Deno Sandbox vs Modal VM Sandboxes
Both run code in its own Linux VM. Deno Sandbox gives you a fixed 2 vCPU microVM for up to 30 minutes, built for fast, locked-down runs, while Modal VM Sandboxes give you a bigger VM with Docker and systemd for up to 24 hours, next to Modal's AI platform.
The companies and products
Deno Sandbox
Deno Sandbox is part of Deno Deploy, the hosting platform from the company behind the Deno runtime, and runs untrusted or AI-generated code in Linux microVMs.
Each sandbox is a Firecracker microVM with 2 vCPU, up to 4 GB of memory and a 10 GB disk that is wiped when it ends, created from a TypeScript or Python SDK. Outbound traffic goes through a proxy that can enforce a host allowlist and swap placeholder secrets for real ones. It is built for short runs of agent or user code, and a sandbox can be promoted to a Deno Deploy app.
- Isolation
- Firecracker microVM per sandbox
Modal VM Sandboxes
Modal is a serverless cloud for AI work, and VM Sandboxes are the version of its sandboxes that run in a virtual machine with their own Linux kernel.
You create a VM Sandbox from Python, TypeScript or Go code with runtime="vm", run commands in it, and terminate it when the job is done. Modal built the runtime on the Rust-based Cloud Hypervisor, so Docker, FUSE, systemd and nested cgroups work, with the same API, images and prices as its gVisor sandboxes. It became generally available on 1 October 2026 and suits teams that want many short-lived agent machines next to Modal's inference and training.
- Funding
- Over $466M raised
- Generally available
- 1 October 2026; early customers launched over 20 million VMs before that
- Session length
- Default 5 minutes, maximum 24 hours
- Compliance
- SOC 2 on every plan; HIPAA on Enterprise
Which use cases each one fits
For each use case, Battleships prices every sandbox provider on the same workload and sorts them from the cheapest monthly bill up. “290th cheapest of 367” means 289 of the other 366 providers run that workload, with every feature it needs, for less. “With limits” means the provider runs it but misses something, so it is listed after every full match. Open a use case for its whole ranking and what each provider misses.
| Use case and its workload | Deno Sandbox: price rank | Modal VM Sandboxes: price rank | boat: price rank |
|---|---|---|---|
| Software factory 100 at once · 4 vCPU / 8 GB · 2,200 sessions of 8 h a month A software factory needs Docker and hours of builds, which Modal's VM runtime can do for up to 24 hours and Deno's 30-minute, 2 vCPU sandbox cannot; boat adds a disk that stays and no session cap. | 290th of 367, with limits $5,665 a month | 84th of 367, with limits $759 a month | 3rd cheapest of 367 $634 a month |
| Always-on AI employees 50 machines 24/7 · 2 vCPU / 4 GB An agent that lives on its machine all month outlasts both: Deno ends a sandbox after 30 minutes and Modal after 24 hours, while boat has no cap on paid plans. | 287th of 366, with limits $5,803 a month | Can't run it | 5th cheapest of 366 $657 a month |
| Code interpreter bursts 100 at once · 1 vCPU / 2 GB · 200,000 sessions of 1 min a month Short code runs are where Deno shines, with starts under 200 ms and CPU billed only while code runs. | 141st of 345, with limits $329 a month | Can't run it | 186th of 345, with limits $2,000 a month |
| Sandboxes for your users 300 at once · 2 vCPU / 4 GB · 30,000 sessions of 23 min a month Deno Builder allows 20 sandboxes at once per region and Modal Team allows 5,000 containers, so Modal fits bigger user bases; boat keeps each user's disk while it waits for free. | 148th of 361, with limits $1,863 a month | Can't run it | Cheapest of 361 $209 a month |
