Northflank vs Google Agent Runtime
Northflank gives each sandbox a Kata microVM with its own kernel, so Docker runs inside, on a platform that also has GPUs and your own cloud. Google Agent Runtime hosts your agent code on Google Cloud and gives it sandboxes that run as an unprivileged user with no sudo, plus memory snapshots and a ready browser.
The companies and products
Northflank
Northflank is a London developer platform for running services, jobs and databases on Kubernetes, and Sandboxes is its product for running untrusted code.
A Northflank sandbox is a container image deployed as a service: CPU sandboxes run in Kata microVMs with their own kernel, and GPU sandboxes run under gVisor. You create and drive them from the JavaScript or Python SDK, the CLI or the dashboard, on Northflank's cloud or inside your own. It suits teams that already want one platform for apps, databases, GPUs and sandboxes.
Google Agent Runtime
Google Agent Runtime is the agent hosting part of Gemini Enterprise Agent Platform on Google Cloud, renamed from Vertex AI Agent Engine in April 2026.
It is a hyperscaler service, not a sandbox company. Agent Runtime deploys agents you build with ADK, LangGraph, LangChain, AG2 or LlamaIndex and bills them only while they work on a turn. Next to it, Agent Sandbox gives those agents a place to run code: a Code Execution sandbox, a shell or custom container sandbox, and a Computer Use browser. All of them run as secure containers inside your Google Cloud project.
Which use cases each one fits
For each use case, Battleships prices every sandbox provider on the same workload and sorts them from the cheapest monthly bill up. “38th cheapest of 377” means 37 of the other 376 providers run that workload, with every feature it needs, for less. “With limits” means the provider runs it but misses something, so it is listed after every full match. Open a use case for its whole ranking and what each provider misses.
| Use case and its workload | Northflank: price rank | Google Agent Runtime: price rank | boat: price rank |
|---|---|---|---|
| Software factory 100 at once · 4 vCPU / 8 GB · 2,200 sessions of 8 h a month Northflank sandboxes can run Docker but only attached volumes survive a pause; Google's sandboxes have no root or Docker; boat keeps the whole disk and runs Docker on every VM. | 159th of 367, with limits $1,477 a month | 295th of 367, with limits $5,801 a month | 3rd cheapest of 367 $634 a month |
| Always-on AI employees 50 machines 24/7 · 2 vCPU / 4 GB Google fits a long-lived assistant better than Northflank here because its sandboxes keep their files when paused, though each is deleted when its TTL runs out (7 days at most for a custom container); boat has no session cap on paid plans. | 173rd of 366, with limits $1,365 a month | 28th cheapest of 366 $7,519 a month | 5th cheapest of 366 $657 a month |
| Code interpreter bursts 100 at once · 1 vCPU / 2 GB · 200,000 sessions of 1 min a month Short code runs suit both: Northflank has small per-second plans from a tenth of a vCPU, and Google has a ready Python Code Execution sandbox with no network. | 84th of 345, with limits $115 a month | 254th of 345, with limits $275 a month | 186th of 345, with limits $2,000 a month |
| Sandboxes for your users 300 at once · 2 vCPU / 4 GB · 30,000 sessions of 23 min a month Northflank can serve each user's sandbox on HTTPS ports, while Google reaches sandboxes only through its API or a private endpoint; boat serves HTTPS on up to 50 ports and keeps the whole disk. | 89th of 361, with limits $815 a month | 280th of 361, with limits $1,916 a month | Cheapest of 361 $209 a month |
| RL rollouts 1,000 at once · 2 vCPU / 4 GB · 1,000,000 sessions of 3 min a month | 342nd of 360, with limits $1,762 a month | 128th of 360, with limits $8,240 a month | 34th of 360, with limits $2,000 a month |
| Agent evals 250 at once · 4 vCPU / 8 GB · 15,000 sessions of 20 min a month | 134th of 364, with limits $689 a month | 79th cheapest of 364 $2,060 a month | 10th cheapest of 364 $200 a month |
| CI runners 40 at once · 8 vCPU / 16 GB · 6,000 sessions of 12 min a month Northflank fits CI jobs that build containers because Docker runs inside its microVMs; on Google's unprivileged sandboxes it does not; boat adds /dev/kvm and free stops. | 38th cheapest of 377 $352 a month | 98th cheapest of 377 $989 a month | 4th cheapest of 377 $86 a month |
