Deno Sandbox vs OpenAI Containers
Deno Sandbox is a small microVM you create from an SDK, with root, SSH and public URLs, that lives up to 30 minutes. OpenAI Containers are a tool inside OpenAI's model API: the model runs code in a box you reach only through the API, which expires after 20 minutes without use.
The companies and products
Deno Sandbox
Deno Sandbox is part of Deno Deploy, the hosting platform from the company behind the Deno runtime, and runs untrusted or AI-generated code in Linux microVMs.
Each sandbox is a Firecracker microVM with 2 vCPU, up to 4 GB of memory and a 10 GB disk that is wiped when it ends, created from a TypeScript or Python SDK. Outbound traffic goes through a proxy that can enforce a host allowlist and swap placeholder secrets for real ones. It is built for short runs of agent or user code, and a sandbox can be promoted to a Deno Deploy app.
- Isolation
- Firecracker microVM per sandbox
OpenAI Containers
OpenAI Containers are the sandboxes OpenAI runs for its own model tools: Code Interpreter, Hosted Shell and the Agents API's hosted sandbox.
This is a different kind of product from boat: a tool inside OpenAI's model API, not a machine you rent. You create a container through the API or let a Responses call make one, and the model runs Python or shell commands in it on a fixed Debian 12 image without sudo, until it expires after 20 minutes without use. It is built for apps that already call OpenAI models and want them to run code, read files and make charts without running any servers.
Which use cases each one fits
For each use case, Battleships prices every sandbox provider on the same workload and sorts them from the cheapest monthly bill up. “290th cheapest of 367” means 289 of the other 366 providers run that workload, with every feature it needs, for less. “With limits” means the provider runs it but misses something, so it is listed after every full match. Open a use case for its whole ranking and what each provider misses.
| Use case and its workload | Deno Sandbox: price rank | OpenAI Containers: price rank | boat: price rank |
|---|---|---|---|
| Software factory 100 at once · 4 vCPU / 8 GB · 2,200 sessions of 8 h a month Installs, builds and Docker for hours outlast Deno's 30-minute lifetime and OpenAI's no-sudo image, and boat keeps a full VM with Docker for as long as the work takes. | 290th of 367, with limits $5,665 a month | 356th of 367, with limits $17,371 a month | 3rd cheapest of 367 $634 a month |
| Always-on AI employees 50 machines 24/7 · 2 vCPU / 4 GB An assistant that lives on its machine all month loses its files on both: Deno wipes the disk after 30 minutes and OpenAI discards data when a container expires. | 287th of 366, with limits $5,803 a month | 341st of 366, with limits $13,140 a month | 5th cheapest of 366 $657 a month |
| Code interpreter bursts 100 at once · 1 vCPU / 2 GB · 200,000 sessions of 1 min a month This is the job both are built for: Deno starts in under 200 ms and bills CPU only while code runs, while OpenAI runs the model's code in the same API call. | 141st of 345, with limits $329 a month | 194th of 345, with limits $6,000 a month | 186th of 345, with limits $2,000 a month |
| Sandboxes for your users 300 at once · 2 vCPU / 4 GB · 30,000 sessions of 23 min a month Deno gives each user a sandbox with an HTTPS URL but caps Builder at 20 at once per region; OpenAI containers have no inbound access, and boat ranks first here. | 148th of 361, with limits $1,863 a month | 361st of 361, with limits $3,780 a month | Cheapest of 361 $209 a month |
| RL rollouts 1,000 at once · 2 vCPU / 4 GB · 1,000,000 sessions of 3 min a month | 122nd of 360, with limits $7,963 a month | 191st of 360, with limits $30,000 a month | 34th of 360, with limits $2,000 a month |
