Northflank vs Deno Sandbox
Both run code in a microVM with its own kernel. Northflank is a broad cloud platform whose sandboxes run until you pause them, in sizes up to 20 vCPU and with GPUs, while Deno Sandbox gives you small 2 vCPU machines that start in under 200 ms and live up to 30 minutes.
The companies and products
Northflank
Northflank is a London developer platform for running services, jobs and databases on Kubernetes, and Sandboxes is its product for running untrusted code.
A Northflank sandbox is a container image deployed as a service: CPU sandboxes run in Kata microVMs with their own kernel, and GPU sandboxes run under gVisor. You create and drive them from the JavaScript or Python SDK, the CLI or the dashboard, on Northflank's cloud or inside your own. It suits teams that already want one platform for apps, databases, GPUs and sandboxes.
Deno Sandbox
Deno Sandbox is part of Deno Deploy, the hosting platform from the company behind the Deno runtime, and runs untrusted or AI-generated code in Linux microVMs.
Each sandbox is a Firecracker microVM with 2 vCPU, up to 4 GB of memory and a 10 GB disk that is wiped when it ends, created from a TypeScript or Python SDK. Outbound traffic goes through a proxy that can enforce a host allowlist and swap placeholder secrets for real ones. It is built for short runs of agent or user code, and a sandbox can be promoted to a Deno Deploy app.
- Isolation
- Firecracker microVM per sandbox
Which use cases each one fits
For each use case, Battleships prices every sandbox provider on the same workload and sorts them from the cheapest monthly bill up. “38th cheapest of 377” means 37 of the other 376 providers run that workload, with every feature it needs, for less. “With limits” means the provider runs it but misses something, so it is listed after every full match. Open a use case for its whole ranking and what each provider misses.
| Use case and its workload | Northflank: price rank | Deno Sandbox: price rank | boat: price rank |
|---|---|---|---|
| Software factory 100 at once · 4 vCPU / 8 GB · 2,200 sessions of 8 h a month A software factory runs installs and builds for hours, which fits Northflank's sizes better than Deno's 30-minute, 2 vCPU sandboxes; boat also keeps the whole disk between runs. | 159th of 367, with limits $1,477 a month | 290th of 367, with limits $5,665 a month | 3rd cheapest of 367 $634 a month |
| Always-on AI employees 50 machines 24/7 · 2 vCPU / 4 GB An assistant that lives on its machine all month cannot run on Deno past 30 minutes, and on Northflank only attached volumes survive a pause; boat keeps the whole machine. | 173rd of 366, with limits $1,365 a month | 287th of 366, with limits $5,803 a month | 5th cheapest of 366 $657 a month |
| Code interpreter bursts 100 at once · 1 vCPU / 2 GB · 200,000 sessions of 1 min a month Short code runs suit both: Deno starts in under 200 ms and bills CPU only while code runs, and Northflank has per-second plans from a tenth of a vCPU. | 84th of 345, with limits $115 a month | 141st of 345, with limits $329 a month | 186th of 345, with limits $2,000 a month |
| Sandboxes for your users 300 at once · 2 vCPU / 4 GB · 30,000 sessions of 23 min a month Deno Builder allows 20 sandboxes at once per region and Northflank does not publish a limit; boat's plans go to hundreds, with token-protected HTTPS by default. | 89th of 361, with limits $815 a month | 148th of 361, with limits $1,863 a month | Cheapest of 361 $209 a month |
| RL rollouts 1,000 at once · 2 vCPU / 4 GB · 1,000,000 sessions of 3 min a month Deno ranks above Northflank for RL rollouts in this table, though both are a compromise here and boat ranks higher than either. | 342nd of 360, with limits $1,762 a month | 122nd of 360, with limits $7,963 a month | 34th of 360, with limits $2,000 a month |
| Agent evals 250 at once · 4 vCPU / 8 GB · 15,000 sessions of 20 min a month | 134th of 364, with limits $689 a month | 296th of 364, with limits $1,563 a month | 10th cheapest of 364 $200 a month |
| CI runners 40 at once · 8 vCPU / 16 GB · 6,000 sessions of 12 min a month Northflank fits CI jobs in this table and Deno's 2 vCPU, 30-minute shape does not; boat adds Docker, /dev/kvm for emulators and free stops. | 38th cheapest of 377 $352 a month | 304th of 377, with limits $731 a month | 4th cheapest of 377 $86 a month |
