Tensorlake vs Google Agent Runtime
Tensorlake is a sandbox company: each agent gets a Firecracker microVM with root and Docker that can freeze its memory and wake up warm. Google Agent Runtime, once called Vertex AI Agent Engine, hosts your agent code on Google Cloud and gives it sandboxes that run as an unprivileged user with no sudo.
The companies and products
Tensorlake
Tensorlake is a San Francisco company that sells infrastructure for AI agents, with sandboxes as its main product.
Tensorlake Sandboxes are microVMs, backed by Firecracker and Cloud Hypervisor, that you create through an API and that boot in a few hundred milliseconds. Named sandboxes suspend when idle and keep their memory and running processes, and you can copy a running sandbox into several warm clones. Around them Tensorlake sells versioned file systems, hosted Git, an orchestration layer and a bring-your-own-cloud option, aimed at teams running coding agents, evals and RL rollouts.
- Headquarters
- San Francisco
- Investors shown
- Redpoint and Amplify Partners
Google Agent Runtime
Google Agent Runtime is the agent hosting part of Gemini Enterprise Agent Platform on Google Cloud, renamed from Vertex AI Agent Engine in April 2026.
It is a hyperscaler service, not a sandbox company. Agent Runtime deploys agents you build with ADK, LangGraph, LangChain, AG2 or LlamaIndex and bills them only while they work on a turn. Next to it, Agent Sandbox gives those agents a place to run code: a Code Execution sandbox, a shell or custom container sandbox, and a Computer Use browser. All of them run as secure containers inside your Google Cloud project.
Which use cases each one fits
For each use case, Battleships prices every sandbox provider on the same workload and sorts them from the cheapest monthly bill up. “5th cheapest of 367” means 4 of the other 366 providers run that workload, with every feature it needs, for less. “With limits” means the provider runs it but misses something, so it is listed after every full match. Open a use case for its whole ranking and what each provider misses.
| Use case and its workload | Tensorlake: price rank | Google Agent Runtime: price rank | boat: price rank |
|---|---|---|---|
| Software factory 100 at once · 4 vCPU / 8 GB · 2,200 sessions of 8 h a month Tensorlake fits a software factory with root and Docker, while Google's sandboxes have no sudo or Docker; boat adds /dev/kvm for emulators and preinstalled coding agents. | 5th cheapest of 367 $1,010 a month | 295th of 367, with limits $5,801 a month | 3rd cheapest of 367 $634 a month |
| Always-on AI employees 50 machines 24/7 · 2 vCPU / 4 GB Both keep an agent's state, but a Google sandbox is deleted when its TTL ends (7 days at most for a custom container); boat has no session cap on paid plans. | 9th cheapest of 366 $1,381 a month | 28th cheapest of 366 $7,519 a month | 5th cheapest of 366 $657 a month |
| Code interpreter bursts 100 at once · 1 vCPU / 2 GB · 200,000 sessions of 1 min a month Google's Code Execution sandbox is a ready Python interpreter with no network, and Tensorlake starts microVMs in a few hundred milliseconds for short runs. | 24th cheapest of 345 $250 a month | 254th of 345, with limits $275 a month | 186th of 345, with limits $2,000 a month |
| Sandboxes for your users 300 at once · 2 vCPU / 4 GB · 30,000 sessions of 23 min a month Both create a sandbox per user through an API, but only Tensorlake gives each one HTTP access on exposed ports; boat adds raw TCP and up to 50 HTTPS ports. | 5th cheapest of 361 $471 a month | 280th of 361, with limits $1,916 a month | Cheapest of 361 $209 a month |
| RL rollouts 1,000 at once · 2 vCPU / 4 GB · 1,000,000 sessions of 3 min a month Tensorlake is built for rollouts: Pro allows 1,000 sandboxes at once and warm clones from one memory snapshot, which Google can also branch but without Docker. | Cheapest of 360 $5,637 a month | 128th of 360, with limits $8,240 a month | 34th of 360, with limits $2,000 a month |
| Agent evals 250 at once · 4 vCPU / 8 GB · 15,000 sessions of 20 min a month | 24th cheapest of 364 $506 a month | 79th cheapest of 364 $2,060 a month | 10th cheapest of 364 $200 a month |
| CI runners 40 at once · 8 vCPU / 16 GB · 6,000 sessions of 12 min a month CI jobs that build containers need Docker, which Tensorlake has on its systemd image and Google's unprivileged sandboxes do not; boat runs Docker and systemd on every VM. | 54th cheapest of 377 $424 a month | 98th cheapest of 377 $989 a month | 4th cheapest of 377 $86 a month |
