Cloudflare Sandbox vs Upstash Box
Cloudflare Sandbox runs each sandbox in its own Firecracker microVM inside the Workers platform, but its disk starts fresh after sleep. Upstash Box is a Docker container with a coding agent built in that pauses when idle and keeps its files.
The companies and products
Cloudflare Sandbox
Cloudflare Sandbox SDK runs untrusted or AI-generated code in Linux containers on Cloudflare's network, driven from a Cloudflare Worker.
Each sandbox is a Cloudflare Container backed by a Durable Object, and each container runs in its own Firecracker microVM with its own kernel and network. You build a linux/amd64 image, pick an instance type of up to 4 vCPU and 12 GiB, and reach the sandbox through your own Worker. It suits teams already on Workers who want short-lived sandboxes that sleep when idle; for code that only calls known methods, Cloudflare also offers Dynamic Workers, which run JavaScript in V8 isolates.
- Largest instance
- 4 vCPU, 12 GiB memory, 20 GB disk (defaults, can be raised)
- Account limits
- 1,500 vCPU, 6 TiB memory and 30 TB disk running at once
- Compliance
- Cloudflare holds a SOC 2 Type II report
Upstash Box
Upstash Box is a cloud computer for AI agents from Upstash, the company known for serverless Redis, Vector and QStash.
Each box is a Docker container with its own filesystem, shell, git and an optional coding agent such as Claude Code, Codex or OpenCode, which you drive from TypeScript or Python SDKs. A box pauses when it sits idle, keeps its files, and you pay for the CPU it actually uses. Upstash built it to run its own Context7 service and opened it to everyone in March 2026.
Which use cases each one fits
For each use case, Battleships prices every sandbox provider on the same workload and sorts them from the cheapest monthly bill up. “13th cheapest of 345” means 12 of the other 344 providers run that workload, with every feature it needs, for less. “With limits” means the provider runs it but misses something, so it is listed after every full match. Open a use case for its whole ranking and what each provider misses.
| Use case and its workload | Cloudflare Sandbox: price rank | Upstash Box: price rank | boat: price rank |
|---|---|---|---|
| Software factory 100 at once · 4 vCPU / 8 GB · 2,200 sessions of 8 h a month A software factory needs Docker and files that survive a break; Cloudflare runs Docker with iptables off but resets the disk on sleep, Upstash keeps files but has no Docker, and boat ranks 3rd with both. | 162nd of 367, with limits $1,543 a month | 61st of 367, with limits $464 a month | 3rd cheapest of 367 $634 a month |
| Always-on AI employees 50 machines 24/7 · 2 vCPU / 4 GB | 207th of 366, with limits $2,188 a month | 103rd of 366, with limits $475 a month | 5th cheapest of 366 $657 a month |
| Code interpreter bursts 100 at once · 1 vCPU / 2 GB · 200,000 sessions of 1 min a month Both fit short code runs well, with Upstash Box ranking 10th and Cloudflare Sandbox 13th, since each bills CPU only while it is busy and wakes on the next request. | 13th cheapest of 345 $144 a month | 10th cheapest of 345 $119 a month | 186th of 345, with limits $2,000 a month |
| Sandboxes for your users 300 at once · 2 vCPU / 4 GB · 30,000 sessions of 23 min a month Both fit sandboxes for your users; Upstash Box ranks 2nd at $222 a month and Cloudflare Sandbox 9th at $731, and boat ranks first at $209. | 9th cheapest of 361 $731 a month | 2nd cheapest of 361 $222 a month | Cheapest of 361 $209 a month |
| RL rollouts 1,000 at once · 2 vCPU / 4 GB · 1,000,000 sessions of 3 min a month | 144th of 360, with limits $9,428 a month | 352nd of 360, with limits $8,068 a month | 34th of 360, with limits $2,000 a month |
