Deno Sandbox vs Agent 37
Deno Sandbox gives code a small Firecracker microVM that starts in under 200 ms, can only reach the hosts you allow, and ends within 30 minutes. Agent 37 gives each agent its own machine that stays around, sleeps when idle, and wakes on the next message.
The companies and products
Deno Sandbox
Deno Sandbox is part of Deno Deploy, the hosting platform from the company behind the Deno runtime, and runs untrusted or AI-generated code in Linux microVMs.
Each sandbox is a Firecracker microVM with 2 vCPU, up to 4 GB of memory and a 10 GB disk that is wiped when it ends, created from a TypeScript or Python SDK. Outbound traffic goes through a proxy that can enforce a host allowlist and swap placeholder secrets for real ones. It is built for short runs of agent or user code, and a sandbox can be promoted to a Deno Deploy app.
- Isolation
- Firecracker microVM per sandbox
Agent 37
Agent 37 hosts AI agents, one isolated, always-on sandbox per user, behind one API.
You create an instance from a template (Hermes, OpenClaw, Claude Code, Codex, OpenCode, Pi, Grok or your own Docker image) and talk to it through a chat API, files, exec, SSH and HTTPS URLs. The default instance is a container enforced by gVisor; a VM type gives a full Linux machine with its own kernel for Docker, Kubernetes and Android emulators. It is built for companies that give each of their customers an agent.
- Where it runs
- Dedicated servers in the United States
- Instance types
- Default (shared), Performance (dedicated cores), VM
- Compliance
- SOC 2 Type I, Type II in progress
Which use cases each one fits
For each use case, Battleships prices every sandbox provider on the same workload and sorts them from the cheapest monthly bill up. “290th cheapest of 367” means 289 of the other 366 providers run that workload, with every feature it needs, for less. “With limits” means the provider runs it but misses something, so it is listed after every full match. Open a use case for its whole ranking and what each provider misses.
| Use case and its workload | Deno Sandbox: price rank | Agent 37: price rank | boat: price rank |
|---|---|---|---|
| Software factory 100 at once · 4 vCPU / 8 GB · 2,200 sessions of 8 h a month Long builds and Docker outlast Deno's 30-minute, 2 vCPU sandbox; Agent 37 needs its VM type for Docker, while boat runs Docker and systemd in every sandbox. | 290th of 367, with limits $5,665 a month | 2nd cheapest of 367 $551 a month | 3rd cheapest of 367 $634 a month |
| Always-on AI employees 50 machines 24/7 · 2 vCPU / 4 GB Agent 37 is built for this: an assistant that sleeps when idle, keeps its memory and wakes on the next message, while a Deno sandbox ends after 30 minutes. | 287th of 366, with limits $5,803 a month | Cheapest of 366 $279 a month | 5th cheapest of 366 $657 a month |
| Code interpreter bursts 100 at once · 1 vCPU / 2 GB · 200,000 sessions of 1 min a month Short code runs suit both: Deno starts in under 200 ms and bills CPU only while code runs, and Agent 37's small default sandboxes cost little per minute. | 141st of 345, with limits $329 a month | Cheapest of 345 $22 a month | 186th of 345, with limits $2,000 a month |
| Sandboxes for your users 300 at once · 2 vCPU / 4 GB · 30,000 sessions of 23 min a month Deno Builder allows 20 sandboxes at once per region and Agent 37 holds 200 instances on its top self-serve tier, while boat plans go to hundreds at once. | 148th of 361, with limits $1,863 a month | 30th of 361, with limits $79 a month | Cheapest of 361 $209 a month |
| RL rollouts 1,000 at once · 2 vCPU / 4 GB · 1,000,000 sessions of 3 min a month | 122nd of 360, with limits $7,963 a month | 6th of 360, with limits $363 a month | 34th of 360, with limits $2,000 a month |
| Agent evals 250 at once · 4 vCPU / 8 GB · 15,000 sessions of 20 min a month | 296th of 364, with limits $1,563 a month | 90th of 364, with limits $58 a month | 10th cheapest of 364 $200 a month |
| CI runners 40 at once · 8 vCPU / 16 GB · 6,000 sessions of 12 min a month CI jobs that run Docker or emulators need Docker and /dev/kvm: Deno does not document either, Agent 37 has them only on its VM type, and boat has them everywhere. | 304th of 377, with limits $731 a month | 2nd cheapest of 377 $84 a month | 4th cheapest of 377 $86 a month |
