Modal vs Cloudflare Sandbox
Modal runs sandboxes under gVisor inside a big AI compute platform with GPUs, and ends each one within 24 hours. Cloudflare runs each sandbox as a container in its own Firecracker microVM behind your Worker, sleeping when idle and waking on the next request.
The companies and products
Modal
Modal is a serverless cloud for AI work: inference, training, batch jobs and sandboxed code, all driven from Python, TypeScript or Go code.
Modal Sandboxes are containers you create from code, run commands in, and then terminate. By default they run under gVisor, a user-space kernel from Google; since October 2026 you can also pick a VM runtime with its own Linux kernel for Docker and FUSE (Battleships tracks that as a separate card, Modal VM Sandboxes). It suits teams that already run models on Modal and want short-lived, scalable code execution next to their GPUs.
Cloudflare Sandbox
Cloudflare Sandbox SDK runs untrusted or AI-generated code in Linux containers on Cloudflare's network, driven from a Cloudflare Worker.
Each sandbox is a Cloudflare Container backed by a Durable Object, and each container runs in its own Firecracker microVM with its own kernel and network. You build a linux/amd64 image, pick an instance type of up to 4 vCPU and 12 GiB, and reach the sandbox through your own Worker. It suits teams already on Workers who want short-lived sandboxes that sleep when idle; for code that only calls known methods, Cloudflare also offers Dynamic Workers, which run JavaScript in V8 isolates.
- Largest instance
- 4 vCPU, 12 GiB memory, 20 GB disk (defaults, can be raised)
- Account limits
- 1,500 vCPU, 6 TiB memory and 30 TB disk running at once
- Compliance
- Cloudflare holds a SOC 2 Type II report
Which use cases each one fits
For each use case, Battleships prices every sandbox provider on the same workload and sorts them from the cheapest monthly bill up. “19th cheapest of 345” means 18 of the other 344 providers run that workload, with every feature it needs, for less. “With limits” means the provider runs it but misses something, so it is listed after every full match. Open a use case for its whole ranking and what each provider misses.
| Use case and its workload | Modal: price rank | Cloudflare Sandbox: price rank | boat: price rank |
|---|---|---|---|
| Software factory 100 at once · 4 vCPU / 8 GB · 2,200 sessions of 8 h a month | Can't run it | 162nd of 367, with limits $1,543 a month | 3rd cheapest of 367 $634 a month |
| Always-on AI employees 50 machines 24/7 · 2 vCPU / 4 GB An always-on agent hits Modal's 24-hour session limit and loses its disk on Cloudflare when it sleeps; boat keeps the disk with no session cap on paid plans. | 196th of 366, with limits $1,924 a month | 207th of 366, with limits $2,188 a month | 5th cheapest of 366 $657 a month |
| Code interpreter bursts 100 at once · 1 vCPU / 2 GB · 200,000 sessions of 1 min a month Both fit short code-interpreter calls well: Modal starts sandboxes fast at high concurrency, and Cloudflare bills CPU only while busy and wakes on request. | 19th cheapest of 345 $181 a month | 13th cheapest of 345 $144 a month | 186th of 345, with limits $2,000 a month |
| Sandboxes for your users 300 at once · 2 vCPU / 4 GB · 30,000 sessions of 23 min a month Both fit sandboxes for your users; boat adds sandboxes that stop for free and come back with their disk. | 11th cheapest of 361 $811 a month | 9th cheapest of 361 $731 a month | Cheapest of 361 $209 a month |
| RL rollouts 1,000 at once · 2 vCPU / 4 GB · 1,000,000 sessions of 3 min a month RL rollouts launch many short sandboxes at once, which is what Modal is built for; Cloudflare's 1,500 vCPU account cap gets in the way at that scale. | 5th cheapest of 360 $19,038 a month | 144th of 360, with limits $9,428 a month | 34th of 360, with limits $2,000 a month |
| Agent evals 250 at once · 4 vCPU / 8 GB · 15,000 sessions of 20 min a month | 59th cheapest of 364 $1,244 a month | 45th cheapest of 364 $818 a month | 10th cheapest of 364 $200 a month |
| CI runners 40 at once · 8 vCPU / 16 GB · 6,000 sessions of 12 min a month CI jobs that build Docker images need Modal's VM runtime, and Cloudflare runs docker:dind with iptables off and 20 GB of disk by default; boat runs full Docker in every sandbox. | 126th cheapest of 377 $1,793 a month | 301st of 377, with limits $704 a month | 4th cheapest of 377 $86 a month |