| Agent evals 250 at once · 4 vCPU / 8 GB · 15,000 sessions of 20 min a month Both fit agent evals, Cloudflare Sandbox at $818 a month and Upstash Box at $1,011, while boat ranks 10th at $200. | 45th cheapest of 364 $818 a month | 52nd cheapest of 364 $1,011 a month | 10th cheapest of 364 $200 a month |
| CI runners 40 at once · 8 vCPU / 16 GB · 6,000 sessions of 12 min a month CI jobs that build images need Docker and room on disk; Upstash has no Docker inside, Cloudflare caps disk at 20 GB with iptables off, and boat ranks 4th with full Docker. | 301st of 377, with limits $704 a month | 120th cheapest of 377 $1,520 a month | 4th cheapest of 377 $86 a month |
| 24/7 dev boxes 1 machine 24/7 · 4 vCPU / 8 GB A dev box must keep its files when you log off, which an Upstash keep-alive box does for a flat price, while a Cloudflare container starts from a fresh disk after sleep. | 70th cheapest of 368 $93 a month | 10th cheapest of 368 $20 a month | 18th cheapest of 368 $26 a month |
| Computer-use agents 50 at once · 4 vCPU / 8 GB · 20,000 sessions of 15 min a month Neither ships a desktop: Cloudflare removed its built-in one and Upstash offers a headless Chromium, while boat streams a Linux desktop at 60fps. | 166th of 369, with limits $460 a month | 73rd of 369, with limits $76 a month | 6th cheapest of 369 $200 a month |
| Browser-use agents 50 at once · 2 vCPU / 4 GB · 30,000 sessions of 10 min a month Upstash ships a managed headless Chromium with AI page actions; on Cloudflare you bake a browser into your own image, and boat gives the agent a desktop browser it can see. | 210th of 367, with limits $233 a month | 49th of 367, with limits $38 a month | 7th cheapest of 367 $200 a month |
| Scraping & bots (startup scale) 50 at once · 1 vCPU / 2 GB · 100,000 sessions of 3 min a month | 250th of 346, with limits $286 a month | 37th cheapest of 346 $400 a month | 6th cheapest of 346 $90 a month |
| Mass scraping & bots (undetectable) 1,000 at once · 1 vCPU / 2 GB · 3,000,000 sessions of 2 min a month | 169th of 338, with limits $5,741 a month | 200th of 338, with limits $8,000 a month | 71st of 338, with limits $1,800 a month |
| Parallel red teaming 200 at once · 2 vCPU / 4 GB · 5,000 sessions of 30 min a month | 239th of 360, with limits $325 a month | 225th of 360, with limits $259 a month | 2nd cheapest of 360 $200 a month |
| GPU eval jobs 10 at once · 8 vCPU / 32 GB · 500 sessions of 30 min a month | Can't run it | Can't run it | Can't run it |
| macOS agents 5 at once · 4 vCPU / 8 GB · 1,000 sessions of 20 min a month | Can't run it | Can't run it | Can't run it |
Key features
| Feature | Cloudflare Sandbox | Upstash Box | boat |
|---|---|---|---|
| Isolation | Firecracker microVM per container, own kernel and network | Docker container per box on AWS | Full VM with its own kernel on dedicated AMD Ryzen 9 9950X hosts |
| Files after a pause | Disk is fresh after sleep; snapshots (public beta, 30 days) or R2 backups when your code saves them | Pauses when idle and keeps its files; storage keeps billing while paused | Disk saved every minute and on stop; a stopped sandbox costs nothing |
| Largest machine | 4 vCPU / 12 GiB / 20 GB disk by default (can be raised) | Large: 8 vCPU / 16 GB / 20 GB disk | Up to 16 vCPU / 32 GB on the $100 plan and above; 50 GB disk at 4 vCPU / 8 GB |
| Docker inside | docker:dind with iptables and IP forwarding turned off | Not documented; the box is itself a Docker container | Full Docker, root and systemd |
| Nested virtualization | Not documented | No; boxes are containers | Yes, /dev/kvm for Android emulators and VMs |
| Fork | No fork; restore a saved snapshot or backup into a new sandbox | Snapshot a running box and start many new boxes from it | Fork a running sandbox with its disk, without stopping it |