| 24/7 dev boxes 1 machine 24/7 · 4 vCPU / 8 GB A dev box that stays on all month rules out Deno's 30-minute lifetime; Agent 37 and boat both keep the machine and its disk. | 179th of 368, with limits $200 a month | 3rd cheapest of 368 $12 a month | 18th cheapest of 368 $26 a month |
| Computer-use agents 50 at once · 4 vCPU / 8 GB · 20,000 sessions of 15 min a month Deno Sandbox has no desktop; Agent 37 adds a noVNC desktop through a template build, and boat streams a 60fps desktop with Chromium out of the box. | 280th of 369, with limits $1,583 a month | Cheapest of 369 $53 a month | 6th cheapest of 369 $200 a month |
| Browser-use agents 50 at once · 2 vCPU / 4 GB · 30,000 sessions of 10 min a month | 284th of 367, with limits $783 a month | 48th of 367, with limits $29 a month | 7th cheapest of 367 $200 a month |
| Scraping & bots (startup scale) 50 at once · 1 vCPU / 2 GB · 100,000 sessions of 3 min a month | 286th of 346, with limits $573 a month | Cheapest of 346 $32 a month | 6th cheapest of 346 $90 a month |
| Mass scraping & bots (undetectable) 1,000 at once · 1 vCPU / 2 GB · 3,000,000 sessions of 2 min a month | 247th of 338, with limits $11,923 a month | 36th of 338, with limits $648 a month | 71st of 338, with limits $1,800 a month |
| Parallel red teaming 200 at once · 2 vCPU / 4 GB · 5,000 sessions of 30 min a month Many parallel attempts fit Agent 37 and boat better than Deno's 20-at-once cap, and boat can fork a running sandbox to try many paths from one state. | 251st of 360, with limits $367 a month | Cheapest of 360 $43 a month | 2nd cheapest of 360 $200 a month |
| GPU eval jobs 10 at once · 8 vCPU / 32 GB · 500 sessions of 30 min a month | Can't run it | Can't run it | Can't run it |
| macOS agents 5 at once · 4 vCPU / 8 GB · 1,000 sessions of 20 min a month | Can't run it | Can't run it | Can't run it |
Key features
| Feature | Deno Sandbox | Agent 37 | boat |
|---|---|---|---|
| Isolation | Firecracker microVM with its own kernel | gVisor by default; full VM as an opt-in instance type | Every sandbox is a full VM with its own kernel on dedicated AMD Ryzen 9 9950X hosts |
| Machine size | 2 vCPU fixed, 768 MB to 4 GB memory, 10 GB disk | Shapes from 2 vCPU / 4 GB up to 16 vCPU / 32 GB after a first top-up | 4 vCPU / 8 GB by default, up to 16 vCPU / 32 GB on the $100 plan and above |
| Session length | Up to 30 minutes; longer work can be promoted to a Deno Deploy app | No time limit; runs until you stop it or it sleeps | No cap on paid plans; you set the time to live |
| Disk that persists | Root disk wiped when the sandbox ends; opt-in volumes of 300 MB to 20 GB, Chicago only | Disk kept until you delete the instance, billed even while stopped or asleep | The whole disk is kept, saved every minute and on stop; a stopped sandbox costs nothing |
| Sleep when idle | No; the sandbox ends with its session | Opt-in auto-sleep that keeps memory and wakes on the next request | No idle timer; a time limit you set, and resume reboots with the disk kept |
| Snapshots and fork | Read-only snapshots of a volume that new sandboxes can boot from; no fork | No fork; daily backups plus one on-demand backup, restored in place only | Snapshots every minute, named snapshots as templates, and fork of a running sandbox |
| Docker and nested virtualization | Root access; Docker and nested virtualization not documented | Docker and /dev/kvm only on the VM type, at 2.5x the default compute rate | Docker, systemd and /dev/kvm in every sandbox |
| Desktop and browser | No desktop; a VS Code editor in the browser and SSH | noVNC desktop through a template build or the Ubuntu VM template | Linux desktop streamed at 60fps, Chromium and computer use built in |
| Outbound rules | Host allowlist per sandbox, enforced by a proxy outside the VM | Open internet, no allowlist | Open internet, no provider-side allowlist |
| Keeping API keys out of the sandbox | Placeholder secrets swapped for real ones on requests to approved hosts | Managed models, search and Composio through a per-instance token; your own keys go in as env vars | Credentials proxy for model providers and any HTTPS API; switch a credential to another account when credits run out |
| Coding agents | A root image with Claude Code, run through the shell command API | Hermes, OpenClaw, Claude Code, Codex, Grok, OpenCode and Pi, with a chat API per instance | Seven agents preinstalled, with a prompt, steer and events API |
