Tensorlake vs Instabox
Both give each agent a Firecracker microVM with its own kernel, root and Docker. Tensorlake is a paid platform built to run up to 1,000 sandboxes at once with warm memory clones, while Instabox launched today as a free invite-only beta with 5 machines of one size per account.
The companies and products
Tensorlake
Tensorlake is a San Francisco company that sells infrastructure for AI agents, with sandboxes as its main product.
Tensorlake Sandboxes are microVMs, backed by Firecracker and Cloud Hypervisor, that you create through an API and that boot in a few hundred milliseconds. Named sandboxes suspend when idle and keep their memory and running processes, and you can copy a running sandbox into several warm clones. Around them Tensorlake sells versioned file systems, hosted Git, an orchestration layer and a bring-your-own-cloud option, aimed at teams running coding agents, evals and RL rollouts.
- Headquarters
- San Francisco
- Investors shown
- Redpoint and Amplify Partners
Instabox
Instabox, made by InsForge, gives each AI agent its own Linux computer in the cloud. It launched on 2026-10-14 as an invite-only beta.
Each Instabox machine is a Firecracker microVM with its own kernel, root and Docker, started from one of four templates (agent-browser, universal, herdr or orca) or from your own snapshot. Every machine is 4 vCPU / 8 GiB with 20 GB of storage, and you drive it from a CLI, a TypeScript SDK or an HTTP API, with SSH, mosh, public port URLs and a desktop for computer use. It is aimed at developers who want a cloud box for a coding agent.
- Isolation
- Firecracker microVM per machine
- Machines per account
- 5, in any state: paused and stopped ones count
- Company
- InsForge AI, Inc.
Which use cases each one fits
For each use case, Battleships prices every sandbox provider on the same workload and sorts them from the cheapest monthly bill up. “5th cheapest of 367” means 4 of the other 366 providers run that workload, with every feature it needs, for less. “With limits” means the provider runs it but misses something, so it is listed after every full match. Open a use case for its whole ranking and what each provider misses.
| Use case and its workload | Tensorlake: price rank | Instabox: price rank | boat: price rank |
|---|---|---|---|
| Software factory 100 at once · 4 vCPU / 8 GB · 2,200 sessions of 8 h a month Tensorlake fits a software factory today, while Instabox's 5 machines of one size and its stopped-only fork make it a small trial; boat forks running sandboxes and adds /dev/kvm. | 5th cheapest of 367 $1,010 a month | No published price | 3rd cheapest of 367 $634 a month |
| Always-on AI employees 50 machines 24/7 · 2 vCPU / 4 GB Both can keep a machine on with memory kept while it sleeps; Instabox caps an account at 5 machines, and boat keeps the machine on with no session cap on paid plans. | 9th cheapest of 366 $1,381 a month | No published price | 5th cheapest of 366 $657 a month |
| Code interpreter bursts 100 at once · 1 vCPU / 2 GB · 200,000 sessions of 1 min a month | 24th cheapest of 345 $250 a month | No published price | 186th of 345, with limits $2,000 a month |
| Sandboxes for your users 300 at once · 2 vCPU / 4 GB · 30,000 sessions of 23 min a month Tensorlake can run a sandbox per user at up to 1,000 at once on Pro, while Instabox's 5 machines per account, stopped ones included, cannot do this yet. | 5th cheapest of 361 $471 a month | No published price | Cheapest of 361 $209 a month |
| RL rollouts 1,000 at once · 2 vCPU / 4 GB · 1,000,000 sessions of 3 min a month Tensorlake is built for RL rollouts from one warm state, which Instabox's 5-machine cap rules out and boat's start-rate limits make a compromise. | Cheapest of 360 $5,637 a month | No published price | 34th of 360, with limits $2,000 a month |
| Agent evals 250 at once · 4 vCPU / 8 GB · 15,000 sessions of 20 min a month Tensorlake runs many evals side by side; Instabox runs at most 5 machines at a time. | 24th cheapest of 364 $506 a month | No published price | 10th cheapest of 364 $200 a month |
| CI runners 40 at once · 8 vCPU / 16 GB · 6,000 sessions of 12 min a month None of Tensorlake, Instabox and boat is a CI service, but only boat exposes /dev/kvm for Android and VM builds; Tensorlake has none and Instabox does not document it. | 54th cheapest of 377 $424 a month | No published price | 4th cheapest of 377 $86 a month |