| Wake on request | Stops after inactivity and wakes on the next request | A request to a public URL resumes a paused box | No; a stopped sandbox is started by API |
| Desktop and browser | Built-in desktop removed in SDK 0.10.2; bring your own | Managed headless Chromium with AI page actions and CDP; no desktop | 60fps Linux desktop and Chromium, computer-use API, embeddable stream |
| Coding agents | Run Claude Code, Codex, OpenCode or Pi in your image; OpenCode has an SDK helper | Claude Code, Codex and OpenCode built in, with run and stream APIs, webhooks and scheduled prompts | Claude Code, Codex, pi, OpenCode and more built in, with a prompt, steer and events API |
| Inbound traffic | HTTP and WebSocket previews routed through your Worker; no raw TCP or public IP | HTTPS URL per port, public unless you add a token; SSH through a gateway; no raw TCP | HTTPS URLs for up to 50 ports, token-protected; raw TCP |
| Outbound rules | allowedHosts deny-by-default list plus outbound handlers you write in Worker code | Allow all, deny all, or allow and deny by domain and CIDR, changeable on a running box | Open internet, no provider-side allowlist |
| Keeping keys out of the sandbox | Your outbound handler adds the token for any HTTP or HTTPS host; you write the code | Host proxy injects headers into outbound HTTPS on port 443; set when the box is created | Managed proxy for model providers and any HTTPS API; switch a credential to another account |
| Running at once | 1,500 vCPU, 6 TiB memory and 30 TB disk per account by default | 1,000 boxes on Pay as You Go, raised on request | No session cap on paid plans; up to 90 starts a minute, then starts queue |
| Regions | Several regions across Cloudflare's network | US only (AWS us-east-1) | EU only (Germany, Finland, France) |
Every feature Battleships tracks (43)
| Feature | Cloudflare Sandbox | Upstash Box | boat |
|---|---|---|---|
| Full VM (own kernel) | Yes | No | Yes |
| Docker inside | Yes | No | Yes |
| Nested virtualization | No | No | Yes |
| Root | Yes | Not published | Yes |
| Systemd | Not published | Not published | Yes |
| Desktop GUI | No | No | Yes |
| Browser | No | Yes | Yes |
| Computer-use API | No | No | Yes |
| SSH | Yes | Yes | Yes |
| Persistent disk | No | Yes | Yes |
| Pause/resume | No | Yes | Yes |
| Automatic snapshots | No | No | Yes |
| Fork/clone | No | Yes | Yes |
| Live fork (no pause) | No | Yes | Yes |
| Memory fork | No | No | No |
| Custom image (Docker or snapshot) | Yes | Yes | Yes |
| ≥24 h sessions | Yes | Yes | Yes |
| Idle auto-stop | Yes | Yes | No |
| Wake on request | Yes | Yes | No |
| HTTPS preview URLs | Yes | Yes | Yes |
| Raw TCP inbound | No | No | Yes |
| Public IPv4 | No | No | No |
| Egress allowlist | Yes | Yes | No |
| Secret proxy | Yes | Yes | Yes |
| Secret proxy for any API | Yes | Yes | Yes |
| Preinstalled agents | Yes | Yes | Yes |
| Agent harness API | Yes | Yes | Yes |
| MCP server | No | Yes | No |
| GPU | No | No | No |
| Windows | No | No | No |
| Arm64 | No | Yes | No |
| Self-hosting | No | No | No |
| BYOC | No | No | No |
| Open source | Yes | No | No |
| Scoped API keys | Not published | Not published | Yes |
| Spend limits | No | Not published | Yes |
| Usage per sandbox (API) | Not published | Yes | Yes |
| Audit logs | Yes | Not published | No |
| SSO | Yes | No | No |
| SOC 2 | Yes | Yes | No |
| HIPAA | Yes | No | No |
| EU data residency | Yes | No | Yes |
| Zero data retention | Not published | Not published | Yes |
Performance
Neither Cloudflare Sandbox nor Upstash Box has a result on the hpc-sandbox-benchmarks CPU test, so there is no comparable speed number between them. boat did 26.69 runs per second on that Node.js build-and-test loop at 4 vCPU / 8 GB, on dedicated AMD Ryzen 9 9950X hosts.