| Inbound access | HTTPS URL per exposed port, public without authentication; SSH | HTTPS URL per port, signed URLs, custom domains; SSH through a WebSocket tunnel | HTTPS URLs for up to 50 ports, token-protected by default; raw TCP |
| Start time | Under 200 ms | A few seconds to wake from a checkpoint | Boots a full VM |
| Regions | Amsterdam and Chicago | United States | EU only (Germany, Finland, France), EU data residency |
Every feature Battleships tracks (43)
| Feature | Deno Sandbox | Agent 37 | boat |
|---|---|---|---|
| Full VM (own kernel) | Yes | No | Yes |
| Docker inside | Not published | No | Yes |
| Nested virtualization | No | No | Yes |
| Root | Yes | Yes | Yes |
| Systemd | Not published | Not published | Yes |
| Desktop GUI | No | Yes | Yes |
| Browser | No | Yes | Yes |
| Computer-use API | No | Yes | Yes |
| SSH | Yes | Yes | Yes |
| Persistent disk | Yes | Yes | Yes |
| Pause/resume | No | Yes | Yes |
| Automatic snapshots | No | Yes | Yes |
| Fork/clone | No | Yes | Yes |
| Live fork (no pause) | No | Yes | Yes |
| Memory fork | No | No | No |
| Custom image (Docker or snapshot) | Yes | Yes | Yes |
| ≥24 h sessions | No | Yes | Yes |
| Idle auto-stop | No | Yes | No |
| Wake on request | No | Yes | No |
| HTTPS preview URLs | Yes | Yes | Yes |
| Raw TCP inbound | No | Not published | Yes |
| Public IPv4 | No | No | No |
| Egress allowlist | Yes | No | No |
| Secret proxy | Yes | Yes | Yes |
| Secret proxy for any API | Yes | No | Yes |
| Preinstalled agents | Yes | Yes | Yes |
| Agent harness API | No | Yes | Yes |
| MCP server | No | No | No |
| GPU | No | No | No |
| Windows | No | No | No |
| Arm64 | No | No | No |
| Self-hosting | No | No | No |
| BYOC | No | No | No |
| Open source | No | No | No |
| Scoped API keys | Not published | Not published | Yes |
| Spend limits | Yes | Yes | Yes |
| Usage per sandbox (API) | No | Yes | Yes |
| Audit logs | Not published | Not published | No |
| SSO | No | No | No |
| SOC 2 | Yes | Yes | No |
| HIPAA | Yes | No | No |
| EU data residency | Yes | No | Yes |
| Zero data retention | Not published | Not published | Yes |
Performance
There is no comparable measurement for either. boat did 26.69 runs per second on the StarSling hpc-sandbox-benchmarks Node.js build-and-test loop at 4 vCPU / 8 GB, but Deno Sandbox and Agent 37 are not in that benchmark. Deno's fixed 2 vCPU shape could not run the 4 vCPU test as set up, and Agent 37 says its default instances share host resources.
Node.js build-and-test loop at 4 vCPU / 8 GB, higher is better. Measured with the open hpc-sandbox-benchmarks suite. Deno Sandbox and Agent 37 have no published run in this suite yet, so there is no like-for-like number to compare.
Pricing in five scenarios
Each bill is priced from the providers' public price lists by the open Battleships engine, with the cheapest plan that runs the scenario.
| Scenario | Deno Sandbox, a month | Agent 37, a month | boat, a month |
|---|---|---|---|
| One coding agent, workdays 4 vCPU / 8 GB, 50 GB disk, 8 hours a day, 22 days a month, files kept between days | $53 · Pro · with limits | $6 · Wallet (any top-up) | $20 · $20/mo |
| One agent that never stops 4 vCPU / 8 GB, 50 GB disk, running 24/7 all month | $200 · Builder · with limits | $12 · Wallet (any top-up) | $26 · $20/mo |
| 50 agents in parallel 50 machines of 4 vCPU / 8 GB at once, 8-hour sessions, 1,100 sessions a month, Docker inside | $2,779 · Builder · with limits | $329 · Wallet ($100 lifetime top-ups) | $317 · $20/mo × 3 seats |
| Sandboxes for your users 2 vCPU / 4 GB, 30,000 sessions of 10 minutes a month, up to 300 at once | $783 · Builder · with limits | $33 · Wallet ($250 lifetime top-ups) · with limits | $200 · $100/mo × 2 seats |
| 1,000 short jobs at once 2 vCPU / 4 GB, 1,000 at once, 3 minutes each, 200,000 jobs a month | $1,563 · Builder · with limits | $73 · Wallet ($250 lifetime top-ups) · with limits | $2,000 · $2000/mo · with limits |
Deno Sandbox: Sandboxes need the Pro plan at $20 a month or Builder at $200 a month; the fee bundles CPU, memory and egress allowances shared with Deno Deploy apps. Past those, active CPU costs $0.10 an hour and memory $0.025 per GiB-hour for the whole life of the sandbox.
Agent 37: A prepaid wallet with no plan fee, metered per minute: $0.80 per vCPU and $0.70 per GB of RAM per month while running, and $0.09 per GB of disk per month even while stopped or asleep. Performance compute costs 4x and VM compute 2.5x the default rate.
