Railway vs Deno Sandbox
Railway is an app platform whose sandboxes are Linux VMs up to 32 vCPU that live until their idle timeout. Deno Sandbox runs small Firecracker microVMs that start in under 200 ms, live up to 30 minutes and can be limited to a list of hosts.
The companies and products
Railway
Railway is a cloud platform for deploying web apps, servers and databases, which now also sells sandboxes and cloud agents.
Railway's main product is app hosting: you deploy services and databases as containers on its own hardware. In 2026 it added Sandboxes, isolated Linux VMs you create from the CLI or a TypeScript SDK, run commands in and destroy, and Cloud Agents, a personal VM for running a coding agent, in early access. It suits teams already hosting on Railway who want throwaway machines next to their apps.
Deno Sandbox
Deno Sandbox is part of Deno Deploy, the hosting platform from the company behind the Deno runtime, and runs untrusted or AI-generated code in Linux microVMs.
Each sandbox is a Firecracker microVM with 2 vCPU, up to 4 GB of memory and a 10 GB disk that is wiped when it ends, created from a TypeScript or Python SDK. Outbound traffic goes through a proxy that can enforce a host allowlist and swap placeholder secrets for real ones. It is built for short runs of agent or user code, and a sandbox can be promoted to a Deno Deploy app.
- Isolation
- Firecracker microVM per sandbox
Which use cases each one fits
For each use case, Battleships prices every sandbox provider on the same workload and sorts them from the cheapest monthly bill up. “16th cheapest of 366” means 15 of the other 365 providers run that workload, with every feature it needs, for less. “With limits” means the provider runs it but misses something, so it is listed after every full match. Open a use case for its whole ranking and what each provider misses.
| Use case and its workload | Railway: price rank | Deno Sandbox: price rank | boat: price rank |
|---|---|---|---|
| Software factory 100 at once · 4 vCPU / 8 GB · 2,200 sessions of 8 h a month A software factory runs builds for hours, which outlasts Deno's 30-minute lifetime; Railway can run that long but destroys an idle sandbox, while boat keeps the whole disk. | 51st of 367, with limits $342 a month | 290th of 367, with limits $5,665 a month | 3rd cheapest of 367 $634 a month |
| Always-on AI employees 50 machines 24/7 · 2 vCPU / 4 GB An always-on assistant fits Railway with the idle timeout set to 0 or a Cloud Agent, but not Deno, whose sandboxes end after 30 minutes. | 16th cheapest of 366 $3,977 a month | 287th of 366, with limits $5,803 a month | 5th cheapest of 366 $657 a month |
| Code interpreter bursts 100 at once · 1 vCPU / 2 GB · 200,000 sessions of 1 min a month Short code runs are where Deno shines, with starts under 200 ms and CPU billed only while code runs; Railway also bills CPU used and destroys the sandbox when done. | 36th cheapest of 345 $413 a month | 141st of 345, with limits $329 a month | 186th of 345, with limits $2,000 a month |
| Sandboxes for your users 300 at once · 2 vCPU / 4 GB · 30,000 sessions of 23 min a month Deno Builder allows 20 sandboxes at once per region and Railway Pro 100 per environment, so 300 user sandboxes need several environments or a custom limit on either. | 42nd of 361, with limits $290 a month | 148th of 361, with limits $1,863 a month | Cheapest of 361 $209 a month |
| RL rollouts 1,000 at once · 2 vCPU / 4 GB · 1,000,000 sessions of 3 min a month | 78th of 360, with limits $4,450 a month | 122nd of 360, with limits $7,963 a month | 34th of 360, with limits $2,000 a month |
| Agent evals 250 at once · 4 vCPU / 8 GB · 15,000 sessions of 20 min a month | 108th of 364, with limits $364 a month | 296th of 364, with limits $1,563 a month | 10th cheapest of 364 $200 a month |
| CI runners 40 at once · 8 vCPU / 16 GB · 6,000 sessions of 12 min a month CI jobs that build containers need Docker, which neither Railway's nor Deno's sandbox docs mention and boat documents on every machine. | 113th cheapest of 377 $1,210 a month | 304th of 377, with limits $731 a month | 4th cheapest of 377 $86 a month |
| 24/7 dev boxes 1 machine 24/7 · 4 vCPU / 8 GB A dev box that stays on all month rules out Deno's 30-minute cap; Railway's Cloud Agents keep a disk but are early access and fixed at 4 vCPU / 4 GB on Pro. | 66th cheapest of 368 $89 a month | 179th of 368, with limits $200 a month | 18th cheapest of 368 $26 a month |
