Northflank vs OpenAI Containers
Northflank gives you sandboxes you deploy from your own image and run as long as you want, on a platform that also runs apps, databases and GPUs. OpenAI Containers are a tool inside OpenAI's model API: the model runs Python or shell commands in a fixed Debian box that expires after 20 minutes without use.
The companies and products
Northflank
Northflank is a London developer platform for running services, jobs and databases on Kubernetes, and Sandboxes is its product for running untrusted code.
A Northflank sandbox is a container image deployed as a service: CPU sandboxes run in Kata microVMs with their own kernel, and GPU sandboxes run under gVisor. You create and drive them from the JavaScript or Python SDK, the CLI or the dashboard, on Northflank's cloud or inside your own. It suits teams that already want one platform for apps, databases, GPUs and sandboxes.
OpenAI Containers
OpenAI Containers are the sandboxes OpenAI runs for its own model tools: Code Interpreter, Hosted Shell and the Agents API's hosted sandbox.
This is a different kind of product from boat: a tool inside OpenAI's model API, not a machine you rent. You create a container through the API or let a Responses call make one, and the model runs Python or shell commands in it on a fixed Debian 12 image without sudo, until it expires after 20 minutes without use. It is built for apps that already call OpenAI models and want them to run code, read files and make charts without running any servers.
Which use cases each one fits
For each use case, Battleships prices every sandbox provider on the same workload and sorts them from the cheapest monthly bill up. “38th cheapest of 377” means 37 of the other 376 providers run that workload, with every feature it needs, for less. “With limits” means the provider runs it but misses something, so it is listed after every full match. Open a use case for its whole ranking and what each provider misses.
| Use case and its workload | Northflank: price rank | OpenAI Containers: price rank | boat: price rank |
|---|---|---|---|
| Software factory 100 at once · 4 vCPU / 8 GB · 2,200 sessions of 8 h a month A coding agent needs root, Docker and files that stay; Northflank keeps only attached volumes across a pause, and an OpenAI container has no persistent disk and no Docker. | 159th of 367, with limits $1,477 a month | 356th of 367, with limits $17,371 a month | 3rd cheapest of 367 $634 a month |
| Always-on AI employees 50 machines 24/7 · 2 vCPU / 4 GB An assistant that lives on its machine all month can run on Northflank until you pause it, while an OpenAI container must be touched every 20 minutes or it is deleted. | 173rd of 366, with limits $1,365 a month | 341st of 366, with limits $13,140 a month | 5th cheapest of 366 $657 a month |
| Code interpreter bursts 100 at once · 1 vCPU / 2 GB · 200,000 sessions of 1 min a month This is what OpenAI Containers are built for, with no machine to manage; Northflank's small per-second plans also fit short code runs well. | 84th of 345, with limits $115 a month | 194th of 345, with limits $6,000 a month | 186th of 345, with limits $2,000 a month |
| Sandboxes for your users 300 at once · 2 vCPU / 4 GB · 30,000 sessions of 23 min a month Northflank can give each user a sandbox with HTTPS ports; an OpenAI container has no inbound access at all, and boat adds HTTPS on up to 50 ports and a whole disk that survives. | 89th of 361, with limits $815 a month | 361st of 361, with limits $3,780 a month | Cheapest of 361 $209 a month |
| RL rollouts 1,000 at once · 2 vCPU / 4 GB · 1,000,000 sessions of 3 min a month | 342nd of 360, with limits $1,762 a month | 191st of 360, with limits $30,000 a month | 34th of 360, with limits $2,000 a month |
| Agent evals 250 at once · 4 vCPU / 8 GB · 15,000 sessions of 20 min a month | 134th of 364, with limits $689 a month | 360th of 364, with limits $5,760 a month | 10th cheapest of 364 $200 a month |
| CI runners 40 at once · 8 vCPU / 16 GB · 6,000 sessions of 12 min a month CI needs Docker and open internet, which Northflank has; OpenAI documents no Docker or root, and Code Interpreter containers start with no internet. | 38th cheapest of 377 $352 a month | 345th of 377, with limits $1,728 a month | 4th cheapest of 377 $86 a month |
| 24/7 dev boxes 1 machine 24/7 · 4 vCPU / 8 GB A dev box you SSH into and keep is possible on Northflank, though only volumes survive a pause; OpenAI containers have no SSH and no persistent disk. | 151st of 368, with limits $59 a month | 362nd of 368, with limits $1,051 a month | 18th cheapest of 368 $26 a month |
