Northflank vs Instabox
Northflank is a broad developer platform where sandboxes are one workload, with GPUs, many regions, many sizes and your own cloud. Instabox launched today as an invite-only beta that gives each agent one size of Firecracker VM, free for now, with memory pause, mosh and a desktop.
The companies and products
Northflank
Northflank is a London developer platform for running services, jobs and databases on Kubernetes, and Sandboxes is its product for running untrusted code.
A Northflank sandbox is a container image deployed as a service: CPU sandboxes run in Kata microVMs with their own kernel, and GPU sandboxes run under gVisor. You create and drive them from the JavaScript or Python SDK, the CLI or the dashboard, on Northflank's cloud or inside your own. It suits teams that already want one platform for apps, databases, GPUs and sandboxes.
Instabox
Instabox, made by InsForge, gives each AI agent its own Linux computer in the cloud. It launched on 2026-10-14 as an invite-only beta.
Each Instabox machine is a Firecracker microVM with its own kernel, root and Docker, started from one of four templates (agent-browser, universal, herdr or orca) or from your own snapshot. Every machine is 4 vCPU / 8 GiB with 20 GB of storage, and you drive it from a CLI, a TypeScript SDK or an HTTP API, with SSH, mosh, public port URLs and a desktop for computer use. It is aimed at developers who want a cloud box for a coding agent.
- Isolation
- Firecracker microVM per machine
- Machines per account
- 5, in any state: paused and stopped ones count
- Company
- InsForge AI, Inc.
Which use cases each one fits
For each use case, Battleships prices every sandbox provider on the same workload and sorts them from the cheapest monthly bill up. “38th cheapest of 377” means 37 of the other 376 providers run that workload, with every feature it needs, for less. “With limits” means the provider runs it but misses something, so it is listed after every full match. Open a use case for its whole ranking and what each provider misses.
| Use case and its workload | Northflank: price rank | Instabox: price rank | boat: price rank |
|---|---|---|---|
| Software factory 100 at once · 4 vCPU / 8 GB · 2,200 sessions of 8 h a month A coding agent installs packages all over the machine: Northflank keeps only attached volumes across a pause, Instabox keeps files and memory but forks only stopped machines, and boat keeps the whole disk and forks running sandboxes. | 159th of 367, with limits $1,477 a month | No published price | 3rd cheapest of 367 $634 a month |
| Always-on AI employees 50 machines 24/7 · 2 vCPU / 4 GB | 173rd of 366, with limits $1,365 a month | No published price | 5th cheapest of 366 $657 a month |
| Code interpreter bursts 100 at once · 1 vCPU / 2 GB · 200,000 sessions of 1 min a month | 84th of 345, with limits $115 a month | No published price | 186th of 345, with limits $2,000 a month |
| Sandboxes for your users 300 at once · 2 vCPU / 4 GB · 30,000 sessions of 23 min a month Instabox allows 5 machines per account, paused and stopped ones included, so it cannot give a sandbox to each of many users; Northflank does not publish how many can run at once. | 89th of 361, with limits $815 a month | No published price | Cheapest of 361 $209 a month |
| RL rollouts 1,000 at once · 2 vCPU / 4 GB · 1,000,000 sessions of 3 min a month | 342nd of 360, with limits $1,762 a month | No published price | 34th of 360, with limits $2,000 a month |
| Agent evals 250 at once · 4 vCPU / 8 GB · 15,000 sessions of 20 min a month Running many evals at the same time hits Instabox's 5-machine cap; Northflank publishes no machine cap, and boat runs evals on full VMs with no session cap on paid plans. | 134th of 364, with limits $689 a month | No published price | 10th cheapest of 364 $200 a month |
| CI runners 40 at once · 8 vCPU / 16 GB · 6,000 sessions of 12 min a month CI that builds Android apps or VM images needs /dev/kvm, which boat exposes and neither Northflank nor Instabox documents inside a sandbox. | 38th cheapest of 377 $352 a month | No published price | 4th cheapest of 377 $86 a month |
| 24/7 dev boxes 1 machine 24/7 · 4 vCPU / 8 GB For one cloud dev box, Instabox adds mosh and paste-anywhere SSH tokens, Northflank adds many sizes and regions, and boat keeps the whole disk on free stops. | 151st of 368, with limits $59 a month | No published price | 18th cheapest of 368 $26 a month |