| 24/7 dev boxes 1 machine 24/7 · 4 vCPU / 8 GB Neither is a natural dev box: Tensorlake suspends idle sandboxes and Google has no SSH; boat gives you SSH, a desktop and a machine that stays on. | 185th of 368, with limits $250 a month | 311th of 368, with limits $241 a month | 18th cheapest of 368 $26 a month |
| Computer-use agents 50 at once · 4 vCPU / 8 GB · 20,000 sessions of 15 min a month Tensorlake runs an XFCE desktop with Firefox over VNC, while Google gives only a browser; boat streams a 60fps desktop with Chromium. | 9th cheapest of 369 $294 a month | 283rd of 369, with limits $1,648 a month | 6th cheapest of 369 $200 a month |
| Browser-use agents 50 at once · 2 vCPU / 4 GB · 30,000 sessions of 10 min a month | 13th cheapest of 367 $250 a month | 102nd of 367, with limits $824 a month | 7th cheapest of 367 $200 a month |
| Scraping & bots (startup scale) 50 at once · 1 vCPU / 2 GB · 100,000 sessions of 3 min a month | 22nd cheapest of 346 $250 a month | 53rd cheapest of 346 $515 a month | 6th cheapest of 346 $90 a month |
| Mass scraping & bots (undetectable) 1,000 at once · 1 vCPU / 2 GB · 3,000,000 sessions of 2 min a month | 121st of 338, with limits $3,484 a month | 210th of 338, with limits $8,240 a month | 71st of 338, with limits $1,800 a month |
| Parallel red teaming 200 at once · 2 vCPU / 4 GB · 5,000 sessions of 30 min a month | 4th cheapest of 360 $250 a month | 260th of 360, with limits $412 a month | 2nd cheapest of 360 $200 a month |
| GPU eval jobs 10 at once · 8 vCPU / 32 GB · 500 sessions of 30 min a month | Can't run it | Can't run it | Can't run it |
| macOS agents 5 at once · 4 vCPU / 8 GB · 1,000 sessions of 20 min a month | Can't run it | Can't run it | Can't run it |
Key features
| Feature | Tensorlake | Google Agent Runtime | boat |
|---|---|---|---|
| Isolation | Firecracker and Cloud Hypervisor microVMs with their own kernel; GPU sandboxes use gVisor | Secure container sandboxing inside your Google Cloud project | Full VM with its own kernel on dedicated AMD Ryzen 9 9950X hosts |
| Root and Docker | Root, and Docker on the tensorlake/ubuntu-systemd image | Runs as appuser with no sudo; images must not need root; no Docker documented | Root, systemd and Docker on every machine |
| Nested virtualization | No: sandboxes set SANDBOX_KVM_AVAILABLE=0 | No /dev/kvm documented | Yes, /dev/kvm inside, so Android emulators and VMs run |
| Shell access | SSH and a command API | execute_bash() API calls; each command runs in a new shell; no SSH | SSH, plus an API for commands |
| Memory snapshots and clones | Suspend keeps memory and processes; copy a running sandbox into N warm clones | Snapshots keep memory and files; start many sandboxes from one snapshot | Fork a running sandbox (disk); resume reboots from disk |
| How long a sandbox lives | Unlimited on Pro; idle timeout of 600 s by default, then suspend or terminate | TTL of up to 7 days for a custom container and 14 days for Code Execution, then deleted | No session cap on paid plans; a stopped sandbox costs nothing and keeps its disk |
| Desktop and computer use | XFCE desktop with Firefox over VNC, with screenshot, mouse and keyboard calls | A browser in a container with a VNC view, a click and type API and CDP | 60fps desktop and Chromium, computer use and browser control, embeddable stream |
| Inbound traffic | HTTP, WebSocket and gRPC through an authenticated proxy on exposed ports | Through Google's API or a private endpoint in your VPC; no public URL documented | HTTPS URLs for up to 50 ports, token-protected, plus raw TCP and a dedicated IP |
| Outbound rules | allow_out and deny_out lists by domain, IP or CIDR, or no internet | Off unless the template turns it on; route through your VPC with Cloud NAT, a static IP or Cloud NGFW | Open internet; no provider-side allowlist, you set your own firewall as root |
| Coding agents | You bring and run your own agent | Managed Agents API (Preview) runs Google's Antigravity harness | Claude Code, Codex, OpenCode and more preinstalled, with a prompt, steer and events API |
| API keys | Stored secrets are injected into the sandbox | You provision and scope the credentials the agent uses | AI credentials proxy for any HTTPS API: real keys never enter the sandbox |
