Deno Sandbox vs Instabox
Both run code in Firecracker microVMs. Deno Sandbox is built for short, locked-down runs on 2 vCPU that end after 30 minutes, while Instabox, an invite-only beta that launched on 2026-10-14, gives each agent a 4 vCPU / 8 GiB machine that keeps its files and can pause with its memory.
The companies and products
Deno Sandbox
Deno Sandbox is part of Deno Deploy, the hosting platform from the company behind the Deno runtime, and runs untrusted or AI-generated code in Linux microVMs.
Each sandbox is a Firecracker microVM with 2 vCPU, up to 4 GB of memory and a 10 GB disk that is wiped when it ends, created from a TypeScript or Python SDK. Outbound traffic goes through a proxy that can enforce a host allowlist and swap placeholder secrets for real ones. It is built for short runs of agent or user code, and a sandbox can be promoted to a Deno Deploy app.
- Isolation
- Firecracker microVM per sandbox
Instabox
Instabox, made by InsForge, gives each AI agent its own Linux computer in the cloud. It launched on 2026-10-14 as an invite-only beta.
Each Instabox machine is a Firecracker microVM with its own kernel, root and Docker, started from one of four templates (agent-browser, universal, herdr or orca) or from your own snapshot. Every machine is 4 vCPU / 8 GiB with 20 GB of storage, and you drive it from a CLI, a TypeScript SDK or an HTTP API, with SSH, mosh, public port URLs and a desktop for computer use. It is aimed at developers who want a cloud box for a coding agent.
- Isolation
- Firecracker microVM per machine
- Machines per account
- 5, in any state: paused and stopped ones count
- Company
- InsForge AI, Inc.
Which use cases each one fits
For each use case, Battleships prices every sandbox provider on the same workload and sorts them from the cheapest monthly bill up. “290th cheapest of 367” means 289 of the other 366 providers run that workload, with every feature it needs, for less. “With limits” means the provider runs it but misses something, so it is listed after every full match. Open a use case for its whole ranking and what each provider misses.
| Use case and its workload | Deno Sandbox: price rank | Instabox: price rank | boat: price rank |
|---|---|---|---|
| Software factory 100 at once · 4 vCPU / 8 GB · 2,200 sessions of 8 h a month A software factory runs builds and Docker for hours: Deno stops at 30 minutes on 2 vCPU, Instabox keeps one 4 vCPU size and 5 machines, and boat forks running sandboxes up to 16 vCPU / 32 GB. | 290th of 367, with limits $5,665 a month | No published price | 3rd cheapest of 367 $634 a month |
| Always-on AI employees 50 machines 24/7 · 2 vCPU / 4 GB An assistant that lives on its machine all month cannot use Deno's 30-minute sandbox; Instabox can keep a machine up if you turn off its 30-minute idle pause. | 287th of 366, with limits $5,803 a month | No published price | 5th cheapest of 366 $657 a month |
| Code interpreter bursts 100 at once · 1 vCPU / 2 GB · 200,000 sessions of 1 min a month Short code runs are where Deno Sandbox fits best: Deno says a sandbox starts in under 200 ms, and CPU bills only while code runs. | 141st of 345, with limits $329 a month | No published price | 186th of 345, with limits $2,000 a month |
| Sandboxes for your users 300 at once · 2 vCPU / 4 GB · 30,000 sessions of 23 min a month Deno Builder allows 20 sandboxes at once per region and Instabox 5 machines per account, so neither gives a sandbox to hundreds of users at once. | 148th of 361, with limits $1,863 a month | No published price | Cheapest of 361 $209 a month |
| RL rollouts 1,000 at once · 2 vCPU / 4 GB · 1,000,000 sessions of 3 min a month | 122nd of 360, with limits $7,963 a month | No published price | 34th of 360, with limits $2,000 a month |
| Agent evals 250 at once · 4 vCPU / 8 GB · 15,000 sessions of 20 min a month Many evals at once hit Deno's 20 per region on Builder and Instabox's 5 machines per account, paused and stopped ones included. | 296th of 364, with limits $1,563 a month | No published price | 10th cheapest of 364 $200 a month |
| CI runners 40 at once · 8 vCPU / 16 GB · 6,000 sessions of 12 min a month CI jobs that need Android emulators or VM images need /dev/kvm, which boat exposes and neither Deno nor Instabox documents. | 304th of 377, with limits $731 a month | No published price | 4th cheapest of 377 $86 a month |