| 24/7 dev boxes 1 machine 24/7 · 4 vCPU / 8 GB A dev box needs its files after you log off: Modal ends a sandbox within 24 hours and Cloudflare wipes the disk on sleep, while boat stops for free and resumes with its disk. | 138th of 368, with limits $23 a month | 70th cheapest of 368 $93 a month | 18th cheapest of 368 $26 a month |
| Computer-use agents 50 at once · 4 vCPU / 8 GB · 20,000 sessions of 15 min a month Neither ships a desktop: Modal has a VNC example and Cloudflare removed its built-in desktop, while boat has a 60fps desktop and a computer-use API. | 98th of 369, with limits $183 a month | 166th of 369, with limits $460 a month | 6th cheapest of 369 $200 a month |
| Browser-use agents 50 at once · 2 vCPU / 4 GB · 30,000 sessions of 10 min a month | 177th of 367, with limits $136 a month | 210th of 367, with limits $233 a month | 7th cheapest of 367 $200 a month |
| Scraping & bots (startup scale) 50 at once · 1 vCPU / 2 GB · 100,000 sessions of 3 min a month | 267th of 346, with limits $394 a month | 250th of 346, with limits $286 a month | 6th cheapest of 346 $90 a month |
| Mass scraping & bots (undetectable) 1,000 at once · 1 vCPU / 2 GB · 3,000,000 sessions of 2 min a month | 223rd of 338, with limits $8,795 a month | 169th of 338, with limits $5,741 a month | 71st of 338, with limits $1,800 a month |
| Parallel red teaming 200 at once · 2 vCPU / 4 GB · 5,000 sessions of 30 min a month | Can't run it | 239th of 360, with limits $325 a month | 2nd cheapest of 360 $200 a month |
| GPU eval jobs 10 at once · 8 vCPU / 32 GB · 500 sessions of 30 min a month Modal has GPUs from T4 to B300 and neither Cloudflare nor boat has any, so Modal is the pick for GPU jobs. | 19th cheapest of 98 $1,187 a month | Can't run it | Can't run it |
| macOS agents 5 at once · 4 vCPU / 8 GB · 1,000 sessions of 20 min a month | Can't run it | Can't run it | Can't run it |
Key features
| Feature | Modal | Cloudflare Sandbox | boat |
|---|---|---|---|
| Isolation | gVisor by default; VM runtime with its own kernel available (Modal VM Sandboxes) | Firecracker microVM per container, own kernel and network | Full VM with its own kernel on dedicated AMD Ryzen 9 9950X hosts |
| Docker inside | Only with the VM runtime | docker:dind with iptables and IP forwarding turned off | Full Docker, root and systemd in every sandbox |
| Nested virtualization | VM runtime only, Team and Enterprise plans, on request | Not documented | Yes, /dev/kvm (Android emulators, VMs) |
| Files between sessions | Root disk is gone when a sandbox ends; only Volumes keep files | Disk is fresh after sleep; snapshots (public beta, 30 days) or R2 backups when your code saves them | Disk kept; saved every minute and on stop; a stopped sandbox costs nothing |
| Longest session | 24 hours (default 5 minutes) | No fixed maximum, but no guaranteed runtime; host restarts can stop a container | No cap on paid plans (default TTL 1 h, changeable) |
| Fork and snapshots | Filesystem snapshots into an image; memory snapshots in alpha (they end the sandbox) | No fork; restore a saved snapshot or backup into a new sandbox | Fork a running sandbox without stopping it; no memory snapshots |
| Largest machine | Not published (Modal says a maximum is enforced) | 4 vCPU / 12 GiB / 20 GB disk by default (can be raised) | Up to 16 vCPU / 32 GB, depending on plan |
| GPUs | T4 to B300; 10 at once on Starter, 50 on Team | None | None |
| Desktop and browser | Not offered; an example shows how to set up VNC yourself | Built-in desktop removed in SDK 0.10.2; bring your own | 60fps desktop and Chromium, computer-use API, embeddable stream |
| Coding agents | Examples only | Run Claude Code, Codex, OpenCode or Pi in your image; OpenCode has an SDK helper | Claude Code, Codex, pi, OpenCode and more built in, with a prompt, steer and events API |
| Keeping keys out of the sandbox | Secrets are environment variables, or you run your own proxy in a sidecar | Your outbound handler adds the token for any HTTP or HTTPS host; you write the code | Managed proxy for model providers and any HTTPS API you register; switch a credential to another account |
| Inbound traffic | Encrypted and raw TCP tunnels, connect tokens, inbound IP allowlist | HTTP and WebSocket previews routed through your Worker; no raw TCP or public IP | HTTPS URLs for up to 50 ports, token-protected; raw TCP; own IPv6 or IPv4 |