| 24/7 dev boxes 1 machine 24/7 · 4 vCPU / 8 GB Northflank gives you SSH into a sandbox, Google has no SSH and runs each command in a new shell, and boat gives you SSH and a desktop. | 151st of 368, with limits $59 a month | 311th of 368, with limits $241 a month | 18th cheapest of 368 $26 a month |
| Computer-use agents 50 at once · 4 vCPU / 8 GB · 20,000 sessions of 15 min a month Google ships a browser with a VNC view and a click and type API, Northflank is headless, and boat streams a full 60fps Linux desktop with Chromium. | 151st of 369, with limits $371 a month | 283rd of 369, with limits $1,648 a month | 6th cheapest of 369 $200 a month |
| Browser-use agents 50 at once · 2 vCPU / 4 GB · 30,000 sessions of 10 min a month | 200th of 367, with limits $194 a month | 102nd of 367, with limits $824 a month | 7th cheapest of 367 $200 a month |
| Scraping & bots (startup scale) 50 at once · 1 vCPU / 2 GB · 100,000 sessions of 3 min a month | 196th of 346, with limits $117 a month | 53rd cheapest of 346 $515 a month | 6th cheapest of 346 $90 a month |
| Mass scraping & bots (undetectable) 1,000 at once · 1 vCPU / 2 GB · 3,000,000 sessions of 2 min a month | 83rd of 338, with limits $2,049 a month | 210th of 338, with limits $8,240 a month | 71st of 338, with limits $1,800 a month |
| Parallel red teaming 200 at once · 2 vCPU / 4 GB · 5,000 sessions of 30 min a month | 141st of 360, with limits $99 a month | 260th of 360, with limits $412 a month | 2nd cheapest of 360 $200 a month |
| GPU eval jobs 10 at once · 8 vCPU / 32 GB · 500 sessions of 30 min a month Northflank has GPU sandboxes from L4 to H100 and up; Google's Agent Sandbox and boat run on CPUs only. | 4th cheapest of 98 $693 a month | Can't run it | Can't run it |
| macOS agents 5 at once · 4 vCPU / 8 GB · 1,000 sessions of 20 min a month | Can't run it | Can't run it | Can't run it |
Key features
| Feature | Northflank | Google Agent Runtime | boat |
|---|---|---|---|
| Isolation | Kata microVM with its own kernel for CPU; gVisor for GPU | Secure container sandboxing inside your Google Cloud project | Full VM with its own kernel on dedicated AMD Ryzen 9 9950X hosts |
| Root and Docker | Own kernel, so Docker can run inside | Runs as appuser with no sudo; images must not need root; no Docker documented | Root, systemd and Docker on every machine |
| Nested virtualization | Not documented inside a sandbox | No /dev/kvm documented | Yes, /dev/kvm for Android emulators and VMs |
| What survives a stop | Only attached volumes, which bill while paused; the rest of the disk and all processes reset | Pause keeps the file system at a lower rate Google does not publish | The whole disk, saved every minute and on stop; a stopped sandbox costs nothing |
| Snapshots and fork | Filesystem snapshots of a running sandbox, restored into a new one; no memory snapshots | Snapshots keep memory and files; start many sandboxes from one snapshot | Automatic disk snapshots; fork a running sandbox; resume reboots from disk |
| How long a sandbox lives | No maximum documented; runs until you pause or delete it | TTL of up to 7 days for a custom container and 14 days for Code Execution | No session cap on paid plans |
| Shell access | SDK, CLI, browser terminal or SSH | execute_bash() API calls; each command runs in a new shell; no SSH | SSH, plus an API for commands |
| Desktop and browser | Headless; you build and stream a desktop yourself | A browser in a container with a VNC live view, a click and type API, and CDP | 60fps Linux desktop, Chromium and computer use built in, embeddable stream |
| Reaching the sandbox | HTTPS ports on a code.run domain, private by default; public TCP and UDP need a load balancer | Through Google's API or a private endpoint in your VPC; no public URL documented | HTTPS URLs for up to 50 ports, token-protected; raw TCP; dedicated IPv4 or IPv6 |
| Outbound rules | Network policies with allow lists by IP, CIDR or domain | Off unless the template turns it on; route through your VPC with Cloud NAT, Cloud NGFW or Secure Web Proxy | Open internet on every plan, no provider-side allowlist |
| Coding agents | Harnesses with Claude Code, Codex, Cursor, OpenCode or Pi, reached through a terminal or SSH | Managed Agents API (Preview) runs Google's Antigravity harness | Seven agents preinstalled, with a prompt, steer and events API |
| Keeping API keys out of the sandbox | Header injection for listed hosts in the network policy API | You provision and scope the credentials the agent uses | Credentials proxy for model providers and any HTTPS API; switch a credential to another account when credits run out |
