Tensorlake vs Deno Sandbox
Both run code in Firecracker microVMs. Tensorlake gives agents bigger sandboxes that can sleep with their memory and wake up warm, while Deno Sandbox gives short, locked-down 2 vCPU runs that start in under 200 ms and end within 30 minutes.
The companies and products
Tensorlake
Tensorlake is a San Francisco company that sells infrastructure for AI agents, with sandboxes as its main product.
Tensorlake Sandboxes are microVMs, backed by Firecracker and Cloud Hypervisor, that you create through an API and that boot in a few hundred milliseconds. Named sandboxes suspend when idle and keep their memory and running processes, and you can copy a running sandbox into several warm clones. Around them Tensorlake sells versioned file systems, hosted Git, an orchestration layer and a bring-your-own-cloud option, aimed at teams running coding agents, evals and RL rollouts.
- Headquarters
- San Francisco
- Investors shown
- Redpoint and Amplify Partners
Deno Sandbox
Deno Sandbox is part of Deno Deploy, the hosting platform from the company behind the Deno runtime, and runs untrusted or AI-generated code in Linux microVMs.
Each sandbox is a Firecracker microVM with 2 vCPU, up to 4 GB of memory and a 10 GB disk that is wiped when it ends, created from a TypeScript or Python SDK. Outbound traffic goes through a proxy that can enforce a host allowlist and swap placeholder secrets for real ones. It is built for short runs of agent or user code, and a sandbox can be promoted to a Deno Deploy app.
- Isolation
- Firecracker microVM per sandbox
Which use cases each one fits
For each use case, Battleships prices every sandbox provider on the same workload and sorts them from the cheapest monthly bill up. “5th cheapest of 367” means 4 of the other 366 providers run that workload, with every feature it needs, for less. “With limits” means the provider runs it but misses something, so it is listed after every full match. Open a use case for its whole ranking and what each provider misses.
| Use case and its workload | Tensorlake: price rank | Deno Sandbox: price rank | boat: price rank |
|---|---|---|---|
| Software factory 100 at once · 4 vCPU / 8 GB · 2,200 sessions of 8 h a month Tensorlake fits a software factory that runs for hours, while Deno's 30-minute lifetime and 2 vCPU shape make it a compromise; boat adds /dev/kvm and preinstalled coding agents. | 5th cheapest of 367 $1,010 a month | 290th of 367, with limits $5,665 a month | 3rd cheapest of 367 $634 a month |
| Always-on AI employees 50 machines 24/7 · 2 vCPU / 4 GB Tensorlake keeps an agent's memory while it sleeps and Deno ends a sandbox after 30 minutes and wipes its disk; boat keeps the machine on with no session cap. | 9th cheapest of 366 $1,381 a month | 287th of 366, with limits $5,803 a month | 5th cheapest of 366 $657 a month |
| Code interpreter bursts 100 at once · 1 vCPU / 2 GB · 200,000 sessions of 1 min a month Deno starts in under 200 ms and bills CPU only while code runs, and Tensorlake fits the whole workload on Pro; boat's start-rate limits queue big bursts. | 24th cheapest of 345 $250 a month | 141st of 345, with limits $329 a month | 186th of 345, with limits $2,000 a month |
| Sandboxes for your users 300 at once · 2 vCPU / 4 GB · 30,000 sessions of 23 min a month Tensorlake Pro allows 1,000 sandboxes at once and Deno Builder 20 per region; boat also gives each one token-protected HTTPS URLs and raw TCP. | 5th cheapest of 361 $471 a month | 148th of 361, with limits $1,863 a month | Cheapest of 361 $209 a month |
| RL rollouts 1,000 at once · 2 vCPU / 4 GB · 1,000,000 sessions of 3 min a month Tensorlake ranks first for RL rollouts thanks to warm clones and 1,000 at once, while Deno's 20-at-once cap and boat's start-rate limits make it a compromise. | Cheapest of 360 $5,637 a month | 122nd of 360, with limits $7,963 a month | 34th of 360, with limits $2,000 a month |
| Agent evals 250 at once · 4 vCPU / 8 GB · 15,000 sessions of 20 min a month | 24th cheapest of 364 $506 a month | 296th of 364, with limits $1,563 a month | 10th cheapest of 364 $200 a month |
| CI runners 40 at once · 8 vCPU / 16 GB · 6,000 sessions of 12 min a month Tensorlake documents Docker inside and Deno does not; boat runs Docker with /dev/kvm on the fastest hosts measured on the CPU benchmark. | 54th cheapest of 377 $424 a month | 304th of 377, with limits $731 a month | 4th cheapest of 377 $86 a month |