| 24/7 dev boxes 1 machine 24/7 · 4 vCPU / 8 GB A dev box needs a disk that stays: Deno wipes its root disk after 30 minutes, while Instabox and boat both keep the whole machine. | 179th of 368, with limits $200 a month | No published price | 18th cheapest of 368 $26 a month |
| Computer-use agents 50 at once · 4 vCPU / 8 GB · 20,000 sessions of 15 min a month Deno Sandbox has no desktop; Instabox has a Linux desktop with a screenshot and click API where you bring the model, and boat streams a 60fps desktop with a computer-use agent. | 280th of 369, with limits $1,583 a month | No published price | 6th cheapest of 369 $200 a month |
| Browser-use agents 50 at once · 2 vCPU / 4 GB · 30,000 sessions of 10 min a month | 284th of 367, with limits $783 a month | No published price | 7th cheapest of 367 $200 a month |
| Scraping & bots (startup scale) 50 at once · 1 vCPU / 2 GB · 100,000 sessions of 3 min a month | 286th of 346, with limits $573 a month | No published price | 6th cheapest of 346 $90 a month |
| Mass scraping & bots (undetectable) 1,000 at once · 1 vCPU / 2 GB · 3,000,000 sessions of 2 min a month | 247th of 338, with limits $11,923 a month | No published price | 71st of 338, with limits $1,800 a month |
| Parallel red teaming 200 at once · 2 vCPU / 4 GB · 5,000 sessions of 30 min a month | 251st of 360, with limits $367 a month | No published price | 2nd cheapest of 360 $200 a month |
| GPU eval jobs 10 at once · 8 vCPU / 32 GB · 500 sessions of 30 min a month | Can't run it | No published price | Can't run it |
| macOS agents 5 at once · 4 vCPU / 8 GB · 1,000 sessions of 20 min a month | Can't run it | No published price | Can't run it |
Key features
| Feature | Deno Sandbox | Instabox | boat |
|---|---|---|---|
| Isolation | Firecracker microVM with its own kernel | Firecracker microVM with its own kernel and root | Full VM with its own kernel on dedicated AMD Ryzen 9 9950X hosts |
| Machine size | 2 vCPU fixed, 768 MB to 4 GB memory, 10 GB disk | One size for everyone: 4 vCPU / 8 GiB with 20 GB storage | 4 vCPU / 8 GB by default, up to 16 vCPU / 32 GB on the $100 plan and above |
| Session length | Up to 30 minutes; longer work can be promoted to a Deno Deploy app | No maximum documented; new machines pause after 30 idle minutes unless you change that | No cap on paid plans; you set the time to live |
| Disk that persists | Root disk wiped when the sandbox ends; opt-in volumes of 300 MB to 20 GB, Chicago only | The whole machine is kept; paused and stopped machines count toward the 5 per account | The whole disk is kept, saved every minute and on stop; a stopped sandbox costs nothing |
| Pause and resume | No pause; a sandbox ends with its session | Pause keeps memory and running programs; resume usually takes about a second | Stop keeps the disk; start boots the machine again |
| Snapshots and fork | Read-only snapshots of a volume that new sandboxes can boot from; no fork | Up to 10 snapshots saved by hand, which stops a running machine first; fork copies a stopped machine only | Automatic disk snapshots; fork a running sandbox with its disk |
| Docker and nested virtualization | Root access; Docker and nested virtualization not documented | Docker and Docker Compose run inside; nested virtualization not documented | Docker, systemd and /dev/kvm for Android emulators and VMs |
| Desktop and computer use | No desktop; a VS Code editor in the browser and SSH | Linux desktop with a browser on one template, screenshot and click API, shareable view or control links; you bring the model | Linux desktop streamed at 60fps with Chromium and a computer-use agent |
| Public port URLs | HTTPS URL per exposed port, public without authentication | HTTPS on up to 16 ports, open to anyone with the URL; offline while the machine is paused | HTTPS on up to 50 ports, token-protected by default; raw TCP too |
| Outbound rules | Host allowlist per sandbox, enforced by a proxy outside the VM | Not documented | Open internet, no provider-side allowlist |
| Keeping API keys out of the sandbox | Secrets swapped in on outbound requests to approved hosts; the sandbox only sees a placeholder | Vault writes your secrets into each machine as environment variables or files | Credentials proxy for model providers and any HTTPS API; switch a credential to another account when credits run out |
| Coding agents | A root image with Claude Code, run through the shell command API | Templates and saved agent sign-ins in snapshots; you run the agent yourself | Seven agents preinstalled, with a prompt, steer and events API |