| 24/7 dev boxes 1 machine 24/7 · 4 vCPU / 8 GB | 151st of 368, with limits $59 a month | 179th of 368, with limits $200 a month | 18th cheapest of 368 $26 a month |
| Computer-use agents 50 at once · 4 vCPU / 8 GB · 20,000 sessions of 15 min a month Neither Northflank nor Deno Sandbox has a desktop, so you would build and stream one yourself; boat ships a 60fps Linux desktop with Chromium. | 151st of 369, with limits $371 a month | 280th of 369, with limits $1,583 a month | 6th cheapest of 369 $200 a month |
| Browser-use agents 50 at once · 2 vCPU / 4 GB · 30,000 sessions of 10 min a month | 200th of 367, with limits $194 a month | 284th of 367, with limits $783 a month | 7th cheapest of 367 $200 a month |
| Scraping & bots (startup scale) 50 at once · 1 vCPU / 2 GB · 100,000 sessions of 3 min a month | 196th of 346, with limits $117 a month | 286th of 346, with limits $573 a month | 6th cheapest of 346 $90 a month |
| Mass scraping & bots (undetectable) 1,000 at once · 1 vCPU / 2 GB · 3,000,000 sessions of 2 min a month | 83rd of 338, with limits $2,049 a month | 247th of 338, with limits $11,923 a month | 71st of 338, with limits $1,800 a month |
| Parallel red teaming 200 at once · 2 vCPU / 4 GB · 5,000 sessions of 30 min a month | 141st of 360, with limits $99 a month | 251st of 360, with limits $367 a month | 2nd cheapest of 360 $200 a month |
| GPU eval jobs 10 at once · 8 vCPU / 32 GB · 500 sessions of 30 min a month Northflank has GPU sandboxes from L4 to H100 and up; Deno Sandbox and boat are CPU only. | 4th cheapest of 98 $693 a month | Can't run it | Can't run it |
| macOS agents 5 at once · 4 vCPU / 8 GB · 1,000 sessions of 20 min a month | Can't run it | Can't run it | Can't run it |
Key features
| Feature | Northflank | Deno Sandbox | boat |
|---|---|---|---|
| Isolation | Kata microVM with its own kernel for CPU; gVisor for GPU | Firecracker microVM with its own kernel | Full VM with its own kernel on dedicated AMD Ryzen 9 9950X hosts |
| Machine size | Plans from 0.1 vCPU up to 20 vCPU / 40 GB, more on request | 2 vCPU fixed, 768 MB to 4 GB memory, 10 GB disk | 4 vCPU / 8 GB by default, up to 16 vCPU / 32 GB on the $100 plan and above |
| Session length | No documented cap; runs until you pause or delete it | Up to 30 minutes; longer work can be promoted to a Deno Deploy app | No cap on paid plans; you set the time to live |
| What survives a stop | Only attached volumes, which bill while paused; the rest of the disk and all processes reset | Root disk wiped when the sandbox ends; opt-in volumes of 300 MB to 20 GB, Chicago only | The whole disk, saved every minute and on stop; a stopped sandbox costs nothing |
| Snapshots and fork | Filesystem snapshots of a running or stopping sandbox, opt-in; restore into a new one | Read-only snapshots of a volume that many new sandboxes can boot from; no fork of a running sandbox | Automatic disk snapshots; fork a running sandbox with its disk |
| Docker and nested virtualization | Own kernel, so Docker can run inside; /dev/kvm not documented | Root access; Docker and nested virtualization not documented | Docker, systemd and /dev/kvm for Android emulators and VMs |
| Desktop and browser | Headless; access by SDK, browser terminal or SSH | No desktop; a VS Code editor in the browser and SSH | 60fps Linux desktop, Chromium and computer use built in |
| Coding agents | Harnesses with Claude Code, Codex, Cursor, OpenCode or Pi, reached through a terminal or SSH | A root image with Claude Code, run through the shell command API | Seven agents preinstalled, with a prompt, steer and events API |
| Keeping API keys out of the sandbox | Header injection for listed hosts in the network policy API | Secrets swapped in on outbound requests to approved hosts; the sandbox only sees a placeholder | Credentials proxy for model providers and any HTTPS API; switch a credential to another account when credits run out |
| Inbound access | HTTPS ports on a code.run domain, private by default; public TCP and UDP need a separate load balancer | HTTPS URL per exposed port, public without authentication; SSH | HTTPS URLs for up to 50 ports, token-protected by default; raw TCP |
| Outbound rules | Network policies with allow lists by IP, CIDR or domain | Host allowlist per sandbox (allowNet), enforced by a proxy outside the VM | Open internet, no provider-side allowlist |