| Egress control | Block all, IP-range allowlist, domain allowlist (beta) | allowedHosts deny-by-default list plus outbound handlers you write in Worker code | No provider-side allowlist |
| Idle behavior and regions | Idle sandboxes pay until terminated; US, EU and Asia-Pacific, pinning costs 1.15x to 1.75x | Sleeps after inactivity and wakes on the next request; several regions across Cloudflare's network | TTL based, stops for free; EU only: Germany, Finland, France |
Every feature Battleships tracks (43)
| Feature | Modal | Cloudflare Sandbox | boat |
|---|---|---|---|
| Full VM (own kernel) | No | Yes | Yes |
| Docker inside | No | Yes | Yes |
| Nested virtualization | No | No | Yes |
| Root | Yes | Yes | Yes |
| Systemd | Yes | Not published | Yes |
| Desktop GUI | No | No | Yes |
| Browser | No | No | Yes |
| Computer-use API | No | No | Yes |
| SSH | Yes | Yes | Yes |
| Persistent disk | Yes | No | Yes |
| Pause/resume | No | No | Yes |
| Automatic snapshots | No | No | Yes |
| Fork/clone | Yes | No | Yes |
| Live fork (no pause) | No | No | Yes |
| Memory fork | Yes | No | No |
| Custom image (Docker or snapshot) | Yes | Yes | Yes |
| ≥24 h sessions | Yes | Yes | Yes |
| Idle auto-stop | Yes | Yes | No |
| Wake on request | No | Yes | No |
| HTTPS preview URLs | Yes | Yes | Yes |
| Raw TCP inbound | Yes | No | Yes |
| Public IPv4 | No | No | No |
| Egress allowlist | Yes | Yes | No |
| Secret proxy | No | Yes | Yes |
| Secret proxy for any API | No | Yes | Yes |
| Preinstalled agents | No | Yes | Yes |
| Agent harness API | No | Yes | Yes |
| MCP server | No | No | No |
| GPU | Yes | No | No |
| Windows | No | No | No |
| Arm64 | No | No | No |
| Self-hosting | No | No | No |
| BYOC | No | No | No |
| Open source | No | Yes | No |
| Scoped API keys | Not published | Not published | Yes |
| Spend limits | Not published | No | Yes |
| Usage per sandbox (API) | Not published | Not published | Yes |
| Audit logs | Yes | Yes | No |
| SSO | Yes | Yes | No |
| SOC 2 | Yes | Yes | No |
| HIPAA | Yes | Yes | No |
| EU data residency | Yes | Yes | Yes |
| Zero data retention | Not published | Not published | Yes |
Performance
In the hpc-sandbox-benchmarks Node.js build-and-test loop at 4 vCPU / 8 GB, run on 29 September 2026, boat finished 26.69 runs per second and Modal's default gVisor sandbox 12.79, so boat did about twice the work. Cloudflare has no result on that benchmark, so there is no comparable CPU number for it.
Node.js build-and-test loop at 4 vCPU / 8 GB, higher is better. Measured with the open hpc-sandbox-benchmarks suite. Modal measured on: Sandbox (gVisor), request = size, any region. Cloudflare Sandbox has no published run in this suite yet, so there is no like-for-like number to compare.
Pricing in five scenarios
Each bill is priced from the providers' public price lists by the open Battleships engine, with the cheapest plan that runs the scenario.
| Scenario | Modal, a month | Cloudflare Sandbox, a month | boat, a month |
|---|---|---|---|
| One coding agent, workdays 4 vCPU / 8 GB, 50 GB disk, 8 hours a day, 22 days a month, files kept between days | $15 · Starter · with limits | $39 · Workers Paid · with limits | $20 · $20/mo |
| One agent that never stops 4 vCPU / 8 GB, 50 GB disk, running 24/7 all month | $178 · Starter · with limits | $148 · Workers Paid · with limits | $26 · $20/mo |
| 50 agents in parallel 50 machines of 4 vCPU / 8 GB at once, 8-hour sessions, 1,100 sessions a month, Docker inside | $2,229 · Starter · with limits | $1,660 · Workers Paid · with limits | $317 · $20/mo × 3 seats |
| Sandboxes for your users 2 vCPU / 4 GB, 30,000 sessions of 10 minutes a month, up to 300 at once | $792 · Team | $476 · Workers Paid | $200 · $100/mo × 2 seats |
| 1,000 short jobs at once 2 vCPU / 4 GB, 1,000 at once, 3 minutes each, 200,000 jobs a month | $3,193 · Team · with limits | $1,889 · Workers Paid · with limits | $2,000 · $2000/mo · with limits |
Modal: Modal bills by the second for whichever is higher, the CPU and memory you request or what you use, and an idle sandbox pays until it is terminated. Starter is free with $30 of monthly credit; Team is $250 a month with $100 of credit.
Cloudflare Sandbox: Cloudflare needs Workers Paid ($5 a month minimum). CPU is billed only while busy; memory and disk are billed on the instance size until the container sleeps, and 4 vCPU always comes with 12 GiB.
