Northflank vs Islo
Both run each sandbox as a microVM with its own kernel. Northflank is a broad cloud platform with GPUs, many regions and your own cloud, while Islo is built only for coding agents, with a gateway that controls and logs every outbound call.
The companies and products
Northflank
Northflank is a London developer platform for running services, jobs and databases on Kubernetes, and Sandboxes is its product for running untrusted code.
A Northflank sandbox is a container image deployed as a service: CPU sandboxes run in Kata microVMs with their own kernel, and GPU sandboxes run under gVisor. You create and drive them from the JavaScript or Python SDK, the CLI or the dashboard, on Northflank's cloud or inside your own. It suits teams that already want one platform for apps, databases, GPUs and sandboxes.
Islo
Islo is an agent sandbox from Incredibuild: each coding agent gets its own microVM, with network rules and credentials handled at a gateway.
An Islo sandbox is a Linux microVM with its own kernel, built from a container image, with Claude Code, Cursor CLI and Codex preinstalled. Outbound traffic can pass through a gateway that allows or blocks hosts, injects credentials and logs every request. It is built for teams that run coding agents, evals and RL rollouts in the background, on Islo's cloud or in their own cloud account.
- Launched
- May 4, 2026
Which use cases each one fits
For each use case, Battleships prices every sandbox provider on the same workload and sorts them from the cheapest monthly bill up. “38th cheapest of 377” means 37 of the other 376 providers run that workload, with every feature it needs, for less. “With limits” means the provider runs it but misses something, so it is listed after every full match. Open a use case for its whole ranking and what each provider misses.
| Use case and its workload | Northflank: price rank | Islo: price rank | boat: price rank |
|---|---|---|---|
| Software factory 100 at once · 4 vCPU / 8 GB · 2,200 sessions of 8 h a month A coding agent installs packages all over its machine: Northflank keeps only attached volumes on a pause, Islo keeps files and memory, and boat keeps the whole disk and ranks 3rd. | 159th of 367, with limits $1,477 a month | 326th of 367, with limits $7,402 a month | 3rd cheapest of 367 $634 a month |
| Always-on AI employees 50 machines 24/7 · 2 vCPU / 4 GB An assistant that waits between tasks suits Islo, which pauses it with memory and wakes it on the next request; Northflank bills until you pause it yourself. | 173rd of 366, with limits $1,365 a month | 30th cheapest of 366 $9,928 a month | 5th cheapest of 366 $657 a month |
| Code interpreter bursts 100 at once · 1 vCPU / 2 GB · 200,000 sessions of 1 min a month Short code runs on small machines fit Northflank best of the three, since its per-second plans start at a tenth of a vCPU; Northflank ranks 84th here. | 84th of 345, with limits $115 a month | 153rd of 345, with limits $503 a month | 186th of 345, with limits $2,000 a month |
| Sandboxes for your users 300 at once · 2 vCPU / 4 GB · 30,000 sessions of 23 min a month 300 sandboxes for your users at once is past Islo's reported Team limit of 50 and not confirmed on Northflank; boat ranks 1st with HTTPS on up to 50 ports per sandbox. | 89th of 361, with limits $815 a month | 171st of 361, with limits $3,160 a month | Cheapest of 361 $209 a month |
| RL rollouts 1,000 at once · 2 vCPU / 4 GB · 1,000,000 sessions of 3 min a month | 342nd of 360, with limits $1,762 a month | 167th of 360, with limits $15,265 a month | 34th of 360, with limits $2,000 a month |
| Agent evals 250 at once · 4 vCPU / 8 GB · 15,000 sessions of 20 min a month | 134th of 364, with limits $689 a month | 198th of 364, with limits $2,456 a month | 10th cheapest of 364 $200 a month |
| CI runners 40 at once · 8 vCPU / 16 GB · 6,000 sessions of 12 min a month All three fit; Northflank costs less than Islo here, and boat adds /dev/kvm for Android emulators and VM builds. | 38th cheapest of 377 $352 a month | 119th cheapest of 377 $1,507 a month | 4th cheapest of 377 $86 a month |
| 24/7 dev boxes 1 machine 24/7 · 4 vCPU / 8 GB A box that stays on all month fully fits Islo, while on Northflank anything outside an attached volume resets when you pause it. | 151st of 368, with limits $59 a month | 112th cheapest of 368 $402 a month | 18th cheapest of 368 $26 a month |
