Northflank vs Azure Container Apps Sandboxes
Both run each sandbox with its own kernel. Northflank is a broad platform with GPUs, SSH and your own cloud, while Azure suspends a sandbox with its memory, wakes it on traffic and lives inside your Azure account.
The companies and products
Northflank
Northflank is a London developer platform for running services, jobs and databases on Kubernetes, and Sandboxes is its product for running untrusted code.
A Northflank sandbox is a container image deployed as a service: CPU sandboxes run in Kata microVMs with their own kernel, and GPU sandboxes run under gVisor. You create and drive them from the JavaScript or Python SDK, the CLI or the dashboard, on Northflank's cloud or inside your own. It suits teams that already want one platform for apps, databases, GPUs and sandboxes.
Azure Container Apps Sandboxes
Azure Container Apps Sandboxes is a service inside Microsoft Azure that gives each agent or user an isolated microVM you create, suspend and resume through an SDK.
It is part of Azure Container Apps, the hyperscaler's serverless container platform, and lives in your Azure subscription as a sandbox group resource. Each sandbox boots from an OCI image or a snapshot, has its own kernel, and can be suspended with its memory and resumed in under a second. It is built for teams already on Azure that want stateful code execution with Azure networking, identity and billing.
Which use cases each one fits
For each use case, Battleships prices every sandbox provider on the same workload and sorts them from the cheapest monthly bill up. “38th cheapest of 377” means 37 of the other 376 providers run that workload, with every feature it needs, for less. “With limits” means the provider runs it but misses something, so it is listed after every full match. Open a use case for its whole ranking and what each provider misses.
| Use case and its workload | Northflank: price rank | Azure Container Apps Sandboxes: price rank | boat: price rank |
|---|---|---|---|
| Software factory 100 at once · 4 vCPU / 8 GB · 2,200 sessions of 8 h a month A coding agent installs packages all over the machine; Northflank keeps only attached volumes across a pause, Azure keeps the disk, and boat keeps the whole disk with free stops. | 159th of 367, with limits $1,477 a month | 288th of 367, with limits $5,276 a month | 3rd cheapest of 367 $634 a month |
| Always-on AI employees 50 machines 24/7 · 2 vCPU / 4 GB | 173rd of 366, with limits $1,365 a month | 302nd of 366, with limits $6,544 a month | 5th cheapest of 366 $657 a month |
| Code interpreter bursts 100 at once · 1 vCPU / 2 GB · 200,000 sessions of 1 min a month Short code runs suit Azure best: a sandbox suspends with its memory and resumes in under a second, while Northflank's small per-second plans keep the bill low. | 84th of 345, with limits $115 a month | 34th cheapest of 345 $354 a month | 186th of 345, with limits $2,000 a month |
| Sandboxes for your users 300 at once · 2 vCPU / 4 GB · 30,000 sessions of 23 min a month Azure suspends idle user sandboxes on its own, while Northflank bills until you pause; boat gives each user a machine with HTTPS on up to 50 ports. | 89th of 361, with limits $815 a month | 22nd cheapest of 361 $2,260 a month | Cheapest of 361 $209 a month |
| RL rollouts 1,000 at once · 2 vCPU / 4 GB · 1,000,000 sessions of 3 min a month | 342nd of 360, with limits $1,762 a month | 153rd of 360, with limits $10,740 a month | 34th of 360, with limits $2,000 a month |
| Agent evals 250 at once · 4 vCPU / 8 GB · 15,000 sessions of 20 min a month Azure can snapshot a running sandbox with its memory and start many copies from it; boat forks a running sandbox with its disk. | 134th of 364, with limits $689 a month | 75th cheapest of 364 $1,728 a month | 10th cheapest of 364 $200 a month |
| CI runners 40 at once · 8 vCPU / 16 GB · 6,000 sessions of 12 min a month Both fit plain CI; neither documents /dev/kvm inside a sandbox, which boat has for Android emulators and VM builds. | 38th cheapest of 377 $352 a month | 103rd cheapest of 377 $1,046 a month | 4th cheapest of 377 $86 a month |
| 24/7 dev boxes 1 machine 24/7 · 4 vCPU / 8 GB Northflank gives SSH and Azure gives a shell through its aca CLI; boat adds SSH, raw TCP and a disk that survives every stop. | 151st of 368, with limits $59 a month | 322nd of 368, with limits $262 a month | 18th cheapest of 368 $26 a month |
