Daytona vs Cloudflare Sandbox
Daytona keeps a sandbox's disk while it is stopped and adds VM, Windows and GPU classes on top of its default containers. Cloudflare runs each sandbox as a container in its own Firecracker microVM inside Workers, and it sleeps when idle and starts again on a fresh disk.
The companies and products
Daytona
Daytona is a cloud for running AI-generated code: you create sandboxes from code through its API and SDKs.
By default a Daytona sandbox is a Linux container with its own namespaces and reserved vCPU, memory and disk. You can also pick a Linux VM class (pause, fork, memory snapshots, /dev/kvm), a Windows VM class, or a GPU class with Nvidia and AMD cards. It is built for teams that run agent code, code interpreters and evals through Python, TypeScript, Ruby, Go or Java SDKs.
- Founded
- 2023
Cloudflare Sandbox
Cloudflare Sandbox SDK runs untrusted or AI-generated code in Linux containers on Cloudflare's network, driven from a Cloudflare Worker.
Each sandbox is a Cloudflare Container backed by a Durable Object, and each container runs in its own Firecracker microVM with its own kernel and network. You build a linux/amd64 image, pick an instance type of up to 4 vCPU and 12 GiB, and reach the sandbox through your own Worker. It suits teams already on Workers who want short-lived sandboxes that sleep when idle; for code that only calls known methods, Cloudflare also offers Dynamic Workers, which run JavaScript in V8 isolates.
- Largest instance
- 4 vCPU, 12 GiB memory, 20 GB disk (defaults, can be raised)
- Account limits
- 1,500 vCPU, 6 TiB memory and 30 TB disk running at once
- Compliance
- Cloudflare holds a SOC 2 Type II report
Which use cases each one fits
For each use case, Battleships prices every sandbox provider on the same workload and sorts them from the cheapest monthly bill up. “15th cheapest of 367” means 14 of the other 366 providers run that workload, with every feature it needs, for less. “With limits” means the provider runs it but misses something, so it is listed after every full match. Open a use case for its whole ranking and what each provider misses.
| Use case and its workload | Daytona: price rank | Cloudflare Sandbox: price rank | boat: price rank |
|---|---|---|---|
| Software factory 100 at once · 4 vCPU / 8 GB · 2,200 sessions of 8 h a month Daytona ranks 15th and fits a full workday because the disk stays; Cloudflare is a compromise because the disk resets on sleep, and boat ranks 3rd with Docker, a desktop and agents built in. | 15th cheapest of 367 $4,111 a month | 162nd of 367, with limits $1,543 a month | 3rd cheapest of 367 $634 a month |
| Always-on AI employees 50 machines 24/7 · 2 vCPU / 4 GB Always-on assistants need their files to stay, which Daytona does and Cloudflare does not without your own snapshot code; boat keeps each one on its own VM. | 24th cheapest of 366 $6,104 a month | 207th of 366, with limits $2,188 a month | 5th cheapest of 366 $657 a month |
| Code interpreter bursts 100 at once · 1 vCPU / 2 GB · 200,000 sessions of 1 min a month Both fit short code-interpreter calls: Cloudflare ranks 13th because it bills CPU only while busy and wakes on the next request, and Daytona ranks 25th. | 25th cheapest of 345 $271 a month | 13th cheapest of 345 $144 a month | 186th of 345, with limits $2,000 a month |
| Sandboxes for your users 300 at once · 2 vCPU / 4 GB · 30,000 sessions of 23 min a month Cloudflare fits 300 user sandboxes at once within its 1,500 vCPU account limit, while Daytona's Tier 4 pool of 500 vCPU is short of the 600 needed; boat ranks 1st here. | 154th of 361, with limits $2,000 a month | 9th cheapest of 361 $731 a month | Cheapest of 361 $209 a month |
| RL rollouts 1,000 at once · 2 vCPU / 4 GB · 1,000,000 sessions of 3 min a month | 130th of 360, with limits $8,261 a month | 144th of 360, with limits $9,428 a month | 34th of 360, with limits $2,000 a month |