| Computer-use agents 50 at once · 4 vCPU / 8 GB · 20,000 sessions of 15 min a month OpenAI has a hosted browser for computer use in the Agents API beta, Northflank sandboxes are headless, and boat streams a 60fps desktop you can embed. | 151st of 369, with limits $371 a month | 351st of 369, with limits $5,280 a month | 6th cheapest of 369 $200 a month |
| Browser-use agents 50 at once · 2 vCPU / 4 GB · 30,000 sessions of 10 min a month | 200th of 367, with limits $194 a month | 328th of 367, with limits $1,440 a month | 7th cheapest of 367 $200 a month |
| Scraping & bots (startup scale) 50 at once · 1 vCPU / 2 GB · 100,000 sessions of 3 min a month | 196th of 346, with limits $117 a month | 328th of 346, with limits $1,755 a month | 6th cheapest of 346 $90 a month |
| Mass scraping & bots (undetectable) 1,000 at once · 1 vCPU / 2 GB · 3,000,000 sessions of 2 min a month | 83rd of 338, with limits $2,049 a month | 311th of 338, with limits $35,100 a month | 71st of 338, with limits $1,800 a month |
| Parallel red teaming 200 at once · 2 vCPU / 4 GB · 5,000 sessions of 30 min a month | 141st of 360, with limits $99 a month | 308th of 360, with limits $870 a month | 2nd cheapest of 360 $200 a month |
| GPU eval jobs 10 at once · 8 vCPU / 32 GB · 500 sessions of 30 min a month Northflank has GPU sandboxes from L4 to H100 and up; OpenAI Containers and boat have no GPUs. | 4th cheapest of 98 $693 a month | Can't run it | Can't run it |
| macOS agents 5 at once · 4 vCPU / 8 GB · 1,000 sessions of 20 min a month | Can't run it | Can't run it | Can't run it |
Key features
| Feature | Northflank | OpenAI Containers | boat |
|---|---|---|---|
| What it is | A sandbox you deploy from a container image, on a platform that also runs apps, jobs and databases | A sandbox tool the model uses inside OpenAI's API | A cloud VM you create, keep, stop and reach from outside |
| Isolation | Kata microVM with its own kernel for CPU; gVisor for GPU | A fully sandboxed virtual machine; hypervisor not named | Full VM with its own kernel on dedicated AMD Ryzen 9 9950X hosts |
| Root and Docker | Docker can run inside, since each sandbox has its own kernel | Commands do not run with sudo; no Docker documented | Root, systemd, Docker and /dev/kvm on every machine |
| Custom image | Any container image you build | Fixed Debian 12 image; you upload files or skills into each container | Named snapshots of a set-up machine, reused as templates |
| What survives a stop | Only attached volumes, which bill while paused; the rest of the disk and all processes reset | Nothing: data is discarded when the container expires | The whole disk, saved every minute and on stop; stopped sandboxes cost nothing |
| Lifetime | Runs until you pause or delete it; no idle auto-pause | Expires after 20 minutes without use; Agents API sandboxes after an hour without activity | No session cap on paid plans; you set the time to live |
| Snapshots and fork | Filesystem snapshots of a running or stopping sandbox, opt-in; restore into a new one | No snapshots and no fork | Automatic disk snapshots; fork a running sandbox |
| Machine size | Plans from 0.1 vCPU up to 20 vCPU / 40 GB, more on request | 1, 4, 16 or 64 GB of memory; vCPU not published | 4 vCPU / 8 GB by default, up to 16 vCPU / 32 GB |
| Inbound access | HTTPS ports on a code.run domain, private by default; SSH; public TCP and UDP need a load balancer | None; you reach the container only through the API | SSH, HTTPS URLs for up to 50 ports, token-protected by default; raw TCP |
| Outbound internet | Open by default; network policies with allow lists by IP, CIDR or domain | Code Interpreter and Hosted Shell: off until an admin sets an org domain allowlist | Open internet on every plan; no provider-side allowlist |
| Keeping API keys out of the sandbox | Header injection for listed hosts in the network policy API | domain_secrets: a sidecar adds the real header for approved domains | Credentials proxy for model providers and any HTTPS API; switch a credential to another account when credits run out |
| Coding agents | Harnesses with Claude Code, Codex, Cursor, OpenCode or Pi; you reach them by terminal or SSH | Agents API (beta) drives a managed Codex harness from outside, with steering, events and webhooks | Seven agents preinstalled, with a prompt, steer and events API |
