Northflank vs AWS AgentCore
Northflank is a developer platform whose sandboxes are microVMs up to 20 vCPU that run until you pause them. AWS AgentCore is an AWS agent platform: 2 vCPU microVM sessions that stop after 8 hours, plus a managed code interpreter and browser that live inside your AWS account.
The companies and products
Northflank
Northflank is a London developer platform for running services, jobs and databases on Kubernetes, and Sandboxes is its product for running untrusted code.
A Northflank sandbox is a container image deployed as a service: CPU sandboxes run in Kata microVMs with their own kernel, and GPU sandboxes run under gVisor. You create and drive them from the JavaScript or Python SDK, the CLI or the dashboard, on Northflank's cloud or inside your own. It suits teams that already want one platform for apps, databases, GPUs and sandboxes.
AWS AgentCore
Amazon Bedrock AgentCore is a set of AWS services to deploy and run AI agents: a Runtime that hosts your agent code, plus built-in Code Interpreter and Browser tools.
AgentCore is not a sandbox product first. It is a hyperscaler's agent platform: you push a container image or code, and each Runtime session gets its own Firecracker microVM that you reach through AgentCore APIs. Around it sit managed tools (Code Interpreter, Browser) and services for memory, identity, gateways and evaluations, and an Instances compute type runs longer sessions on EC2 in your own account. It is built for teams who already build on AWS and want agents to stay inside their account, IAM and VPC.
Which use cases each one fits
For each use case, Battleships prices every sandbox provider on the same workload and sorts them from the cheapest monthly bill up. “38th cheapest of 377” means 37 of the other 376 providers run that workload, with every feature it needs, for less. “With limits” means the provider runs it but misses something, so it is listed after every full match. Open a use case for its whole ranking and what each provider misses.
| Use case and its workload | Northflank: price rank | AWS AgentCore: price rank | boat: price rank |
|---|---|---|---|
| Software factory 100 at once · 4 vCPU / 8 GB · 2,200 sessions of 8 h a month A coding agent on AgentCore gets 2 vCPU and 8 hours per session, while Northflank gives it a bigger machine with no cap; on both, packages outside a volume or mount reset after a stop, and boat keeps the whole disk. | 159th of 367, with limits $1,477 a month | 100th of 367, with limits $888 a month | 3rd cheapest of 367 $634 a month |
| Always-on AI employees 50 machines 24/7 · 2 vCPU / 4 GB An assistant that runs all month fits Northflank's open-ended sandboxes but outlasts AgentCore's 8-hour microVM sessions, so on AWS it needs the Instances type on EC2 in your account. | 173rd of 366, with limits $1,365 a month | 64th of 366, with limits $1,300 a month | 5th cheapest of 366 $657 a month |
| Code interpreter bursts 100 at once · 1 vCPU / 2 GB · 200,000 sessions of 1 min a month AgentCore Code Interpreter is built for short code runs and bills only for CPU actually used, which is why AWS AgentCore ranks 7th here against Northflank at 84th. | 84th of 345, with limits $115 a month | 7th cheapest of 345 $114 a month | 186th of 345, with limits $2,000 a month |
| Sandboxes for your users 300 at once · 2 vCPU / 4 GB · 30,000 sessions of 23 min a month Northflank can give each user a sandbox with HTTPS ports, while AgentCore sessions have no open ports; boat gives each one HTTPS URLs on up to 50 ports. | 89th of 361, with limits $815 a month | 210th of 361, with limits $506 a month | Cheapest of 361 $209 a month |
| RL rollouts 1,000 at once · 2 vCPU / 4 GB · 1,000,000 sessions of 3 min a month | 342nd of 360, with limits $1,762 a month | 125th of 360, with limits $8,075 a month | 34th of 360, with limits $2,000 a month |
| Agent evals 250 at once · 4 vCPU / 8 GB · 15,000 sessions of 20 min a month | 134th of 364, with limits $689 a month | 33rd cheapest of 364 $650 a month | 10th cheapest of 364 $200 a month |
