Deno Sandbox vs AWS AgentCore
Both run agent code in small Firecracker microVMs. Deno Sandbox is built for short, locked-down runs that start in under 200 ms, while AgentCore is an AWS platform that hosts agents for up to 8 hours and adds a managed code interpreter and browser.
The companies and products
Deno Sandbox
Deno Sandbox is part of Deno Deploy, the hosting platform from the company behind the Deno runtime, and runs untrusted or AI-generated code in Linux microVMs.
Each sandbox is a Firecracker microVM with 2 vCPU, up to 4 GB of memory and a 10 GB disk that is wiped when it ends, created from a TypeScript or Python SDK. Outbound traffic goes through a proxy that can enforce a host allowlist and swap placeholder secrets for real ones. It is built for short runs of agent or user code, and a sandbox can be promoted to a Deno Deploy app.
- Isolation
- Firecracker microVM per sandbox
AWS AgentCore
Amazon Bedrock AgentCore is a set of AWS services to deploy and run AI agents: a Runtime that hosts your agent code, plus built-in Code Interpreter and Browser tools.
AgentCore is not a sandbox product first. It is a hyperscaler's agent platform: you push a container image or code, and each Runtime session gets its own Firecracker microVM that you reach through AgentCore APIs. Around it sit managed tools (Code Interpreter, Browser) and services for memory, identity, gateways and evaluations, and an Instances compute type runs longer sessions on EC2 in your own account. It is built for teams who already build on AWS and want agents to stay inside their account, IAM and VPC.
Which use cases each one fits
For each use case, Battleships prices every sandbox provider on the same workload and sorts them from the cheapest monthly bill up. “290th cheapest of 367” means 289 of the other 366 providers run that workload, with every feature it needs, for less. “With limits” means the provider runs it but misses something, so it is listed after every full match. Open a use case for its whole ranking and what each provider misses.
| Use case and its workload | Deno Sandbox: price rank | AWS AgentCore: price rank | boat: price rank |
|---|---|---|---|
| Software factory 100 at once · 4 vCPU / 8 GB · 2,200 sessions of 8 h a month A coding agent needs hours, Docker and more than 2 vCPU; Deno stops at 30 minutes and AgentCore microVMs at 8 hours, while boat gives a full VM with Docker and no cap. | 290th of 367, with limits $5,665 a month | 100th of 367, with limits $888 a month | 3rd cheapest of 367 $634 a month |
| Always-on AI employees 50 machines 24/7 · 2 vCPU / 4 GB An assistant that runs all month outlasts both: Deno ends after 30 minutes and AgentCore needs its Instances type on EC2, while a boat sandbox just keeps running. | 287th of 366, with limits $5,803 a month | 64th of 366, with limits $1,300 a month | 5th cheapest of 366 $657 a month |
| Code interpreter bursts 100 at once · 1 vCPU / 2 GB · 200,000 sessions of 1 min a month Both bill CPU only while code runs, but AgentCore Code Interpreter is a ready-made tool for this and allows 1,000 sessions at once, against 20 per region on Deno Builder. | 141st of 345, with limits $329 a month | 7th cheapest of 345 $114 a month | 186th of 345, with limits $2,000 a month |
| Sandboxes for your users 300 at once · 2 vCPU / 4 GB · 30,000 sessions of 23 min a month Deno gives each user a public HTTPS URL per port but only 20 sandboxes at once on Builder, AgentCore sessions have no open ports, and boat serves token-protected URLs on up to 50 ports. | 148th of 361, with limits $1,863 a month | 210th of 361, with limits $506 a month | Cheapest of 361 $209 a month |
| RL rollouts 1,000 at once · 2 vCPU / 4 GB · 1,000,000 sessions of 3 min a month | 122nd of 360, with limits $7,963 a month | 125th of 360, with limits $8,075 a month | 34th of 360, with limits $2,000 a month |