| 24/7 dev boxes 1 machine 24/7 · 4 vCPU / 8 GB Instabox works as a free cloud dev box with SSH and mosh during the beta; Tensorlake suspends idle sandboxes, and boat keeps a box on with a published price. | 185th of 368, with limits $250 a month | No published price | 18th cheapest of 368 $26 a month |
| Computer-use agents 50 at once · 4 vCPU / 8 GB · 20,000 sessions of 15 min a month All three give a Linux desktop with screenshot and click control; boat streams it at 60fps, Tensorlake uses VNC, and Instabox can share a view or control link. | 9th cheapest of 369 $294 a month | No published price | 6th cheapest of 369 $200 a month |
| Browser-use agents 50 at once · 2 vCPU / 4 GB · 30,000 sessions of 10 min a month | 13th cheapest of 367 $250 a month | No published price | 7th cheapest of 367 $200 a month |
| Scraping & bots (startup scale) 50 at once · 1 vCPU / 2 GB · 100,000 sessions of 3 min a month | 22nd cheapest of 346 $250 a month | No published price | 6th cheapest of 346 $90 a month |
| Mass scraping & bots (undetectable) 1,000 at once · 1 vCPU / 2 GB · 3,000,000 sessions of 2 min a month | 121st of 338, with limits $3,484 a month | No published price | 71st of 338, with limits $1,800 a month |
| Parallel red teaming 200 at once · 2 vCPU / 4 GB · 5,000 sessions of 30 min a month | 4th cheapest of 360 $250 a month | No published price | 2nd cheapest of 360 $200 a month |
| GPU eval jobs 10 at once · 8 vCPU / 32 GB · 500 sessions of 30 min a month | Can't run it | No published price | Can't run it |
| macOS agents 5 at once · 4 vCPU / 8 GB · 1,000 sessions of 20 min a month | Can't run it | No published price | Can't run it |
Key features
| Feature | Tensorlake | Instabox | boat |
|---|---|---|---|
| Isolation | Firecracker and Cloud Hypervisor microVMs with their own kernel; GPU sandboxes use gVisor | Firecracker microVM with its own kernel and root | Full VM with its own kernel on dedicated AMD Ryzen 9 9950X hosts |
| Machine sizes | Set when the sandbox is created, up to 16 vCPU / 64 GB RAM / 100 GB disk on Pro | One size for everyone: 4 vCPU / 8 GiB with 20 GB storage; other sizes are refused | Several sizes, up to 8 vCPU / 16 GB on the $20 plan and 16 vCPU / 32 GB on $100 and above |
| Machines at once | Up to 1,000 sandboxes at once on Pro | 5 per account, and paused and stopped ones count | Fleets of 50 agents fit; new starts are rate-limited, and bursts above 90 a minute are queued |
| Docker inside | Yes, on the tensorlake/ubuntu-systemd image | Docker and Docker Compose run inside | Docker and Compose, with root and systemd |
| Nested virtualization | No: sandboxes set SANDBOX_KVM_AVAILABLE=0 | Not documented | Yes, /dev/kvm inside, so Android emulators and VMs run |
| Pause with memory | Named sandboxes suspend with memory and running processes and restore warm | Pause keeps memory and running programs; resume usually takes about a second | No: stop keeps the disk, and start boots the machine again |
| Fork and clone | Copy a running or suspended sandbox into many warm clones with memory | Fork copies a stopped machine only, disk only | Fork a running sandbox with its disk |
| Snapshots | Memory snapshots and suspend; snapshot storage billed per GB-month | Saved by hand, up to 10; saving stops a running machine first, unless the server allows a live save | Disk saved every minute and on stop, plus named snapshots of running sandboxes |
| Inbound traffic | HTTP, WebSocket and gRPC through an authenticated proxy on exposed ports | HTTPS on up to 16 ports, open to anyone with the URL; offline while the machine is paused | HTTPS on up to 50 ports, token-protected by default, plus raw TCP and a dedicated IP per machine |
| SSH | SSH into sandboxes | SSH through a gateway with short-lived certificates, paste-anywhere SSH tokens and mosh | SSH into every sandbox |
| Desktop and computer use | XFCE desktop with Firefox over VNC, with screenshot, mouse and keyboard calls | Linux desktop with a browser on one template, screenshot and click API, shareable view or control links | 60fps desktop with Chromium, computer-use and browser control, embeddable stream |
| Coding agents and API keys | You bring your own agent; stored secrets are injected into the sandbox | Templates and saved agent sign-ins; a vault writes your secrets into each machine | Claude Code, Codex, OpenCode and more preinstalled; a credentials proxy keeps real keys outside the sandbox for any HTTPS API |
