Tensorlake vs Azure Container Apps Sandboxes
Both give each agent a microVM with its own kernel that can suspend with its memory and wake up warm. Tensorlake is a standalone sandbox service with GPUs, a desktop and a bring-your-own-cloud option, while Azure Container Apps Sandboxes lives inside your Azure subscription, with fine-grained egress rules and 40 regions.
The companies and products
Tensorlake
Tensorlake is a San Francisco company that sells infrastructure for AI agents, with sandboxes as its main product.
Tensorlake Sandboxes are microVMs, backed by Firecracker and Cloud Hypervisor, that you create through an API and that boot in a few hundred milliseconds. Named sandboxes suspend when idle and keep their memory and running processes, and you can copy a running sandbox into several warm clones. Around them Tensorlake sells versioned file systems, hosted Git, an orchestration layer and a bring-your-own-cloud option, aimed at teams running coding agents, evals and RL rollouts.
- Headquarters
- San Francisco
- Investors shown
- Redpoint and Amplify Partners
Azure Container Apps Sandboxes
Azure Container Apps Sandboxes is a service inside Microsoft Azure that gives each agent or user an isolated microVM you create, suspend and resume through an SDK.
It is part of Azure Container Apps, the hyperscaler's serverless container platform, and lives in your Azure subscription as a sandbox group resource. Each sandbox boots from an OCI image or a snapshot, has its own kernel, and can be suspended with its memory and resumed in under a second. It is built for teams already on Azure that want stateful code execution with Azure networking, identity and billing.
Which use cases each one fits
For each use case, Battleships prices every sandbox provider on the same workload and sorts them from the cheapest monthly bill up. “5th cheapest of 367” means 4 of the other 366 providers run that workload, with every feature it needs, for less. “With limits” means the provider runs it but misses something, so it is listed after every full match. Open a use case for its whole ranking and what each provider misses.
| Use case and its workload | Tensorlake: price rank | Azure Container Apps Sandboxes: price rank | boat: price rank |
|---|---|---|---|
| Software factory 100 at once · 4 vCPU / 8 GB · 2,200 sessions of 8 h a month Tensorlake fits a full software factory, while Azure is a compromise; boat also fits and adds /dev/kvm for Android emulators and preinstalled coding agents. | 5th cheapest of 367 $1,010 a month | 288th of 367, with limits $5,276 a month | 3rd cheapest of 367 $634 a month |
| Always-on AI employees 50 machines 24/7 · 2 vCPU / 4 GB | 9th cheapest of 366 $1,381 a month | 302nd of 366, with limits $6,544 a month | 5th cheapest of 366 $657 a month |
| Code interpreter bursts 100 at once · 1 vCPU / 2 GB · 200,000 sessions of 1 min a month Both fit short code runs well, since both suspend with memory and wake warm; boat's start-rate limits make big bursts a compromise. | 24th cheapest of 345 $250 a month | 34th cheapest of 345 $354 a month | 186th of 345, with limits $2,000 a month |
| Sandboxes for your users 300 at once · 2 vCPU / 4 GB · 30,000 sessions of 23 min a month Both fit a sandbox per user through an API; boat also gives each one HTTPS URLs on up to 50 ports and raw TCP. | 5th cheapest of 361 $471 a month | 22nd cheapest of 361 $2,260 a month | Cheapest of 361 $209 a month |
| RL rollouts 1,000 at once · 2 vCPU / 4 GB · 1,000,000 sessions of 3 min a month Tensorlake is built for RL rollouts at a thousand at a time, while Azure's default quota of 500 active cores holds a fleet back until support raises it. | Cheapest of 360 $5,637 a month | 153rd of 360, with limits $10,740 a month | 34th of 360, with limits $2,000 a month |