| Computer-use agents 50 at once · 4 vCPU / 8 GB · 20,000 sessions of 15 min a month Both are headless, so a computer-use agent needs a desktop you build yourself; boat streams a Linux desktop at 60fps. | 151st of 369, with limits $371 a month | 279th of 369, with limits $1,573 a month | 6th cheapest of 369 $200 a month |
| Browser-use agents 50 at once · 2 vCPU / 4 GB · 30,000 sessions of 10 min a month | 200th of 367, with limits $194 a month | 288th of 367, with limits $795 a month | 7th cheapest of 367 $200 a month |
| Scraping & bots (startup scale) 50 at once · 1 vCPU / 2 GB · 100,000 sessions of 3 min a month | 196th of 346, with limits $117 a month | 284th of 346, with limits $561 a month | 6th cheapest of 346 $90 a month |
| Mass scraping & bots (undetectable) 1,000 at once · 1 vCPU / 2 GB · 3,000,000 sessions of 2 min a month | 83rd of 338, with limits $2,049 a month | 239th of 338, with limits $10,956 a month | 71st of 338, with limits $1,800 a month |
| Parallel red teaming 200 at once · 2 vCPU / 4 GB · 5,000 sessions of 30 min a month | 141st of 360, with limits $99 a month | 278th of 360, with limits $517 a month | 2nd cheapest of 360 $200 a month |
| GPU eval jobs 10 at once · 8 vCPU / 32 GB · 500 sessions of 30 min a month Only Northflank has GPU sandboxes, from L4 to H100 and up; Azure's sandboxes and boat are CPU only. | 4th cheapest of 98 $693 a month | Can't run it | Can't run it |
| macOS agents 5 at once · 4 vCPU / 8 GB · 1,000 sessions of 20 min a month | Can't run it | Can't run it | Can't run it |
Key features
| Feature | Northflank | Azure Container Apps Sandboxes | boat |
|---|---|---|---|
| Isolation | Kata microVM with its own kernel for CPU; gVisor for GPU | MicroVM per sandbox with its own kernel | Full VM with its own kernel on dedicated AMD Ryzen 9 9950X hosts |
| What survives a stop | Only attached volumes, which bill while paused; the rest of the disk and all processes reset | Suspend keeps memory and disk; resume in under a second with processes running | The whole disk, saved every minute and on stop; stopped sandboxes cost nothing |
| Idle handling | No idle auto-pause; a sandbox bills until you pause it | Auto-suspend after an idle timeout (5 minutes by default); traffic or a start command wakes it | Auto-stop timer you set; a stopped sandbox is started by API |
| Snapshots and fork | Filesystem snapshots of a running or stopping sandbox; restore into a new one | Snapshot a running sandbox with its memory and create new sandboxes from it | Automatic disk snapshots; fork a running sandbox |
| Getting a shell | SDK, browser terminal or SSH | Interactive shell through the aca CLI, SDK or portal; no SSH | SSH, plus CLI and API exec |
| Inbound access | HTTPS ports on a code.run domain, private by default; public TCP and UDP need a separate load balancer | Public HTTPS routes per published port; private endpoint from your VNet at extra cost; no public IP | HTTPS URLs for up to 50 ports, token-protected by default; raw TCP; dedicated IPv4 or IPv6 |
| Docker and nested virtualization | Docker can run on its own kernel; /dev/kvm not documented | Docker depends on the image (azure-dev ships it, default ubuntu has only Buildah); /dev/kvm not documented | Docker, systemd and root on every sandbox, plus /dev/kvm for Android emulators and VMs |
| Desktop and browser | Headless; no desktop or browser product | Headless; no desktop or managed browser | 60fps Linux desktop, Chromium and computer use built in |
| Coding agents | Harnesses with Claude Code, Codex, Cursor, OpenCode or Pi, reached through a terminal or SSH | Copilot CLI and Claude Code images, run through the exec API | Seven agents preinstalled, with a prompt, steer and events API |
| Keeping API keys out of the sandbox | Header injection for listed hosts in the network policy API; otherwise env vars or files | Group secrets usable in egress header transforms; Copilot and Anthropic tokens are injected at startup | Credentials proxy for model providers and any HTTPS API; switch a credential to another account when credits run out |
| Outbound rules | Network policies with allow lists by IP, CIDR or domain | Egress policy with allow, deny, rewrite and header rules by host, path and method; VNet integration | Open internet, no provider-side allowlist |