| Computer-use agents 50 at once · 4 vCPU / 8 GB · 20,000 sessions of 15 min a month Neither Railway nor Deno has a desktop to stream or drive, while boat ships a 60fps Linux desktop with Chromium for computer use. | 77th of 369, with limits $103 a month | 280th of 369, with limits $1,583 a month | 6th cheapest of 369 $200 a month |
| Browser-use agents 50 at once · 2 vCPU / 4 GB · 30,000 sessions of 10 min a month | 53rd of 367, with limits $93 a month | 284th of 367, with limits $783 a month | 7th cheapest of 367 $200 a month |
| Scraping & bots (startup scale) 50 at once · 1 vCPU / 2 GB · 100,000 sessions of 3 min a month | 60th cheapest of 346 $570 a month | 286th of 346, with limits $573 a month | 6th cheapest of 346 $90 a month |
| Mass scraping & bots (undetectable) 1,000 at once · 1 vCPU / 2 GB · 3,000,000 sessions of 2 min a month | 109th of 338, with limits $2,988 a month | 247th of 338, with limits $11,923 a month | 71st of 338, with limits $1,800 a month |
| Parallel red teaming 200 at once · 2 vCPU / 4 GB · 5,000 sessions of 30 min a month Parallel red teaming needs many machines at once; Deno Builder stops at 20 per region and Railway at 100 per environment on Pro. | 43rd of 360, with limits $574 a month | 251st of 360, with limits $367 a month | 2nd cheapest of 360 $200 a month |
| GPU eval jobs 10 at once · 8 vCPU / 32 GB · 500 sessions of 30 min a month | Can't run it | Can't run it | Can't run it |
| macOS agents 5 at once · 4 vCPU / 8 GB · 1,000 sessions of 20 min a month | Can't run it | Can't run it | Can't run it |
Key features
| Feature | Railway | Deno Sandbox | boat |
|---|---|---|---|
| Isolation | Sandboxes are isolated Linux VMs; app services are containers | Firecracker microVM with its own kernel | Full VM with its own kernel on dedicated AMD Ryzen 9 9950X hosts |
| Machine size | 8 vCPU / 8 GB on Hobby, up to 32 vCPU / 32 GB on Pro | 2 vCPU fixed, 768 MB to 4 GB memory, 10 GB disk | 4 vCPU / 8 GB by default, 8 vCPU / 16 GB on the $20 plan, 16 vCPU / 32 GB from $100 |
| How long a sandbox lives | Until destroyed or its idle timeout fires (30 minutes by default, or never if set to 0) | Up to 30 minutes; longer work can be promoted to a Deno Deploy app | No cap on paid plans; you set the time to live |
| Files after the sandbox ends | Gone when destroyed; only the disk checkpoints you take survive | Root disk wiped; opt-in volumes of 300 MB to 20 GB, Chicago only | The whole disk is kept, saved every minute and on stop; a stopped sandbox costs nothing |
| Fork and snapshots | Fork a running sandbox's filesystem; named disk checkpoints to boot new ones | Read-only volume snapshots that new sandboxes boot from; no fork of a running sandbox | Fork a running sandbox; automatic and named disk snapshots |
| Docker and nested virtualization | Root shell on Ubuntu; Docker and /dev/kvm not mentioned in the sandbox docs | Root access; Docker and nested virtualization not documented | Docker, root, systemd and /dev/kvm on every machine |
| Desktop and browser | Headless: terminal, exec and SSH only | No desktop; a VS Code editor in the browser and SSH | Linux desktop streamed at 60fps, Chromium and computer use built in |
| Inbound access | Up to 10 public HTTPS domains, set at creation; SSH and port forwarding | HTTPS URL per exposed port, public without authentication; SSH | HTTPS URLs for up to 50 ports, token-protected by default; raw TCP |
| Outbound rules | Open internet; no host allowlist for sandboxes | Host allowlist per sandbox, enforced by a proxy outside the VM | Open internet, no provider-side allowlist |
| Keeping API keys out of the sandbox | Secrets go in as environment variables or a signed-in checkpoint | Placeholder secrets swapped for real ones on requests to approved hosts | Credentials proxy for model providers and any HTTPS API; switch a credential to another account when credits run out |
| Coding agents | Claude Code, Codex, OpenCode and Pi preinstalled, run headless through exec | A root image with Claude Code, run through the shell command API | Seven agents preinstalled, with a prompt, steer and events API |
| Sandboxes at once | 50 per environment on Hobby, 100 on Pro | 3 per region on Pro, 20 on Builder | 100 to 2,000 by plan |