| Agent evals 250 at once · 4 vCPU / 8 GB · 15,000 sessions of 20 min a month | 24th cheapest of 364 $506 a month | 75th cheapest of 364 $1,728 a month | 10th cheapest of 364 $200 a month |
| CI runners 40 at once · 8 vCPU / 16 GB · 6,000 sessions of 12 min a month Both run fresh build machines; boat's Ryzen 9 9950X hosts are the fastest measured on the CPU benchmark, and neither Tensorlake nor Azure is measured. | 54th cheapest of 377 $424 a month | 103rd cheapest of 377 $1,046 a month | 4th cheapest of 377 $86 a month |
| 24/7 dev boxes 1 machine 24/7 · 4 vCPU / 8 GB Both are built around suspending idle sandboxes, so a box that stays on all day fits boat better. | 185th of 368, with limits $250 a month | 322nd of 368, with limits $262 a month | 18th cheapest of 368 $26 a month |
| Computer-use agents 50 at once · 4 vCPU / 8 GB · 20,000 sessions of 15 min a month Tensorlake ships an XFCE desktop with Firefox over VNC, Azure's sandboxes are headless, and boat streams a desktop at 60fps. | 9th cheapest of 369 $294 a month | 279th of 369, with limits $1,573 a month | 6th cheapest of 369 $200 a month |
| Browser-use agents 50 at once · 2 vCPU / 4 GB · 30,000 sessions of 10 min a month Tensorlake has a desktop browser with mouse and keyboard calls, while on Azure you install a headless browser yourself; boat ships Chromium on a desktop. | 13th cheapest of 367 $250 a month | 288th of 367, with limits $795 a month | 7th cheapest of 367 $200 a month |
| Scraping & bots (startup scale) 50 at once · 1 vCPU / 2 GB · 100,000 sessions of 3 min a month | 22nd cheapest of 346 $250 a month | 284th of 346, with limits $561 a month | 6th cheapest of 346 $90 a month |
| Mass scraping & bots (undetectable) 1,000 at once · 1 vCPU / 2 GB · 3,000,000 sessions of 2 min a month | 121st of 338, with limits $3,484 a month | 239th of 338, with limits $10,956 a month | 71st of 338, with limits $1,800 a month |
| Parallel red teaming 200 at once · 2 vCPU / 4 GB · 5,000 sessions of 30 min a month | 4th cheapest of 360 $250 a month | 278th of 360, with limits $517 a month | 2nd cheapest of 360 $200 a month |
| GPU eval jobs 10 at once · 8 vCPU / 32 GB · 500 sessions of 30 min a month | Can't run it | Can't run it | Can't run it |
| macOS agents 5 at once · 4 vCPU / 8 GB · 1,000 sessions of 20 min a month | Can't run it | Can't run it | Can't run it |
Key features
| Feature | Tensorlake | Azure Container Apps Sandboxes | boat |
|---|---|---|---|
| Isolation | Firecracker and Cloud Hypervisor microVMs with their own kernel; GPU sandboxes use gVisor | MicroVM per sandbox with its own kernel | Full VM with its own kernel on dedicated AMD Ryzen 9 9950X hosts |
| Nested virtualization | No: sandboxes set SANDBOX_KVM_AVAILABLE=0 | Not documented | Yes, /dev/kvm inside, so Android emulators and VMs run |
| Docker inside | Yes, on the tensorlake/ubuntu-systemd image | Depends on the image: azure-dev ships Docker on systemd; the default ubuntu image has only Buildah | Docker, systemd and root on every sandbox |
| Memory suspend and resume | Named sandboxes suspend with memory and running processes and restore warm | Suspend with memory and disk; resume in under a second with processes running | Disk is saved every minute and on stop; resume boots the machine again |
| Clone a running sandbox | Copy a running or suspended sandbox into N warm clones with memory | Snapshot a running sandbox with its memory and create new sandboxes from it | Fork a running sandbox with its disk |
| Idle handling | Idle timeout, 600 s by default, then suspend (named) or terminate (ephemeral) | Auto-suspend after 300 s idle by default; network traffic or a start command wakes it | Time-to-live you set (1 h by default, changeable or off); a stopped sandbox costs nothing |