| Computer-use agents 50 at once · 4 vCPU / 8 GB · 20,000 sessions of 15 min a month Northflank sandboxes are headless; Instabox has a Linux desktop with screenshot and click control on one template, and boat streams a 60fps desktop with a computer-use agent. | 151st of 369, with limits $371 a month | No published price | 6th cheapest of 369 $200 a month |
| Browser-use agents 50 at once · 2 vCPU / 4 GB · 30,000 sessions of 10 min a month Northflank has no browser product, so you put one in your image; Instabox has a desktop with a browser on one template, and boat has Chromium in every sandbox. | 200th of 367, with limits $194 a month | No published price | 7th cheapest of 367 $200 a month |
| Scraping & bots (startup scale) 50 at once · 1 vCPU / 2 GB · 100,000 sessions of 3 min a month | 196th of 346, with limits $117 a month | No published price | 6th cheapest of 346 $90 a month |
| Mass scraping & bots (undetectable) 1,000 at once · 1 vCPU / 2 GB · 3,000,000 sessions of 2 min a month | 83rd of 338, with limits $2,049 a month | No published price | 71st of 338, with limits $1,800 a month |
| Parallel red teaming 200 at once · 2 vCPU / 4 GB · 5,000 sessions of 30 min a month | 141st of 360, with limits $99 a month | No published price | 2nd cheapest of 360 $200 a month |
| GPU eval jobs 10 at once · 8 vCPU / 32 GB · 500 sessions of 30 min a month Northflank has GPU sandboxes from L4 to H100 and up; Instabox and boat are CPU only. | 4th cheapest of 98 $693 a month | No published price | Can't run it |
| macOS agents 5 at once · 4 vCPU / 8 GB · 1,000 sessions of 20 min a month | Can't run it | No published price | Can't run it |
Key features
| Feature | Northflank | Instabox | boat |
|---|---|---|---|
| Isolation | Kata microVM with its own kernel for CPU; gVisor for GPU | Firecracker microVM with its own kernel and root | Full VM with its own kernel on dedicated AMD Ryzen 9 9950X hosts |
| Machine sizes | Plans from 0.1 vCPU up to 20 vCPU / 40 GB, more on request; a resize restarts the sandbox | One size for everyone: 4 vCPU / 8 GiB with 20 GB storage; other sizes are refused | Several sizes, up to 8 vCPU / 16 GB on the $20 plan and 16 vCPU / 32 GB on $100 and above |
| What survives a pause or stop | Only attached volumes, which bill while paused; the rest of the disk and all processes reset | Pause keeps memory and running programs; resume usually takes about a second | The whole disk, saved every minute and on stop; stopped sandboxes cost nothing |
| Snapshots and fork | Filesystem snapshots of a running or stopping sandbox, opt-in; restore into a new one | Saved by hand, up to 10; saving stops a running machine first unless the server allows a live save; fork copies a stopped machine only | Automatic disk snapshots every minute; fork a running sandbox with its disk |
| Docker | Docker runs inside, since each sandbox has its own kernel | Docker and Docker Compose run inside | Docker and Compose run inside, with root and systemd |
| Nested virtualization | Not documented inside a sandbox | Not documented | Yes, /dev/kvm for Android emulators and VMs |
| Desktop and computer use | Headless; access by SDK, browser terminal or SSH | Linux desktop with a browser on one template, screenshot and click API, shareable view or control links; you bring the model | 60fps Linux desktop with Chromium and a computer-use agent |
| Coding agents | Harnesses with Claude Code, Codex, Cursor, OpenCode or Pi; you talk to the agent through a terminal or SSH | Templates and saved agent sign-ins in snapshots; you run the agent yourself | Seven agents preinstalled, with a prompt, steer and events API |
| Keeping API keys out of the sandbox | Header injection for listed hosts in the network policy API; otherwise secrets are env vars or files | Vault writes your secrets into each machine as environment variables or files | Credentials proxy for model providers and any HTTPS API; real keys never enter the sandbox |
| Inbound access | HTTPS ports on a code.run domain, private by default; public TCP and UDP need a separate load balancer | HTTPS on up to 16 ports, open to anyone with the URL; offline while the machine is paused | HTTPS URLs for up to 50 ports, token-protected by default; raw TCP; dedicated IPv4 or IPv6 |
| SSH | SSH and a browser terminal | SSH through a gateway with short-lived certificates, paste-anywhere SSH tokens and mosh | SSH into every sandbox |