Agent 37: Plans start at $20 a month, and the whole fee is usage credit. You pay per second while a sandbox runs, and a stopped sandbox costs nothing and keeps its disk.
Limits in those scenarios
Deno Sandbox fits none of the five scenarios as written: a sandbox lives up to 30 minutes, is fixed at 2 vCPU with up to 4 GB, and Builder allows 20 at once per region. Agent 37 fits the workday agent, the always-on agent and 50 agents in parallel, with the 50-agent fleet priced on its VM type for Docker, but its top self-serve tier stops at 200 instances, counting sleeping and stopped ones, so 300 user sandboxes and 1,000 jobs at once do not fit. boat fits four of the five; at 1,000 short jobs at once its top plan queues starts above 90 a minute, so none of the three fits that one without a custom plan.
| Scenario | Deno Sandbox | Agent 37 | boat |
|---|---|---|---|
| One coding agent, workdays |
|
| None that bite |
| One agent that never stops |
|
| None that bite |
| 50 agents in parallel |
|
| None that bite |
| Sandboxes for your users |
|
| None that bite |
| 1,000 short jobs at once |
|
|
|
Which one should you use?
Use Deno Sandbox when
you run short pieces of untrusted code that must start in milliseconds and reach only the hosts you allow, especially if you already deploy on Deno Deploy.
- Locked-down outbound traffic. Good for running untrusted code: each sandbox can be limited to a list of hosts, enforced by a proxy outside the VM.
- Starts in under 200 ms. Fits per-request code runs: a sandbox starts in under 200 ms and CPU bills only while code is running.
- Part of Deno Deploy. Fits teams already on Deno Deploy: a sandbox can be promoted to a Deploy app and bills on the same meters.
Use Agent 37 when
you host one mostly idle assistant per customer in the US that should sleep with its memory kept and wake on the next message.
- Sleeps and keeps its memory. Good for assistants idle most of the day: an instance sleeps, keeps its memory and wakes on the next message.
- No time limit on a machine. Fits agents that live on one machine: an instance runs until you stop it, with its disk kept.
- Bring your own Docker image. Fits teams with an existing image: templates build from your own Docker image, and dedicated cores are an option.
Where boat fits
Look at boat when your agents do real work for hours: installs, builds, Docker, emulators and a browser. Deno Sandbox stops at 30 minutes on 2 vCPU, and Agent 37 keeps Docker and a kernel of its own behind a costlier opt-in type. boat gives every sandbox a full VM with all of that by default.
A full VM in every sandbox
Agents start Docker, databases and emulators. Deno does not document Docker or /dev/kvm, and Agent 37's default gVisor type cannot run Docker; its VM type bills compute at 2.5x and has no systemd.
A machine you can fork
Neither Deno nor Agent 37 can fork a running sandbox, so every parallel try rebuilds its state from the start. boat copies a running sandbox, disk and all, and saves its disk every minute.
A desktop and keys kept outside
Deno has no desktop, and Agent 37 needs a template build for one. On Agent 37 your own API keys sit inside the machine; boat streams a 60fps desktop and proxies keys for any HTTPS API.
Use boat when your agents do real work for hours: installs, builds, tests, Docker and emulators on a full VM in the EU, with forks of running machines, a 60fps desktop and keys kept outside for any API. Compare it one to one: boat vs Deno Sandbox and boat vs Agent 37.
Questions people ask
Is Deno Sandbox cheaper than Agent 37?
No. In every scenario on this page Agent 37's bill is far lower; for one agent that never stops, Agent 37 comes to $12 a month against $200 on Deno Builder. Deno Sandbox also does not fit any of the five scenarios as written.
Which is faster, Deno Sandbox or Agent 37?
Neither has a result on the CPU benchmark this page uses, so there is no fair speed comparison. Deno Sandbox starts in under 200 ms, while Agent 37 wakes from a checkpoint in a few seconds.
Can Deno Sandbox or Agent 37 run Docker?
Deno's docs do not say Docker works inside a sandbox. Agent 37 runs Docker and Compose on its VM type, which bills compute at 2.5x, but not on its default gVisor type. boat runs Docker and systemd in every sandbox.
How long can each one run?
A Deno sandbox lives up to 30 minutes, and its root disk is wiped when it ends. An Agent 37 instance has no time limit and runs until you stop it or it sleeps. A boat sandbox has no lifetime cap on paid plans.
Where do they run?
Deno Sandbox runs in Amsterdam and Chicago, and Agent 37 runs on dedicated servers in the United States. boat runs only in the EU, in Germany, Finland and France, with EU data residency.
Is boat SOC 2 compliant?
SOC 2 is in progress. We're open about where we stand: live status at status.ascii.dev and our data retention policy at docs.boat.dev/data-retention.
Try boat
Install the CLI, then run boat new.
7-day free trial