| RL rollouts 1,000 at once · 2 vCPU / 4 GB · 1,000,000 sessions of 3 min a month Huge bursts of short rollouts suit Modal's scale, but Deno's 2 vCPU shape is cheaper per run here; boat queues very large bursts of starts. | 122nd of 360, with limits $7,963 a month | 171st of 360, with limits $16,322 a month | 34th of 360, with limits $2,000 a month |
| Agent evals 250 at once · 4 vCPU / 8 GB · 15,000 sessions of 20 min a month | 296th of 364, with limits $1,563 a month | Can't run it | 10th cheapest of 364 $200 a month |
| CI runners 40 at once · 8 vCPU / 16 GB · 6,000 sessions of 12 min a month CI that builds Docker images works in a Modal VM and is not documented on Deno; boat also gives every plan /dev/kvm for Android emulators. | 304th of 377, with limits $731 a month | 188th of 377, with limits $1,064 a month | 4th cheapest of 377 $86 a month |
| 24/7 dev boxes 1 machine 24/7 · 4 vCPU / 8 GB | 179th of 368, with limits $200 a month | Can't run it | 18th cheapest of 368 $26 a month |
| Computer-use agents 50 at once · 4 vCPU / 8 GB · 20,000 sessions of 15 min a month Neither Deno nor Modal ships a desktop; boat has a 60fps Linux desktop with Chromium and a computer-use API. | 280th of 369, with limits $1,583 a month | Can't run it | 6th cheapest of 369 $200 a month |
| Browser-use agents 50 at once · 2 vCPU / 4 GB · 30,000 sessions of 10 min a month | 284th of 367, with limits $783 a month | Can't run it | 7th cheapest of 367 $200 a month |
| Scraping & bots (startup scale) 50 at once · 1 vCPU / 2 GB · 100,000 sessions of 3 min a month | 286th of 346, with limits $573 a month | Can't run it | 6th cheapest of 346 $90 a month |
| Mass scraping & bots (undetectable) 1,000 at once · 1 vCPU / 2 GB · 3,000,000 sessions of 2 min a month | 247th of 338, with limits $11,923 a month | Can't run it | 71st of 338, with limits $1,800 a month |
| Parallel red teaming 200 at once · 2 vCPU / 4 GB · 5,000 sessions of 30 min a month Red-team agents need many machines running for a while, which Deno's 30-minute cap and 20-at-once limit make hard; boat runs them as full VMs without a session cap. | 251st of 360, with limits $367 a month | 294th of 360, with limits $642 a month | 2nd cheapest of 360 $200 a month |
| GPU eval jobs 10 at once · 8 vCPU / 32 GB · 500 sessions of 30 min a month | Can't run it | Can't run it | Can't run it |
| macOS agents 5 at once · 4 vCPU / 8 GB · 1,000 sessions of 20 min a month | Can't run it | Can't run it | Can't run it |
Key features
| Feature | Deno Sandbox | Modal VM Sandboxes | boat |
|---|---|---|---|
| Isolation | Firecracker microVM with its own kernel | VM with its own Linux kernel on Cloud Hypervisor | Full VM with its own kernel on dedicated AMD Ryzen 9 9950X hosts |
| Machine size | 2 vCPU fixed, 768 MB to 4 GB memory, 10 GB disk | You request the CPU and memory you need; 4 vCPU / 8 GB was measured | 4 vCPU / 8 GB by default, up to 16 vCPU / 32 GB on the $100 plan and above |
| Longest session | Up to 30 minutes; longer work can be promoted to a Deno Deploy app | 24 hours (default 5 minutes); continue with a filesystem snapshot | No cap on paid plans; you set the time to live |
| Files after it ends | Root disk wiped; opt-in volumes of 300 MB to 20 GB, Chicago only | Root disk gone; only Volumes and snapshots keep files | Whole disk kept, saved every minute and on stop; a stopped sandbox costs nothing |
| Docker and systemd | Root access; Docker not documented | Yes; start dockerd yourself as the entrypoint | Yes, in every sandbox |