| Hosting agent code | No agent hosting service; you run your loop in a sandbox | Deploys ADK, LangGraph, LangChain, AG2 and LlamaIndex agents; idle time between turns is not billed | You run your own agent loop inside a sandbox |
| GPUs | GPU sandboxes by request | None for sandboxes | None |
| Where it runs | US and EU, or your own cloud account through BYOC | 23 locations across the US, Europe, Asia, Canada, Australia and Brazil | EU only: Germany, Finland, France |
Every feature Battleships tracks (43)
| Feature | Tensorlake | Google Agent Runtime | boat |
|---|---|---|---|
| Full VM (own kernel) | Yes | No | Yes |
| Docker inside | Yes | No | Yes |
| Nested virtualization | No | No | Yes |
| Root | Yes | No | Yes |
| Systemd | Yes | Not published | Yes |
| Desktop GUI | Yes | No | Yes |
| Browser | Yes | Yes | Yes |
| Computer-use API | Yes | Yes | Yes |
| SSH | Yes | No | Yes |
| Persistent disk | Yes | Yes | Yes |
| Pause/resume | Yes | Yes | Yes |
| Automatic snapshots | Yes | Yes | Yes |
| Fork/clone | Yes | Yes | Yes |
| Live fork (no pause) | Yes | Yes | Yes |
| Memory fork | Yes | Yes | No |
| Custom image (Docker or snapshot) | Yes | Yes | Yes |
| ≥24 h sessions | Yes | Yes | Yes |
| Idle auto-stop | Yes | No | No |
| Wake on request | Yes | No | No |
| HTTPS preview URLs | Yes | No | Yes |
| Raw TCP inbound | No | Not published | Yes |
| Public IPv4 | No | No | No |
| Egress allowlist | Yes | Yes | No |
| Secret proxy | No | No | Yes |
| Secret proxy for any API | No | No | Yes |
| Preinstalled agents | No | Yes | Yes |
| Agent harness API | No | Yes | Yes |
| MCP server | No | No | No |
| GPU | Yes | No | No |
| Windows | No | No | No |
| Arm64 | No | Yes | No |
| Self-hosting | No | No | No |
| BYOC | Yes | No | No |
| Open source | No | No | No |
| Scoped API keys | Not published | Not published | Yes |
| Spend limits | Not published | Not published | Yes |
| Usage per sandbox (API) | No | Yes | Yes |
| Audit logs | Not published | Not published | No |
| SSO | Yes | Yes | No |
| SOC 2 | Yes | Yes | No |
| HIPAA | Yes | Yes | No |
| EU data residency | Yes | Yes | Yes |
| Zero data retention | Yes | Not published | Yes |
Performance
Neither Tensorlake nor Google Agent Runtime has a result on the hpc-sandbox-benchmarks Node.js build-and-test loop, so there is no comparable CPU measurement between them. boat scores 26.69 runs/s on that benchmark at 4 vCPU / 8 GB, the fastest result measured. Tensorlake's docs say its default image starts in a few hundred milliseconds.
Node.js build-and-test loop at 4 vCPU / 8 GB, higher is better. Measured with the open hpc-sandbox-benchmarks suite. Tensorlake and Google Agent Runtime have no published run in this suite yet, so there is no like-for-like number to compare.
Pricing in five scenarios
Each bill is priced from the providers' public price lists by the open Battleships engine, with the cheapest plan that runs the scenario.
| Scenario | Tensorlake, a month | Google Agent Runtime, a month | boat, a month |
|---|---|---|---|
| One coding agent, workdays 4 vCPU / 8 GB, 50 GB disk, 8 hours a day, 22 days a month, files kept between days | $250 · Pro | $73 · Pay as you go | $20 · $20/mo |
| One agent that never stops 4 vCPU / 8 GB, 50 GB disk, running 24/7 all month | $250 · Pro | $301 · Pay as you go | $26 · $20/mo |
| 50 agents in parallel 50 machines of 4 vCPU / 8 GB at once, 8-hour sessions, 1,100 sessions a month, Docker inside | $1,030 · Pro | $3,626 · Pay as you go · with limits | $317 · $20/mo × 3 seats |
| Sandboxes for your users 2 vCPU / 4 GB, 30,000 sessions of 10 minutes a month, up to 300 at once | $293 · Pro | $1,030 · Pay as you go | $200 · $100/mo × 2 seats |
| 1,000 short jobs at once 2 vCPU / 4 GB, 1,000 at once, 3 minutes each, 200,000 jobs a month | $1,127 · Pro | $2,060 · Pay as you go | $2,000 · $2000/mo · with limits |
Tensorlake: Pro is $250 per billing cycle, which includes $250 of usage, then $0.01 per CU. CPU is billed only while it is actively working, RAM and disk on what you allocate while the sandbox runs, and a suspended sandbox pays snapshot storage.
Google Agent Runtime: Google bills $0.085 per vCPU-hour and $0.009 per GiB-hour for what you allocate, with the first 50 vCPU-hours and 100 GiB-hours free each month. Sandboxes are billed while they exist, and disk and egress rates are not published.
Google Agent Runtime: You pick a monthly plan from $20, and all of it becomes usage credit spent per second on running sandboxes. A stopped sandbox costs nothing and keeps its disk.