| GPUs | L4, A100, H100, RTX PRO 6000 and more | No | No |
| Regions and hosting | US, Europe, Asia, Australia, South America and Africa; or your own cloud account | Amsterdam and Chicago | EU only (Germany, Finland, France) |
Every feature Battleships tracks (43)
| Feature | Northflank | Deno Sandbox | boat |
|---|---|---|---|
| Full VM (own kernel) | Yes | Yes | Yes |
| Docker inside | Yes | Not published | Yes |
| Nested virtualization | No | No | Yes |
| Root | Not published | Yes | Yes |
| Systemd | Not published | Not published | Yes |
| Desktop GUI | No | No | Yes |
| Browser | No | No | Yes |
| Computer-use API | No | No | Yes |
| SSH | Yes | Yes | Yes |
| Persistent disk | Yes | Yes | Yes |
| Pause/resume | Yes | No | Yes |
| Automatic snapshots | Yes | No | Yes |
| Fork/clone | Yes | No | Yes |
| Live fork (no pause) | Yes | No | Yes |
| Memory fork | No | No | No |
| Custom image (Docker or snapshot) | Yes | Yes | Yes |
| ≥24 h sessions | Yes | No | Yes |
| Idle auto-stop | No | No | No |
| Wake on request | No | No | No |
| HTTPS preview URLs | Yes | Yes | Yes |
| Raw TCP inbound | Yes | No | Yes |
| Public IPv4 | No | No | No |
| Egress allowlist | Yes | Yes | No |
| Secret proxy | Yes | Yes | Yes |
| Secret proxy for any API | Yes | Yes | Yes |
| Preinstalled agents | Yes | Yes | Yes |
| Agent harness API | No | No | Yes |
| MCP server | No | No | No |
| GPU | Yes | No | No |
| Windows | No | No | No |
| Arm64 | Yes | No | No |
| Self-hosting | Yes | No | No |
| BYOC | Yes | No | No |
| Open source | No | No | No |
| Scoped API keys | Not published | Not published | Yes |
| Spend limits | Not published | Yes | Yes |
| Usage per sandbox (API) | Yes | No | Yes |
| Audit logs | Yes | Not published | No |
| SSO | Yes | No | No |
| SOC 2 | Yes | Yes | No |
| HIPAA | Yes | Yes | No |
| EU data residency | Yes | Yes | Yes |
| Zero data retention | Not published | Not published | Yes |
Performance
There is no comparable CPU measurement for Northflank Sandboxes or Deno Sandbox: neither has a result on the StarSling hpc-sandbox-benchmarks test. boat did 26.69 runs per second on that Node.js build-and-test loop at 4 vCPU / 8 GB, on dedicated AMD Ryzen 9 9950X hosts. Deno's fixed 2 vCPU shape could not run the 4 vCPU test as set up.
Node.js build-and-test loop at 4 vCPU / 8 GB, higher is better. Measured with the open hpc-sandbox-benchmarks suite. Northflank and Deno Sandbox have no published run in this suite yet, so there is no like-for-like number to compare.
Pricing in five scenarios
Each bill is priced from the providers' public price lists by the open Battleships engine, with the cheapest plan that runs the scenario.
| Scenario | Northflank, a month | Deno Sandbox, a month | boat, a month |
|---|---|---|---|
| One coding agent, workdays 4 vCPU / 8 GB, 50 GB disk, 8 hours a day, 22 days a month, files kept between days | $32 · Developer Sandbox (free tier) · with limits | $53 · Pro · with limits | $20 · $20/mo |
| One agent that never stops 4 vCPU / 8 GB, 50 GB disk, running 24/7 all month | $108 · Developer Sandbox (free tier) · with limits | $200 · Builder · with limits | $26 · $20/mo |
| 50 agents in parallel 50 machines of 4 vCPU / 8 GB at once, 8-hour sessions, 1,100 sessions a month, Docker inside | $1,322 · Developer Sandbox (free tier) · with limits | $2,779 · Builder · with limits | $317 · $20/mo × 3 seats |
| Sandboxes for your users 2 vCPU / 4 GB, 30,000 sessions of 10 minutes a month, up to 300 at once | $361 · Developer Sandbox (free tier) · with limits | $783 · Builder · with limits | $200 · $100/mo × 2 seats |
| 1,000 short jobs at once 2 vCPU / 4 GB, 1,000 at once, 3 minutes each, 200,000 jobs a month | $688 · Developer Sandbox (free tier) · with limits | $1,563 · Builder · with limits | $2,000 · $2000/mo · with limits |
Northflank: Northflank bills per second for the plan size you pick, with no monthly fee, until you pause the sandbox; there is no idle auto-pause. Volumes cost $0.15 per GB a month even while paused, and outbound traffic costs $0.06 per GB.
Deno Sandbox: Sandboxes need the Pro plan at $20 a month or Builder at $200 a month, which include CPU, memory and egress allowances shared with your Deno Deploy apps. Past those, CPU costs $0.10 per hour of active CPU time and memory $0.025 per GiB-hour for the whole life of the sandbox.