| Start time | Deno says under 200 ms | Instabox says a new machine's shell is ready in under a second; not measured | Boots a full VM |
| Regions | Amsterdam and Chicago | Not published | EU only (Germany, Finland, France) |
Every feature Battleships tracks (43)
| Feature | Deno Sandbox | Instabox | boat |
|---|---|---|---|
| Full VM (own kernel) | Yes | Yes | Yes |
| Docker inside | Not published | Yes | Yes |
| Nested virtualization | No | Not published | Yes |
| Root | Yes | Yes | Yes |
| Systemd | Not published | Not published | Yes |
| Desktop GUI | No | Yes | Yes |
| Browser | No | Yes | Yes |
| Computer-use API | No | Yes | Yes |
| SSH | Yes | Yes | Yes |
| Persistent disk | Yes | Yes | Yes |
| Pause/resume | No | Yes | Yes |
| Automatic snapshots | No | No | Yes |
| Fork/clone | No | Yes | Yes |
| Live fork (no pause) | No | No | Yes |
| Memory fork | No | No | No |
| Custom image (Docker or snapshot) | Yes | Yes | Yes |
| ≥24 h sessions | No | Yes | Yes |
| Idle auto-stop | No | Yes | No |
| Wake on request | No | No | No |
| HTTPS preview URLs | Yes | Yes | Yes |
| Raw TCP inbound | No | Not published | Yes |
| Public IPv4 | No | No | No |
| Egress allowlist | Yes | Not published | No |
| Secret proxy | Yes | No | Yes |
| Secret proxy for any API | Yes | No | Yes |
| Preinstalled agents | Yes | Not published | Yes |
| Agent harness API | No | Not published | Yes |
| MCP server | No | Not published | No |
| GPU | No | No | No |
| Windows | No | No | No |
| Arm64 | No | Not published | No |
| Self-hosting | No | Not published | No |
| BYOC | No | Not published | No |
| Open source | No | No | No |
| Scoped API keys | Not published | Yes | Yes |
| Spend limits | Yes | Not published | Yes |
| Usage per sandbox (API) | No | Yes | Yes |
| Audit logs | Not published | Not published | No |
| SSO | No | No | No |
| SOC 2 | Yes | Not published | No |
| HIPAA | Yes | Not published | No |
| EU data residency | Yes | Not published | Yes |
| Zero data retention | Not published | Not published | Yes |
Performance
There is no comparable measurement for Deno Sandbox or Instabox: neither is in the CPU benchmark, so this page makes no speed claim between them. boat did 26.69 runs per second on the hpc-sandbox-benchmarks Node.js build-and-test loop at 4 vCPU / 8 GB. Deno says a sandbox starts in under 200 ms and Instabox says a new shell is ready in under a second; neither has been measured here.
Node.js build-and-test loop at 4 vCPU / 8 GB, higher is better. Measured with the open hpc-sandbox-benchmarks suite. Deno Sandbox and Instabox have no published run in this suite yet, so there is no like-for-like number to compare.
Pricing in five scenarios
Each bill is priced from the providers' public price lists by the open Battleships engine, with the cheapest plan that runs the scenario.
| Scenario | Deno Sandbox, a month | Instabox, a month | boat, a month |
|---|---|---|---|
| One coding agent, workdays 4 vCPU / 8 GB, 50 GB disk, 8 hours a day, 22 days a month, files kept between days | $53 · Pro · with limits | No published price | $20 · $20/mo |
| One agent that never stops 4 vCPU / 8 GB, 50 GB disk, running 24/7 all month | $200 · Builder · with limits | No published price | $26 · $20/mo |
| 50 agents in parallel 50 machines of 4 vCPU / 8 GB at once, 8-hour sessions, 1,100 sessions a month, Docker inside | $2,779 · Builder · with limits | No published price | $317 · $20/mo × 3 seats |
| Sandboxes for your users 2 vCPU / 4 GB, 30,000 sessions of 10 minutes a month, up to 300 at once | $783 · Builder · with limits | No published price | $200 · $100/mo × 2 seats |
| 1,000 short jobs at once 2 vCPU / 4 GB, 1,000 at once, 3 minutes each, 200,000 jobs a month | $1,563 · Builder · with limits | No published price | $2,000 · $2000/mo · with limits |
Deno Sandbox: Sandboxes need the Pro plan at $20 a month or Builder at $200 a month; the fee is not credit but includes CPU, memory and egress allowances shared with your Deno Deploy apps. Past those, CPU costs $0.10 per hour of active CPU time and memory $0.025 per GiB-hour for the whole life of the sandbox.
Instabox: Instabox is free during the beta, with 5 machines per user, and publishes no price yet, so no bill can be compared yet.
Instabox: Plans start at $20 a month, and the whole fee is usage credit. You pay per second while a sandbox runs, and a stopped sandbox costs nothing and keeps its disk.