Limits in those scenarios
Google cannot run the 50-agent fleet because its sandboxes have no Docker inside, and every Google row leaves disk and egress unpriced because those rates are not published. A Google sandbox is also deleted when its TTL ends, 7 days at most for a custom container. Tensorlake fits all five scenarios on Pro, though an ephemeral sandbox ends after 10 idle minutes by default. boat's limit is how fast new machines start: bursts above 90 starts a minute are queued, so 1,000 short jobs at once does not fit.
| Scenario | Tensorlake | Google Agent Runtime | boat |
|---|---|---|---|
| One coding agent, workdays | None that bite |
| None that bite |
| One agent that never stops | None that bite |
| None that bite |
| 50 agents in parallel | None that bite |
| None that bite |
| Sandboxes for your users | None that bite |
| None that bite |
| 1,000 short jobs at once | None that bite |
|
|
Which one should you use?
Use Tensorlake when
your agents need root and Docker in a microVM that can freeze its memory, fan out to a thousand warm clones, or run on GPUs or in your own cloud.
- Root and Docker in a microVM. Useful when agents install packages or build containers: Tensorlake gives root and Docker, which Google's sandboxes do not.
- Warm clones and big fan-outs. Useful for RL and evals: Pro runs 1,000 sandboxes at once and copies a running one into warm clones with memory.
- GPUs and your own cloud. Tensorlake offers GPU sandboxes by request and can run in your own AWS, GCP, Azure, CoreWeave or Nebius account.
Use Google Agent Runtime when
you build agents with ADK or LangGraph on Google Cloud and want them hosted inside your own project, network rules and regions, with short code runs in a locked sandbox.
- A managed home for agent code. Useful if you build with ADK or LangGraph: Agent Runtime hosts your agents and skips billing for idle time between turns.
- Inside your Google Cloud network. Useful when agents must stay in a Google Cloud perimeter, with egress off by default and routed through your own VPC.
- Regions worldwide. Google runs Agent Runtime and sandboxes in 23 locations, including Asia, Canada, Australia and Brazil.
Where boat fits
If your agents do long, real work like installs, builds, Docker, emulators and previews people can open, look at boat. Each one gets a full VM with root, /dev/kvm, a desktop and coding agents built in, and it stays on with no session cap on paid plans.
Emulators and VMs run inside
Tensorlake sets SANDBOX_KVM_AVAILABLE=0 and Google runs an unprivileged container, so an Android emulator or a VM does not start on either. On boat every sandbox has /dev/kvm.
Anyone can open what agents build
Tensorlake carries only HTTP, WebSocket and gRPC, so raw TCP services can't be reached, and Google has no public URL at all. boat serves HTTPS on up to 50 ports plus raw TCP.
Coding agents with keys kept outside
On Tensorlake you install your own agent and inject secrets, and on Google you get only the Antigravity harness in Preview. boat ships Claude Code and Codex and keeps real keys in a proxy.
Use boat when your agents do real work for hours: installs, Docker, emulators, a desktop and public URLs on a full VM, with coding agents built in and keys kept outside the machine. Compare it one to one: boat vs Tensorlake and boat vs Google Agent Runtime.
Questions people ask
Is Tensorlake cheaper than Google Agent Runtime?
It depends on the shape. One coding agent on workdays is $73 a month on Google and $250 on Tensorlake Pro, because Pro has a $250 minimum. For bigger loads Tensorlake comes out lower: one agent all month is $250 against $301, and sandboxes for your users $293 against $1,030. On boat those come to $20, $26 and $200.
Which is faster?
Neither Tensorlake nor Google has a result on the CPU benchmark we use, so we can't compare their speed. boat scores 26.69 runs/s on it at 4 vCPU / 8 GB, the fastest result measured.
Can Tensorlake or Google Agent Runtime run Docker?
Tensorlake can, on its tensorlake/ubuntu-systemd image. Google's sandboxes run as the unprivileged user appuser with no sudo, so Docker is not available. boat runs Docker with root and systemd on every VM.
Is Google Agent Runtime the same as Vertex AI Agent Engine?
Yes. Google renamed Vertex AI Agent Engine to Agent Runtime in April 2026, as part of Gemini Enterprise Agent Platform. Its code, shell and browser sandboxes are a separate part called Agent Sandbox.
Can I keep a sandbox's memory when it stops?
Both can. Tensorlake's named sandboxes suspend with memory and running processes, and Google's snapshots save memory and files. boat keeps the disk with snapshots every minute and on stop, but a resume boots the machine again.
Where do they run?
Tensorlake runs in the US and the EU, or in your own cloud account. Google runs in 23 locations across the US, Europe, Asia, Canada, Australia and Brazil. boat runs only in the EU, in Germany, Finland and France.
Try boat
Install the CLI, then run boat new.
7-day free trial