| 24/7 dev boxes 1 machine 24/7 · 4 vCPU / 8 GB Tensorlake is built around suspending idle sandboxes and Deno ends them after 30 minutes, so a box that stays on all day fits boat better. | 185th of 368, with limits $250 a month | 179th of 368, with limits $200 a month | 18th cheapest of 368 $26 a month |
| Computer-use agents 50 at once · 4 vCPU / 8 GB · 20,000 sessions of 15 min a month Tensorlake has an XFCE desktop over VNC and Deno has no desktop at all; boat streams a Linux desktop at 60fps with Chromium. | 9th cheapest of 369 $294 a month | 280th of 369, with limits $1,583 a month | 6th cheapest of 369 $200 a month |
| Browser-use agents 50 at once · 2 vCPU / 4 GB · 30,000 sessions of 10 min a month | 13th cheapest of 367 $250 a month | 284th of 367, with limits $783 a month | 7th cheapest of 367 $200 a month |
| Scraping & bots (startup scale) 50 at once · 1 vCPU / 2 GB · 100,000 sessions of 3 min a month | 22nd cheapest of 346 $250 a month | 286th of 346, with limits $573 a month | 6th cheapest of 346 $90 a month |
| Mass scraping & bots (undetectable) 1,000 at once · 1 vCPU / 2 GB · 3,000,000 sessions of 2 min a month | 121st of 338, with limits $3,484 a month | 247th of 338, with limits $11,923 a month | 71st of 338, with limits $1,800 a month |
| Parallel red teaming 200 at once · 2 vCPU / 4 GB · 5,000 sessions of 30 min a month | 4th cheapest of 360 $250 a month | 251st of 360, with limits $367 a month | 2nd cheapest of 360 $200 a month |
| GPU eval jobs 10 at once · 8 vCPU / 32 GB · 500 sessions of 30 min a month | Can't run it | Can't run it | Can't run it |
| macOS agents 5 at once · 4 vCPU / 8 GB · 1,000 sessions of 20 min a month | Can't run it | Can't run it | Can't run it |
Key features
| Feature | Tensorlake | Deno Sandbox | boat |
|---|---|---|---|
| Isolation | Firecracker and Cloud Hypervisor microVMs with their own kernel; GPU sandboxes use gVisor | Firecracker microVM with its own kernel | Full VM with its own kernel on dedicated AMD Ryzen 9 9950X hosts |
| Machine size | Up to 16 vCPU, 64 GB RAM and a 100 GB root disk on Pro, fixed when the sandbox is created | 2 vCPU fixed, 768 MB to 4 GB memory, 10 GB disk | 4 vCPU / 8 GB by default, up to 16 vCPU / 32 GB on the $100 plan and above |
| Session length | No cap on Pro; an idle timeout (600 s by default) suspends or ends the sandbox | Up to 30 minutes; longer work can be promoted to a Deno Deploy app | No cap on paid plans and no idle timer; you set the time to live |
| Keeping state | Named sandboxes suspend with their memory and running processes | Root disk wiped when the sandbox ends; opt-in volumes of 300 MB to 20 GB, Chicago only | Whole disk saved every minute and on stop; a stopped sandbox costs nothing |
| Clone a running sandbox | Copy a running or suspended sandbox into many warm clones with memory | No fork; many new sandboxes can boot from a read-only volume snapshot | Fork a running sandbox with its disk |
| Docker and nested virtualization | Docker on the tensorlake/ubuntu-systemd image; no /dev/kvm | Root access; Docker and nested virtualization not documented | Docker, systemd and /dev/kvm for Android emulators and VMs |
| Desktop and computer use | XFCE desktop with Firefox over VNC, with screenshot, mouse and keyboard calls | No desktop; a VS Code editor in the browser and SSH | Linux desktop streamed at 60fps with Chromium, computer use and browser control |
| Coding agents | You bring and run your own agent on plain OS images | A root image with Claude Code, run through the shell command API | Claude Code, Codex, OpenCode and more preinstalled, with a prompt, steer and events API |
| API keys | Stored secrets are injected into the sandbox | Placeholder secrets swapped for real ones on requests to approved hosts | Credentials proxy for model providers and any HTTPS API; real keys never enter the sandbox |
| Inbound traffic | HTTP, WebSocket and gRPC through an authenticated proxy | HTTPS URL per exposed port, public without authentication; SSH | HTTPS URLs for up to 50 ports, token-protected, plus raw TCP and a dedicated IP |
| Outbound rules | Allow and deny lists by domain, IP or CIDR, or no internet at all | Host allowlist per sandbox, enforced by a proxy outside the VM | Open internet, no provider-side allowlist; you set your own firewall as root |