Limits in those scenarios
Deno Sandbox fits none of the five scenarios as written: a sandbox lives up to 30 minutes on 2 vCPU with up to 4 GB, and Builder allows 20 at once per region. Instabox publishes no rate, so no scenario can be priced, and its 5 machines per account, paused and stopped ones included, rule out the 50-agent and user-sandbox scenarios today. boat fits four of the five; at 1,000 short jobs at once its top plan caps starts per hour and per day, so none of the three fits that burst without a custom plan.
| Scenario | Deno Sandbox | Instabox | boat |
|---|---|---|---|
| One coding agent, workdays |
|
| None that bite |
| One agent that never stops |
|
| None that bite |
| 50 agents in parallel |
|
| None that bite |
| Sandboxes for your users |
|
| None that bite |
| 1,000 short jobs at once |
|
|
|
Which one should you use?
Use Deno Sandbox when
you run short pieces of untrusted code that must start fast, reach only the hosts you allow, or run in the US, especially if you already deploy on Deno Deploy.
- Locked-down outbound traffic. For untrusted code, each sandbox can be limited to a list of hosts, enforced by a proxy outside the VM.
- Fast starts for short runs. Deno says a sandbox starts in under 200 ms, and CPU bills only while code runs, which suits short bursts.
- A US region and Deno Deploy. Sandboxes run in Chicago or Amsterdam and can be promoted to Deno Deploy apps, which helps teams already on Deploy.
Use Instabox when
you want to try a few 4 vCPU / 8 GiB agent machines for free during its invite-only beta, with memory pause and mosh.
- A machine that keeps its files. Each machine is 4 vCPU / 8 GiB with Docker, keeps its whole disk, and has no documented maximum run time.
- Pause with memory. A paused machine keeps its memory and running programs, and its docs say it usually resumes in about a second.
- SSH gateway with mosh. SSH runs through a gateway with short-lived certificates and relays mosh, so a session survives sleep and network changes.
Where boat fits
If your agents do hours of real work, need more than one machine size or more than five machines, or serve apps you do not want public, look at boat. It gives each agent a full VM with Docker, /dev/kvm and a disk saved every minute, on plans and limits published today.
Branch work without stopping it
Deno ends a sandbox after 30 minutes and wipes its root disk, and Instabox forks only a stopped machine, so the agent's running programs end. boat forks a running sandbox while the original keeps working.
Room for builds, emulators and fleets
Deno is fixed at 2 vCPU and 4 GB, Instabox at one 4 vCPU / 8 GiB size and 5 machines per account, and neither documents nested virtualization. boat goes up to 16 vCPU / 32 GB with /dev/kvm.
Private URLs and agents driven from outside
Port URLs on both Deno and Instabox are open to anyone who has them, so you add a login in front of each app. boat's URLs carry a token by default, and you drive agents inside from outside through one API.
Use boat when your agents work for hours, need Docker, /dev/kvm, a bigger machine or more than five machines, fork running work and serve private URLs, on terms published today. Compare it one to one: boat vs Deno Sandbox and boat vs Instabox.
Questions people ask
Is Deno Sandbox cheaper than Instabox?
It can't be compared yet. Instabox is free during its beta with 5 machines per user and publishes no price, so there is no bill to set against Deno's. Deno sandboxes need the Pro plan at $20 a month or Builder at $200 a month, plus usage past the allowances.
Which is faster, Deno Sandbox or Instabox?
Neither has a CPU measurement, so there is no fair answer. Deno says a sandbox starts in under 200 ms, and Instabox says a new shell is ready in under a second; neither claim has been measured here. boat did 26.69 runs per second on the Node.js benchmark at 4 vCPU / 8 GB.
Can Deno Sandbox or Instabox run Docker?
Instabox's docs say Docker and Docker Compose run inside a machine. Deno's docs give root access but do not say Docker works. Neither documents nested virtualization; boat runs Docker and systemd and exposes /dev/kvm.
How long can a machine run?
A Deno sandbox lives up to 30 minutes. Instabox documents no maximum run time, but new machines pause after 30 idle minutes unless you change that. boat has no cap on paid plans.
Can anyone sign up for Instabox?
Not yet. Instabox launched on 2026-10-14 as an invite-only beta, with sign-in through GitHub or Google. Deno Sandbox needs a Deno Deploy Pro or Builder plan.
Are their port URLs private?
No. Deno's port URLs are public without authentication, and Instabox's docs say a published URL is not a secret. boat's port URLs carry a token by default, and you can make one public if you want.
Try boat
Install the CLI, then run boat new.
7-day free trial