| CI runners 40 at once · 8 vCPU / 16 GB · 6,000 sessions of 12 min a month Both fit CI jobs; boat adds /dev/kvm for Android emulators and VM builds, which neither Northflank nor AgentCore documents. | 38th cheapest of 377 $352 a month | 52nd cheapest of 377 $399 a month | 4th cheapest of 377 $86 a month |
| 24/7 dev boxes 1 machine 24/7 · 4 vCPU / 8 GB | 151st of 368, with limits $59 a month | 228th of 368, with limits $52 a month | 18th cheapest of 368 $26 a month |
| Computer-use agents 50 at once · 4 vCPU / 8 GB · 20,000 sessions of 15 min a month AgentCore Browser drives a browser and Northflank sandboxes are headless; boat streams a full Linux desktop at 60fps for agents that use other apps too. | 151st of 369, with limits $371 a month | 104th of 369, with limits $202 a month | 6th cheapest of 369 $200 a month |
| Browser-use agents 50 at once · 2 vCPU / 4 GB · 30,000 sessions of 10 min a month AgentCore Browser is a managed Chromium with live view and replay, so AWS AgentCore ranks 4th here, while on Northflank you install and run a browser in your own image. | 200th of 367, with limits $194 a month | 4th cheapest of 367 $144 a month | 7th cheapest of 367 $200 a month |
| Scraping & bots (startup scale) 50 at once · 1 vCPU / 2 GB · 100,000 sessions of 3 min a month | 196th of 346, with limits $117 a month | 27th cheapest of 346 $287 a month | 6th cheapest of 346 $90 a month |
| Mass scraping & bots (undetectable) 1,000 at once · 1 vCPU / 2 GB · 3,000,000 sessions of 2 min a month | 83rd of 338, with limits $2,049 a month | 165th of 338, with limits $5,458 a month | 71st of 338, with limits $1,800 a month |
| Parallel red teaming 200 at once · 2 vCPU / 4 GB · 5,000 sessions of 30 min a month | 141st of 360, with limits $99 a month | 62nd of 360, with limits $294 a month | 2nd cheapest of 360 $200 a month |
| GPU eval jobs 10 at once · 8 vCPU / 32 GB · 500 sessions of 30 min a month Northflank has GPU sandboxes from L4 to H100 and ranks 4th here; AgentCore offers GPUs only on the Instances type, and boat is CPU only. | 4th cheapest of 98 $693 a month | Can't run it | Can't run it |
| macOS agents 5 at once · 4 vCPU / 8 GB · 1,000 sessions of 20 min a month | Can't run it | Can't run it | Can't run it |
Key features
| Feature | Northflank | AWS AgentCore | boat |
|---|---|---|---|
| What it is | A developer platform for services, jobs and databases, with sandboxes as one workload type | An AWS agent platform: hosted agent sessions plus managed Code Interpreter and Browser tools | A sandbox platform: each agent gets its own full Linux machine |
| Isolation | Kata microVM with its own kernel for CPU sandboxes; gVisor for GPU | Firecracker microVM per Runtime session; Code Interpreter and Browser in a containerized environment | Full VM with its own kernel on dedicated AMD Ryzen 9 9950X hosts |
| Biggest machine | Plans from 0.1 vCPU up to 20 vCPU / 40 GB, more on request; a resize restarts the sandbox | 2 vCPU / 8 GB per microVM session, not adjustable; bigger EC2 types only on Instances | Up to 16 vCPU / 32 GB on the $100 plan and above |
| Session length | No documented maximum; a sandbox runs until you pause or delete it, with no idle auto-pause | Up to 8 hours per lifecycle on microVMs, stopped after 15 idle minutes by default; up to 14 days on Instances | No cap on paid plans; you set the time to live |
| What survives a stop | Only attached volumes, which bill while paused; the rest of the disk and all processes reset | Only one storage mount under /mnt, up to 1 GB, in preview; EBS volumes on Instances; the rest resets | The whole disk, saved every minute and on stop; stopped sandboxes cost nothing |
| Snapshots and fork | Filesystem snapshots of a running or stopping sandbox, opt-in; restore into a new one | No user snapshots or fork of a session | Automatic snapshots every minute; fork a running sandbox with its disk |