| GPUs | L4, A100, H100, RTX PRO 6000 and more | No | No |
| Regions | US, Canada, Brazil, UK, EU, Switzerland, Asia, Australia and South Africa | Not published | EU only (Germany, Finland, France) |
| Your own cloud | Bring your own cloud, or the control plane in your VPC on Enterprise | Not documented | No |
Every feature Battleships tracks (43)
| Feature | Northflank | Instabox | boat |
|---|---|---|---|
| Full VM (own kernel) | Yes | Yes | Yes |
| Docker inside | Yes | Yes | Yes |
| Nested virtualization | No | Not published | Yes |
| Root | Not published | Yes | Yes |
| Systemd | Not published | Not published | Yes |
| Desktop GUI | No | Yes | Yes |
| Browser | No | Yes | Yes |
| Computer-use API | No | Yes | Yes |
| SSH | Yes | Yes | Yes |
| Persistent disk | Yes | Yes | Yes |
| Pause/resume | Yes | Yes | Yes |
| Automatic snapshots | Yes | No | Yes |
| Fork/clone | Yes | Yes | Yes |
| Live fork (no pause) | Yes | No | Yes |
| Memory fork | No | No | No |
| Custom image (Docker or snapshot) | Yes | Yes | Yes |
| ≥24 h sessions | Yes | Yes | Yes |
| Idle auto-stop | No | Yes | No |
| Wake on request | No | No | No |
| HTTPS preview URLs | Yes | Yes | Yes |
| Raw TCP inbound | Yes | Not published | Yes |
| Public IPv4 | No | No | No |
| Egress allowlist | Yes | Not published | No |
| Secret proxy | Yes | No | Yes |
| Secret proxy for any API | Yes | No | Yes |
| Preinstalled agents | Yes | Not published | Yes |
| Agent harness API | No | Not published | Yes |
| MCP server | No | Not published | No |
| GPU | Yes | No | No |
| Windows | No | No | No |
| Arm64 | Yes | Not published | No |
| Self-hosting | Yes | Not published | No |
| BYOC | Yes | Not published | No |
| Open source | No | No | No |
| Scoped API keys | Not published | Yes | Yes |
| Spend limits | Not published | Not published | Yes |
| Usage per sandbox (API) | Yes | Yes | Yes |
| Audit logs | Yes | Not published | No |
| SSO | Yes | No | No |
| SOC 2 | Yes | Not published | No |
| HIPAA | Yes | Not published | No |
| EU data residency | Yes | Not published | Yes |
| Zero data retention | Not published | Not published | Yes |
Performance
Neither Northflank Sandboxes nor Instabox has a result on the hpc-sandbox-benchmarks test, so this page makes no speed claim between them. boat did 26.69 runs per second on that Node.js build-and-test loop at 4 vCPU / 8 GB, on dedicated AMD Ryzen 9 9950X hosts. Instabox says a new machine's shell is ready in under a second; that has not been measured.
Node.js build-and-test loop at 4 vCPU / 8 GB, higher is better. Measured with the open hpc-sandbox-benchmarks suite. Northflank and Instabox have no published run in this suite yet, so there is no like-for-like number to compare.
Pricing in five scenarios
Each bill is priced from the providers' public price lists by the open Battleships engine, with the cheapest plan that runs the scenario.
| Scenario | Northflank, a month | Instabox, a month | boat, a month |
|---|---|---|---|
| One coding agent, workdays 4 vCPU / 8 GB, 50 GB disk, 8 hours a day, 22 days a month, files kept between days | $32 · Developer Sandbox (free tier) · with limits | No published price | $20 · $20/mo |
| One agent that never stops 4 vCPU / 8 GB, 50 GB disk, running 24/7 all month | $108 · Developer Sandbox (free tier) · with limits | No published price | $26 · $20/mo |
| 50 agents in parallel 50 machines of 4 vCPU / 8 GB at once, 8-hour sessions, 1,100 sessions a month, Docker inside | $1,322 · Developer Sandbox (free tier) · with limits | No published price | $317 · $20/mo × 3 seats |
| Sandboxes for your users 2 vCPU / 4 GB, 30,000 sessions of 10 minutes a month, up to 300 at once | $361 · Developer Sandbox (free tier) · with limits | No published price | $200 · $100/mo × 2 seats |
| 1,000 short jobs at once 2 vCPU / 4 GB, 1,000 at once, 3 minutes each, 200,000 jobs a month | $688 · Developer Sandbox (free tier) · with limits | No published price | $2,000 · $2000/mo · with limits |
Northflank: Northflank bills per second for the plan size you pick, with no monthly fee, until you pause the sandbox; there is no idle auto-pause. Volumes cost $0.15 per GB a month even while paused, and outbound traffic costs $0.06 per GB.
Instabox: Instabox is free during the beta, with 5 machines per user, and publishes no price yet, so no bill can be compared with Northflank's or boat's.