| Computer-use agents 50 at once · 4 vCPU / 8 GB · 20,000 sessions of 15 min a month Northflank and Islo sandboxes are both headless, so a computer-use agent needs a desktop you build yourself; boat streams a 60fps desktop with Chromium. | 151st of 369, with limits $371 a month | 310th of 369, with limits $2,210 a month | 6th cheapest of 369 $200 a month |
| Browser-use agents 50 at once · 2 vCPU / 4 GB · 30,000 sessions of 10 min a month | 200th of 367, with limits $194 a month | 113th of 367, with limits $1,105 a month | 7th cheapest of 367 $200 a month |
| Scraping & bots (startup scale) 50 at once · 1 vCPU / 2 GB · 100,000 sessions of 3 min a month | 196th of 346, with limits $117 a month | 66th cheapest of 346 $748 a month | 6th cheapest of 346 $90 a month |
| Mass scraping & bots (undetectable) 1,000 at once · 1 vCPU / 2 GB · 3,000,000 sessions of 2 min a month | 83rd of 338, with limits $2,049 a month | 265th of 338, with limits $14,966 a month | 71st of 338, with limits $1,800 a month |
| Parallel red teaming 200 at once · 2 vCPU / 4 GB · 5,000 sessions of 30 min a month | 141st of 360, with limits $99 a month | 47th of 360, with limits $746 a month | 2nd cheapest of 360 $200 a month |
| GPU eval jobs 10 at once · 8 vCPU / 32 GB · 500 sessions of 30 min a month Northflank is the only one of the three with GPUs, from L4 to H100 and up; Islo and boat are CPU only. | 4th cheapest of 98 $693 a month | Can't run it | Can't run it |
| macOS agents 5 at once · 4 vCPU / 8 GB · 1,000 sessions of 20 min a month | Can't run it | Can't run it | Can't run it |
Key features
| Feature | Northflank | Islo | boat |
|---|---|---|---|
| Isolation | Kata microVM with its own kernel for CPU; gVisor for GPU | A microVM with its own kernel for every sandbox | Full VM with its own kernel on dedicated AMD Ryzen 9 9950X hosts |
| What survives a pause | Only attached volumes, which bill while paused; the rest of the disk and all processes reset | Files, processes and memory | The whole disk, saved every minute and on stop; a resumed sandbox reboots from disk |
| Idle pause and wake | No idle auto-pause; a sandbox bills its plan until you pause it | Can pause after a set idle time (chosen at creation) and wake on the next exec, file access or webhook | A stopped sandbox costs nothing and keeps its whole disk |
| Docker and nested virtualization | Docker inside; no /dev/kvm documented | Docker and sudo inside; no /dev/kvm or nested virtualization documented | Docker, root, systemd and /dev/kvm on every machine |
| Desktop and computer use | Headless; access by SDK, browser terminal or SSH | A browser inside for testing; no desktop or computer-use API | 60fps Linux desktop, Chromium and a computer-use API, with an embeddable stream |
| Coding agents | Harnesses start Claude Code, Codex, Cursor, OpenCode or Pi; you reach the agent through a terminal or SSH | Claude Code, Cursor CLI and Codex preinstalled; factory lines run agent steps with events and steer, on a schedule, webhook or GitHub, Slack and Linear events | Seven agents preinstalled, with a prompt, steer and events API |
| Keeping API keys out of the sandbox | Header injection for listed hosts in the network policy API; otherwise env vars or files | Gateway injects stored credentials into outbound requests for any host | Credentials proxy for model providers and any HTTPS API; switch a credential to another account when credits run out |
| Outbound rules | Network policies with allow lists by IP, CIDR or domain, documented for your own cluster | Gateway rules by host, path and HTTP method, default deny, rate limits, content filters and per-request logs | Open internet, no provider-side allowlist |
| Inbound access | HTTPS ports on a code.run domain, private by default; public TCP and UDP need a separate load balancer | HTTPS share links anyone with the URL can open, expiring after 24 hours by default; SSH and port-forward through the CLI; no raw TCP | HTTPS URLs for up to 50 ports, token-protected by default; raw TCP; dedicated IPv4 or IPv6 |
| Sandboxes at once | Limit not published | Free 5 and Team 50 running sandboxes per launch coverage; more by contract | 100 to 2,000 running sandboxes by plan, raised by adding seats |