| Start time | Not published | Under 200 ms | Boots a full VM |
| Regions | California, Virginia, Amsterdam and Singapore | Amsterdam and Chicago | EU only: Germany, Finland, France |
Every feature Battleships tracks (43)
| Feature | Railway | Deno Sandbox | boat |
|---|---|---|---|
| Full VM (own kernel) | Yes | Yes | Yes |
| Docker inside | Not published | Not published | Yes |
| Nested virtualization | No | No | Yes |
| Root | Yes | Yes | Yes |
| Systemd | Not published | Not published | Yes |
| Desktop GUI | No | No | Yes |
| Browser | Yes | No | Yes |
| Computer-use API | No | No | Yes |
| SSH | Yes | Yes | Yes |
| Persistent disk | Yes | Yes | Yes |
| Pause/resume | Yes | No | Yes |
| Automatic snapshots | No | No | Yes |
| Fork/clone | Yes | No | Yes |
| Live fork (no pause) | Yes | No | Yes |
| Memory fork | No | No | No |
| Custom image (Docker or snapshot) | Yes | Yes | Yes |
| ≥24 h sessions | Yes | No | Yes |
| Idle auto-stop | Yes | No | No |
| Wake on request | No | No | No |
| HTTPS preview URLs | Yes | Yes | Yes |
| Raw TCP inbound | No | No | Yes |
| Public IPv4 | No | No | No |
| Egress allowlist | No | Yes | No |
| Secret proxy | No | Yes | Yes |
| Secret proxy for any API | No | Yes | Yes |
| Preinstalled agents | Yes | Yes | Yes |
| Agent harness API | Yes | No | Yes |
| MCP server | Yes | No | No |
| GPU | No | No | No |
| Windows | No | No | No |
| Arm64 | No | No | No |
| Self-hosting | No | No | No |
| BYOC | Yes | No | No |
| Open source | No | No | No |
| Scoped API keys | Not published | Not published | Yes |
| Spend limits | Yes | Yes | Yes |
| Usage per sandbox (API) | No | No | Yes |
| Audit logs | Yes | Not published | No |
| SSO | Yes | No | No |
| SOC 2 | Yes | Yes | No |
| HIPAA | Yes | Yes | No |
| EU data residency | Yes | Yes | Yes |
| Zero data retention | Not published | Not published | Yes |
Performance
There is no comparable measurement for Railway or Deno Sandbox. boat did 26.69 Node.js build-and-test runs per second at 4 vCPU / 8 GB in StarSling's public benchmark, but neither of the other two is in it, and Deno's fixed 2 vCPU shape could not run the 4 vCPU test as set up.
Node.js build-and-test loop at 4 vCPU / 8 GB, higher is better. Measured with the open hpc-sandbox-benchmarks suite. Railway and Deno Sandbox have no published run in this suite yet, so there is no like-for-like number to compare.
Pricing in five scenarios
Each bill is priced from the providers' public price lists by the open Battleships engine, with the cheapest plan that runs the scenario.
| Scenario | Railway, a month | Deno Sandbox, a month | boat, a month |
|---|---|---|---|
| One coding agent, workdays 4 vCPU / 8 GB, 50 GB disk, 8 hours a day, 22 days a month, files kept between days | $16 · Hobby · with limits | $53 · Pro · with limits | $20 · $20/mo |
| One agent that never stops 4 vCPU / 8 GB, 50 GB disk, running 24/7 all month | $70 · Hobby · with limits | $200 · Builder · with limits | $26 · $20/mo |
| 50 agents in parallel 50 machines of 4 vCPU / 8 GB at once, 8-hour sessions, 1,100 sessions a month, Docker inside | $739 · Hobby · with limits | $2,779 · Builder · with limits | $317 · $20/mo × 3 seats |
| Sandboxes for your users 2 vCPU / 4 GB, 30,000 sessions of 10 minutes a month, up to 300 at once | $223 · Pro · with limits | $783 · Builder · with limits | $200 · $100/mo × 2 seats |
| 1,000 short jobs at once 2 vCPU / 4 GB, 1,000 at once, 3 minutes each, 200,000 jobs a month | $781 · Pro · with limits | $1,563 · Builder · with limits | $2,000 · $2000/mo · with limits |
Railway: Railway bills sandboxes per second at $50 per vCPU-month on CPU actually used and $50 per GB-month on memory in use, which keeps billing while a sandbox waits. The Hobby ($5) and Pro ($20) fees count toward usage, and sandbox disk has no published price, so our bills leave it out.
Deno Sandbox: Sandboxes need Pro at $20 a month or Builder at $200 a month, whose fees are not credit but include CPU, memory and egress allowances shared with Deno Deploy apps. Past those, CPU costs $0.10 per hour of active CPU time and memory $0.025 per GiB-hour for the whole life of the sandbox.
Deno Sandbox: Plans start at $20 a month, and the whole fee is usage credit spent per second while a sandbox runs. A stopped sandbox costs nothing and keeps its disk.