| Desktop and browser | Headless; no browser product | Hosted browser for the Agents API computer_use tool | 60fps Linux desktop, Chromium and computer use built in, embeddable stream |
| GPUs, regions and your own cloud | GPUs from L4 to H100 and up; regions on six continents; run in your own cloud account | No GPUs; US or EU processing for Code Interpreter; Agents API can drive a sandbox you host | CPU only; EU only (Germany, Finland, France) |
Every feature Battleships tracks (43)
| Feature | Northflank | OpenAI Containers | boat |
|---|---|---|---|
| Full VM (own kernel) | Yes | Yes | Yes |
| Docker inside | Yes | No | Yes |
| Nested virtualization | No | No | Yes |
| Root | Not published | No | Yes |
| Systemd | Not published | Not published | Yes |
| Desktop GUI | No | Yes | Yes |
| Browser | No | Yes | Yes |
| Computer-use API | No | Yes | Yes |
| SSH | Yes | No | Yes |
| Persistent disk | Yes | No | Yes |
| Pause/resume | Yes | No | Yes |
| Automatic snapshots | Yes | No | Yes |
| Fork/clone | Yes | No | Yes |
| Live fork (no pause) | Yes | No | Yes |
| Memory fork | No | No | No |
| Custom image (Docker or snapshot) | Yes | No | Yes |
| ≥24 h sessions | Yes | Yes | Yes |
| Idle auto-stop | No | Yes | No |
| Wake on request | No | No | No |
| HTTPS preview URLs | Yes | No | Yes |
| Raw TCP inbound | Yes | No | Yes |
| Public IPv4 | No | No | No |
| Egress allowlist | Yes | Yes | No |
| Secret proxy | Yes | Yes | Yes |
| Secret proxy for any API | Yes | Yes | Yes |
| Preinstalled agents | Yes | No | Yes |
| Agent harness API | No | Yes | Yes |
| MCP server | No | No | No |
| GPU | Yes | No | No |
| Windows | No | No | No |
| Arm64 | Yes | No | No |
| Self-hosting | Yes | Yes | No |
| BYOC | Yes | No | No |
| Open source | No | No | No |
| Scoped API keys | Not published | Not published | Yes |
| Spend limits | Not published | Not published | Yes |
| Usage per sandbox (API) | Yes | No | Yes |
| Audit logs | Yes | Not published | No |
| SSO | Yes | Yes | No |
| SOC 2 | Yes | Yes | No |
| HIPAA | Yes | Yes | No |
| EU data residency | Yes | Yes | Yes |
| Zero data retention | Not published | Not published | Yes |
Performance
Neither Northflank Sandboxes nor OpenAI Containers has a comparable CPU measurement: neither is in the hpc-sandbox-benchmarks test, and OpenAI does not publish how many vCPU each container size gets. boat did 26.69 runs per second on that Node.js build-and-test loop at 4 vCPU / 8 GB, on dedicated AMD Ryzen 9 9950X hosts.
Node.js build-and-test loop at 4 vCPU / 8 GB, higher is better. Measured with the open hpc-sandbox-benchmarks suite. Northflank and OpenAI Containers have no published run in this suite yet, so there is no like-for-like number to compare.
Pricing in five scenarios
Each bill is priced from the providers' public price lists by the open Battleships engine, with the cheapest plan that runs the scenario.
| Scenario | Northflank, a month | OpenAI Containers, a month | boat, a month |
|---|---|---|---|
| One coding agent, workdays 4 vCPU / 8 GB, 50 GB disk, 8 hours a day, 22 days a month, files kept between days | $32 · Developer Sandbox (free tier) · with limits | $228 · API pay as you go · with limits | $20 · $20/mo |
| One agent that never stops 4 vCPU / 8 GB, 50 GB disk, running 24/7 all month | $108 · Developer Sandbox (free tier) · with limits | $1,051 · API pay as you go · with limits | $26 · $20/mo |
| 50 agents in parallel 50 machines of 4 vCPU / 8 GB at once, 8-hour sessions, 1,100 sessions a month, Docker inside | $1,322 · Developer Sandbox (free tier) · with limits | $11,405 · API pay as you go · with limits | $317 · $20/mo × 3 seats |
| Sandboxes for your users 2 vCPU / 4 GB, 30,000 sessions of 10 minutes a month, up to 300 at once | $361 · Developer Sandbox (free tier) · with limits | $1,620 · API pay as you go · with limits | $200 · $100/mo × 2 seats |
| 1,000 short jobs at once 2 vCPU / 4 GB, 1,000 at once, 3 minutes each, 200,000 jobs a month | $688 · Developer Sandbox (free tier) · with limits | $6,000 · API pay as you go · with limits | $2,000 · $2000/mo · with limits |
Northflank: Northflank bills per second for the plan size you pick, with no monthly fee, until you pause the sandbox; there is no idle auto-pause. Volumes cost $0.15 per GB a month even while paused, and outbound traffic costs $0.06 per GB.
OpenAI Containers: OpenAI bills each container session by the minute for the memory size you pick, with a 5-minute minimum, and model tokens are billed separately on top. The scenarios use the 16 GB size for 8 GB needs and the 4 GB size for 4 GB needs, since vCPU is not published.