| Agent evals 250 at once · 4 vCPU / 8 GB · 15,000 sessions of 20 min a month | 296th of 364, with limits $1,563 a month | 360th of 364, with limits $5,760 a month | 10th cheapest of 364 $200 a month |
| CI runners 40 at once · 8 vCPU / 16 GB · 6,000 sessions of 12 min a month CI jobs need Docker and root; Deno documents root but not Docker, OpenAI documents neither, and boat has Docker and /dev/kvm on every machine. | 304th of 377, with limits $731 a month | 345th of 377, with limits $1,728 a month | 4th cheapest of 377 $86 a month |
| 24/7 dev boxes 1 machine 24/7 · 4 vCPU / 8 GB Deno offers SSH but no machine that stays on, OpenAI offers neither SSH nor a persistent disk, and boat keeps the disk while a stopped sandbox costs nothing. | 179th of 368, with limits $200 a month | 362nd of 368, with limits $1,051 a month | 18th cheapest of 368 $26 a month |
| Computer-use agents 50 at once · 4 vCPU / 8 GB · 20,000 sessions of 15 min a month Deno has no desktop, OpenAI has a hosted browser inside the Agents API beta, and boat streams a 60fps Linux desktop with Chromium. | 280th of 369, with limits $1,583 a month | 351st of 369, with limits $5,280 a month | 6th cheapest of 369 $200 a month |
| Browser-use agents 50 at once · 2 vCPU / 4 GB · 30,000 sessions of 10 min a month On Deno you install a headless browser yourself in 4 GB of memory, OpenAI's hosted browser is driven by its own Codex harness, and boat ships Chromium on a desktop. | 284th of 367, with limits $783 a month | 328th of 367, with limits $1,440 a month | 7th cheapest of 367 $200 a month |
| Scraping & bots (startup scale) 50 at once · 1 vCPU / 2 GB · 100,000 sessions of 3 min a month | 286th of 346, with limits $573 a month | 328th of 346, with limits $1,755 a month | 6th cheapest of 346 $90 a month |
| Mass scraping & bots (undetectable) 1,000 at once · 1 vCPU / 2 GB · 3,000,000 sessions of 2 min a month | 247th of 338, with limits $11,923 a month | 311th of 338, with limits $35,100 a month | 71st of 338, with limits $1,800 a month |
| Parallel red teaming 200 at once · 2 vCPU / 4 GB · 5,000 sessions of 30 min a month | 251st of 360, with limits $367 a month | 308th of 360, with limits $870 a month | 2nd cheapest of 360 $200 a month |
| GPU eval jobs 10 at once · 8 vCPU / 32 GB · 500 sessions of 30 min a month | Can't run it | Can't run it | Can't run it |
| macOS agents 5 at once · 4 vCPU / 8 GB · 1,000 sessions of 20 min a month | Can't run it | Can't run it | Can't run it |
Key features
| Feature | Deno Sandbox | OpenAI Containers | boat |
|---|---|---|---|
| What it is | A microVM you create from a TypeScript or Python SDK, part of Deno Deploy | A sandbox tool the model uses inside OpenAI's API | A cloud VM you create, keep, stop and reach from outside |
| Isolation | Firecracker microVM with its own kernel | A fully sandboxed virtual machine; hypervisor not named | Full VM with its own kernel on dedicated AMD Ryzen 9 9950X hosts |
| Machine size | 2 vCPU fixed, 768 MB to 4 GB memory, 10 GB disk | 1, 4, 16 or 64 GB of memory; vCPU not published | 4 vCPU / 8 GB by default, up to 16 vCPU / 32 GB |
| Lifetime | Up to 30 minutes; longer work can be promoted to a Deno Deploy app | Expires after 20 minutes without use; no total cap while it is kept busy | No session cap on paid plans; you set the time to live |
| Files after the session | Root disk wiped; opt-in volumes of 300 MB to 20 GB, Chicago only | Data is discarded when the container expires and cannot be recovered | Whole disk saved every minute and on stop; a stopped sandbox costs nothing |
| Root, Docker and nested virtualization | Root access; Docker and nested virtualization not documented | Commands do not run with sudo; no Docker or /dev/kvm documented | Root, systemd, Docker and /dev/kvm on every machine |