Limits in those scenarios
Neither fits any of the five scenarios cleanly. Railway is marked as a different kind of product, an app platform with no published sandbox disk price, and caps sandboxes at 100 per environment on Pro. Deno Sandbox is fixed at 2 vCPU / 4 GB, ends every sandbox after 30 minutes and allows 20 at once per region on Builder, short of 50 agents or 300 user sandboxes. boat fits four of the five; at 1,000 short jobs at once it queues starts above 90 a minute and needs more starts per day than its top plan allows.
| Scenario | Railway | Deno Sandbox | boat |
|---|---|---|---|
| One coding agent, workdays |
|
| None that bite |
| One agent that never stops |
|
| None that bite |
| 50 agents in parallel |
|
| None that bite |
| Sandboxes for your users |
|
| None that bite |
| 1,000 short jobs at once |
|
|
|
Which one should you use?
Use Railway when
your apps and databases already live on Railway, you need bigger sandboxes that can stay up for hours, or you want regions in the US and Asia.
- Bigger machines that can stay up. Useful for heavy builds: Railway Pro sandboxes go up to 32 vCPU / 32 GB and can run with no idle timeout.
- Your apps and databases in one place. Useful if your app already runs on Railway: sandboxes can join the private network of your Postgres and services.
- Fork a running sandbox. Useful for trying many paths at once: Railway can fork a running sandbox's filesystem, which Deno Sandbox cannot.
Use Deno Sandbox when
you run short pieces of untrusted code that must start in milliseconds and reach only the hosts you allow, especially if you deploy on Deno Deploy.
- Locked-down outbound traffic. Useful for untrusted code: each sandbox can reach only the hosts you list, enforced by a proxy outside the VM.
- Starts in under 200 ms. Good for one sandbox per request: Deno says a sandbox starts in under 200 ms and CPU bills only while code runs.
- Secrets the code never sees. Useful when agents call paid APIs: the sandbox holds a placeholder, and the real secret is added only for approved hosts.
Where boat fits
If what you are really running is agents that work for hours, look at boat. Railway destroys an idle sandbox and Deno ends one after 30 minutes, while a boat sandbox stops, keeps its whole disk and comes with Docker, a desktop and coding agents you drive from outside.
A disk that stays
A Deno sandbox wipes its root disk after at most 30 minutes, and a Railway sandbox is destroyed at its idle timeout. On boat the disk is saved every minute and a stopped sandbox costs nothing.
Docker, KVM and a desktop
Neither Railway's nor Deno's sandbox docs mention Docker or /dev/kvm, and both are headless. boat has root, systemd, Docker, /dev/kvm and a 60fps desktop with Chromium for computer use on every machine.
Agents you drive from outside
Railway and Deno both make you run Claude Code through shell commands and parse its output. boat's prompt, steer and events API lets your app start an agent, correct it mid-task and stream what it does.
Use boat when your agents work for hours or days: a full VM that keeps its disk, with Docker, /dev/kvm, a desktop, and coding agents you drive from outside while their keys stay outside the sandbox. Compare it one to one: boat vs Railway and boat vs Deno Sandbox.
Questions people ask
Is Railway cheaper than Deno Sandbox?
In our scenarios, Railway comes lower in all five: one agent running all month is $70 on Railway against $200 on Deno, and 50 agents in parallel $739 against $2,779. Railway's bills leave out disk, which it does not price, and neither fits these scenarios cleanly. boat comes to $26 and $317 for the same two.
Which is faster, Railway or Deno Sandbox?
Neither is in StarSling's public CPU benchmark, so we cannot say. Deno says a sandbox starts in under 200 ms, and Railway offers bigger machines, up to 32 vCPU on Pro against Deno's fixed 2 vCPU. boat did 26.69 runs per second in that benchmark at 4 vCPU / 8 GB.
Can Railway or Deno Sandbox run Docker?
Neither provider's sandbox docs say Docker works inside, and neither mentions nested virtualization. boat runs Docker and systemd and exposes /dev/kvm for Android emulators and VMs.
How long can a sandbox run on each?
A Deno sandbox lives up to 30 minutes, and longer work can be promoted to a Deno Deploy app. A Railway sandbox runs until you destroy it or its idle timeout fires, 30 minutes by default, or never if you set it to 0. A boat sandbox has no lifetime cap on paid plans.
Do they keep files when the sandbox ends?
Not by default. Deno wipes the root disk but lets you mount a volume in Chicago, and Railway keeps only the checkpoints you take before it destroys a sandbox. boat keeps the whole disk, saves it every minute and on stop, and charges nothing while it is stopped.
Where do Railway and Deno Sandbox run?
Railway has regions in California, Virginia, Amsterdam and Singapore. Deno Sandbox runs in Amsterdam and Chicago, with volumes only in Chicago. boat runs only in the EU, in Germany, Finland and France.
Try boat
Install the CLI, then run boat new.
7-day free trial