| Docker and /dev/kvm | Own kernel, so Docker can run inside; /dev/kvm not documented | Root inside the microVM with arm64 container images; Docker and /dev/kvm not documented | Root, Docker, systemd and /dev/kvm for Android emulators and VMs |
| Inbound access | HTTPS ports on a code.run domain, private by default; public TCP and UDP need a separate load balancer | No open ports or SSH; sessions are reached only through AgentCore APIs with IAM or JWT | HTTPS URLs for up to 50 ports, token-protected by default; raw TCP; SSH |
| Network controls | Network policies with allow lists by IP, CIDR or domain, documented for your own cluster | VPC mode with security groups, PrivateLink and a NAT gateway for a fixed outbound IP | Open internet, no provider-side allowlist |
| Browser and desktop | Headless; access by SDK, browser terminal or SSH | Managed Chromium with live view, session recording and replay, profiles and proxies; no full desktop | Full Linux desktop streamed at 60fps, with Chromium and computer use |
| Coding agents | Harnesses with Claude Code, Codex, Cursor, OpenCode or Pi; you talk to the agent through a terminal or SSH | AWS's own managed harness built on Strands Agents, or your own agent code in any framework | Claude Code, Codex and five more preinstalled, with a prompt, steer and events API |
| Keeping API keys out of the sandbox | Header injection for listed hosts in the network policy API; otherwise secrets are env vars or files | AgentCore Identity stores OAuth tokens and API keys and hands them to your agent code | Credentials proxy for model providers and any HTTPS API; switch a credential to another account when credits run out |
| GPUs | L4, A100, H100, RTX PRO 6000 and more, billed per hour | NVIDIA G-series and Inferentia2 on the Instances type | No |
| Regions and your own cloud | US, Canada, Brazil, UK, EU, Switzerland, Asia, Australia and South Africa; or your own AWS, GCP, Azure and other clouds | 17 commercial AWS regions plus GovCloud, inside your own AWS account | EU only (Germany, Finland, France) |
Every feature Battleships tracks (43)
| Feature | Northflank | AWS AgentCore | boat |
|---|---|---|---|
| Full VM (own kernel) | Yes | Yes | Yes |
| Docker inside | Yes | Not published | Yes |
| Nested virtualization | No | No | Yes |
| Root | Not published | Yes | Yes |
| Systemd | Not published | No | Yes |
| Desktop GUI | No | No | Yes |
| Browser | No | Yes | Yes |
| Computer-use API | No | Yes | Yes |
| SSH | Yes | No | Yes |
| Persistent disk | Yes | Yes | Yes |
| Pause/resume | Yes | No | Yes |
| Automatic snapshots | Yes | No | Yes |
| Fork/clone | Yes | No | Yes |
| Live fork (no pause) | Yes | No | Yes |
| Memory fork | No | No | No |
| Custom image (Docker or snapshot) | Yes | Yes | Yes |
| ≥24 h sessions | Yes | No | Yes |
| Idle auto-stop | No | Yes | No |
| Wake on request | No | Yes | No |
| HTTPS preview URLs | Yes | No | Yes |
| Raw TCP inbound | Yes | No | Yes |
| Public IPv4 | No | No | No |
| Egress allowlist | Yes | Yes | No |
| Secret proxy | Yes | No | Yes |
| Secret proxy for any API | Yes | No | Yes |
| Preinstalled agents | Yes | No | Yes |
| Agent harness API | No | No | Yes |
| MCP server | No | Yes | No |
| GPU | Yes | Yes | No |
| Windows | No | No | No |
| Arm64 | Yes | Yes | No |
| Self-hosting | Yes | No | No |
| BYOC | Yes | Yes | No |
| Open source | No | No | No |
| Scoped API keys | Not published | Not published | Yes |
| Spend limits | Not published | Yes | Yes |
| Usage per sandbox (API) | Yes | No | Yes |
| Audit logs | Yes | Yes | No |
| SSO | Yes | Yes | No |
| SOC 2 | Yes | Yes | No |
| HIPAA | Yes | Yes | No |
| EU data residency | Yes | Yes | Yes |
| Zero data retention | Not published | Not published | Yes |
Performance
Neither Northflank nor AWS AgentCore has a result on the hpc-sandbox-benchmarks test, so there is no comparable CPU measurement for either. boat did 26.69 runs per second on that Node.js build-and-test loop at 4 vCPU / 8 GB, on dedicated AMD Ryzen 9 9950X hosts. An AgentCore microVM session stops at 2 vCPU, so a like-for-like test would need its Instances type.