Instabox: Plans start at $20 a month, and the whole fee is usage credit. You pay per second while a sandbox runs, and a stopped sandbox costs nothing and keeps its whole disk.
Limits in those scenarios
On Northflank the limit that bites is what survives a pause: only attached volumes keep their files, and it does not publish how many sandboxes can run at once, so 300 or 1,000 at a time is not confirmed. Instabox allows 5 machines per account, paused and stopped ones included, all 4 vCPU / 8 GiB, and an API exec call runs at most 10 minutes with 4 at once; it has no published rate, so no scenario can be priced. boat's limit is the burst scenario: even the $2,000 plan queues starts above 90 a minute.
| Scenario | Northflank | Instabox | boat |
|---|---|---|---|
| One coding agent, workdays |
|
| None that bite |
| One agent that never stops |
|
| None that bite |
| 50 agents in parallel |
|
| None that bite |
| Sandboxes for your users |
|
| None that bite |
| 1,000 short jobs at once |
|
|
|
Which one should you use?
Use Northflank when
you need GPUs next to the agent, regions outside Europe, a machine smaller or larger than 4 vCPU / 8 GiB, or sandboxes inside your own cloud next to the rest of your apps.
- GPU sandboxes. For agents that train, fine-tune or run models: Northflank has GPU sandboxes from L4 to H100 and up.
- Many sizes on published rates. For work that needs a tiny or a large machine: plans go from 0.1 vCPU to 20 vCPU / 40 GB, billed per second.
- Regions and your own cloud. For users far from Europe, or teams that must stay in their own AWS, GCP or Azure account.
Use Instabox when
you want to try a few free 4 vCPU / 8 GiB agent machines during its invite-only beta, with memory pause, mosh and a desktop.
- Free during the beta. For trying things out: during the beta, every account can run 5 machines of 4 vCPU / 8 GiB for free.
- Pause with memory. A paused machine keeps its memory and running programs and usually resumes in about a second.
- SSH gateway with mosh. Its SSH gateway relays mosh and gives paste-anywhere SSH tokens, so a session survives sleep and network changes.
Where boat fits
If your agents work on one machine for hours or days, look at boat too. It keeps the whole disk on every stop, forks running sandboxes, and ships the agent, a desktop and a browser inside, driven from your code. It is EU only and has no GPUs, so Northflank still wins for GPU work or users far from Europe.
The whole machine comes back, and forks while running
A Northflank pause wipes everything outside attached volumes, so agents reinstall tools unless you plan volumes for every path. Instabox keeps memory on pause, but forks only stopped machines and stops a machine to snapshot it.
Agents and keys handled from outside
Northflank Harnesses reach the agent through a terminal or SSH, and Instabox leaves running the agent to you, so you build the control layer. Both put most secrets inside the machine; boat's credentials proxy keeps real keys out.
KVM, a 60fps desktop and private URLs
Northflank sandboxes are headless, and neither documents /dev/kvm for Android emulators. Instabox port URLs are open to anyone who finds them, so you add your own login. boat URLs carry a token by default.
Use boat when your agents work on one machine for hours or days and should find it as they left it, fork running work, serve private URLs and be driven from your code. Compare it one to one: boat vs Northflank and boat vs Instabox.
Questions people ask
Is Northflank cheaper than Instabox?
It can't be compared yet. Instabox is free during the beta and publishes no price, so there is no bill to set against Northflank's per-second rates. Northflank's and boat's prices for each scenario are in the table above.
Which is faster, Northflank or Instabox?
Neither has a comparable CPU measurement, so this page makes no speed claim. Instabox says a new machine's shell is ready in under a second, and its docs say a paused machine usually resumes in about a second; neither has been measured here.
Can Northflank and Instabox run Docker?
Yes. Each gives a sandbox its own kernel, and Instabox documents Docker and Docker Compose inside. Neither documents /dev/kvm for Android emulators or VMs; boat exposes it.
What does each keep when a machine is paused?
A Northflank pause keeps only attached volumes; the rest of the disk and all processes reset. An Instabox pause keeps memory and running programs, but its port URLs go offline until it resumes. boat keeps the whole disk on every stop.
Can I fork a running sandbox on either?
Northflank can take a filesystem snapshot of a running sandbox and restore it into a new one. Instabox's fork copies a stopped machine only. boat forks a running sandbox and keeps the original working.
Does either have GPUs or regions outside Europe?
Northflank has GPU sandboxes from L4 to H100 and regions from the US to Asia, Australia and South Africa. Instabox has no GPUs and publishes no regions. boat is CPU only and runs in the EU.
Try boat
Install the CLI, then run boat new.
7-day free trial