| Start time | A few hundred milliseconds | Under 200 ms | Boots a full VM |
| GPUs | GPU sandboxes by request (H100 shown in the docs) | None | None |
| Where it runs | US and EU, or your own cloud account through BYOC | Amsterdam and Chicago | EU only: Germany, Finland, France |
Every feature Battleships tracks (43)
| Feature | Tensorlake | Deno Sandbox | boat |
|---|---|---|---|
| Full VM (own kernel) | Yes | Yes | Yes |
| Docker inside | Yes | Not published | Yes |
| Nested virtualization | No | No | Yes |
| Root | Yes | Yes | Yes |
| Systemd | Yes | Not published | Yes |
| Desktop GUI | Yes | No | Yes |
| Browser | Yes | No | Yes |
| Computer-use API | Yes | No | Yes |
| SSH | Yes | Yes | Yes |
| Persistent disk | Yes | Yes | Yes |
| Pause/resume | Yes | No | Yes |
| Automatic snapshots | Yes | No | Yes |
| Fork/clone | Yes | No | Yes |
| Live fork (no pause) | Yes | No | Yes |
| Memory fork | Yes | No | No |
| Custom image (Docker or snapshot) | Yes | Yes | Yes |
| ≥24 h sessions | Yes | No | Yes |
| Idle auto-stop | Yes | No | No |
| Wake on request | Yes | No | No |
| HTTPS preview URLs | Yes | Yes | Yes |
| Raw TCP inbound | No | No | Yes |
| Public IPv4 | No | No | No |
| Egress allowlist | Yes | Yes | No |
| Secret proxy | No | Yes | Yes |
| Secret proxy for any API | No | Yes | Yes |
| Preinstalled agents | No | Yes | Yes |
| Agent harness API | No | No | Yes |
| MCP server | No | No | No |
| GPU | Yes | No | No |
| Windows | No | No | No |
| Arm64 | No | No | No |
| Self-hosting | No | No | No |
| BYOC | Yes | No | No |
| Open source | No | No | No |
| Scoped API keys | Not published | Not published | Yes |
| Spend limits | Not published | Yes | Yes |
| Usage per sandbox (API) | No | No | Yes |
| Audit logs | Not published | Not published | No |
| SSO | Yes | No | No |
| SOC 2 | Yes | Yes | No |
| HIPAA | Yes | Yes | No |
| EU data residency | Yes | Yes | Yes |
| Zero data retention | Yes | Not published | Yes |
Performance
Neither Tensorlake nor Deno Sandbox has a result on the StarSling hpc-sandbox-benchmarks CPU test, so there is no comparable CPU measurement between them. boat did 26.69 runs per second on its Node.js build-and-test loop at 4 vCPU / 8 GB, the fastest result measured. On start time, Deno says under 200 ms and Tensorlake's docs say a few hundred milliseconds.
Node.js build-and-test loop at 4 vCPU / 8 GB, higher is better. Measured with the open hpc-sandbox-benchmarks suite. Tensorlake and Deno Sandbox have no published run in this suite yet, so there is no like-for-like number to compare.
Pricing in five scenarios
Each bill is priced from the providers' public price lists by the open Battleships engine, with the cheapest plan that runs the scenario.
| Scenario | Tensorlake, a month | Deno Sandbox, a month | boat, a month |
|---|---|---|---|
| One coding agent, workdays 4 vCPU / 8 GB, 50 GB disk, 8 hours a day, 22 days a month, files kept between days | $250 · Pro | $53 · Pro · with limits | $20 · $20/mo |
| One agent that never stops 4 vCPU / 8 GB, 50 GB disk, running 24/7 all month | $250 · Pro | $200 · Builder · with limits | $26 · $20/mo |
| 50 agents in parallel 50 machines of 4 vCPU / 8 GB at once, 8-hour sessions, 1,100 sessions a month, Docker inside | $1,030 · Pro | $2,779 · Builder · with limits | $317 · $20/mo × 3 seats |
| Sandboxes for your users 2 vCPU / 4 GB, 30,000 sessions of 10 minutes a month, up to 300 at once | $293 · Pro | $783 · Builder · with limits | $200 · $100/mo × 2 seats |
| 1,000 short jobs at once 2 vCPU / 4 GB, 1,000 at once, 3 minutes each, 200,000 jobs a month | $1,127 · Pro | $1,563 · Builder · with limits | $2,000 · $2000/mo · with limits |
Tensorlake: Pro is $250 per billing cycle, which includes 25,000 CU ($250) of usage, then $0.01 per CU. CPU bills only while it is actively working, RAM and disk bill on what you allocate, and small users can instead buy prepaid packs from $5.
Deno Sandbox: Sandboxes need Pro at $20 a month or Builder at $200 a month; the fee is not credit but includes CPU, memory and egress allowances shared with Deno Deploy apps. Past those, active CPU costs $0.10 an hour and memory $0.025 per GiB-hour for the whole life of the sandbox.
Deno Sandbox: Plans start at $20 a month and the whole fee is usage credit. Running time bills per second, and a stopped sandbox costs nothing while its disk is kept.