Node.js build-and-test loop at 4 vCPU / 8 GB, higher is better. Measured with the open hpc-sandbox-benchmarks suite. Cloudflare Sandbox and Upstash Box have no published run in this suite yet, so there is no like-for-like number to compare.
Pricing in five scenarios
Each bill is priced from the providers' public price lists by the open Battleships engine, with the cheapest plan that runs the scenario.
| Scenario | Cloudflare Sandbox, a month | Upstash Box, a month | boat, a month |
|---|---|---|---|
| One coding agent, workdays 4 vCPU / 8 GB, 50 GB disk, 8 hours a day, 22 days a month, files kept between days | $39 · Workers Paid · with limits | $21 · Pay as You Go | $20 · $20/mo |
| One agent that never stops 4 vCPU / 8 GB, 50 GB disk, running 24/7 all month | $148 · Workers Paid · with limits | $21 · Pay as You Go | $26 · $20/mo |
| 50 agents in parallel 50 machines of 4 vCPU / 8 GB at once, 8-hour sessions, 1,100 sessions a month, Docker inside | $1,660 · Workers Paid · with limits | $900 · Pay as You Go · with limits | $317 · $20/mo × 3 seats |
| Sandboxes for your users 2 vCPU / 4 GB, 30,000 sessions of 10 minutes a month, up to 300 at once | $476 · Workers Paid | $306 · Pay as You Go | $200 · $100/mo × 2 seats |
| 1,000 short jobs at once 2 vCPU / 4 GB, 1,000 at once, 3 minutes each, 200,000 jobs a month | $1,889 · Workers Paid · with limits | $1,822 · Pay as You Go | $2,000 · $2000/mo · with limits |
Cloudflare Sandbox: You need Workers Paid ($5 a month minimum). CPU is billed only while busy, but memory and disk are billed on the instance size until the container sleeps, and 4 vCPU always comes with 12 GiB.
Upstash Box: A standard box is billed per active CPU hour by size, with RAM free and storage at $0.10 per GB-month. A keep-alive box costs a flat $8, $16 or $32 a month whether it is busy or not.
Upstash Box: Plans start at $20 a month, and the whole fee is usage credit, billed per second while a sandbox runs. A stopped sandbox costs nothing and keeps its disk.
Limits in those scenarios
Cloudflare's disk resets after sleep, so none of the scenarios that keep files fit there without your own snapshot code, and its 1,500 vCPU account limit is short of the 2,000 the 1,000-job burst needs. Upstash fits that burst, but with no Docker inside it misses the 50-agent scenario, and its egress price is not published. boat fits the 50-agent scenario at $317 a month, but its start rate limit queues the 1,000-job burst.
| Scenario | Cloudflare Sandbox | Upstash Box | boat |
|---|---|---|---|
| One coding agent, workdays |
|
| None that bite |
| One agent that never stops |
|
| None that bite |
| 50 agents in parallel |
|
| None that bite |
| Sandboxes for your users | None that bite |
| None that bite |
| 1,000 short jobs at once |
|
|
|
Which one should you use?
Use Cloudflare Sandbox when
your app already runs on Workers and you want short sandboxes that wake on request, with egress rules you write as code.
- A microVM with its own kernel. Each container runs in its own Firecracker microVM, and Docker works inside it, with iptables turned off.