| GPUs | L4, A100, H100, RTX PRO 6000 and more | No | No |
| Regions | US, Canada, Brazil, UK, EU, Switzerland, Asia, Australia and South Africa | US West | EU only (Germany, Finland, France), with EU data residency |
| Your own cloud | AWS, GCP, Azure, Oracle, CoreWeave and others, or the control plane in your VPC on Enterprise | BYOC puts the control plane and sandboxes in your own cloud account | No |
Every feature Battleships tracks (43)
| Feature | Northflank | Islo | boat |
|---|---|---|---|
| Full VM (own kernel) | Yes | Yes | Yes |
| Docker inside | Yes | Yes | Yes |
| Nested virtualization | No | No | Yes |
| Root | Not published | Yes | Yes |
| Systemd | Not published | Not published | Yes |
| Desktop GUI | No | No | Yes |
| Browser | No | Yes | Yes |
| Computer-use API | No | No | Yes |
| SSH | Yes | Yes | Yes |
| Persistent disk | Yes | Yes | Yes |
| Pause/resume | Yes | Yes | Yes |
| Automatic snapshots | Yes | Yes | Yes |
| Fork/clone | Yes | Yes | Yes |
| Live fork (no pause) | Yes | Yes | Yes |
| Memory fork | No | No | No |
| Custom image (Docker or snapshot) | Yes | Yes | Yes |
| ≥24 h sessions | Yes | Yes | Yes |
| Idle auto-stop | No | Yes | No |
| Wake on request | No | Yes | No |
| HTTPS preview URLs | Yes | Yes | Yes |
| Raw TCP inbound | Yes | No | Yes |
| Public IPv4 | No | No | No |
| Egress allowlist | Yes | Yes | No |
| Secret proxy | Yes | Yes | Yes |
| Secret proxy for any API | Yes | Yes | Yes |
| Preinstalled agents | Yes | Yes | Yes |
| Agent harness API | No | Yes | Yes |
| MCP server | No | No | No |
| GPU | Yes | No | No |
| Windows | No | No | No |
| Arm64 | Yes | No | No |
| Self-hosting | Yes | No | No |
| BYOC | Yes | Yes | No |
| Open source | No | No | No |
| Scoped API keys | Not published | Not published | Yes |
| Spend limits | Not published | Not published | Yes |
| Usage per sandbox (API) | Yes | Yes | Yes |
| Audit logs | Yes | Yes | No |
| SSO | Yes | Yes | No |
| SOC 2 | Yes | Not published | No |
| HIPAA | Yes | Not published | No |
| EU data residency | Yes | No | Yes |
| Zero data retention | Not published | Not published | Yes |
Performance
There is no comparable CPU measurement for Northflank or Islo: neither has a result on the StarSling hpc-sandbox-benchmarks test. On that test boat did 26.69 Node.js build-and-test runs per second at 4 vCPU / 8 GB, on dedicated AMD Ryzen 9 9950X hosts.
Node.js build-and-test loop at 4 vCPU / 8 GB, higher is better. Measured with the open hpc-sandbox-benchmarks suite. Northflank and Islo have no published run in this suite yet, so there is no like-for-like number to compare.
Pricing in five scenarios
Each bill is priced from the providers' public price lists by the open Battleships engine, with the cheapest plan that runs the scenario.
| Scenario | Northflank, a month | Islo, a month | boat, a month |
|---|---|---|---|
| One coding agent, workdays 4 vCPU / 8 GB, 50 GB disk, 8 hours a day, 22 days a month, files kept between days | $32 · Developer Sandbox (free tier) · with limits | $101 · Free | $20 · $20/mo |
| One agent that never stops 4 vCPU / 8 GB, 50 GB disk, running 24/7 all month | $108 · Developer Sandbox (free tier) · with limits | $420 · Free | $26 · $20/mo |
| 50 agents in parallel 50 machines of 4 vCPU / 8 GB at once, 8-hour sessions, 1,100 sessions a month, Docker inside | $1,322 · Developer Sandbox (free tier) · with limits | $4,863 · Team | $317 · $20/mo × 3 seats |
| Sandboxes for your users 2 vCPU / 4 GB, 30,000 sessions of 10 minutes a month, up to 300 at once | $361 · Developer Sandbox (free tier) · with limits | $1,382 · Team · with limits | $200 · $100/mo × 2 seats |
| 1,000 short jobs at once 2 vCPU / 4 GB, 1,000 at once, 3 minutes each, 200,000 jobs a month | $688 · Developer Sandbox (free tier) · with limits | $3,053 · Team · with limits | $2,000 · $2000/mo · with limits |
Northflank: Northflank bills per second for the plan size you pick, with no monthly fee, until you pause the sandbox. Volumes cost $0.15 per GB a month even while paused, and outbound traffic costs $0.06 per GB.
Islo: Islo bills each CPU core and each GB of memory and disk while a sandbox runs, billed per hour, with no plan fee. An idle sandbox keeps billing until its pause-after-idle timer fires, and egress has no published price.
