Northflank vs Railway
Both are app platforms that now run agent sandboxes as VMs with their own kernel. A Northflank sandbox runs until you pause it and keeps only its attached volumes, with GPUs and many regions, while a Railway sandbox bills for the CPU it uses and is destroyed once it sits idle.
The companies and products
Northflank
Northflank is a London developer platform for running services, jobs and databases on Kubernetes, and Sandboxes is its product for running untrusted code.
A Northflank sandbox is a container image deployed as a service: CPU sandboxes run in Kata microVMs with their own kernel, and GPU sandboxes run under gVisor. You create and drive them from the JavaScript or Python SDK, the CLI or the dashboard, on Northflank's cloud or inside your own. It suits teams that already want one platform for apps, databases, GPUs and sandboxes.
Railway
Railway is a cloud platform for deploying web apps, servers and databases, which now also sells sandboxes and cloud agents.
Railway's main product is app hosting: you deploy services and databases as containers on its own hardware. In 2026 it added Sandboxes, isolated Linux VMs you create from the CLI or a TypeScript SDK, run commands in and destroy, and Cloud Agents, a personal VM for running a coding agent, in early access. It suits teams already hosting on Railway who want throwaway machines next to their apps.
Which use cases each one fits
For each use case, Battleships prices every sandbox provider on the same workload and sorts them from the cheapest monthly bill up. “38th cheapest of 377” means 37 of the other 376 providers run that workload, with every feature it needs, for less. “With limits” means the provider runs it but misses something, so it is listed after every full match. Open a use case for its whole ranking and what each provider misses.
| Use case and its workload | Northflank: price rank | Railway: price rank | boat: price rank |
|---|---|---|---|
| Software factory 100 at once · 4 vCPU / 8 GB · 2,200 sessions of 8 h a month A coding agent installs packages all over the machine: Northflank keeps only attached volumes after a pause and Railway destroys an idle sandbox, while boat keeps the whole disk and ranks 3rd of 367. | 159th of 367, with limits $1,477 a month | 51st of 367, with limits $342 a month | 3rd cheapest of 367 $634 a month |
| Always-on AI employees 50 machines 24/7 · 2 vCPU / 4 GB Railway fits an always-on assistant if you set the idle timeout to 0, though memory bills the whole time; on Northflank a pause resets everything outside volumes. | 173rd of 366, with limits $1,365 a month | 16th cheapest of 366 $3,977 a month | 5th cheapest of 366 $657 a month |
| Code interpreter bursts 100 at once · 1 vCPU / 2 GB · 200,000 sessions of 1 min a month Short code runs suit both: Northflank has per-second plans from a tenth of a vCPU, and Railway bills for CPU used and destroys the sandbox when the job ends. | 84th of 345, with limits $115 a month | 36th cheapest of 345 $413 a month | 186th of 345, with limits $2,000 a month |
| Sandboxes for your users 300 at once · 2 vCPU / 4 GB · 30,000 sessions of 23 min a month Railway allows 100 sandboxes per environment on Pro and Northflank does not publish a limit, so 300 at once is not confirmed on either; boat ranks 1st of 361. | 89th of 361, with limits $815 a month | 42nd of 361, with limits $290 a month | Cheapest of 361 $209 a month |
| RL rollouts 1,000 at once · 2 vCPU / 4 GB · 1,000,000 sessions of 3 min a month | 342nd of 360, with limits $1,762 a month | 78th of 360, with limits $4,450 a month | 34th of 360, with limits $2,000 a month |
| Agent evals 250 at once · 4 vCPU / 8 GB · 15,000 sessions of 20 min a month | 134th of 364, with limits $689 a month | 108th of 364, with limits $364 a month | 10th cheapest of 364 $200 a month |
| CI runners 40 at once · 8 vCPU / 16 GB · 6,000 sessions of 12 min a month Both fit CI, and Northflank ranks higher here; Railway's sandbox docs do not mention Docker, and boat adds /dev/kvm for emulators and free stops. | 38th cheapest of 377 $352 a month | 113th cheapest of 377 $1,210 a month | 4th cheapest of 377 $86 a month |
| 24/7 dev boxes 1 machine 24/7 · 4 vCPU / 8 GB Railway's Cloud Agents keep a disk and sleep or wake but are early access; a Northflank sandbox bills its full plan until you pause it. | 151st of 368, with limits $59 a month | 66th cheapest of 368 $89 a month | 18th cheapest of 368 $26 a month |
