside already installed.

A full machine with Docker and /dev/kvm

Agents start databases with docker compose and run emulators. Cloudflare runs Docker with iptables off on 20 GB of disk by default, and Unikraft has no documented container runtime and keeps nested virtualization for Enterprise.

Files that stay put between sessions

On Cloudflare a sleeping sandbox loses its cloned repo and installs unless your code saves a snapshot that expires in 30 days. boat saves the disk every minute and on stop, and a stopped sandbox costs nothing.

Agents, keys and a desktop built in

Neither ships a desktop or preinstalled agents. On Cloudflare you write the outbound handler that adds every key; on Unikraft secret injection is Enterprise only. boat ships a 60fps desktop and seven agents, and its credentials proxy works on every plan.

Use boat when your agents need a real machine for hours: full Docker, /dev/kvm, a desktop, files kept between sessions and coding agents you drive from outside. Compare it one to one: boat vs Cloudflare Sandbox and boat vs Unikraft Cloud.

Questions people ask

Is Cloudflare Sandbox cheaper than Unikraft Cloud?

For one agent running 24/7, Unikraft's $39 Team pool is lower than Cloudflare's $148 estimate, and on workdays both come to $39. For 50 agents, sandboxes for your users or 1,000 short jobs, no self-serve Unikraft plan is big enough, while Cloudflare prices the user-sandbox scenario at $476 a month. boat comes to $20 and $26 a month for one agent.

Which is faster, Cloudflare Sandbox or Unikraft Cloud?

Neither has a CPU result on the benchmark this page uses, so there is no fair CPU comparison. For start time, Unikraft says its microVMs cold boot in under 10 ms and wake on the next request, which is its main design goal.

Can Cloudflare Sandbox or Unikraft Cloud run Docker?

Cloudflare supports docker:dind with iptables and IP forwarding turned off. Unikraft uses your Dockerfile to build the VM image and does not document a container runtime inside a running instance. boat runs full Docker with systemd and root.

Do they keep my files when a sandbox sleeps?

Cloudflare starts from a fresh disk after sleep unless your code saved a snapshot (public beta, kept 30 days) or an R2 backup. Unikraft's stateful standby snapshots memory and resumes with warm caches. boat saves the disk every minute and on stop.

Can I SSH into them?

Cloudflare containers support SSH. Unikraft has announced SSH as coming soon, and today you use its sandbox plugin and CLI for commands and files. Every boat sandbox takes SSH.

Where do they run?

Cloudflare places containers in several regions of its network. Unikraft runs in Dallas, Frankfurt, San Francisco, Singapore and Washington DC, with on-prem and your own cloud on Enterprise. boat runs in the EU only, in Germany, Finland and France.

Try boat

Install the CLI, then run boat new.

7-day free trial