| Sizes | Plans from 0.1 vCPU up to 20 vCPU / 40 GB, more on request | Tiers from 0.25 cores / 0.5 GB to 4 cores / 8 GB; up to 16 vCPU / 32 GB by API | Up to 16 vCPU / 32 GB on the $100 plan and above |
| GPUs | L4, A100, H100, RTX PRO 6000 and more | No | No |
| Where it runs | Many regions on six continents, or your own AWS, GCP, Azure and other clouds | 40 Azure regions, inside your Azure subscription | EU only (Germany, Finland, France) |
Every feature Battleships tracks (43)
| Feature | Northflank | Azure Container Apps Sandboxes | boat |
|---|---|---|---|
| Full VM (own kernel) | Yes | Yes | Yes |
| Docker inside | Yes | Yes | Yes |
| Nested virtualization | No | No | Yes |
| Root | Not published | Yes | Yes |
| Systemd | Not published | Yes | Yes |
| Desktop GUI | No | No | Yes |
| Browser | No | No | Yes |
| Computer-use API | No | No | Yes |
| SSH | Yes | No | Yes |
| Persistent disk | Yes | Yes | Yes |
| Pause/resume | Yes | Yes | Yes |
| Automatic snapshots | Yes | Yes | Yes |
| Fork/clone | Yes | Yes | Yes |
| Live fork (no pause) | Yes | Yes | Yes |
| Memory fork | No | Yes | No |
| Custom image (Docker or snapshot) | Yes | Yes | Yes |
| ≥24 h sessions | Yes | Yes | Yes |
| Idle auto-stop | No | Yes | No |
| Wake on request | No | Yes | No |
| HTTPS preview URLs | Yes | Yes | Yes |
| Raw TCP inbound | Yes | No | Yes |
| Public IPv4 | No | No | No |
| Egress allowlist | Yes | Yes | No |
| Secret proxy | Yes | Yes | Yes |
| Secret proxy for any API | Yes | Yes | Yes |
| Preinstalled agents | Yes | Yes | Yes |
| Agent harness API | No | No | Yes |
| MCP server | No | No | No |
| GPU | Yes | No | No |
| Windows | No | No | No |
| Arm64 | Yes | No | No |
| Self-hosting | Yes | No | No |
| BYOC | Yes | No | No |
| Open source | No | No | No |
| Scoped API keys | Not published | Not published | Yes |
| Spend limits | Not published | Yes | Yes |
| Usage per sandbox (API) | Yes | Yes | Yes |
| Audit logs | Yes | Yes | No |
| SSO | Yes | Yes | No |
| SOC 2 | Yes | Yes | No |
| HIPAA | Yes | Yes | No |
| EU data residency | Yes | Yes | Yes |
| Zero data retention | Not published | Not published | Yes |
Performance
Neither Northflank nor Azure Container Apps Sandboxes has a result on the StarSling hpc-sandbox-benchmarks test, so this page makes no speed claim between them. boat did 26.69 runs per second on that Node.js build-and-test loop at 4 vCPU / 8 GB, on dedicated AMD Ryzen 9 9950X hosts.
Node.js build-and-test loop at 4 vCPU / 8 GB, higher is better. Measured with the open hpc-sandbox-benchmarks suite. Northflank and Azure Container Apps Sandboxes have no published run in this suite yet, so there is no like-for-like number to compare.
Pricing in five scenarios
Each bill is priced from the providers' public price lists by the open Battleships engine, with the cheapest plan that runs the scenario.
| Scenario | Northflank, a month | Azure Container Apps Sandboxes, a month | boat, a month |
|---|---|---|---|
| One coding agent, workdays 4 vCPU / 8 GB, 50 GB disk, 8 hours a day, 22 days a month, files kept between days | $32 · Developer Sandbox (free tier) · with limits | $68 · Pay-as-you-go | $20 · $20/mo |
| One agent that never stops 4 vCPU / 8 GB, 50 GB disk, running 24/7 all month | $108 · Developer Sandbox (free tier) · with limits | $262 · Pay-as-you-go · with limits | $26 · $20/mo |
| 50 agents in parallel 50 machines of 4 vCPU / 8 GB at once, 8-hour sessions, 1,100 sessions a month, Docker inside | $1,322 · Developer Sandbox (free tier) · with limits | $3,421 · Pay-as-you-go | $317 · $20/mo × 3 seats |
| Sandboxes for your users 2 vCPU / 4 GB, 30,000 sessions of 10 minutes a month, up to 300 at once | $361 · Developer Sandbox (free tier) · with limits | $989 · Pay-as-you-go | $200 · $100/mo × 2 seats |
| 1,000 short jobs at once 2 vCPU / 4 GB, 1,000 at once, 3 minutes each, 200,000 jobs a month | $688 · Developer Sandbox (free tier) · with limits | $2,148 · Pay-as-you-go | $2,000 · $2000/mo · with limits |
Northflank: Northflank bills per second for the plan size you pick, with no monthly fee, until you pause the sandbox; there is no idle auto-pause. Volumes cost $0.15 per GB a month even while paused, and outbound traffic costs $0.06 per GB.
Azure Container Apps Sandboxes: Azure bills per second on the Container Apps Consumption meters for the sandbox's tier while it runs, idle time before auto-suspend included. There is no plan fee, stopped sandboxes pay no CPU or memory, and some regions charge more.