| Desktop and computer use | XFCE desktop with Firefox over VNC, with screenshot, mouse and keyboard calls | Headless; no desktop or managed browser | 60fps desktop and Chromium, computer-use and browser control, embeddable stream |
| Coding agents | You bring and run your own agent; managed images are plain OS bases | Copilot CLI and Claude Code images, run through the exec API | Claude Code, Codex, OpenCode and more preinstalled, with a prompt, steer and events API |
| API keys | Stored secrets are injected into the sandbox | Group secrets usable in egress header transforms; Copilot and Anthropic tokens are injected at startup | Credentials proxy: real keys for models and any HTTPS API stay outside the sandbox |
| Inbound traffic | HTTP, WebSocket and gRPC through an authenticated proxy on exposed ports | Public HTTPS routes per published port; private endpoint from your VNet; no public IP | HTTPS URLs for up to 50 ports, token-protected, plus raw TCP and a dedicated IP per machine |
| Outbound rules | allow_out and deny_out lists by domain, IP or CIDR, or no internet at all | Egress policy with allow, deny, rewrite and header rules by host, path and method; VNet integration | No provider-side allowlist; you set your own firewall as root |
| GPUs | GPU sandboxes by request (H100 shown in the docs) | None | None |
| Scaling a fleet | Pro allows 1,000 sandboxes at once; Enterprise has no set limit | 500 concurrent active cores by default; more by Azure support request | Concurrency set by plan, up to 2,000 sandboxes, self-serve |
| Where it runs | US and EU, or your own cloud account through BYOC | 40 Azure regions, 9 of them in the EU, inside your Azure subscription | EU only: Germany, Finland, France |
Every feature Battleships tracks (43)
| Feature | Tensorlake | Azure Container Apps Sandboxes | boat |
|---|---|---|---|
| Full VM (own kernel) | Yes | Yes | Yes |
| Docker inside | Yes | Yes | Yes |
| Nested virtualization | No | No | Yes |
| Root | Yes | Yes | Yes |
| Systemd | Yes | Yes | Yes |
| Desktop GUI | Yes | No | Yes |
| Browser | Yes | No | Yes |
| Computer-use API | Yes | No | Yes |
| SSH | Yes | No | Yes |
| Persistent disk | Yes | Yes | Yes |
| Pause/resume | Yes | Yes | Yes |
| Automatic snapshots | Yes | Yes | Yes |
| Fork/clone | Yes | Yes | Yes |
| Live fork (no pause) | Yes | Yes | Yes |
| Memory fork | Yes | Yes | No |
| Custom image (Docker or snapshot) | Yes | Yes | Yes |
| ≥24 h sessions | Yes | Yes | Yes |
| Idle auto-stop | Yes | Yes | No |
| Wake on request | Yes | Yes | No |
| HTTPS preview URLs | Yes | Yes | Yes |
| Raw TCP inbound | No | No | Yes |
| Public IPv4 | No | No | No |
| Egress allowlist | Yes | Yes | No |
| Secret proxy | No | Yes | Yes |
| Secret proxy for any API | No | Yes | Yes |
| Preinstalled agents | No | Yes | Yes |
| Agent harness API | No | No | Yes |
| MCP server | No | No | No |
| GPU | Yes | No | No |
| Windows | No | No | No |
| Arm64 | No | No | No |
| Self-hosting | No | No | No |
| BYOC | Yes | No | No |
| Open source | No | No | No |
| Scoped API keys | Not published | Not published | Yes |
| Spend limits | Not published | Yes | Yes |
| Usage per sandbox (API) | No | Yes | Yes |
| Audit logs | Not published | Yes | No |
| SSO | Yes | Yes | No |
| SOC 2 | Yes | Yes | No |
| HIPAA | Yes | Yes | No |
| EU data residency | Yes | Yes | Yes |
| Zero data retention | Yes | Not published | Yes |
Performance
boat scores 26.69 runs/s on the StarSling hpc-sandbox-benchmarks Node.js build-and-test loop at 4 vCPU / 8 GB, on dedicated AMD Ryzen 9 9950X hosts. Neither Tensorlake nor Azure Container Apps Sandboxes has a result on this benchmark, so there is no comparable CPU measurement between the three.