| Agent evals 250 at once · 4 vCPU / 8 GB · 15,000 sessions of 20 min a month Cloudflare ranks 45th and fits; Daytona ranks 189th as a compromise, and boat ranks 10th. | 189th of 364, with limits $2,000 a month | 45th cheapest of 364 $818 a month | 10th cheapest of 364 $200 a month |
| CI runners 40 at once · 8 vCPU / 16 GB · 6,000 sessions of 12 min a month | 308th of 377, with limits $805 a month | 301st of 377, with limits $704 a month | 4th cheapest of 377 $86 a month |
| 24/7 dev boxes 1 machine 24/7 · 4 vCPU / 8 GB Cloudflare ranks 70th and Daytona 183rd; boat stops at no cost and resumes with its disk, which suits a dev box you leave and come back to. | 183rd of 368, with limits $245 a month | 70th cheapest of 368 $93 a month | 18th cheapest of 368 $26 a month |
| Computer-use agents 50 at once · 4 vCPU / 8 GB · 20,000 sessions of 15 min a month Daytona has a VNC desktop and a computer-use API on Linux and Windows; Cloudflare removed its built-in desktop, so you would bring your own. | 26th cheapest of 369 $1,198 a month | 166th of 369, with limits $460 a month | 6th cheapest of 369 $200 a month |
| Browser-use agents 50 at once · 2 vCPU / 4 GB · 30,000 sessions of 10 min a month | 93rd of 367, with limits $598 a month | 210th of 367, with limits $233 a month | 7th cheapest of 367 $200 a month |
| Scraping & bots (startup scale) 50 at once · 1 vCPU / 2 GB · 100,000 sessions of 3 min a month | 38th cheapest of 346 $404 a month | 250th of 346, with limits $286 a month | 6th cheapest of 346 $90 a month |
| Mass scraping & bots (undetectable) 1,000 at once · 1 vCPU / 2 GB · 3,000,000 sessions of 2 min a month | 202nd of 338, with limits $8,073 a month | 169th of 338, with limits $5,741 a month | 71st of 338, with limits $1,800 a month |
| Parallel red teaming 200 at once · 2 vCPU / 4 GB · 5,000 sessions of 30 min a month | 12th cheapest of 360 $2,000 a month | 239th of 360, with limits $325 a month | 2nd cheapest of 360 $200 a month |
| GPU eval jobs 10 at once · 8 vCPU / 32 GB · 500 sessions of 30 min a month Only Daytona fits: it rents Nvidia and AMD GPUs by the hour, and neither Cloudflare Sandbox nor boat has GPUs. | 20th cheapest of 98 $1,190 a month | Can't run it | Can't run it |
| macOS agents 5 at once · 4 vCPU / 8 GB · 1,000 sessions of 20 min a month | Can't run it | Can't run it | Can't run it |
Key features
| Feature | Daytona | Cloudflare Sandbox | boat |
|---|---|---|---|
| Isolation | Container by default; Linux VM and Windows VM classes with their own kernel | Firecracker microVM per container, own kernel and network | Full VM with its own kernel on dedicated AMD Ryzen 9 9950X hosts |
| CPU speed (Node.js build-and-test, 4 vCPU / 8 GB) | 21.52 runs/s on the Linux VM class; the default container class reported no result | No result on this benchmark | 26.69 runs/s |
| Largest machine | 4 vCPU / 8 GiB / 10 GiB disk per sandbox by default (can be raised) | 4 vCPU / 12 GiB / 20 GB disk by default (can be raised) | Up to 16 vCPU / 32 GB, depending on plan |
| Docker and nested virtualization | Docker in all classes; /dev/kvm only on Linux VMs, once KVM is turned on for your organization | docker:dind with iptables and IP forwarding turned off; nested virtualization not documented | Full Docker, root, systemd and /dev/kvm on every machine |
| Desktop and computer use | VNC desktop (xfce4) and a computer-use API on Linux and Windows | Built-in desktop removed in SDK 0.10.2; bring your own | 60fps desktop and Chromium, computer-use API, embeddable stream |
| Files after a stop | Disk kept and billed while stopped; archived containers are free | Fresh disk after sleep; snapshots (public beta, 30 days) or R2 backups when your code saves them | Snapshot every minute and on stop; a stopped sandbox costs nothing |