| Agent evals 250 at once · 4 vCPU / 8 GB · 15,000 sessions of 20 min a month | 296th of 364, with limits $1,563 a month | 33rd cheapest of 364 $650 a month | 10th cheapest of 364 $200 a month |
| CI runners 40 at once · 8 vCPU / 16 GB · 6,000 sessions of 12 min a month CI jobs that run Docker or Android emulators need Docker and /dev/kvm, which neither Deno nor AgentCore documents and boat provides. | 304th of 377, with limits $731 a month | 52nd cheapest of 377 $399 a month | 4th cheapest of 377 $86 a month |
| 24/7 dev boxes 1 machine 24/7 · 4 vCPU / 8 GB A dev box needs SSH and a disk that keeps packages; Deno has SSH but wipes its disk, AgentCore has no SSH, and boat keeps the whole disk. | 179th of 368, with limits $200 a month | 228th of 368, with limits $52 a month | 18th cheapest of 368 $26 a month |
| Computer-use agents 50 at once · 4 vCPU / 8 GB · 20,000 sessions of 15 min a month Neither Deno nor AgentCore has a full desktop; boat streams a Linux desktop at 60fps for agents that use more than a browser. | 280th of 369, with limits $1,583 a month | 104th of 369, with limits $202 a month | 6th cheapest of 369 $200 a month |
| Browser-use agents 50 at once · 2 vCPU / 4 GB · 30,000 sessions of 10 min a month AgentCore Browser is a managed Chromium with live view and replay, Deno Sandbox has no browser, and boat runs Chromium on a full desktop in each sandbox. | 284th of 367, with limits $783 a month | 4th cheapest of 367 $144 a month | 7th cheapest of 367 $200 a month |
| Scraping & bots (startup scale) 50 at once · 1 vCPU / 2 GB · 100,000 sessions of 3 min a month | 286th of 346, with limits $573 a month | 27th cheapest of 346 $287 a month | 6th cheapest of 346 $90 a month |
| Mass scraping & bots (undetectable) 1,000 at once · 1 vCPU / 2 GB · 3,000,000 sessions of 2 min a month | 247th of 338, with limits $11,923 a month | 165th of 338, with limits $5,458 a month | 71st of 338, with limits $1,800 a month |
| Parallel red teaming 200 at once · 2 vCPU / 4 GB · 5,000 sessions of 30 min a month | 251st of 360, with limits $367 a month | 62nd of 360, with limits $294 a month | 2nd cheapest of 360 $200 a month |
| GPU eval jobs 10 at once · 8 vCPU / 32 GB · 500 sessions of 30 min a month | Can't run it | Can't run it | Can't run it |
| macOS agents 5 at once · 4 vCPU / 8 GB · 1,000 sessions of 20 min a month | Can't run it | Can't run it | Can't run it |
Key features
| Feature | Deno Sandbox | AWS AgentCore | boat |
|---|---|---|---|
| What it is | A sandbox inside Deno Deploy for running untrusted or AI-generated code | An AWS agent platform: hosted agent sessions plus managed Code Interpreter and Browser tools | A sandbox platform: each agent gets its own full Linux machine |
| Isolation | Firecracker microVM with its own kernel | Firecracker microVM per Runtime session; Code Interpreter and Browser in a containerized environment | Full VM with its own kernel on dedicated AMD Ryzen 9 9950X hosts |
| Machine size | 2 vCPU fixed, 768 MB to 4 GB memory, 10 GB disk | 2 vCPU / 8 GB per microVM session; bigger EC2 types only on Instances | 4 vCPU / 8 GB by default, up to 16 vCPU / 32 GB on the $100 plan and above |
| Session length | Up to 30 minutes; longer work can be promoted to a Deno Deploy app | Up to 8 hours on microVMs, stopped after 15 idle minutes by default; up to 14 days on Instances | No cap on paid plans; you set the time to live |
| What survives the end of a session | Root disk wiped; opt-in volumes of 300 MB to 20 GB, Chicago only | One storage mount under /mnt, up to 1 GB, in preview; EBS volumes on Instances | The whole disk, saved every minute and on stop; a stopped sandbox costs nothing |
| Snapshots and fork | Read-only snapshots of a volume that new sandboxes can boot from; no fork | No user snapshots or fork of a session | Automatic snapshots every minute; fork a running sandbox with its disk |