| Snapshots and fork | Read-only snapshots of a volume that new sandboxes boot from; no fork | No snapshots and no fork | Automatic disk snapshots; fork a running sandbox with its disk |
| Inbound access | SSH and a public HTTPS URL per exposed port, without authentication | None; you reach the container only through the API | SSH, HTTPS URLs for up to 50 ports, token-protected by default, and raw TCP |
| Outbound network | Open by default; a host allowlist per sandbox, enforced by a proxy outside the VM | Code Interpreter and Hosted Shell: off until an admin sets an org domain allowlist | Open internet on every plan; no provider-side allowlist |
| Keeping API keys out of the sandbox | Placeholder secrets swapped for real ones on requests to approved hosts | domain_secrets: a sidecar adds the real header for approved domains | Credentials proxy for model providers and any HTTPS API; switch a credential to another account when credits run out |
| Coding agents | A root image with Claude Code, run through the shell command API | Agents API (beta) drives a managed Codex harness, with steering, events and webhooks | Seven agents preinstalled, including Claude Code and Codex, with a prompt, steer and events API |
| Desktop and computer use | No desktop; a VS Code editor in the browser | Hosted browser for the Agents API computer_use tool | Linux desktop streamed at 60fps, Chromium and computer use built in |
| How many at once | 3 per region on Pro, 20 per region on Builder | No container limit published; Code Interpreter allows 100 requests a minute per org | Hundreds at once on the larger plans |
| Regions | Amsterdam and Chicago | US or EU processing for Code Interpreter; Agents API data residency in the US only | EU only (Germany, Finland, France) |
Every feature Battleships tracks (43)
| Feature | Deno Sandbox | OpenAI Containers | boat |
|---|---|---|---|
| Full VM (own kernel) | Yes | Yes | Yes |
| Docker inside | Not published | No | Yes |
| Nested virtualization | No | No | Yes |
| Root | Yes | No | Yes |
| Systemd | Not published | Not published | Yes |
| Desktop GUI | No | Yes | Yes |
| Browser | No | Yes | Yes |
| Computer-use API | No | Yes | Yes |
| SSH | Yes | No | Yes |
| Persistent disk | Yes | No | Yes |
| Pause/resume | No | No | Yes |
| Automatic snapshots | No | No | Yes |
| Fork/clone | No | No | Yes |
| Live fork (no pause) | No | No | Yes |
| Memory fork | No | No | No |
| Custom image (Docker or snapshot) | Yes | No | Yes |
| ≥24 h sessions | No | Yes | Yes |
| Idle auto-stop | No | Yes | No |
| Wake on request | No | No | No |
| HTTPS preview URLs | Yes | No | Yes |
| Raw TCP inbound | No | No | Yes |
| Public IPv4 | No | No | No |
| Egress allowlist | Yes | Yes | No |
| Secret proxy | Yes | Yes | Yes |
| Secret proxy for any API | Yes | Yes | Yes |
| Preinstalled agents | Yes | No | Yes |
| Agent harness API | No | Yes | Yes |
| MCP server | No | No | No |
| GPU | No | No | No |
| Windows | No | No | No |
| Arm64 | No | No | No |
| Self-hosting | No | Yes | No |
| BYOC | No | No | No |
| Open source | No | No | No |
| Scoped API keys | Not published | Not published | Yes |
| Spend limits | Yes | Not published | Yes |
| Usage per sandbox (API) | No | No | Yes |
| Audit logs | Not published | Not published | No |
| SSO | No | Yes | No |
| SOC 2 | Yes | Yes | No |
| HIPAA | Yes | Yes | No |
| EU data residency | Yes | Yes | Yes |
| Zero data retention | Not published | Not published | Yes |
Performance
There is no comparable measurement for either. Deno Sandbox and OpenAI Containers are not in the public CPU benchmark, Deno's fixed 2 vCPU shape could not run the 4 vCPU test, and OpenAI does not publish the vCPU behind each container size. boat did 26.69 runs per second on the hpc-sandbox-benchmarks Node.js build-and-test loop at 4 vCPU / 8 GB.