| Pause and fork | Linux VM and Windows classes pause, resume and fork with memory kept; containers do not | No pause or fork; restore a saved snapshot into a new sandbox | Fork a running sandbox; resume reboots from disk (no memory snapshots) |
| Idle behavior | Containers auto-stop after 15 idle minutes, VMs auto-pause after 60; can be turned off | Sleeps after inactivity and wakes on the next request | TTL based (1 h default, changeable); no idle timer |
| Running at once | Org-wide pool: 10, 100, 250 or 500 vCPU from Tier 1 to Tier 4 | 1,500 vCPU, 6 TiB memory and 30 TB disk per account by default | 100 to 2,000 sandboxes by plan, plus start limits |
| Reaching the sandbox | HTTPS preview URLs on any port, token-protected or public; SSH; no raw TCP or public IP | HTTP and WebSocket previews routed through your Worker; no raw TCP or public IP | HTTPS URLs for up to 50 ports, token-protected; raw TCP; own IPv6 or IPv4 |
| Outbound internet | Tier 1 and 2 reach only registries, git hosts and AI APIs; Tier 3 and up get open internet plus allowlists | Open internet, or an allowedHosts list plus outbound handlers you write in Worker code | Open internet on every plan; no provider-side allowlist |
| Coding agents | Guides install agents and run them through process exec | Run Claude Code, Codex, OpenCode or Pi in your image; OpenCode has an SDK helper | Claude Code, Codex, pi, OpenCode and more built in, with a prompt, steer and events API |
| GPUs and Windows | Nvidia and AMD GPUs by the hour; Windows VM sandboxes | No GPUs, no Windows | No GPUs; no Windows guests (Wine for Windows apps) |
| Regions | US and EU, plus dedicated regions or your own machines (BYOC) | Several regions across Cloudflare's network, nearest free one picked | EU only: Germany, Finland, France |
Every feature Battleships tracks (43)
| Feature | Daytona | Cloudflare Sandbox | boat |
|---|---|---|---|
| Full VM (own kernel) | No | Yes | Yes |
| Docker inside | Yes | Yes | Yes |
| Nested virtualization | Yes | No | Yes |
| Root | Yes | Yes | Yes |
| Systemd | Not published | Not published | Yes |
| Desktop GUI | Yes | No | Yes |
| Browser | Yes | No | Yes |
| Computer-use API | Yes | No | Yes |
| SSH | Yes | Yes | Yes |
| Persistent disk | Yes | No | Yes |
| Pause/resume | Yes | No | Yes |
| Automatic snapshots | Yes | No | Yes |
| Fork/clone | Yes | No | Yes |
| Live fork (no pause) | No | No | Yes |
| Memory fork | Yes | No | No |
| Custom image (Docker or snapshot) | Yes | Yes | Yes |
| ≥24 h sessions | Yes | Yes | Yes |
| Idle auto-stop | Yes | Yes | No |
| Wake on request | No | Yes | No |
| HTTPS preview URLs | Yes | Yes | Yes |
| Raw TCP inbound | No | No | Yes |
| Public IPv4 | No | No | No |
| Egress allowlist | Yes | Yes | No |
| Secret proxy | Yes | Yes | Yes |
| Secret proxy for any API | Yes | Yes | Yes |
| Preinstalled agents | Yes | Yes | Yes |
| Agent harness API | No | Yes | Yes |
| MCP server | Yes | No | No |
| GPU | Yes | No | No |
| Windows | Yes | No | No |
| Arm64 | No | No | No |
| Self-hosting | No | No | No |
| BYOC | Yes | No | No |
| Open source | No | Yes | No |
| Scoped API keys | Yes | Not published | Yes |
| Spend limits | Not published | No | Yes |
| Usage per sandbox (API) | Yes | Not published | Yes |
| Audit logs | Yes | Yes | No |
| SSO | Yes | Yes | No |
| SOC 2 | Yes | Yes | No |
| HIPAA | Yes | Yes | No |
| EU data residency | Yes | Yes | Yes |
| Zero data retention | Not published | Not published | Yes |
Performance
In StarSling's public run of 2026-09-29 at 4 vCPU / 8 GB, boat did 26.69 Node.js build-and-test runs per second and Daytona's Linux VM class did 21.52, so boat finished about a quarter more work. Daytona's default container class reported no result, and Cloudflare Sandbox has no result on this benchmark, so there is no CPU number to compare it with.