| Hosting agent code and GPUs | Runs services, jobs and databases; GPU sandboxes from L4 to H100 and up | Agent Runtime hosts ADK, LangGraph, LangChain, AG2 and LlamaIndex agents; idle time between turns is not billed | CPU only; you run your own agent loop inside a sandbox |
| Where it runs | US, Canada, Brazil, UK, EU, Switzerland, Asia, Australia, South Africa, or your own cloud | 23 locations in the US, Europe, Asia, Canada, Australia and Brazil | EU only: Germany, Finland, France |
Every feature Battleships tracks (43)
| Feature | Northflank | Google Agent Runtime | boat |
|---|---|---|---|
| Full VM (own kernel) | Yes | No | Yes |
| Docker inside | Yes | No | Yes |
| Nested virtualization | No | No | Yes |
| Root | Not published | No | Yes |
| Systemd | Not published | Not published | Yes |
| Desktop GUI | No | No | Yes |
| Browser | No | Yes | Yes |
| Computer-use API | No | Yes | Yes |
| SSH | Yes | No | Yes |
| Persistent disk | Yes | Yes | Yes |
| Pause/resume | Yes | Yes | Yes |
| Automatic snapshots | Yes | Yes | Yes |
| Fork/clone | Yes | Yes | Yes |
| Live fork (no pause) | Yes | Yes | Yes |
| Memory fork | No | Yes | No |
| Custom image (Docker or snapshot) | Yes | Yes | Yes |
| ≥24 h sessions | Yes | Yes | Yes |
| Idle auto-stop | No | No | No |
| Wake on request | No | No | No |
| HTTPS preview URLs | Yes | No | Yes |
| Raw TCP inbound | Yes | Not published | Yes |
| Public IPv4 | No | No | No |
| Egress allowlist | Yes | Yes | No |
| Secret proxy | Yes | No | Yes |
| Secret proxy for any API | Yes | No | Yes |
| Preinstalled agents | Yes | Yes | Yes |
| Agent harness API | No | Yes | Yes |
| MCP server | No | No | No |
| GPU | Yes | No | No |
| Windows | No | No | No |
| Arm64 | Yes | Yes | No |
| Self-hosting | Yes | No | No |
| BYOC | Yes | No | No |
| Open source | No | No | No |
| Scoped API keys | Not published | Not published | Yes |
| Spend limits | Not published | Not published | Yes |
| Usage per sandbox (API) | Yes | Yes | Yes |
| Audit logs | Yes | Not published | No |
| SSO | Yes | Yes | No |
| SOC 2 | Yes | Yes | No |
| HIPAA | Yes | Yes | No |
| EU data residency | Yes | Yes | Yes |
| Zero data retention | Not published | Not published | Yes |
Performance
Neither Northflank nor Google Agent Runtime has a comparable CPU measurement: neither was part of the hpc-sandbox-benchmarks test. In StarSling's run of 2026-09-29, boat did 26.69 Node.js build-and-test runs per second at 4 vCPU / 8 GB on dedicated AMD Ryzen 9 9950X hosts.
Node.js build-and-test loop at 4 vCPU / 8 GB, higher is better. Measured with the open hpc-sandbox-benchmarks suite. Northflank and Google Agent Runtime have no published run in this suite yet, so there is no like-for-like number to compare.
Pricing in five scenarios
Each bill is priced from the providers' public price lists by the open Battleships engine, with the cheapest plan that runs the scenario.
| Scenario | Northflank, a month | Google Agent Runtime, a month | boat, a month |
|---|---|---|---|
| One coding agent, workdays 4 vCPU / 8 GB, 50 GB disk, 8 hours a day, 22 days a month, files kept between days | $32 · Developer Sandbox (free tier) · with limits | $73 · Pay as you go | $20 · $20/mo |
| One agent that never stops 4 vCPU / 8 GB, 50 GB disk, running 24/7 all month | $108 · Developer Sandbox (free tier) · with limits | $301 · Pay as you go | $26 · $20/mo |
| 50 agents in parallel 50 machines of 4 vCPU / 8 GB at once, 8-hour sessions, 1,100 sessions a month, Docker inside | $1,322 · Developer Sandbox (free tier) · with limits | $3,626 · Pay as you go · with limits | $317 · $20/mo × 3 seats |
| Sandboxes for your users 2 vCPU / 4 GB, 30,000 sessions of 10 minutes a month, up to 300 at once | $361 · Developer Sandbox (free tier) · with limits | $1,030 · Pay as you go | $200 · $100/mo × 2 seats |
| 1,000 short jobs at once 2 vCPU / 4 GB, 1,000 at once, 3 minutes each, 200,000 jobs a month | $688 · Developer Sandbox (free tier) · with limits | $2,060 · Pay as you go | $2,000 · $2000/mo · with limits |
Northflank: Northflank bills per second for the plan size you pick, with no monthly fee, until you pause the sandbox; there is no idle auto-pause. Volumes cost $0.15 per GB a month even while paused, and outbound traffic costs $0.06 per GB.
Google Agent Runtime: Google bills $0.085 per vCPU-hour and $0.009 per GiB-hour allocated, with the first 50 vCPU-hours and 100 GiB-hours free each month. Sandboxes bill while they exist, and the paused, disk and egress rates are not published.