Node.js build-and-test loop at 4 vCPU / 8 GB, higher is better. Measured with the open hpc-sandbox-benchmarks suite. Deno Sandbox and OpenAI Containers have no published run in this suite yet, so there is no like-for-like number to compare.
Pricing in five scenarios
Each bill is priced from the providers' public price lists by the open Battleships engine, with the cheapest plan that runs the scenario.
| Scenario | Deno Sandbox, a month | OpenAI Containers, a month | boat, a month |
|---|---|---|---|
| One coding agent, workdays 4 vCPU / 8 GB, 50 GB disk, 8 hours a day, 22 days a month, files kept between days | $53 · Pro · with limits | $228 · API pay as you go · with limits | $20 · $20/mo |
| One agent that never stops 4 vCPU / 8 GB, 50 GB disk, running 24/7 all month | $200 · Builder · with limits | $1,051 · API pay as you go · with limits | $26 · $20/mo |
| 50 agents in parallel 50 machines of 4 vCPU / 8 GB at once, 8-hour sessions, 1,100 sessions a month, Docker inside | $2,779 · Builder · with limits | $11,405 · API pay as you go · with limits | $317 · $20/mo × 3 seats |
| Sandboxes for your users 2 vCPU / 4 GB, 30,000 sessions of 10 minutes a month, up to 300 at once | $783 · Builder · with limits | $1,620 · API pay as you go · with limits | $200 · $100/mo × 2 seats |
| 1,000 short jobs at once 2 vCPU / 4 GB, 1,000 at once, 3 minutes each, 200,000 jobs a month | $1,563 · Builder · with limits | $6,000 · API pay as you go · with limits | $2,000 · $2000/mo · with limits |
Deno Sandbox: Sandboxes need the Pro plan at $20 a month or Builder at $200 a month; the fee is not credit but includes CPU, memory and egress allowances shared with Deno Deploy apps. Past those, CPU costs $0.10 per hour of active CPU time and memory $0.025 per GiB-hour for the whole life of the sandbox.
OpenAI Containers: OpenAI bills each container session by the minute for the memory size you pick, with a 5-minute minimum, and model tokens are billed separately on top. There is no plan fee.
OpenAI Containers: Plans start at $20 a month, and the whole fee is usage credit spent per second on running sandboxes. A stopped sandbox costs nothing and keeps its disk.
Limits in those scenarios
Neither Deno Sandbox nor OpenAI Containers fits any of the five scenarios as written. Deno caps a sandbox at 30 minutes and 2 vCPU / 4 GB, and Builder allows 20 at once per region, short of 50 agents. OpenAI has no persistent disk or Docker, starts Code Interpreter and Hosted Shell with no internet, and does not publish vCPU or how many containers can run at once. boat fits four of the five; at 1,000 short jobs at once its $2,000 plan queues starts above 90 a minute.
| Scenario | Deno Sandbox | OpenAI Containers | boat |
|---|---|---|---|
| One coding agent, workdays |
|
| None that bite |
| One agent that never stops |
|
| None that bite |
| 50 agents in parallel |
|
| None that bite |
| Sandboxes for your users |
|
| None that bite |
| 1,000 short jobs at once |
|
|
|
Which one should you use?
Use Deno Sandbox when
you run short pieces of untrusted code from your own app and need them to start in milliseconds, reach only the hosts you allow, or serve a URL, especially if you deploy on Deno Deploy.
- Reachable and in your control. Good if you or your users must open what the code built: Deno gives SSH and an HTTPS URL per port.
- Fast starts and active-CPU billing. Suits short bursts of code: a sandbox starts in under 200 ms and CPU bills only while code runs.