Node.js build-and-test loop at 4 vCPU / 8 GB, higher is better. Measured with the open hpc-sandbox-benchmarks suite. Daytona measured on: Linux VM sandbox (same rates; KVM / nested virt per-org feature). Cloudflare Sandbox has no published run in this suite yet, so there is no like-for-like number to compare.
Pricing in five scenarios
Each bill is priced from the providers' public price lists by the open Battleships engine, with the cheapest plan that runs the scenario.
| Scenario | Daytona, a month | Cloudflare Sandbox, a month | boat, a month |
|---|---|---|---|
| One coding agent, workdays 4 vCPU / 8 GB, 50 GB disk, 8 hours a day, 22 days a month, files kept between days | $56 · Tier 3 ($500 top-up) | $39 · Workers Paid · with limits | $20 · $20/mo |
| One agent that never stops 4 vCPU / 8 GB, 50 GB disk, running 24/7 all month | $245 · Tier 3 ($500 top-up) | $148 · Workers Paid · with limits | $26 · $20/mo |
| 50 agents in parallel 50 machines of 4 vCPU / 8 GB at once, 8-hour sessions, 1,100 sessions a month, Docker inside | $2,682 · Tier 3 ($500 top-up) | $1,660 · Workers Paid · with limits | $317 · $20/mo × 3 seats |
| Sandboxes for your users 2 vCPU / 4 GB, 30,000 sessions of 10 minutes a month, up to 300 at once | $2,000 · Tier 4 ($2,000 top-up every 30 days) · with limits | $476 · Workers Paid | $200 · $100/mo × 2 seats |
| 1,000 short jobs at once 2 vCPU / 4 GB, 1,000 at once, 3 minutes each, 200,000 jobs a month | $2,000 · Tier 4 ($2,000 top-up every 30 days) · with limits | $1,889 · Workers Paid · with limits | $2,000 · $2000/mo · with limits |
Daytona: Daytona bills per second for the vCPU, memory and disk you reserve, including while a sandbox starts or stops, and keeps billing the disk while it is stopped. You pay from a prepaid wallet: open internet needs a $500 top-up (Tier 3), and the biggest pool needs $2,000 every 30 days (Tier 4).
Cloudflare Sandbox: Cloudflare needs Workers Paid ($5 a month minimum) and bills CPU only while it is in use, with memory and disk billed on the instance size until the container sleeps. There is no 4 vCPU / 8 GB size, so 4 vCPU always comes with 12 GiB, and Worker and Durable Object requests are billed on top.
Cloudflare Sandbox: You pick a monthly plan from $20, and all of it becomes usage credit spent per second on running sandboxes. A stopped sandbox costs nothing and keeps its disk.
Limits in those scenarios
Daytona limits the total vCPU running at once, 500 vCPU at Tier 4, so 300 sandboxes for your users (600 vCPU) and 1,000 short jobs at once (2,000 vCPU) need a custom limit, and Tier 1 and 2 reach only an allowlist of services. Cloudflare's disk resets after sleep, so the scenarios that keep 50 GB of files between days do not fit without your own snapshot or backup code, and its default 1,500 vCPU per account is short of the 1,000-job burst, though it can be raised. On boat that burst runs into start limits: bursts above 90 starts a minute wait in a queue.
| Scenario | Daytona | Cloudflare Sandbox | boat |
|---|---|---|---|
| One coding agent, workdays |
|
| None that bite |
| One agent that never stops |
|
| None that bite |
| 50 agents in parallel |
|
| None that bite |
| Sandboxes for your users |
| None that bite | None that bite |
| 1,000 short jobs at once |
|
|
|
Which one should you use?