Google Agent Runtime: Plans start at $20 a month, and the whole fee is usage credit spent per second on running sandboxes. A stopped sandbox costs nothing and keeps its whole disk.
Limits in those scenarios
On Northflank the limit that bites is what survives a stop: only attached volumes keep their files, and it does not publish how many sandboxes can run at once, so 300 or 1,000 at a time is not confirmed. On Google the 50-agent fleet does not fit because its sandboxes have no Docker, a sandbox is deleted when its TTL ends, and disk and egress are unpriced. boat's limit is the 1,000-job burst: starts above 90 a minute are queued, even on the $2,000 plan.
| Scenario | Northflank | Google Agent Runtime | boat |
|---|---|---|---|
| One coding agent, workdays |
|
| None that bite |
| One agent that never stops |
|
| None that bite |
| 50 agents in parallel |
|
| None that bite |
| Sandboxes for your users |
|
| None that bite |
| 1,000 short jobs at once |
|
|
|
Which one should you use?
Use Northflank when
your agents need Docker, GPUs, regions outside Europe or your own cloud account, and you can keep the files that matter on attached volumes.
- Docker inside a microVM. For agents that build containers or run compose stacks: each Northflank sandbox has its own kernel, so Docker runs inside.
- GPUs on the same platform. For agents that train or run models: Northflank has GPU sandboxes from L4 to H100 and up, billed per hour.
- Your own cloud. For teams that must run in their own AWS, GCP or Azure account, next to their apps and databases.
Use Google Agent Runtime when
you build agents with ADK or LangGraph on Google Cloud and want them hosted in your own project, with memory snapshots, a ready browser and locked-down network rules.
- A managed home for agent code. For teams building with ADK or LangGraph: Agent Runtime hosts the agent and skips billing for idle time between turns.
- Memory snapshots to branch from. For agents that try many paths: a Google snapshot keeps memory and files, and many sandboxes can start from it.
- Inside a Google Cloud perimeter. For agents that must stay in your Google Cloud network, with outbound internet off by default and routed through your firewall.
Where boat fits
If your agents work on one machine for hours or days, look at boat. Northflank resets everything outside its volumes on a pause, and Google's sandboxes have no root, no Docker and a TTL. boat gives each agent a full VM that keeps its whole disk, with a desktop, public URLs and coding agents built in.
The whole machine comes back
On Northflank a pause wipes everything outside attached volumes, which bill while paused. Google keeps files when paused but deletes the sandbox when its TTL ends. boat saves the whole disk every minute, and stopped sandboxes cost nothing.
Root, Docker, KVM and a desktop
Google sandboxes run as appuser with no sudo or Docker, and Northflank documents no /dev/kvm and has no desktop. boat gives every VM root, systemd, Docker, /dev/kvm and a 60fps desktop with Chromium for computer use.
Agents you drive and preview from outside
Northflank Harnesses are reached through a terminal or SSH, and Google runs only its own Antigravity harness with no public URL. boat drives seven agents through a prompt, steer and events API and serves HTTPS on up to 50 ports.
Use boat when your agents need a real computer that keeps its whole disk: root, Docker, /dev/kvm, SSH, a desktop and public URLs, with Claude Code, Codex and other agents driven from your code. Compare it one to one: boat vs Northflank and boat vs Google Agent Runtime.
Questions people ask
Is Northflank cheaper than Google Agent Runtime?
In all five scenarios we priced, yes: one agent that never stops is $108 a month on Northflank against $301 on Google, and 1,000 short jobs at once are $688 against $2,060. Google's numbers assume a sandbox that exists all those hours. boat comes to $26 for the always-on agent.
Which is faster?
We cannot say: neither Northflank nor Google's sandboxes have a result on the CPU benchmark we use. boat did 26.69 Node.js build-and-test runs per second at 4 vCPU / 8 GB on that test.
Can I run Docker in Northflank and Google Agent Runtime?
On Northflank, yes: each CPU sandbox is a Kata microVM with its own kernel. On Google, no: shell commands run as appuser with no sudo, and custom images must not need root. boat runs Docker, systemd and /dev/kvm on every VM.
Do sandboxes keep their files when stopped?
On Northflank only files on attached volumes survive a pause. Google keeps the file system when paused, but deletes the sandbox when its TTL ends, 7 days at most for a custom container. boat keeps the whole disk on every stop.
Is Google Agent Runtime the same as Vertex AI Agent Engine?
Yes. Google renamed Vertex AI Agent Engine to Agent Runtime in April 2026, as part of Gemini Enterprise Agent Platform. Its sandboxes for code, shell and browser use are called Agent Sandbox.
Which one has GPUs?
Northflank has GPU sandboxes under gVisor, from L4 and A100 to H100 and more. Google's Agent Sandbox and boat run on CPUs only.
Try boat
Install the CLI, then run boat new.
7-day free trial