| Computer-use agents 50 at once · 4 vCPU / 8 GB · 20,000 sessions of 15 min a month Both are headless, with no desktop to stream or drive, so computer-use agents are a compromise on each; boat ships a 60fps desktop with Chromium. | 151st of 369, with limits $371 a month | 77th of 369, with limits $103 a month | 6th cheapest of 369 $200 a month |
| Browser-use agents 50 at once · 2 vCPU / 4 GB · 30,000 sessions of 10 min a month | 200th of 367, with limits $194 a month | 53rd of 367, with limits $93 a month | 7th cheapest of 367 $200 a month |
| Scraping & bots (startup scale) 50 at once · 1 vCPU / 2 GB · 100,000 sessions of 3 min a month | 196th of 346, with limits $117 a month | 60th cheapest of 346 $570 a month | 6th cheapest of 346 $90 a month |
| Mass scraping & bots (undetectable) 1,000 at once · 1 vCPU / 2 GB · 3,000,000 sessions of 2 min a month | 83rd of 338, with limits $2,049 a month | 109th of 338, with limits $2,988 a month | 71st of 338, with limits $1,800 a month |
| Parallel red teaming 200 at once · 2 vCPU / 4 GB · 5,000 sessions of 30 min a month | 141st of 360, with limits $99 a month | 43rd of 360, with limits $574 a month | 2nd cheapest of 360 $200 a month |
| GPU eval jobs 10 at once · 8 vCPU / 32 GB · 500 sessions of 30 min a month Northflank has GPU sandboxes from L4 to H100 and up; Railway and boat have no GPUs. | 4th cheapest of 98 $693 a month | Can't run it | Can't run it |
| macOS agents 5 at once · 4 vCPU / 8 GB · 1,000 sessions of 20 min a month | Can't run it | Can't run it | Can't run it |
Key features
| Feature | Northflank | Railway | boat |
|---|---|---|---|
| Isolation | Kata microVM with its own kernel for CPU; gVisor for GPU | Sandboxes are isolated Linux VMs; app services are containers | Full VM with its own kernel on dedicated AMD Ryzen 9 9950X hosts |
| When the sandbox sits idle | Keeps running and billing its full plan until you pause it; no idle auto-pause | Destroyed after the idle timeout, 30 minutes by default, or never if set to 0 | You stop it; a stopped sandbox costs nothing and keeps its disk |
| What survives a stop | Only attached volumes, billed while paused; the rest of the disk and all processes reset | Only the checkpoints you take; the sandbox itself is gone | The whole disk, saved every minute and on stop |
| Snapshots and fork | Filesystem snapshots of a running sandbox, opt-in; restore into a new one | Fork a running sandbox's filesystem; named disk checkpoints to boot new ones | Automatic disk snapshots; fork a running sandbox |
| Docker and nested virtualization | Own kernel, so Docker can run; /dev/kvm not documented inside a sandbox | Root shell on Ubuntu; the sandbox docs do not mention Docker or /dev/kvm | Docker, root, systemd and /dev/kvm on every machine |
| Desktop and computer use | Headless; access by SDK, browser terminal or SSH | Headless: terminal, exec and SSH only | 60fps Linux desktop, Chromium and computer use built in, embeddable stream |
| Coding agents | Harnesses with Claude Code, Codex, Cursor, OpenCode or Pi; you reach the agent through a terminal or SSH | Claude Code, Codex, OpenCode and Pi preinstalled; you run them headless through exec | Seven agents preinstalled, with a prompt, steer and events API |
| Keeping API keys out of the sandbox | Header injection for listed hosts in the network policy API; otherwise env vars or files | Environment variables in the sandbox, or signed in and saved in a checkpoint | Credentials proxy for model providers and any HTTPS API; switch a credential to another account when credits run out |
| Inbound access | HTTPS ports on a code.run domain, private by default; public TCP and UDP need a separate load balancer | Up to 10 public HTTPS domains, set only at creation; SSH and port forwarding | HTTPS URLs for up to 50 ports, token-protected by default; raw TCP; dedicated IPv4 or IPv6 |
| Outbound rules | Network policies with allow lists by IP, CIDR or domain | No sandbox egress allowlist | Open internet, no provider-side allowlist |
| Biggest sandbox | Up to 20 vCPU / 40 GB, more on request; a resize restarts the sandbox | 8 vCPU / 8 GB on Hobby, 32 vCPU / 32 GB on Pro | 8 vCPU / 16 GB on the $20 plan, 16 vCPU / 32 GB from $100 |
| Sandboxes at once | Limit not published | 50 per environment on Hobby, 100 on Pro; Enterprise can ask for more | 100 to 2,000 by plan |