Node.js build-and-test loop at 4 vCPU / 8 GB, higher is better. Measured with the open hpc-sandbox-benchmarks suite. Northflank and AWS AgentCore have no published run in this suite yet, so there is no like-for-like number to compare.
Pricing in five scenarios
Each bill is priced from the providers' public price lists by the open Battleships engine, with the cheapest plan that runs the scenario.
| Scenario | Northflank, a month | AWS AgentCore, a month | boat, a month |
|---|---|---|---|
| One coding agent, workdays 4 vCPU / 8 GB, 50 GB disk, 8 hours a day, 22 days a month, files kept between days | $32 · Developer Sandbox (free tier) · with limits | $26 · Pay-as-you-go (Instances) · with limits | $20 · $20/mo |
| One agent that never stops 4 vCPU / 8 GB, 50 GB disk, running 24/7 all month | $108 · Developer Sandbox (free tier) · with limits | $107 · Pay-as-you-go (Instances) · with limits | $26 · $20/mo |
| 50 agents in parallel 50 machines of 4 vCPU / 8 GB at once, 8-hour sessions, 1,100 sessions a month, Docker inside | $1,322 · Developer Sandbox (free tier) · with limits | $1,286 · Pay-as-you-go (Instances) · with limits | $317 · $20/mo × 3 seats |
| Sandboxes for your users 2 vCPU / 4 GB, 30,000 sessions of 10 minutes a month, up to 300 at once | $361 · Developer Sandbox (free tier) · with limits | $423 · Pay-as-you-go · with limits | $200 · $100/mo × 2 seats |
| 1,000 short jobs at once 2 vCPU / 4 GB, 1,000 at once, 3 minutes each, 200,000 jobs a month | $688 · Developer Sandbox (free tier) · with limits | $1,615 · Pay-as-you-go (Instances) | $2,000 · $2000/mo · with limits |
Northflank: Northflank bills per second for the plan size you pick, with no monthly fee, until you pause the sandbox; there is no idle auto-pause. Volumes cost $0.15 per GB a month even while paused, and outbound traffic costs $0.06 per GB.
AWS AgentCore: Runtime microVMs, Code Interpreter and Browser bill per second for CPU actually used and for peak memory. The 4 vCPU shape in these scenarios is the Instances type: the EC2 on-demand price plus a 12% management fee, with EBS storage and data transfer billed by AWS on top.
AWS AgentCore: Plans start at $20 a month, and the whole fee is usage credit. You pay per second while a sandbox runs, and a stopped sandbox costs nothing and keeps its whole disk.
Limits in those scenarios
On both, files outside attached volumes (Northflank) or the session storage mount (AgentCore) reset after a stop, so installed packages have to be set up again in every scenario that keeps work between days. AgentCore's serverless sessions stop at 2 vCPU and 8 hours, so the 4 vCPU and always-on scenarios use its Instances type, capped at 336 hours. Northflank does not publish how many sandboxes can run at once, so 300 or 1,000 at a time is not confirmed, while AgentCore fits 1,000 short jobs at once. boat queues starts above 90 a minute even on the $2000 plan, so it does not fit that burst.
| Scenario | Northflank | AWS AgentCore | boat |
|---|---|---|---|
| One coding agent, workdays |
|
| None that bite |
| One agent that never stops |
|
| None that bite |
| 50 agents in parallel |
|
| None that bite |
| Sandboxes for your users |
|
| None that bite |
| 1,000 short jobs at once |
|
|
|
Which one should you use?