| Nested virtualization | Not documented | Team and Enterprise plans only, on request | /dev/kvm on every plan for Android emulators and VMs |
| Snapshots and fork | Read-only snapshots of a volume that new sandboxes boot from | Filesystem snapshots into an image; memory snapshots in alpha that end the sandbox | Automatic disk snapshots; fork a running sandbox with its disk |
| CPU benchmark (4 vCPU / 8 GB) | Not measured; the 2 vCPU shape cannot run the 4 vCPU test | 15.54 runs/s | 26.69 runs/s |
| Start time | Under 200 ms | Fast starts; not compared in the same test | Boots a full VM |
| Sandboxes at once | 3 per region on Pro, 20 per region on Builder | 100 containers on Starter, 5,000 on Team | Per-plan start limits; up to 90 starts a minute on the $2,000 plan |
| Outbound rules | Host allowlist per sandbox, enforced by a proxy outside the VM | Block all, IP-range allowlist, domain allowlist (beta) | Open internet, no provider-side allowlist |
| Keeping API keys out | Placeholder secrets swapped for real ones on requests to approved hosts | Secrets are environment variables, or you run your own proxy in a sidecar | Credentials proxy for model providers and any HTTPS API, with account switching when credits run out |
| Desktop and coding agents | No desktop; an image with Claude Code run through shell commands | No desktop; examples show Xvfb and VNC set up yourself | 60fps desktop, Chromium, computer use, and seven agents with a prompt, steer and events API |
| Regions | Amsterdam and Chicago | US, EU and Asia-Pacific; pinning costs 1.15x to 1.75x | EU only (Germany, Finland, France) |
Every feature Battleships tracks (43)
| Feature | Deno Sandbox | Modal VM Sandboxes | boat |
|---|---|---|---|
| Full VM (own kernel) | Yes | Yes | Yes |
| Docker inside | Not published | Yes | Yes |
| Nested virtualization | No | Yes | Yes |
| Root | Yes | Yes | Yes |
| Systemd | Not published | Yes | Yes |
| Desktop GUI | No | No | Yes |
| Browser | No | No | Yes |
| Computer-use API | No | No | Yes |
| SSH | Yes | Yes | Yes |
| Persistent disk | Yes | Yes | Yes |
| Pause/resume | No | No | Yes |
| Automatic snapshots | No | No | Yes |
| Fork/clone | No | Yes | Yes |
| Live fork (no pause) | No | Yes | Yes |
| Memory fork | No | Yes | No |
| Custom image (Docker or snapshot) | Yes | Yes | Yes |
| ≥24 h sessions | No | Yes | Yes |
| Idle auto-stop | No | Yes | No |
| Wake on request | No | No | No |
| HTTPS preview URLs | Yes | Yes | Yes |
| Raw TCP inbound | No | Yes | Yes |
| Public IPv4 | No | No | No |
| Egress allowlist | Yes | Yes | No |
| Secret proxy | Yes | No | Yes |
| Secret proxy for any API | Yes | No | Yes |
| Preinstalled agents | Yes | No | Yes |
| Agent harness API | No | No | Yes |
| MCP server | No | No | No |
| GPU | No | No | No |
| Windows | No | No | No |
| Arm64 | No | No | No |
| Self-hosting | No | No | No |
| BYOC | No | No | No |
| Open source | No | No | No |
| Scoped API keys | Not published | Not published | Yes |
| Spend limits | Yes | Not published | Yes |
| Usage per sandbox (API) | No | Not published | Yes |
| Audit logs | Not published | Yes | No |
| SSO | No | Yes | No |
| SOC 2 | Yes | Yes | No |
| HIPAA | Yes | Yes | No |
| EU data residency | Yes | Yes | Yes |
| Zero data retention | Not published | Not published | Yes |
Performance
On the hpc-sandbox-benchmarks Node.js build-and-test loop at 4 vCPU / 8 GB, run on 29 September 2026, Modal's VM runtime did 15.54 runs per second and boat did 26.69, about 1.7 times the CPU work. Deno Sandbox has no comparable measurement: it is not in that benchmark, and its fixed 2 vCPU shape could not run the 4 vCPU test as set up.