Deno Sandbox: Plans start at $20 a month, and the whole fee is usage credit. You pay per second while a sandbox runs, and a stopped sandbox costs nothing and keeps its whole disk.
Limits in those scenarios
Neither fits the five scenarios as written. On Northflank the limit that bites is what survives a stop, since only attached volumes keep their files, and it does not publish how many sandboxes can run at once, so 300 or 1,000 at a time is not confirmed. Deno Sandbox lives up to 30 minutes at a fixed 2 vCPU with up to 4 GB of memory, and Builder allows 20 at once per region. boat fits four of the five; at 1,000 short jobs at once its top plan queues starts above 90 a minute.
| Scenario | Northflank | Deno Sandbox | boat |
|---|---|---|---|
| One coding agent, workdays |
|
| None that bite |
| One agent that never stops |
|
| None that bite |
| 50 agents in parallel |
|
| None that bite |
| Sandboxes for your users |
|
| None that bite |
| 1,000 short jobs at once |
|
|
|
Which one should you use?
Use Northflank when
your sandboxes run for hours, need more than 2 vCPU or a GPU, or must live in regions outside Europe or in your own cloud account.
- Bigger machines and GPUs. For work that needs more than 2 vCPU or a GPU: Northflank goes to 20 vCPU / 40 GB and has cards up to H100.
- No 30-minute limit. For agents that run for hours: a Northflank sandbox runs until you pause it, with no documented session cap.
- Many regions or your own cloud. For teams far from Europe or bound to their own AWS, GCP or Azure account, next to their other apps.
Use Deno Sandbox when
you run short pieces of untrusted code that must start in milliseconds and reach only the hosts you allow, especially if you already deploy on Deno Deploy.
- Starts in under 200 ms. For one sandbox per request: Deno says a sandbox starts in under 200 ms, and CPU bills only while code runs.
- Locked-down outbound traffic. For untrusted code: each sandbox can be limited to a list of hosts, enforced by a proxy outside the VM.
- A path to Deno Deploy. For teams on Deno Deploy: a sandbox can be promoted to a Deploy app and bills on the same meters.
Where boat fits
If your agents work on one machine for hours or days, look at boat as well. It gives each agent a full VM whose whole disk is still there after a stop, with Docker, /dev/kvm, a desktop, a browser and coding agents you drive from your code.
The whole machine comes back
On Northflank a pause wipes everything outside attached volumes, and a Deno sandbox wipes its root disk when it ends. boat saves the whole disk every minute and on stop, so an agent never reinstalls its tools.
Emulators, a desktop and a browser inside
Both Northflank and Deno Sandbox are headless and document no /dev/kvm, so a computer-use agent needs a desktop image you build and stream yourself. boat ships a 60fps desktop with Chromium and runs Android emulators.
Agents you drive from outside
Northflank Harnesses are reached through a terminal or SSH, and Deno runs Claude Code through shell commands you parse yourself. boat preinstalls seven agents with an API to prompt, steer and follow them.
Use boat when your agents do real work on one machine for hours or days and should find it as they left it: installs, Docker, emulators, a desktop and a browser, with the agent driven from your code. Compare it one to one: boat vs Northflank and boat vs Deno Sandbox.
Questions people ask
Is Northflank cheaper than Deno Sandbox?
In all five scenarios on this page, yes: one agent that never stops is $108 a month on Northflank against $200 on Deno, and 50 agents in parallel are $1,322 against $2,779. boat is $26 and $317 a month for the same two.
Which is faster?
Neither Northflank nor Deno Sandbox has a result on the CPU benchmark boat is measured on, so there is no fair speed ratio. Deno says a sandbox starts in under 200 ms, and Northflank offers bigger machines, up to 20 vCPU.
How long can a sandbox run on each?
Northflank documents no session cap: a sandbox runs until you pause or delete it. A Deno sandbox lives up to 30 minutes, and longer work can be promoted to a Deno Deploy app. boat has no cap on paid plans.
Do they keep files between runs?
Only on volumes. Northflank keeps attached volumes when paused and resets the rest of the disk, and Deno wipes the root disk when a sandbox ends, with volumes only in Chicago. boat keeps the whole disk and saves it every minute.
Can Northflank or Deno Sandbox run Docker?
Northflank gives each sandbox its own kernel, so Docker can run inside. Deno's docs do not say Docker works inside a sandbox. boat runs Docker and systemd and exposes /dev/kvm for Android emulators and VMs.
Which has GPUs?
Northflank has GPU sandboxes under gVisor with cards from L4 to H100 and more. Deno Sandbox and boat run on CPUs only.
Try boat
Install the CLI, then run boat new.
7-day free trial