Use Northflank when
your sandboxes must run for days, need more than 2 vCPU or a GPU, or should sit next to your apps on one platform or in a cloud other than AWS.
- Sandboxes that run as long as you need. For agents that work all day or all week: a Northflank sandbox has no documented time limit and goes up to 20 vCPU / 40 GB.
- GPU sandboxes. For agents that train or run models: Northflank has GPU sandboxes from L4 and A100 to H100 and up, billed per hour.
- Any cloud, and one platform. For teams on GCP, Azure or other clouds, or who want apps, databases and sandboxes on one platform with HTTPS ports.
Use AWS AgentCore when
your agents must stay inside your AWS account and VPC, or are short code and browser tasks that fit its managed tools.
- It lives inside your AWS account. Teams built on AWS keep agents behind their own IAM, VPC, security groups and PrivateLink, in 17 commercial regions.
- Managed code interpreter and browser. For short code runs and browser tasks, Code Interpreter and Browser bill only for CPU actually used, with live view and replay.
- Many short sessions at once. For bursts of short jobs: Code Interpreter and Browser allow 1,000 sessions at once by default, and support can raise it.
Where boat fits
Look at boat when your agents do long work on one machine and should find it as they left it. Northflank and AgentCore both reset everything outside a volume or mount after a stop, and neither ships a desktop or an API to drive the coding agent inside. boat gives each agent a full VM that keeps its whole disk, runs Docker and emulators, and opens on HTTPS URLs.
The whole machine comes back
On Northflank only attached volumes survive a pause, billed while paused; on AgentCore only a 1 GB mount in preview does. An agent reinstalls its tools after every stop. boat saves the whole disk every minute, and a stopped sandbox costs nothing.
A real machine with a desktop inside
Neither documents /dev/kvm, Northflank sandboxes are headless, and AgentCore gives a browser at 2 vCPU but no desktop. boat has root, Docker, systemd, /dev/kvm for Android emulators and a 60fps Linux desktop with Chromium.
Agents you drive from outside
Northflank Harnesses are reached through a terminal or SSH, and AgentCore runs its own Strands harness behind its APIs with no open ports. boat preinstalls seven agents with a prompt, steer and events API, plus HTTPS on up to 50 ports.
Use boat when your agents work on one machine for hours or days and should find it as they left it: installs, Docker, emulators, a desktop and a browser, with the agent itself driven from your code. Compare it one to one: boat vs Northflank and boat vs AWS AgentCore.
Questions people ask
Is Northflank cheaper than AWS AgentCore?
It depends on the job. For one agent that never stops they are close, $108 a month on Northflank against $107 on AgentCore, and for sandboxes for your users Northflank is $361 against $423. For 1,000 short jobs at once AgentCore fits at $1,615 a month, while Northflank does not confirm it can run that many at once.
Which is faster, Northflank or AWS AgentCore?
There is no comparable measurement: neither has a result on the hpc-sandbox-benchmarks test. boat did 26.69 runs per second on it at 4 vCPU / 8 GB.
How long can a session run on each?
A Northflank sandbox has no documented maximum and runs until you pause it. An AgentCore microVM session lasts up to 8 hours and stops after 15 idle minutes by default; the Instances type runs up to 14 days. boat has no session cap on paid plans.
Can Northflank or AgentCore run Docker?
A Northflank CPU sandbox has its own kernel, so Docker can run inside. AgentCore runs your arm64 container image as root in a microVM, but its docs do not say Docker works inside a session. boat runs Docker and also exposes /dev/kvm for Android emulators.
Do files survive a stop?
On Northflank only attached volumes survive a pause, and they bill while paused. On AgentCore only a storage mount under /mnt, up to 1 GB and in preview, or EBS volumes on Instances. boat keeps the whole disk and saves it every minute.
Which one has GPUs?
Northflank has GPU sandboxes with L4, A100, H100 and more. AgentCore offers NVIDIA G-series and Inferentia2 only on the Instances type, on EC2 in your account. boat runs on CPUs only.
Try boat
Install the CLI, then run boat new.
7-day free trial