Node.js build-and-test loop at 4 vCPU / 8 GB, higher is better. Measured with the open hpc-sandbox-benchmarks suite. Tensorlake and Azure Container Apps Sandboxes have no published run in this suite yet, so there is no like-for-like number to compare.
Pricing in five scenarios
Each bill is priced from the providers' public price lists by the open Battleships engine, with the cheapest plan that runs the scenario.
| Scenario | Tensorlake, a month | Azure Container Apps Sandboxes, a month | boat, a month |
|---|---|---|---|
| One coding agent, workdays 4 vCPU / 8 GB, 50 GB disk, 8 hours a day, 22 days a month, files kept between days | $250 · Pro | $68 · Pay-as-you-go | $20 · $20/mo |
| One agent that never stops 4 vCPU / 8 GB, 50 GB disk, running 24/7 all month | $250 · Pro | $262 · Pay-as-you-go · with limits | $26 · $20/mo |
| 50 agents in parallel 50 machines of 4 vCPU / 8 GB at once, 8-hour sessions, 1,100 sessions a month, Docker inside | $1,030 · Pro | $3,421 · Pay-as-you-go | $317 · $20/mo × 3 seats |
| Sandboxes for your users 2 vCPU / 4 GB, 30,000 sessions of 10 minutes a month, up to 300 at once | $293 · Pro | $989 · Pay-as-you-go | $200 · $100/mo × 2 seats |
| 1,000 short jobs at once 2 vCPU / 4 GB, 1,000 at once, 3 minutes each, 200,000 jobs a month | $1,127 · Pro | $2,148 · Pay-as-you-go | $2,000 · $2000/mo · with limits |
Tensorlake: Pro is $250 per billing cycle, which includes 25,000 CU of usage, then $0.01 per CU. CPU is billed only while it is actively working, RAM and disk on what you allocate while the sandbox runs, and a suspended sandbox pays snapshot storage.
Tensorlake: Small users can skip Pro and buy prepaid Usage Credits packs from $5 at higher rates, with no overage. The table prices the Pro path, so it overstates very small workloads.
Azure Container Apps Sandboxes: Azure bills per second on the Container Apps Consumption meters for the vCPU and memory of the sandbox's tier while it runs, idle time before auto-suspend included. There is no plan fee, and some regions such as West Europe and UK South charge more per second.
Azure Container Apps Sandboxes: Plans start at $20 a month, and the whole fee becomes usage credit. Running time is billed per second, and a stopped sandbox costs nothing while its disk is kept.
Limits in those scenarios
Azure has no plan fee, so one coding agent on workdays is $68 a month on Azure against $250 on Tensorlake Pro, whose fee is the floor. For bigger loads Tensorlake costs less: 50 agents in parallel is $1,030 on Tensorlake and $3,421 on Azure. Azure's always-on scenario only gets close with a 3-year savings plan commitment, and its default quota of 500 active cores caps a fleet until support raises it. boat's limit that bites is its start rate: 1,000 short jobs at once does not fit, while both Tensorlake and Azure fit it.
| Scenario | Tensorlake | Azure Container Apps Sandboxes | boat |
|---|---|---|---|
| One coding agent, workdays | None that bite | None that bite | None that bite |
| One agent that never stops | None that bite |
| None that bite |
| 50 agents in parallel | None that bite | None that bite | None that bite |
| Sandboxes for your users | None that bite | None that bite | None that bite |
| 1,000 short jobs at once | None that bite | None that bite |
|
Which one should you use?
Use Tensorlake when
you fan out about a thousand short rollouts at once from one warm state, need GPU sandboxes, a desktop for computer use, or sandboxes in your own cloud account.