- Open by default, lockable per sandbox. Fits untrusted code that still needs the internet: each sandbox can get its own host allowlist, enforced outside the VM.
Use OpenAI Containers when
your app already calls OpenAI models and the model only needs to run short pieces of Python or shell on files you give it, with no machine to manage.
- Built into the model call. Useful if your app already calls OpenAI models: one tool line in a request gives the model a place to run code.
- Bigger memory sizes. Fits data work that needs memory: containers come in 16 GB and 64 GB sizes, while Deno stops at 4 GB.
- No plan fee. Fits light or occasional use: you pay per minute for each container session, with no monthly plan to buy first.
Where boat fits
Both Deno Sandbox and OpenAI Containers are made for short runs of code that leave nothing behind. If what you are really running is agents that install, build and test for hours or days, boat gives each one a full VM it keeps, with Docker, a desktop and coding agents built in.
A machine that stays
A Deno sandbox ends after 30 minutes and wipes its root disk, and an OpenAI container discards its data after 20 idle minutes. Your agent rebuilds its clone and installs each time; boat saves the whole disk every minute and on stop.
Root, Docker and a bigger machine
Deno is fixed at 2 vCPU and 4 GB with no documented Docker, and OpenAI runs commands without sudo. A repo that needs a database in Docker or an emulator stalls; boat has root, Docker, systemd and /dev/kvm on up to 16 vCPU.
Agents and a desktop driven from outside
On Deno you run Claude Code through shell commands and parse the output, and OpenAI's harness only runs Codex. boat preinstalls seven agents you prompt and steer through one API, plus a 60fps desktop with Chromium.
Use boat when your agents do real work for more than a few minutes: installs, builds, Docker, emulators and a browser, on a bigger machine whose disk is still there tomorrow. Compare it one to one: boat vs Deno Sandbox and boat vs OpenAI Containers.
Questions people ask
Is Deno Sandbox cheaper than OpenAI Containers?
In the scenarios on this page, yes: one coding agent on workdays comes to $53 a month on Deno Pro against $228 on OpenAI, and one agent running all month $200 against $1,051. Neither fits those scenarios as written, and OpenAI also bills model tokens on top.
Which is faster, Deno Sandbox or OpenAI Containers?
There is no comparable CPU measurement for either. Deno says a sandbox starts in under 200 ms, and OpenAI does not publish the vCPU behind its container sizes.
Can Deno Sandbox or OpenAI Containers run Docker?
Deno gives root access but its docs do not say Docker works, and OpenAI runs commands without sudo with no Docker documented. boat runs Docker and systemd and exposes /dev/kvm on every sandbox.
Do they keep files after a session?
Deno wipes the root disk when a sandbox ends, but you can mount a volume of 300 MB to 20 GB in Chicago. OpenAI discards a container's data when it expires after 20 minutes without use. boat keeps the whole disk and saves it every minute.
Can I open a web app running inside either one?
On Deno, yes: each exposed port gets a public HTTPS URL, and you can SSH in. OpenAI containers have no ports, URLs or SSH. boat gives each sandbox token-protected HTTPS URLs for up to 50 ports, raw TCP and SSH.
Is boat SOC 2 compliant?
SOC 2 is in progress. We're open about where we stand: live status at status.ascii.dev and our data retention policy at docs.boat.dev/data-retention.
Try boat
Install the CLI, then run boat new.
7-day free trial
More comparisons
- boat vs Deno Sandbox
- boat vs OpenAI Containers
- E2B vs Deno Sandbox
- Daytona vs Deno Sandbox
- Modal vs Deno Sandbox
- Vercel Sandbox vs Deno Sandbox
- Cloudflare Sandbox vs Deno Sandbox
- Blaxel vs Deno Sandbox
- Runloop vs Deno Sandbox
- Tensorlake vs Deno Sandbox
- Morph Cloud vs Deno Sandbox
- CodeSandbox SDK vs Deno Sandbox