OpenAI Containers: Plans start at $20 a month, and the whole fee is usage credit spent per second on running sandboxes. A stopped sandbox costs nothing and keeps its whole disk.
Limits in those scenarios
On Northflank the limit that bites is what survives a stop: only attached volumes keep their files, so packages installed anywhere else reset. OpenAI Containers fit none of the five scenarios as written: no persistent disk, no Docker, no internet in Code Interpreter until an admin allows domains, and no published vCPU. Neither publishes how many sandboxes can run at once, so 300 or 1,000 at a time is not confirmed. On boat the burst is limited by starts per minute, so even the $2,000 plan queues 1,000 short jobs.
| Scenario | Northflank | OpenAI Containers | boat |
|---|---|---|---|
| One coding agent, workdays |
|
| None that bite |
| One agent that never stops |
|
| None that bite |
| 50 agents in parallel |
|
| None that bite |
| Sandboxes for your users |
|
| None that bite |
| 1,000 short jobs at once |
|
|
|
Which one should you use?
Use Northflank when
you want sandboxes from your own image that run until you pause them, with GPUs, regions outside Europe, or your own cloud account.
- A sandbox you own and keep running. For agents that run for hours: a Northflank sandbox runs your own image until you pause it, with Docker and SSH.
- GPUs and regions around the world. For agents that need a GPU or users far from Europe: Northflank has L4 to H100 cards and regions on six continents.
- Your own cloud, and one platform. For teams that must run in their own AWS, GCP or Azure account, or want apps and sandboxes on one platform.
Use OpenAI Containers when
your app already calls OpenAI models and the model only needs to run short pieces of code or shell commands on files you give it.
- Built into the model call. Useful if your app already calls OpenAI models: one tool line in a request gives the model a place to run code.
- Nothing to manage or clean up. For short code runs: OpenAI creates the container, bills it by the minute, and it expires on its own when idle.
- Locked-down network by default. Useful if code must only reach chosen hosts: Code Interpreter and Hosted Shell have no outbound access until an admin allows domains.
Where boat fits
If your agents work on one machine for hours or days, Northflank makes you plan volumes for every path they touch, and OpenAI Containers forget everything after 20 idle minutes. boat gives each agent a full VM with root, Docker and a whole disk that comes back after every stop, with the agent, a desktop and a browser already inside.
The whole machine comes back
On Northflank a pause wipes everything outside attached volumes, which bill while paused. An OpenAI container discards all data when it expires. boat saves the whole disk every minute and on stop, and a stopped sandbox costs nothing.
Root, Docker and /dev/kvm
OpenAI's hosted shell runs without sudo and documents no Docker, so an agent stops at its first apt install. Northflank runs Docker but documents no /dev/kvm. boat has root, systemd, Docker and /dev/kvm for Android emulators.
Agents, a desktop and ports you can reach
Northflank Harnesses are reached by terminal or SSH and its sandboxes are headless; OpenAI containers take no inbound connections. boat preinstalls seven agents with a prompt and steer API, a 60fps desktop, and HTTPS on 50 ports.
Use boat when your agents work on one machine for hours or days and should find it as they left it: root, Docker, emulators, a desktop and a browser, with the agent driven from your code. Compare it one to one: boat vs Northflank and boat vs OpenAI Containers.
Questions people ask
Is Northflank cheaper than OpenAI Containers?
In all five scenarios on this page, yes: one agent that never stops is $108 a month on Northflank against $1,051 on OpenAI, and boat is $26. OpenAI also bills model tokens on top.
Which is faster?
There is no comparable CPU measurement for either one, and OpenAI does not publish the vCPU behind each container size. boat did 26.69 runs per second on the hpc-sandbox-benchmarks Node.js loop at 4 vCPU / 8 GB.
Can Northflank or OpenAI Containers run Docker?
A Northflank sandbox has its own kernel, so Docker can run inside. OpenAI's hosted shell runs without sudo and documents no Docker. boat gives root, systemd, Docker and /dev/kvm on every sandbox.
Do they keep files between sessions?
Northflank keeps only files on attached volumes when you pause; the rest of the disk resets. An OpenAI container discards its data when it expires after 20 minutes without use. boat keeps the whole disk on every stop.
Can I open a web app running inside the sandbox?
On Northflank, yes, through HTTPS ports on a code.run domain. OpenAI containers have no ports, URLs or SSH. boat gives each sandbox HTTPS URLs for up to 50 ports, raw TCP and SSH.
Does either one have GPUs?
Northflank has GPU sandboxes under gVisor with cards from L4 to H100 and more. OpenAI Containers and boat run on CPUs only.
Try boat
Install the CLI, then run boat new.
7-day free trial