Cloudflare Sandbox: boat plans start at $20 a month and all of it is usage credit, billed per second while a sandbox runs. A stopped sandbox costs nothing and keeps its disk.
Limits in those scenarios
Modal ends a sandbox within 24 hours and keeps only files in a Volume, and its default sandbox has no Docker, so the 50-agent fleet does not fit. Cloudflare wipes the disk on sleep, so the scenarios that keep files between days do not fit without your own snapshot code, and its 1,500 vCPU account cap is short of the 2,000 vCPU the 1,000-job burst needs. On boat, that burst runs into start limits: bursts above 90 starts a minute wait in a queue.
| Scenario | Modal | Cloudflare Sandbox | boat |
|---|---|---|---|
| One coding agent, workdays |
|
| None that bite |
| One agent that never stops |
|
| None that bite |
| 50 agents in parallel |
|
| None that bite |
| Sandboxes for your users | None that bite | None that bite | None that bite |
| 1,000 short jobs at once |
|
|
|
Which one should you use?
Use Modal when
your sandboxes need GPUs, or are huge bursts of short jobs next to models you already run on Modal.
- GPUs next to your sandboxes. Useful if your agent trains or runs models: Modal rents GPUs from T4 to B300 on the same platform as its sandboxes.
- Huge bursts of short jobs. Modal runs up to 5,000 containers on Team with fast starts, and memory snapshots are in alpha.
- Raw TCP and a VM option. Modal offers raw TCP tunnels, and its VM runtime gives a real kernel for Docker and FUSE when you need it.
Use Cloudflare Sandbox when
your app already runs on Workers and you want short sandboxes that sleep when idle, wake on request and follow egress rules you write.
- Sleeps when idle, wakes on request. Useful for many short, spiky sessions: a sandbox sleeps when idle, wakes on the next request, and bills CPU only while busy.
- Egress rules you can program. Cloudflare can block every host except the ones you list, and run your own code on each outbound request.
- Next to your Workers app. If your app already runs on Workers, sandboxes sit next to Durable Objects and R2, in several regions.
Where boat fits
Modal and Cloudflare both shine at short sandboxes that come and go. If your agents work for hours or days, building, testing, running Docker and checking a UI, look at boat: a full VM on a fast machine that keeps its disk, stops for free and has agents and a desktop ready.
A disk that survives
Modal wipes the root disk when a sandbox ends, at most 24 hours in, and Cloudflare starts from a fresh disk after sleep. On both you write code to save files to Volumes, snapshots or R2, or the agent reinstalls everything.
A whole machine with a screen
Modal needs its VM runtime for Docker, Cloudflare runs Docker with iptables off in 20 GB of disk, and neither ships a desktop. boat gives full Docker, /dev/kvm and a 60fps desktop with computer use in every sandbox.
Agents and keys handled for you
On Modal and Cloudflare you bake each coding agent into your image and keep keys in env vars or write your own sidecar or outbound handler. boat ships Claude Code, Codex and others with one API, and real keys never enter the sandbox.
Use boat when your agents work for hours or days: installs, builds, tests, full Docker and a desktop, on a fast VM that keeps its disk and never cuts them off. Compare it one to one: boat vs Modal and boat vs Cloudflare Sandbox.
Questions people ask
Is Modal cheaper than Cloudflare Sandbox?
It depends on the job. For one agent on workdays Modal is $15 a month against $39 on Cloudflare, but for 50 parallel agents Cloudflare is $1,660 against $2,229, and for sandboxes for your users $476 against $792. boat comes in at $317 and $200 for those two.
Which is faster, Modal or Cloudflare Sandbox?
There is no comparable CPU number: Modal's default sandbox scored 12.79 runs per second on the hpc-sandbox-benchmarks Node.js loop, and Cloudflare has no result there. boat scored 26.69 in the same run.
Can Modal or Cloudflare Sandbox run Docker?
Modal runs Docker only with its VM runtime. Cloudflare supports docker:dind with iptables and IP forwarding turned off. Every boat sandbox runs full Docker with root and systemd.
Do they keep my files?
Not on their own. A Modal sandbox loses its root disk when it ends, so files must go in a Volume, and a Cloudflare sandbox starts from a fresh disk after sleep unless your code saved a snapshot or R2 backup. boat keeps the disk across stops.
Which one has GPUs?
Modal, with GPUs from T4 to B300. Cloudflare Sandbox has none, and neither does boat.
How long can a sandbox run?
Modal caps a sandbox at 24 hours, with a 5-minute default. Cloudflare sets no fixed maximum but does not guarantee any runtime, and stops idle containers. boat has no session cap on paid plans.
Try boat
Install the CLI, then run boat new.
7-day free trial