| GPUs | L4, A100, H100, RTX PRO 6000 and more, billed per hour | No | No |
| Regions | US, Canada, Brazil, UK, EU, Switzerland, Asia, Australia and South Africa | US West, US East, Amsterdam and Singapore | EU only: Germany, Finland, France |
Every feature Battleships tracks (43)
| Feature | Northflank | Railway | boat |
|---|---|---|---|
| Full VM (own kernel) | Yes | Yes | Yes |
| Docker inside | Yes | Not published | Yes |
| Nested virtualization | No | No | Yes |
| Root | Not published | Yes | Yes |
| Systemd | Not published | Not published | Yes |
| Desktop GUI | No | No | Yes |
| Browser | No | Yes | Yes |
| Computer-use API | No | No | Yes |
| SSH | Yes | Yes | Yes |
| Persistent disk | Yes | Yes | Yes |
| Pause/resume | Yes | Yes | Yes |
| Automatic snapshots | Yes | No | Yes |
| Fork/clone | Yes | Yes | Yes |
| Live fork (no pause) | Yes | Yes | Yes |
| Memory fork | No | No | No |
| Custom image (Docker or snapshot) | Yes | Yes | Yes |
| ≥24 h sessions | Yes | Yes | Yes |
| Idle auto-stop | No | Yes | No |
| Wake on request | No | No | No |
| HTTPS preview URLs | Yes | Yes | Yes |
| Raw TCP inbound | Yes | No | Yes |
| Public IPv4 | No | No | No |
| Egress allowlist | Yes | No | No |
| Secret proxy | Yes | No | Yes |
| Secret proxy for any API | Yes | No | Yes |
| Preinstalled agents | Yes | Yes | Yes |
| Agent harness API | No | Yes | Yes |
| MCP server | No | Yes | No |
| GPU | Yes | No | No |
| Windows | No | No | No |
| Arm64 | Yes | No | No |
| Self-hosting | Yes | No | No |
| BYOC | Yes | Yes | No |
| Open source | No | No | No |
| Scoped API keys | Not published | Not published | Yes |
| Spend limits | Not published | Yes | Yes |
| Usage per sandbox (API) | Yes | No | Yes |
| Audit logs | Yes | Yes | No |
| SSO | Yes | Yes | No |
| SOC 2 | Yes | Yes | No |
| HIPAA | Yes | Yes | No |
| EU data residency | Yes | Yes | Yes |
| Zero data retention | Not published | Not published | Yes |
Performance
There is no comparable CPU measurement for Northflank or Railway: neither has a result on the hpc-sandbox-benchmarks test, so we cannot say which of the two is faster. boat did 26.69 runs per second on that Node.js build-and-test loop at 4 vCPU / 8 GB, on dedicated AMD Ryzen 9 9950X hosts.
Node.js build-and-test loop at 4 vCPU / 8 GB, higher is better. Measured with the open hpc-sandbox-benchmarks suite. Northflank and Railway have no published run in this suite yet, so there is no like-for-like number to compare.
Pricing in five scenarios
Each bill is priced from the providers' public price lists by the open Battleships engine, with the cheapest plan that runs the scenario.
| Scenario | Northflank, a month | Railway, a month | boat, a month |
|---|---|---|---|
| One coding agent, workdays 4 vCPU / 8 GB, 50 GB disk, 8 hours a day, 22 days a month, files kept between days | $32 · Developer Sandbox (free tier) · with limits | $16 · Hobby · with limits | $20 · $20/mo |
| One agent that never stops 4 vCPU / 8 GB, 50 GB disk, running 24/7 all month | $108 · Developer Sandbox (free tier) · with limits | $70 · Hobby · with limits | $26 · $20/mo |
| 50 agents in parallel 50 machines of 4 vCPU / 8 GB at once, 8-hour sessions, 1,100 sessions a month, Docker inside | $1,322 · Developer Sandbox (free tier) · with limits | $739 · Hobby · with limits | $317 · $20/mo × 3 seats |
| Sandboxes for your users 2 vCPU / 4 GB, 30,000 sessions of 10 minutes a month, up to 300 at once | $361 · Developer Sandbox (free tier) · with limits | $223 · Pro · with limits | $200 · $100/mo × 2 seats |
| 1,000 short jobs at once 2 vCPU / 4 GB, 1,000 at once, 3 minutes each, 200,000 jobs a month | $688 · Developer Sandbox (free tier) · with limits | $781 · Pro · with limits | $2,000 · $2000/mo · with limits |
Northflank: Northflank bills per second for the plan size you pick, with no monthly fee, until you pause the sandbox; there is no idle auto-pause. Volumes cost $0.15 per GB a month even while paused, and outbound traffic costs $0.06 per GB.
Railway: Railway bills sandboxes per second at $50 per vCPU-month on CPU actually used and $50 per GB-month on memory in use, which keeps billing while a sandbox waits. The Hobby ($5) and Pro ($20) fees count toward usage, and Railway publishes no sandbox disk price, so our bills leave disk out.
Railway: Plans start at $20 a month, and the whole fee is usage credit spent per second on running sandboxes. A stopped sandbox costs nothing and keeps its whole disk.