| Docker and nested virtualization | Root access; Docker and nested virtualization not documented | Root inside the microVM; Docker and /dev/kvm not documented | Docker, systemd and /dev/kvm for Android emulators and VMs |
| Inbound access | Public HTTPS URL per exposed port, no authentication; SSH | No open ports or SSH; reached only through AgentCore APIs with IAM or JWT | HTTPS URLs for up to 50 ports, token-protected by default; raw TCP; SSH |
| Network controls | Host allowlist per sandbox, enforced by a proxy outside the VM | VPC mode with security groups, PrivateLink and a NAT gateway for a fixed outbound IP | Open internet, no provider-side allowlist |
| Keeping API keys out of the sandbox | Secrets swapped in on outbound requests to approved hosts; the sandbox only sees a placeholder | AgentCore Identity stores OAuth tokens and API keys and hands them to your agent code | Credentials proxy for model providers and any HTTPS API; switch a credential to another account when credits run out |
| Browser and desktop | No browser or desktop; a VS Code editor in the browser | Managed Chromium with live view, recording and replay; no full desktop | Linux desktop streamed at 60fps, Chromium and computer use built in |
| Coding agents | A root image with Claude Code, run through the shell command API | AWS's managed harness built on Strands Agents, or your own agent code | Claude Code, Codex and five more preinstalled, with a prompt, steer and events API |
| Sessions at once | 3 per region on Pro, 20 per region on Builder | 1,000 Code Interpreter or Browser sessions; up to 5,000 Runtime sessions in us-east-1 | Hundreds at once on the larger plans; starts above 90 a minute are queued |
| Regions and GPUs | Amsterdam and Chicago; no GPUs | 17 commercial AWS regions plus GovCloud; GPUs on Instances | EU only (Germany, Finland, France); no GPUs |
Every feature Battleships tracks (43)
| Feature | Deno Sandbox | AWS AgentCore | boat |
|---|---|---|---|
| Full VM (own kernel) | Yes | Yes | Yes |
| Docker inside | Not published | Not published | Yes |
| Nested virtualization | No | No | Yes |
| Root | Yes | Yes | Yes |
| Systemd | Not published | No | Yes |
| Desktop GUI | No | No | Yes |
| Browser | No | Yes | Yes |
| Computer-use API | No | Yes | Yes |
| SSH | Yes | No | Yes |
| Persistent disk | Yes | Yes | Yes |
| Pause/resume | No | No | Yes |
| Automatic snapshots | No | No | Yes |
| Fork/clone | No | No | Yes |
| Live fork (no pause) | No | No | Yes |
| Memory fork | No | No | No |
| Custom image (Docker or snapshot) | Yes | Yes | Yes |
| ≥24 h sessions | No | No | Yes |
| Idle auto-stop | No | Yes | No |
| Wake on request | No | Yes | No |
| HTTPS preview URLs | Yes | No | Yes |
| Raw TCP inbound | No | No | Yes |
| Public IPv4 | No | No | No |
| Egress allowlist | Yes | Yes | No |
| Secret proxy | Yes | No | Yes |
| Secret proxy for any API | Yes | No | Yes |
| Preinstalled agents | Yes | No | Yes |
| Agent harness API | No | No | Yes |
| MCP server | No | Yes | No |
| GPU | No | Yes | No |
| Windows | No | No | No |
| Arm64 | No | Yes | No |
| Self-hosting | No | No | No |
| BYOC | No | Yes | No |
| Open source | No | No | No |
| Scoped API keys | Not published | Not published | Yes |
| Spend limits | Yes | Yes | Yes |
| Usage per sandbox (API) | No | No | Yes |
| Audit logs | Not published | Yes | No |
| SSO | No | Yes | No |
| SOC 2 | Yes | Yes | No |
| HIPAA | Yes | Yes | No |
| EU data residency | Yes | Yes | Yes |
| Zero data retention | Not published | Not published | Yes |
Performance
There is no comparable measurement for either one: neither Deno Sandbox nor AWS AgentCore is in the hpc-sandbox-benchmarks run. boat did 26.69 runs per second on its Node.js build-and-test loop at 4 vCPU / 8 GB. Both stop at 2 vCPU per microVM, so a like-for-like test would need AgentCore's Instances type, and Deno has no 4 vCPU shape.