| Outbound rules | Allow or deny lists by domain, IP or CIDR, or no internet at all | Not documented | No provider-side allowlist; you set your own firewall as root |
| Regions and own cloud | US and EU, or your own cloud account through BYOC | Not published | EU only: Germany, Finland, France |
Every feature Battleships tracks (43)
| Feature | Tensorlake | Instabox | boat |
|---|---|---|---|
| Full VM (own kernel) | Yes | Yes | Yes |
| Docker inside | Yes | Yes | Yes |
| Nested virtualization | No | Not published | Yes |
| Root | Yes | Yes | Yes |
| Systemd | Yes | Not published | Yes |
| Desktop GUI | Yes | Yes | Yes |
| Browser | Yes | Yes | Yes |
| Computer-use API | Yes | Yes | Yes |
| SSH | Yes | Yes | Yes |
| Persistent disk | Yes | Yes | Yes |
| Pause/resume | Yes | Yes | Yes |
| Automatic snapshots | Yes | No | Yes |
| Fork/clone | Yes | Yes | Yes |
| Live fork (no pause) | Yes | No | Yes |
| Memory fork | Yes | No | No |
| Custom image (Docker or snapshot) | Yes | Yes | Yes |
| ≥24 h sessions | Yes | Yes | Yes |
| Idle auto-stop | Yes | Yes | No |
| Wake on request | Yes | No | No |
| HTTPS preview URLs | Yes | Yes | Yes |
| Raw TCP inbound | No | Not published | Yes |
| Public IPv4 | No | No | No |
| Egress allowlist | Yes | Not published | No |
| Secret proxy | No | No | Yes |
| Secret proxy for any API | No | No | Yes |
| Preinstalled agents | No | Not published | Yes |
| Agent harness API | No | Not published | Yes |
| MCP server | No | Not published | No |
| GPU | Yes | No | No |
| Windows | No | No | No |
| Arm64 | No | Not published | No |
| Self-hosting | No | Not published | No |
| BYOC | Yes | Not published | No |
| Open source | No | No | No |
| Scoped API keys | Not published | Yes | Yes |
| Spend limits | Not published | Not published | Yes |
| Usage per sandbox (API) | No | Yes | Yes |
| Audit logs | Not published | Not published | No |
| SSO | Yes | No | No |
| SOC 2 | Yes | Not published | No |
| HIPAA | Yes | Not published | No |
| EU data residency | Yes | Not published | Yes |
| Zero data retention | Yes | Not published | Yes |
Performance
Neither Tensorlake nor Instabox has a result on the hpc-sandbox-benchmarks CPU test, so this page makes no speed claim between them. boat scored 26.69 runs/s on its Node.js build-and-test loop at 4 vCPU / 8 GB. Tensorlake's docs say its default image starts in a few hundred milliseconds, and Instabox says a new machine's shell is ready in under a second; neither has been measured here.
Node.js build-and-test loop at 4 vCPU / 8 GB, higher is better. Measured with the open hpc-sandbox-benchmarks suite. Tensorlake and Instabox have no published run in this suite yet, so there is no like-for-like number to compare.
Pricing in five scenarios
Each bill is priced from the providers' public price lists by the open Battleships engine, with the cheapest plan that runs the scenario.
| Scenario | Tensorlake, a month | Instabox, a month | boat, a month |
|---|---|---|---|
| One coding agent, workdays 4 vCPU / 8 GB, 50 GB disk, 8 hours a day, 22 days a month, files kept between days | $250 · Pro | No published price | $20 · $20/mo |
| One agent that never stops 4 vCPU / 8 GB, 50 GB disk, running 24/7 all month | $250 · Pro | No published price | $26 · $20/mo |
| 50 agents in parallel 50 machines of 4 vCPU / 8 GB at once, 8-hour sessions, 1,100 sessions a month, Docker inside | $1,030 · Pro | No published price | $317 · $20/mo × 3 seats |
| Sandboxes for your users 2 vCPU / 4 GB, 30,000 sessions of 10 minutes a month, up to 300 at once | $293 · Pro | No published price | $200 · $100/mo × 2 seats |
| 1,000 short jobs at once 2 vCPU / 4 GB, 1,000 at once, 3 minutes each, 200,000 jobs a month | $1,127 · Pro | No published price | $2,000 · $2000/mo · with limits |
Tensorlake: Pro is $250 per billing cycle, which includes $250 of usage, then $0.01 per CU. CPU is billed only while it is actively working, RAM and disk on what you allocate while running, and small users can buy prepaid packs from $5 instead.
Instabox: Instabox is free during the beta, with 5 free machines per user, and publishes no price yet ("Free until we figure it out"). No bill can be compared with Tensorlake's or boat's yet.
Instabox: Plans start at $20 a month, and the whole fee is usage credit. You pay per second while a sandbox runs, and a stopped sandbox costs nothing and keeps its disk.