Islo: Plans start at $20 a month, and the whole fee is usage credit spent per second on running sandboxes. A stopped sandbox costs nothing and keeps its whole disk.
Limits in those scenarios
On Northflank the limit that bites in every scenario is what survives a pause: only attached volumes keep their files, so packages installed anywhere else reset. Northflank does not publish how many sandboxes can run at once, and Islo's Team plan is reported at 50, so 300 sandboxes for your users or 1,000 short jobs at once do not fit Islo and are not confirmed on Northflank. boat queues starts above 90 a minute, so the 1,000-job burst does not all start together.
| Scenario | Northflank | Islo | boat |
|---|---|---|---|
| One coding agent, workdays |
|
| None that bite |
| One agent that never stops |
|
| None that bite |
| 50 agents in parallel |
|
| None that bite |
| Sandboxes for your users |
|
| None that bite |
| 1,000 short jobs at once |
|
|
|
Which one should you use?
Use Northflank when
you need GPUs next to the agent, regions outside the US and Europe, or sandboxes in your own cloud next to your apps and databases.
- GPU sandboxes. For agents that train or run models: Northflank has GPU sandboxes from L4 to H100 and up, and Islo has none.
- Regions around the world. For users far from the US West coast: Northflank also runs in Canada, Brazil, Europe, Asia, Australia and South Africa.
- One platform for apps and sandboxes. For teams that also run services, jobs and databases: Northflank keeps them and the sandboxes on one platform, or in your cloud.
Use Islo when
you need per-host egress rules with a log of every outbound call, or coding agents that pause with memory and wake on the next request.
- Egress rules and request logs. For teams that must control what agents reach: Islo allows or blocks each host, path and method, and logs every call.
- Pause with memory, wake on request. For agents idle between tasks: Islo pauses them with files, processes and memory kept, and wakes them on the next request.
- Agent runs from your tools. For teams automating coding agents: Islo factory lines start agent steps from a schedule, a webhook or GitHub, Slack and Linear events.
Where boat fits
Northflank and Islo both give an agent a headless microVM. If your agents need to see a screen, boot an emulator or serve something others can reach, look at boat: every sandbox is a full VM with a desktop, /dev/kvm and ports you can host on, and it keeps the whole disk when it stops.
A desktop agents can see and use
Northflank and Islo sandboxes are headless, so an agent that must check a UI or fill a form in a real app has no screen. On either you would build an image with a desktop, a browser and a way to stream it.
Emulators and VMs inside
Neither Northflank nor Islo documents /dev/kvm inside a sandbox, so Android emulators and tools that start their own VMs stop at the first boot. boat has /dev/kvm, root and systemd on every machine.
Ports you can host on
On Northflank, public TCP or UDP needs a separate load balancer. Islo share links are public to anyone with the URL and expire after 24 hours by default. boat serves up to 50 HTTPS ports with tokens, plus raw TCP.
Use boat when your agents work on one machine for hours or days and need a desktop, /dev/kvm, Docker and ports you can host on, with the whole disk kept on every stop. Compare it one to one: boat vs Northflank and boat vs Islo.
Questions people ask
Is Northflank cheaper than Islo?
In every scenario we priced, yes: one agent that never stops is $108 on Northflank against $420 on Islo, and 50 agents in parallel are $1,322 against $4,863. But on Northflank only attached volumes keep their files when paused, so those totals do not fully fit an agent that installs packages. boat comes to $26 and $317 a month for the same two.
Which is faster, Northflank or Islo?
We cannot say: neither has a result on the public CPU benchmark we use. boat did 26.69 Node.js build-and-test runs per second on it at 4 vCPU / 8 GB.
Can Northflank and Islo run Docker?
Yes. Both give each sandbox its own kernel in a microVM, and Docker runs inside. Neither documents /dev/kvm, which boat has for Android emulators and VMs.
Does a sandbox keep its files when paused?
On Islo, yes: a pause keeps files, processes and memory. On Northflank only attached volumes survive, and the rest of the disk and all processes reset. boat keeps the whole disk on every stop and reboots from it.
Do Northflank or Islo have GPUs?
Northflank does, with GPU sandboxes from L4 and A100 to H100 and more under gVisor. Islo and boat run on CPUs only.
Where do Northflank and Islo run?
Northflank runs in the US, Canada, Brazil, the UK, the EU, Switzerland, Asia, Australia and South Africa, or in your own cloud. Islo runs in US West or in your own cloud account. boat runs only in the EU, in Germany, Finland and France.
Try boat
Install the CLI, then run boat new.
7-day free trial