- GPUs and your own cloud. For teams that need GPUs or their own cloud account: Tensorlake offers GPU sandboxes by request and BYOC on AWS, GCP, Azure and more.
- A desktop for computer use. Computer-use agents get an XFCE desktop with Firefox over VNC, while Azure's sandboxes are headless.
- Large fleets without a support ticket. For RL rollouts and big evals: Pro runs 1,000 sandboxes at once, where Azure starts at 500 active cores.
Use Azure Container Apps Sandboxes when
your team already runs on Azure and wants short stateful sandboxes that wake on traffic, sit behind strict egress rules, or run in one of 40 regions.
- It lives in your Azure account. Teams already on Azure get Entra ID, Azure billing and VNets, with no new vendor to sign up.
- Fine-grained outbound rules. Its egress policy can allow, deny or rewrite each outbound HTTP request by host, path and method.
- 40 regions and wake on traffic. It runs in 40 Azure regions, and an idle sandbox wakes on incoming traffic in under a second.
Where boat fits
Tensorlake and Azure are both built for short, stateful jobs that sleep and wake with their memory. If your agents instead work for hours on real projects, with installs, Docker, emulators, a browser and hosted services, boat gives each one a whole VM that stays on with no session cap on paid plans.
Emulators and VMs inside
Tensorlake sets SANDBOX_KVM_AVAILABLE=0 and Azure does not document nested virtualization, so an agent that tests an Android app or boots a VM has nowhere to run it. boat exposes /dev/kvm on every sandbox.
Agents driven from outside, keys kept outside
Tensorlake injects stored secrets into the sandbox and Azure injects Copilot and Anthropic tokens at startup, where a prompt-injected agent can read them. boat keeps real keys in a proxy and lets you drive agents inside from outside through one API.
Reach it like a server
Tensorlake's proxy carries only HTTP, WebSocket and gRPC, and Azure publishes HTTPS ports with no SSH, so a database or editor over SSH needs a workaround. boat gives HTTPS on 50 ports, raw TCP, SSH and its own IP.
Use boat when your agents do real work for hours: SSH, Docker, emulators, a desktop and a browser, hosting on 50 ports and raw TCP, with coding agents and a credentials proxy built in. Compare it one to one: boat vs Tensorlake and boat vs Azure Container Apps Sandboxes.
Questions people ask
Is Tensorlake cheaper than Azure Container Apps Sandboxes?
It depends on size. One coding agent on workdays is $68 a month on Azure and $250 on Tensorlake, because Tensorlake Pro has a $250 fee. For 50 agents in parallel Tensorlake is $1,030 against $3,421 on Azure, and boat is $317 for the same fleet.
Which is faster?
Neither Tensorlake nor Azure Container Apps Sandboxes has a result on the CPU benchmark we use, so there is no fair speed comparison between them. boat scores 26.69 runs/s on that benchmark at 4 vCPU / 8 GB.
Can Tensorlake and Azure sandboxes run Docker?
Tensorlake runs Docker on its tensorlake/ubuntu-systemd image. On Azure the azure-dev image ships Docker on systemd, while the default ubuntu image has only Buildah. boat runs Docker on every sandbox and also exposes /dev/kvm.
Do either of them have GPUs?
Tensorlake offers GPU sandboxes by request, running on gVisor. Azure Container Apps Sandboxes has no GPUs, and neither does boat.
Can I keep a sandbox's memory when it goes idle?
Yes on both. Tensorlake's named sandboxes suspend with memory and running processes, and Azure suspends with memory and resumes in under a second. boat saves the disk every minute and on stop, but a resume boots the machine again.
Where do they run?
Tensorlake runs in the US and the EU, or in your own cloud account through BYOC. Azure runs in 40 regions inside your Azure subscription. boat runs only in the EU (Germany, Finland, France).
Try boat
Install the CLI, then run boat new.
7-day free trial