- Egress you can program. Useful when every outbound request must pass your own Worker code, on top of a deny-by-default host list.
- Close to your Workers app. If your app already runs on Workers, sandboxes sit next to Durable Objects and R2, in several regions.
Use Upstash Box when
your agents mostly wait, need to keep their files between pauses, come with a coding agent built in, and can run in the US.
- Files stay through a pause. A box pauses when idle and comes back with its files, so an agent can pick up where it stopped.
- Agents ready out of the box. Claude Code, Codex and OpenCode come built in, with streaming, webhooks and scheduled prompts.
- Pay only for CPU you use. Good for agents that wait a lot: idle CPU and RAM cost nothing, and a keep-alive box has a flat price.
Where boat fits
Look at boat if your agents need more than a short run: full Docker, a big disk that is never wiped, emulators or a desktop. Cloudflare resets the disk after sleep and Upstash cannot run Docker, which is why neither fits the 50-agent scenario on this page.
A full machine with Docker and /dev/kvm
Upstash has no Docker inside a box, and Cloudflare runs Docker with iptables off and no documented nested virtualization. boat gives each agent root, systemd, full Docker and /dev/kvm for emulators and VMs.
Files that are never wiped, and room for them
A Cloudflare sandbox loses its disk on sleep unless your code saves a snapshot, and both stop at 20 GB. boat saves the disk every minute, keeps 50 GB at 4 vCPU / 8 GB, and a stopped sandbox costs nothing.
A desktop and real hosting
Neither ships a desktop, and neither takes raw TCP from outside. boat streams a 60fps desktop for computer-use agents, serves HTTPS on up to 50 ports and takes raw TCP.
Use boat when your agents need a real machine for hours: full Docker, emulators, a desktop, a big disk that is never wiped and hosting on many ports. Compare it one to one: boat vs Cloudflare Sandbox and boat vs Upstash Box.
Questions people ask
Is Cloudflare Sandbox cheaper than Upstash Box?
Not in the scenarios on this page: Upstash costs less in all five. For sandboxes for your users it is $306 a month against $476 on Cloudflare, and for 1,000 short jobs at once it is $1,822 against $1,889.
Which one keeps my files?
Upstash Box does: a box pauses when idle and resumes with its files, and storage keeps billing while paused. A Cloudflare sandbox starts from a fresh disk after sleep unless your code saved a snapshot or an R2 backup.
Can I run Docker inside Cloudflare Sandbox or Upstash Box?
On Cloudflare, yes, through docker:dind with iptables and IP forwarding turned off. Upstash does not document Docker inside a box, since each box is itself a Docker container. boat runs full Docker and systemd.
Which is faster?
Neither has a result on the hpc-sandbox-benchmarks CPU test, so there is no fair speed comparison. boat scored 26.69 runs per second on that test at 4 vCPU / 8 GB.
Which has better isolation?
Cloudflare runs each container in its own Firecracker microVM with its own kernel. An Upstash box is a Docker container with its own filesystem, process tree and network stack. boat sandboxes are full VMs with their own kernel.
Where do they run?
Cloudflare places containers in several regions of its network. Upstash Box runs in AWS us-east-1 only, with more regions planned. boat runs in the EU, in Germany, Finland and France.
Try boat
Install the CLI, then run boat new.
7-day free trial
More comparisons
- boat vs Cloudflare Sandbox
- boat vs Upstash Box
- E2B vs Cloudflare Sandbox
- Daytona vs Cloudflare Sandbox
- Modal vs Cloudflare Sandbox
- Vercel Sandbox vs Cloudflare Sandbox
- Cloudflare Sandbox vs Blaxel
- Cloudflare Sandbox vs Runloop
- Cloudflare Sandbox vs Tensorlake
- Cloudflare Sandbox vs Morph Cloud
- Cloudflare Sandbox vs CodeSandbox SDK
- Cloudflare Sandbox vs Northflank