Node.js build-and-test loop at 4 vCPU / 8 GB, higher is better. Measured with the open hpc-sandbox-benchmarks suite. Modal VM Sandboxes measured on: VM Sandbox, request = size. Deno Sandbox has no published run in this suite yet, so there is no like-for-like number to compare.
Pricing in five scenarios
Each bill is priced from the providers' public price lists by the open Battleships engine, with the cheapest plan that runs the scenario.
| Scenario | Deno Sandbox, a month | Modal VM Sandboxes, a month | boat, a month |
|---|---|---|---|
| One coding agent, workdays 4 vCPU / 8 GB, 50 GB disk, 8 hours a day, 22 days a month, files kept between days | $53 · Pro · with limits | $15 · Starter · with limits | $20 · $20/mo |
| One agent that never stops 4 vCPU / 8 GB, 50 GB disk, running 24/7 all month | $200 · Builder · with limits | $178 · Starter · with limits | $26 · $20/mo |
| 50 agents in parallel 50 machines of 4 vCPU / 8 GB at once, 8-hour sessions, 1,100 sessions a month, Docker inside | $2,779 · Builder · with limits | $2,229 · Starter · with limits | $317 · $20/mo × 3 seats |
| Sandboxes for your users 2 vCPU / 4 GB, 30,000 sessions of 10 minutes a month, up to 300 at once | $783 · Builder · with limits | $792 · Team | $200 · $100/mo × 2 seats |
| 1,000 short jobs at once 2 vCPU / 4 GB, 1,000 at once, 3 minutes each, 200,000 jobs a month | $1,563 · Builder · with limits | $3,193 · Team · with limits | $2,000 · $2000/mo · with limits |
Deno Sandbox: Sandboxes need Deno Deploy Pro at $20 a month or Builder at $200 a month; the fee is not credit but includes CPU, memory and egress allowances shared with your Deploy apps. Past those, CPU costs $0.10 per hour of active CPU time and memory $0.025 per GiB-hour for the whole life of the sandbox.
Modal VM Sandboxes: Modal bills by the second for the higher of the CPU and memory you request or what you use, until the sandbox ends. Starter is free with $30 of monthly credit, Team is $250 a month with $100 of credit, and pinning a region multiplies the price by 1.15x to 1.75x.
Modal VM Sandboxes: Plans start at $20 a month and the whole fee is usage credit. You pay per second while a sandbox runs, and a stopped sandbox costs nothing and keeps its disk.
Limits in those scenarios
Deno Sandbox fits none of the five scenarios as written: it is fixed at 2 vCPU, lives up to 30 minutes, and Builder allows 20 sandboxes at once per region. Modal fits only the user sandboxes scenario; its VMs end within 24 hours and keep files only in Volumes, so the workday, always-on and fleet agents lose installed packages. At 1,000 short jobs at once none of the three fits: Deno caps concurrency, Modal's small request bursts onto shared CPU, and boat queues starts above 90 a minute.
| Scenario | Deno Sandbox | Modal VM Sandboxes | boat |
|---|---|---|---|
| One coding agent, workdays |
|
| None that bite |
| One agent that never stops |
|
| None that bite |
| 50 agents in parallel |
|
| None that bite |
| Sandboxes for your users |
| None that bite | None that bite |
| 1,000 short jobs at once |
|
|
|
Which one should you use?
Use Deno Sandbox when
you run short pieces of untrusted code that must start in milliseconds and reach only the hosts you allow, especially if you already deploy on Deno Deploy.
- Starts in under 200 ms. Good for one sandbox per request: Deno says a sandbox starts in under 200 ms, and CPU bills only while code runs.
- Secrets the code never sees. Useful for untrusted code: a proxy outside the VM limits hosts and swaps placeholder secrets for real ones on approved requests.
- A path to Deno Deploy. Fits teams already on Deno Deploy: a sandbox can be promoted to a Deploy app and bills on the same meters.
Use Modal VM Sandboxes when
your jobs need Docker or a bigger VM for up to a day, come in huge bursts, need regions outside Europe, or sit next to models you run on Modal.