Limits in those scenarios
Deno Sandbox fits none of the five scenarios as written: a sandbox lives up to 30 minutes, is fixed at 2 vCPU with up to 4 GB, and Builder allows 20 at once per region. Tensorlake Pro fits all five, including 1,000 short jobs at once, though an ephemeral sandbox ends after 10 idle minutes by default. boat fits four of the five; for 1,000 short jobs at once its top plan queues starts above 90 a minute.
| Scenario | Tensorlake | Deno Sandbox | boat |
|---|---|---|---|
| One coding agent, workdays | None that bite |
| None that bite |
| One agent that never stops | None that bite |
| None that bite |
| 50 agents in parallel | None that bite |
| None that bite |
| Sandboxes for your users | None that bite |
| None that bite |
| 1,000 short jobs at once | None that bite |
|
|
Which one should you use?
Use Tensorlake when
agents run for a long time on big sandboxes, must resume mid-process from memory, fan out to a thousand at once, or need GPUs or your own cloud.
- Memory snapshots and warm clones. Useful when agents must pick up mid-process: Tensorlake can suspend a sandbox with its memory and copy it into warm clones.
- Long runs at large scale. Fits big fleets: Pro allows 1,000 sandboxes at once, up to 16 vCPU and 64 GB each, with no session cap.
- GPUs and your own cloud. For teams that need GPUs or their own account: GPU sandboxes by request, and BYOC on AWS, GCP, Azure and more.
Use Deno Sandbox when
you run short pieces of untrusted code that must start in milliseconds and reach only the hosts you allow, especially if you already deploy on Deno Deploy.
- Fast starts and active-CPU billing. Good for short bursts of code: a sandbox starts in under 200 ms and CPU bills only while code runs.
- Secrets that stay outside. Useful for untrusted code: the sandbox only sees placeholder secrets, swapped for real ones on requests to approved hosts.
- A small entry plan and Deno Deploy. Fits teams already on Deno Deploy: sandboxes start on the $20 Pro plan and can be promoted to Deploy apps.
Where boat fits
If your agents do real work for hours, with installs, builds, Docker, emulators and a browser, look at boat. Each sandbox is a full VM with its own kernel and /dev/kvm, its disk is saved every minute, and coding agents come built in with keys kept outside the machine.
Run emulators and Docker inside
Tensorlake sandboxes have no /dev/kvm, so an Android emulator or a VM does not start. Deno documents neither Docker nor nested virtualization, and its 2 vCPU, 4 GB shape is tight for real builds.
Drive agents inside from outside
On Tensorlake you install the agent yourself and stored secrets are injected into the sandbox it controls. On Deno you run Claude Code through shell commands and parse its output yourself, with no desktop to see a page.
Reach it like a server
Tensorlake's proxy carries only HTTP, WebSocket and gRPC, so a raw TCP service cannot be reached. Deno's URLs are public without authentication, and the sandbox ends after 30 minutes anyway.
Use boat when your agents do real work for hours: installs, builds, tests, Docker, emulators and a desktop, with coding agents built in and keys kept outside the machine. Compare it one to one: boat vs Tensorlake and boat vs Deno Sandbox.
Questions people ask
Is Tensorlake cheaper than Deno Sandbox?
Deno is cheaper to start, at $20 a month for Pro against $250 for Tensorlake Pro. But Deno fits none of our five scenarios as written, and at scale Tensorlake comes out lower: 1,000 short jobs at once is $1,127 a month on Tensorlake against $1,563 on Deno Builder. On boat one coding agent on workdays is $20 a month, and 50 agents in parallel is $317 against $1,030 on Tensorlake.
Which is faster, Tensorlake or Deno Sandbox?
Neither has a CPU benchmark result, so there is no fair speed comparison. Deno says a sandbox starts in under 200 ms and Tensorlake says a few hundred milliseconds. boat scores 26.69 runs per second, the fastest measured, but it boots a full VM.
Can Tensorlake or Deno Sandbox run Docker?
Tensorlake runs Docker on its tensorlake/ubuntu-systemd image, but it has no /dev/kvm. Deno's docs mention neither Docker nor nested virtualization. boat runs Docker and systemd and exposes /dev/kvm for Android emulators and VMs.
How long can a sandbox run?
Tensorlake Pro has no session cap, though an idle timeout of 600 s by default suspends or ends the sandbox. A Deno sandbox lives up to 30 minutes and its root disk is wiped when it ends. A boat sandbox has no cap on paid plans and keeps its whole disk.
Which one keeps API keys out of the sandbox?
Deno does: the sandbox sees a placeholder, swapped for the real secret only on requests to approved hosts. Tensorlake injects stored secrets into the sandbox. boat's credentials proxy keeps real keys outside for model providers and any HTTPS API.
Try boat
Install the CLI, then run boat new.
7-day free trial