Node.js build-and-test loop at 4 vCPU / 8 GB, higher is better. Measured with the open hpc-sandbox-benchmarks suite. Deno Sandbox and AWS AgentCore have no published run in this suite yet, so there is no like-for-like number to compare.
Pricing in five scenarios
Each bill is priced from the providers' public price lists by the open Battleships engine, with the cheapest plan that runs the scenario.
| Scenario | Deno Sandbox, a month | AWS AgentCore, a month | boat, a month |
|---|---|---|---|
| One coding agent, workdays 4 vCPU / 8 GB, 50 GB disk, 8 hours a day, 22 days a month, files kept between days | $53 · Pro · with limits | $26 · Pay-as-you-go (Instances) · with limits | $20 · $20/mo |
| One agent that never stops 4 vCPU / 8 GB, 50 GB disk, running 24/7 all month | $200 · Builder · with limits | $107 · Pay-as-you-go (Instances) · with limits | $26 · $20/mo |
| 50 agents in parallel 50 machines of 4 vCPU / 8 GB at once, 8-hour sessions, 1,100 sessions a month, Docker inside | $2,779 · Builder · with limits | $1,286 · Pay-as-you-go (Instances) · with limits | $317 · $20/mo × 3 seats |
| Sandboxes for your users 2 vCPU / 4 GB, 30,000 sessions of 10 minutes a month, up to 300 at once | $783 · Builder · with limits | $423 · Pay-as-you-go · with limits | $200 · $100/mo × 2 seats |
| 1,000 short jobs at once 2 vCPU / 4 GB, 1,000 at once, 3 minutes each, 200,000 jobs a month | $1,563 · Builder · with limits | $1,615 · Pay-as-you-go (Instances) | $2,000 · $2000/mo · with limits |
Deno Sandbox: Sandboxes need the Pro plan at $20 a month or Builder at $200 a month; the fee is not credit but includes CPU, memory and egress allowances shared with Deno Deploy apps. Past those, CPU costs $0.10 per hour of active CPU and memory $0.025 per GiB-hour for the whole life of the sandbox.
AWS AgentCore: There is no monthly fee: Runtime microVMs, Code Interpreter and Browser bill per second for CPU actually used and for peak memory. The 4 vCPU shape in these scenarios is the Instances type, billed as the EC2 on-demand price plus a 12% management fee, with storage and data transfer on top.
AWS AgentCore: Plans start at $20 a month, and the whole fee is usage credit. You pay per second while a sandbox runs, and a stopped sandbox costs nothing and keeps its disk.
Limits in those scenarios
Deno Sandbox fits none of the five scenarios as written: it is fixed at 2 vCPU with up to 4 GB, lives up to 30 minutes, and Builder allows 20 sandboxes at once per region. AgentCore fits only the 1,000 short jobs, at $1,615 a month; for the 4 vCPU agents it needs Instances, where files outside the storage mount reset after a stop, and its code interpreter is a different kind of product for user sandboxes. boat fits four of the five, but at 1,000 short jobs at once its top plan queues starts above 90 a minute.
| Scenario | Deno Sandbox | AWS AgentCore | boat |
|---|---|---|---|
| One coding agent, workdays |
|
| None that bite |
| One agent that never stops |
|
| None that bite |
| 50 agents in parallel |
|
| None that bite |
| Sandboxes for your users |
|
| None that bite |
| 1,000 short jobs at once |
|
|
|
Which one should you use?