Use Daytona when
your agents need GPUs, Windows, memory-keeping pause and fork, or a sandbox that keeps its disk without extra code.
- Files that stay put. Useful for agents that work across days: a stopped Daytona sandbox keeps its disk, while Cloudflare starts again from a fresh one.
- GPUs and Windows. Useful if your agents test models or need Windows: Daytona rents Nvidia and AMD GPUs and runs Windows VM sandboxes.
- Pause with memory, US and your own machines. Daytona's VM classes pause and fork with memory kept, and it runs in the US, the EU or on machines you bring.
Use Cloudflare Sandbox when
your app already runs on Workers and you want many short sandboxes that sleep when idle and wake on the next request.
- A microVM for every sandbox. Each Cloudflare sandbox gets its own Firecracker microVM and kernel by default, without picking a special class.
- Sleeps when idle, wakes on request. Useful for many short, spiky sessions: a sandbox sleeps when idle, wakes on the next request, and bills CPU only while busy.
- Bigger pool and programmable egress. An account can run 1,500 vCPU at once, and outbound handlers in your Worker can check or block each request.
Where boat fits
Look at boat when your agents do long work, such as installs, builds, tests, Docker and emulators, and need the machine to keep its files. Daytona gives you that only on its VM class, and Cloudflare forgets the disk on sleep. boat gives every sandbox a full VM that does it by default.
A full VM with Docker and /dev/kvm
On Daytona the default sandbox is a container on a shared kernel, and /dev/kvm needs the VM class plus KVM turned on for your organization. On Cloudflare, Docker runs with iptables turned off and nested virtualization is not documented.
Disk saved every minute, stops are free
Cloudflare wipes the disk on sleep, so an agent loses its repo and packages unless your code saves a snapshot (public beta, 30 days) or an R2 backup. Daytona keeps the disk but keeps billing it while stopped.
Agents and a desktop, driven from outside
On Daytona you install each agent and run it as a process; on Cloudflare you bake it into your image and have no desktop. boat ships Claude Code, Codex and others with a prompt, steer and events API and a 60fps desktop.
Use boat when your agents work for hours on a full, faster VM that keeps its files, with Docker, /dev/kvm, a desktop and coding agents built in. Compare it one to one: boat vs Daytona and boat vs Cloudflare Sandbox.
Questions people ask
Is Daytona cheaper than Cloudflare Sandbox?
Cloudflare's estimate is lower in every scenario we priced, for example $39 against $56 for one coding agent on workdays, but it does not keep the 50 GB disk between days without your own snapshot code. For 300 sandboxes for your users, Cloudflare fits at $476 a month, while Daytona lands at $2,000 and still needs a higher vCPU limit. boat comes to $20 a month for the workday agent.
Which is faster, Daytona or Cloudflare Sandbox?
There is no shared number. Daytona's Linux VM class did 21.52 runs per second in StarSling's Node.js build-and-test benchmark, and Cloudflare has no result there. boat did 26.69 in the same run.
Do Daytona and Cloudflare Sandbox keep my files?
Daytona keeps the disk while a sandbox is stopped and bills for it. Cloudflare starts a sandbox that slept from a fresh disk, unless your code saved a snapshot (public beta, kept 30 days) or a backup to R2. boat saves the disk every minute and on stop.
Can I run Docker inside Daytona or Cloudflare Sandbox?
Yes, in both. Daytona runs Docker in all classes, and /dev/kvm only on its Linux VM class. Cloudflare supports docker:dind with iptables and IP forwarding turned off. boat runs full Docker with systemd and /dev/kvm.
Are they containers or VMs?
Daytona's default is a container that shares the host kernel, with Linux VM and Windows VM classes on request. Cloudflare ships your container image but runs each one in its own Firecracker microVM. Every boat sandbox is a full VM.
Which one has GPUs or Windows?
Only Daytona. It rents Nvidia and AMD GPUs by the hour and runs Windows VM sandboxes. Cloudflare Sandbox and boat have neither.
Try boat
Install the CLI, then run boat new.
7-day free trial