Limits in those scenarios
Instabox allows 5 machines per account, paused and stopped ones included, and every machine is 4 vCPU / 8 GiB with 20 GB storage, so the 50-agent, user-sandbox and burst scenarios do not fit it today. Tensorlake's Pro plan fits every scenario, with up to 1,000 sandboxes at once, but sizes are fixed at creation, disk is 10 to 100 GiB, and an ephemeral sandbox ends after 10 idle minutes by default. boat fits all but the burst of 1,000 short jobs, because even its $2,000 plan caps starts per hour and per day.
| Scenario | Tensorlake | Instabox | boat |
|---|---|---|---|
| One coding agent, workdays | None that bite |
| None that bite |
| One agent that never stops | None that bite |
| None that bite |
| 50 agents in parallel | None that bite |
| None that bite |
| Sandboxes for your users | None that bite |
| None that bite |
| 1,000 short jobs at once | None that bite |
|
|
Which one should you use?
Use Tensorlake when
you run hundreds of sandboxes at once, fan out from a warm memory state, or need GPUs, US regions or your own cloud account.
- Fleets of a thousand. For RL rollouts and evals, Tensorlake's Pro plan runs up to 1,000 sandboxes at once, each sized when it is created.
- Warm clones with memory. Tensorlake can copy a running sandbox, memory and processes included, into many warm clones that start from one prepared state.
- GPUs, US regions and your own cloud. Tensorlake offers GPU sandboxes by request, runs in the US and EU, and can run inside your own AWS, GCP or Azure account.
Use Instabox when
you want to try a few free 4 vCPU / 8 GiB agent machines during its beta, with memory pause and mosh, and can wait for published terms.
- Free during the beta. To try things out, every Instabox account can run 5 machines of 4 vCPU / 8 GiB for free while the beta lasts.
- Pause with memory. A paused Instabox machine keeps its memory and running programs, and its docs say it usually resumes in about a second.
- SSH gateway with mosh. For people who live in a terminal, Instabox relays mosh and gives paste-anywhere SSH tokens, so a session survives sleep and network changes.
Where boat fits
If your agents do long, real work like installs, builds, tests, emulators and serving apps, look at boat. It gives each agent a full VM with /dev/kvm, coding agents built in, keys kept outside the machine and private URLs for its ports, on plans that are published today.
Run emulators and VMs inside
Tensorlake sets SANDBOX_KVM_AVAILABLE=0 and Instabox does not document /dev/kvm, so an agent testing an Android app has nowhere to boot the emulator. On boat every sandbox has /dev/kvm.
Keep API keys out of the sandbox
Tensorlake injects stored secrets into the sandbox, and Instabox's vault writes them into each machine, so one prompt injection can leak them. boat's credentials proxy keeps real keys outside for any HTTPS API.
Serve ports privately, raw TCP too
Instabox port URLs are open to anyone who finds them and go offline while paused, and Tensorlake's proxy carries only HTTP, WebSocket and gRPC. boat gives 50 token-protected HTTPS ports plus raw TCP.
Use boat when your agents do real work for hours with Docker, emulators and a desktop, need private port URLs and keys kept outside, and you want published plans today. Compare it one to one: boat vs Tensorlake and boat vs Instabox.
Questions people ask
Is Tensorlake cheaper than Instabox?
It can't be compared yet. Instabox is free during the beta and publishes no price, so there is no bill to set against Tensorlake's. Tensorlake's Pro plan is $250 a month for one coding agent on workdays in our table.
Which is faster, Tensorlake or Instabox?
Neither has a result on the CPU benchmark we use, so there is no fair speed comparison. Instabox says a new machine is ready in under a second, and Tensorlake's docs say its default image starts in a few hundred milliseconds; neither claim has been measured here.
Can Tensorlake and Instabox run Docker?
Yes. Tensorlake runs Docker on its tensorlake/ubuntu-systemd image, and Instabox runs Docker and Docker Compose inside each machine. boat runs Docker with root and systemd too.
Do they support nested virtualization?
Tensorlake does not: its sandboxes set SANDBOX_KVM_AVAILABLE=0. Instabox does not document it. boat exposes /dev/kvm, so Android emulators and VMs run inside.
How many machines can I run on Instabox?
5 per account, and paused and stopped machines count, each 4 vCPU / 8 GiB with 20 GB storage. Tensorlake's Pro plan allows up to 1,000 sandboxes at once.
Is boat SOC 2 compliant?
SOC 2 is in progress. We're open about where we stand: live status at status.ascii.dev and our data retention policy at docs.boat.dev/data-retention.
Try boat
Install the CLI, then run boat new.
7-day free trial