Limits in those scenarios
On Northflank the limit that bites in the agent scenarios is what survives a stop: only attached volumes keep their files, so packages installed anywhere else reset, and it does not publish how many sandboxes can run at once. Railway is marked as a different kind of product with no published disk price, and it caps sandboxes per environment, 100 on Pro, so 300 user sandboxes or 1,000 jobs at once need several environments or an Enterprise limit. On boat, the 1,000-job burst is queued above 90 starts a minute and needs more starts per day than the $2,000 plan allows.
| Scenario | Northflank | Railway | boat |
|---|---|---|---|
| One coding agent, workdays |
|
| None that bite |
| One agent that never stops |
|
| None that bite |
| 50 agents in parallel |
|
| None that bite |
| Sandboxes for your users |
|
| None that bite |
| 1,000 short jobs at once |
|
|
|
Which one should you use?
Use Northflank when
you need GPUs next to the agent, regions outside the US and Europe, outbound allow lists, or sandboxes inside your own cloud account.
- GPU sandboxes. For agents that train, fine-tune or run models: Northflank has GPU sandboxes from L4 to H100 and up, and Railway has none.
- Regions around the world. For users far from the US and Europe: Northflank also runs in Canada, Brazil, Asia, Australia and South Africa.
- Your own cloud and outbound rules. For teams that must run in their own AWS, GCP or Azure account, or limit where sandboxes may connect.
Use Railway when
your app and databases already live on Railway and you want short-lived sandboxes on the same private network that bill for the CPU they use.
- Short jobs that bill for CPU used. For many quick code runs: a Railway sandbox bills for the CPU it uses and is gone when the job ends.
- Lower bills for most of these jobs. For steady agent work: Railway's bills are lower than Northflank's in four of the five scenarios here, though they leave out disk.
- Sandboxes next to your Railway apps. For apps already on Railway: a sandbox can join the same private network as your Postgres and services.
Where boat fits
If your agents work on one machine for hours or days, look at boat. Northflank and Railway are app platforms that added sandboxes, and on both a stopped or idle sandbox loses most of what the agent built. boat gives each agent a full VM that keeps its whole disk, with Docker, /dev/kvm, a desktop and coding agents you drive from your code.
The whole machine comes back
A Northflank pause wipes everything outside attached volumes, and Railway destroys a sandbox after 30 idle minutes unless you take checkpoints or set the timeout to 0, which keeps memory billing. boat saves the whole disk every minute and stops for free.
Agents you drive from outside
Northflank Harnesses hand you a terminal or SSH, and Railway runs agents headless through exec with the API key inside the VM. boat adds a prompt, steer and events API, and its credentials proxy keeps real keys outside the sandbox.
A desktop, Docker and KVM
Both are headless, neither documents /dev/kvm, and Railway's sandbox docs do not mention Docker. A browser or emulator agent there means building and streaming your own desktop. boat ships a 60fps desktop, Chromium, Docker and /dev/kvm.
Use boat when your agents work for hours or days and should find the machine as they left it: a full VM with Docker, /dev/kvm, a desktop and coding agents you drive by API while their keys stay outside. Compare it one to one: boat vs Northflank and boat vs Railway.
Questions people ask
Is Northflank cheaper than Railway?
Mostly no. Railway comes out lower in four of the five scenarios: one agent that never stops is $70 on Railway against $108 on Northflank, and 50 agents in parallel are $739 against $1,322. Northflank is lower for 1,000 short jobs at once ($688 against $781), and Railway's numbers leave out disk, which it does not price.
Which is faster, Northflank or Railway?
We cannot say: neither has a result on the public hpc-sandbox-benchmarks CPU test. boat did 26.69 runs per second on it at 4 vCPU / 8 GB.
Can Northflank or Railway run Docker?
A Northflank CPU sandbox is a Kata microVM with its own kernel, so Docker can run inside. Railway's sandbox docs give you a root shell on Ubuntu but do not mention Docker. boat has Docker, systemd and /dev/kvm on every machine.
What happens to a sandbox when it goes idle?
A Northflank sandbox keeps running and billing until you pause it, and a pause keeps only attached volumes. Railway destroys an idle sandbox after its timeout, 30 minutes by default, unless you set it to 0. A boat sandbox stops, keeps its whole disk and costs nothing while stopped.
Do Northflank or Railway have GPUs?
Northflank has GPU sandboxes under gVisor with cards from L4 to H100 and more, billed per hour. Railway has no GPUs, and boat runs on CPUs only.
Where do they run?
Northflank runs in the US, Canada, Brazil, the UK, the EU, Switzerland, Asia, Australia and South Africa, fixed per project. Railway has California, Virginia, Amsterdam and Singapore. boat runs only in the EU (Germany, Finland and France), with EU data residency.
Try boat
Install the CLI, then run boat new.
7-day free trial