Use Deno Sandbox when
you run short pieces of untrusted code that must start in milliseconds and reach only the hosts you allow, especially if you already deploy on Deno Deploy.
- Fast starts for short code. For one sandbox per request, Deno says a sandbox starts in under 200 ms, and CPU bills only while code runs.
- Outbound traffic you can lock down. For untrusted code, each sandbox can reach only the hosts you list, and secrets are swapped in outside the VM.
- A link you can open, and a path to Deno Deploy. For teams on Deno Deploy, a sandbox can expose HTTPS ports, take SSH, and be promoted to a Deploy app.
Use AWS AgentCore when
your agents must stay inside your AWS account and VPC, need sessions of hours or a GPU, or are short code and browser tasks at high concurrency.
- It lives inside your AWS account. For teams built on AWS, agents stay behind their own IAM, VPC and PrivateLink, in 17 commercial regions.
- Longer sessions, and GPUs on Instances. For work past 30 minutes, microVM sessions last 8 hours, and Instances run up to 14 days with GPUs available.
- Managed code and browser tools at scale. For short code runs and browser tasks, Code Interpreter and Browser bill only for CPU used and allow 1,000 sessions at once.
Where boat fits
Deno Sandbox and AgentCore both hand an agent a small 2 vCPU microVM for a limited time. If your agents install packages, run Docker, build and test for hours, or serve an app you want to open, look at boat: each one gets a full Linux machine that keeps its disk.
A machine that stays
A Deno sandbox ends at 30 minutes and wipes its disk; an AgentCore microVM stops at 8 hours and keeps only a 1 GB mount. AgentCore's way around it is Instances, which means running EC2 in your own account.
Docker, /dev/kvm and more than 2 vCPU
Neither documents Docker or nested virtualization, and both cap a session at 2 vCPU. Builds and Docker images crawl or fail, and an Android emulator cannot start; boat goes up to 16 vCPU / 32 GB.
Agents, desktop and URLs built in
On Deno you run Claude Code through shell commands, and AgentCore has no open ports, so you proxy a dev server through your own code. boat ships seven agents with an API, a 60fps desktop and HTTPS on 50 ports.
Use boat when your agents do real work on a machine for hours: installs, builds, tests, Docker, emulators and a browser, with a disk that keeps everything and a URL you can open. Compare it one to one: boat vs Deno Sandbox and boat vs AWS AgentCore.
Questions people ask
Is Deno Sandbox cheaper than AWS AgentCore?
Not in these scenarios. AgentCore comes in lower in four of the five, for example $107 against $200 a month for one agent that never stops, though neither fits that one as written. For 1,000 short jobs at once they are close, $1,563 on Deno Builder against $1,615 on AgentCore, and only AgentCore fits.
How long can each one run?
A Deno sandbox lives up to 30 minutes, and longer work can be promoted to a Deno Deploy app. An AgentCore microVM session lasts up to 8 hours and stops after 15 idle minutes by default; the Instances type runs up to 14 days on EC2. A boat sandbox has no cap on paid plans.
Which is faster?
Neither has a comparable CPU measurement, so there is no fair speed ratio. Deno says a sandbox starts in under 200 ms. boat did 26.69 runs per second on the hpc-sandbox-benchmarks Node.js loop at 4 vCPU / 8 GB.
Can Deno Sandbox or AgentCore run Docker?
Both give root inside a microVM, but neither one's docs say Docker or nested virtualization works. boat runs Docker and systemd and exposes /dev/kvm for Android emulators and VMs.
Do files survive when a session ends?
On Deno the root disk is wiped, and you can mount a volume of 300 MB to 20 GB in Chicago. On AgentCore only a storage mount of up to 1 GB, in preview, or an EBS volume on Instances survives a stop. boat keeps the whole disk and saves it every minute.
Which one has a browser for agents?
AgentCore has a managed Chromium tool with live view, recording and replay. Deno Sandbox has no browser or desktop. boat streams a full Linux desktop at 60fps with Chromium and computer use.
Try boat
Install the CLI, then run boat new.
7-day free trial