- A fuller VM for longer jobs. Fits jobs that need Docker, systemd or FUSE for hours: Modal's VM runtime runs them for up to 24 hours.
- Very large bursts. Useful for huge fan-outs of short jobs: Modal Team runs 5,000 containers at once, against Deno Builder's 20 per region.
- Regions and one AI platform. Fits teams that serve models on Modal or need Asia-Pacific: sandboxes, inference and training share one account.
Where boat fits
If your agents do real work for hours or days, both of these end the machine under them: Deno after 30 minutes, Modal after 24 hours. boat gives each agent a full VM with no session cap on paid plans, a disk that is still there tomorrow, and a desktop and coding agents ready to drive from outside.
A machine that stays
On Deno a task past 30 minutes is cut off and the root disk is wiped; on Modal the VM ends within 24 hours. Both make you rebuild in volumes or snapshots, while boat saves the whole disk every minute and stops for free.
Docker, /dev/kvm and more CPU
Deno's 2 vCPU sandbox does not document Docker, and Modal offers nested virtualization only on Team by request. boat has Docker and /dev/kvm on every plan and did 26.69 runs/s against Modal's 15.54.
Desktop and agents built in
Neither ships a desktop or an agent API: on Deno you parse Claude Code's shell output, and on Modal you set up Xvfb, VNC and the harness yourself. boat has a 60fps desktop, Chromium and agents you drive from outside.
Use boat when your agents work for hours or days in a machine they come back to, with Docker, emulators and a desktop, on a faster VM that keeps its disk. Compare it one to one: boat vs Deno Sandbox and boat vs Modal VM Sandboxes.
Questions people ask
Is Deno Sandbox cheaper than Modal VM Sandboxes?
It depends on the job. For one agent that never stops, Deno Builder comes to $200 a month against $178 on Modal, and 50 parallel agents cost $2,779 against $2,229, though neither fits those as written. For 1,000 short jobs at once Deno is $1,563 against $3,193 on Modal, but Deno caps you at 20 at once.
Which is faster, Deno Sandbox or Modal VM Sandboxes?
Deno starts a sandbox in under 200 ms. For CPU work, Modal's VM runtime did 15.54 runs per second at 4 vCPU / 8 GB, and Deno has no comparable score because it is fixed at 2 vCPU. boat did 26.69 runs per second in the same test.
Can Deno Sandbox or Modal VM Sandboxes run Docker?
Modal's VM runtime runs Docker, FUSE and systemd; you start dockerd yourself as the entrypoint. Deno's docs give root access but do not say Docker works. boat runs Docker and systemd in every sandbox and exposes /dev/kvm.
How long can each sandbox run?
A Deno sandbox lives up to 30 minutes, and a Modal VM Sandbox defaults to 5 minutes with a maximum of 24 hours. Both suggest promoting or snapshotting for longer work. boat has no session cap on paid plans.
Do they keep files after the sandbox ends?
Not by default. Deno wipes the root disk and offers volumes of 300 MB to 20 GB in Chicago only; Modal keeps files only in Volumes or snapshots. boat keeps the whole disk, saves it every minute and on stop, and charges nothing while stopped.
Is boat SOC 2 compliant?
SOC 2 is in progress. We're open about where we stand: live status at status.ascii.dev and our data retention policy at docs.boat.dev/data-retention.
Try boat
Install the CLI, then run boat new.
7-day free trial
More comparisons
- boat vs Deno Sandbox
- boat vs Modal VM Sandboxes
- E2B vs Deno Sandbox
- Daytona vs Deno Sandbox
- Modal vs Deno Sandbox
- Vercel Sandbox vs Deno Sandbox
- Cloudflare Sandbox vs Deno Sandbox
- Blaxel vs Deno Sandbox
- Runloop vs Deno Sandbox
- Tensorlake vs Deno Sandbox
- Morph Cloud vs Deno Sandbox
- CodeSandbox SDK vs Deno Sandbox