Azure Container Apps Sandboxes: Plans start at $20 a month, and the whole fee is usage credit. You pay per second while a sandbox runs, and a stopped sandbox costs nothing and keeps its whole disk.
Limits in those scenarios
On Northflank the limit that bites is what survives a stop: only attached volumes keep their files, and it does not publish how many sandboxes can run at once, so 300 or 1,000 together is not confirmed. On Azure the always-on scenario only gets close with a 3-year commitment, Docker needs an image that ships it, and a default quota of 500 active cores caps a fleet until support raises it. boat's limit is the burst: even the $2,000 plan queues starts above 90 a minute.
| Scenario | Northflank | Azure Container Apps Sandboxes | boat |
|---|---|---|---|
| One coding agent, workdays |
| None that bite | None that bite |
| One agent that never stops |
|
| None that bite |
| 50 agents in parallel |
| None that bite | None that bite |
| Sandboxes for your users |
| None that bite | None that bite |
| 1,000 short jobs at once |
| None that bite |
|
Which one should you use?
Use Northflank when
you need GPUs next to the agent, SSH into each sandbox, sandboxes in your own cloud account, or lower list prices for steady work.
- GPU sandboxes. For agents that train or run models: Northflank has GPU sandboxes from L4 to H100, which Azure's sandboxes do not offer.
- SSH and your own cloud. For teams that want SSH into each sandbox, or sandboxes running in their own AWS, GCP or Azure account.
- Lower list prices. For steady workloads: on list prices Northflank costs less than Azure in every scenario on this page.
Use Azure Container Apps Sandboxes when
your team already runs on Azure and wants short stateful sandboxes that suspend with their memory, wake on traffic and sit behind strict egress rules.
- Memory suspend and wake on traffic. For stateful jobs that sleep between requests: a sandbox suspends with its memory and resumes in under a second.
- Fine-grained outbound rules. For agents held to set hosts: egress rules can allow, deny or rewrite each request by host, path and method.
- Inside your Azure account. For teams already on Azure: sandboxes use Entra ID, Azure billing and your VNets, with a published quota of 500 active cores.
Where boat fits
If your agents do long, hands-on work on one machine, look at boat. Northflank and Azure both run code well, but both are headless, neither documents /dev/kvm, and their agents are reached through a terminal or raw exec. boat gives each agent a whole computer that keeps its disk, with the agent driven from your code.
A screen and a browser inside
Both Northflank and Azure sandboxes are headless, so a computer-use or browser agent needs you to build an image with a desktop, a browser and a streaming stack. boat streams a 60fps Linux desktop with Chromium in every sandbox.
Emulators, Docker and SSH on every machine
Neither documents /dev/kvm, so Android emulators and nested VMs will not start. Azure has no SSH and its default image lacks Docker; Northflank needs a separate load balancer for raw TCP. boat has all of these.
Agents driven from outside, keys kept outside
Northflank Harnesses are reached by terminal or SSH and Azure's agent images by raw exec, so you build the control layer. Azure also injects tokens into the sandbox. boat has a prompt and steer API and a credentials proxy.
Use boat when your agents need a whole computer for hours or days: SSH, Docker, emulators, a desktop and a browser, a disk that survives every stop, and agents driven from your code. Compare it one to one: boat vs Northflank and boat vs Azure Container Apps Sandboxes.
Questions people ask
Is Northflank cheaper than Azure Container Apps Sandboxes?
On list prices, yes, in every scenario on this page: one agent that never stops is $108 a month on Northflank against $262 on Azure, and boat is $26. Northflank has no idle auto-pause, so you must pause sandboxes yourself to keep that bill.
Which is faster, Northflank or Azure Container Apps Sandboxes?
Neither has a result on the CPU benchmark this page uses, so there is no fair speed comparison. Azure resumes a suspended sandbox in under a second with its processes running; Northflank restarts from its image and volumes.
Does each keep files when a sandbox stops?
Azure suspends with memory and disk, so the whole sandbox comes back. Northflank keeps only attached volumes, and the rest of the disk resets. boat keeps the whole disk, saved every minute and on stop.
Can Northflank or Azure run Docker?
Northflank gives each CPU sandbox its own kernel, so Docker can run inside. On Azure it depends on the image: azure-dev ships Docker, while the default ubuntu image has only Buildah. boat runs Docker on every sandbox and adds /dev/kvm.
Can I SSH into a sandbox on each?
Northflank supports SSH alongside its SDK and browser terminal. Azure does not; you get a shell through the aca CLI, the SDK or the portal. Every boat sandbox has an SSH endpoint.
Which has GPUs?
Only Northflank, with GPU sandboxes from L4 and A100 up to H100 and more, run under gVisor. Azure Container Apps Sandboxes and boat are CPU only.
Try boat
Install the CLI, then run boat new.
7-day free trial