Tensorlake vs Islo
Both give each agent a microVM with its own kernel. Tensorlake is built for fanning out many warm clones at once, with GPUs and a desktop, while Islo is built around coding agents it preinstalls and a gateway that controls and logs every outbound call.
The companies and products
Tensorlake
Tensorlake is a San Francisco company that sells infrastructure for AI agents, with sandboxes as its main product.
Tensorlake Sandboxes are microVMs, backed by Firecracker and Cloud Hypervisor, that you create through an API and that boot in a few hundred milliseconds. Named sandboxes suspend when idle and keep their memory and running processes, and you can copy a running sandbox into several warm clones. Around them Tensorlake sells versioned file systems, hosted Git, an orchestration layer and a bring-your-own-cloud option, aimed at teams running coding agents, evals and RL rollouts.
- Headquarters
- San Francisco
- Investors shown
- Redpoint and Amplify Partners
Islo
Islo is an agent sandbox from Incredibuild: each coding agent gets its own microVM, with network rules and credentials handled at a gateway.
An Islo sandbox is a Linux microVM with its own kernel, built from a container image, with Claude Code, Cursor CLI and Codex preinstalled. Outbound traffic can pass through a gateway that allows or blocks hosts, injects credentials and logs every request. It is built for teams that run coding agents, evals and RL rollouts in the background, on Islo's cloud or in their own cloud account.
- Launched
- May 4, 2026
Which use cases each one fits
For each use case, Battleships prices every sandbox provider on the same workload and sorts them from the cheapest monthly bill up. “5th cheapest of 367” means 4 of the other 366 providers run that workload, with every feature it needs, for less. “With limits” means the provider runs it but misses something, so it is listed after every full match. Open a use case for its whole ranking and what each provider misses.
| Use case and its workload | Tensorlake: price rank | Islo: price rank | boat: price rank |
|---|---|---|---|
| Software factory 100 at once · 4 vCPU / 8 GB · 2,200 sessions of 8 h a month Tensorlake fits a full software factory and Islo is a compromise there; boat adds /dev/kvm for emulators and preinstalled coding agents. | 5th cheapest of 367 $1,010 a month | 326th of 367, with limits $7,402 a month | 3rd cheapest of 367 $634 a month |
| Always-on AI employees 50 machines 24/7 · 2 vCPU / 4 GB All three fit always-on assistants; Tensorlake and Islo can both pause an idle one with its memory, and boat keeps the machine on with no session cap. | 9th cheapest of 366 $1,381 a month | 30th cheapest of 366 $9,928 a month | 5th cheapest of 366 $657 a month |
| Code interpreter bursts 100 at once · 1 vCPU / 2 GB · 200,000 sessions of 1 min a month | 24th cheapest of 345 $250 a month | 153rd of 345, with limits $503 a month | 186th of 345, with limits $2,000 a month |
| Sandboxes for your users 300 at once · 2 vCPU / 4 GB · 30,000 sessions of 23 min a month Tensorlake allows 1,000 sandboxes at once on Pro, while Islo's Team plan is reported at 50, so 300 sandboxes for your users needs a custom limit on Islo. | 5th cheapest of 361 $471 a month | 171st of 361, with limits $3,160 a month | Cheapest of 361 $209 a month |
| RL rollouts 1,000 at once · 2 vCPU / 4 GB · 1,000,000 sessions of 3 min a month Tensorlake is built for RL rollouts at a thousand at a time from warm clones; Islo's 50-sandbox cap and boat's start-rate limits make it a compromise. | Cheapest of 360 $5,637 a month | 167th of 360, with limits $15,265 a month | 34th of 360, with limits $2,000 a month |
| Agent evals 250 at once · 4 vCPU / 8 GB · 15,000 sessions of 20 min a month Islo has a built-in Harbor integration and gateway rules that stop trials from looking up answers; Tensorlake and boat run more trials at once. | 24th cheapest of 364 $506 a month | 198th of 364, with limits $2,456 a month | 10th cheapest of 364 $200 a month |
| CI runners 40 at once · 8 vCPU / 16 GB · 6,000 sessions of 12 min a month | 54th cheapest of 377 $424 a month | 119th cheapest of 377 $1,507 a month | 4th cheapest of 377 $86 a month |
| 24/7 dev boxes 1 machine 24/7 · 4 vCPU / 8 GB Islo and boat fit a box that stays on all day better, since Tensorlake's model is built around suspending idle sandboxes. | 185th of 368, with limits $250 a month | 112th cheapest of 368 $402 a month | 18th cheapest of 368 $26 a month |
| Computer-use agents 50 at once · 4 vCPU / 8 GB · 20,000 sessions of 15 min a month Tensorlake has an XFCE desktop over VNC with mouse and keyboard calls, Islo has no desktop, and boat streams a 60fps desktop with Chromium. | 9th cheapest of 369 $294 a month | 310th of 369, with limits $2,210 a month | 6th cheapest of 369 $200 a month |
| Browser-use agents 50 at once · 2 vCPU / 4 GB · 30,000 sessions of 10 min a month | 13th cheapest of 367 $250 a month | 113th of 367, with limits $1,105 a month | 7th cheapest of 367 $200 a month |
| Scraping & bots (startup scale) 50 at once · 1 vCPU / 2 GB · 100,000 sessions of 3 min a month | 22nd cheapest of 346 $250 a month | 66th cheapest of 346 $748 a month | 6th cheapest of 346 $90 a month |
| Mass scraping & bots (undetectable) 1,000 at once · 1 vCPU / 2 GB · 3,000,000 sessions of 2 min a month | 121st of 338, with limits $3,484 a month | 265th of 338, with limits $14,966 a month | 71st of 338, with limits $1,800 a month |
| Parallel red teaming 200 at once · 2 vCPU / 4 GB · 5,000 sessions of 30 min a month All three give root in a real kernel; boat adds raw TCP inbound and nested virtualization for tools that need them. | 4th cheapest of 360 $250 a month | 47th of 360, with limits $746 a month | 2nd cheapest of 360 $200 a month |
| GPU eval jobs 10 at once · 8 vCPU / 32 GB · 500 sessions of 30 min a month | Can't run it | Can't run it | Can't run it |
| macOS agents 5 at once · 4 vCPU / 8 GB · 1,000 sessions of 20 min a month | Can't run it | Can't run it | Can't run it |
Key features
| Feature | Tensorlake | Islo | boat |
|---|---|---|---|
| Isolation | Firecracker and Cloud Hypervisor microVMs with their own kernel; GPU sandboxes use gVisor | A microVM with its own kernel for each sandbox, built from a container image | Full VM with its own kernel on dedicated AMD Ryzen 9 9950X hosts |
| Nested virtualization | No: sandboxes set SANDBOX_KVM_AVAILABLE=0 | No /dev/kvm or nested virtualization documented | Yes, /dev/kvm inside, so Android emulators and VMs run |
| Docker inside | Yes, on the tensorlake/ubuntu-systemd image | Yes, with sudo | Yes, with root and systemd |
| Pause with memory | Named sandboxes suspend with memory and running processes and restore warm | Pause keeps files, processes and memory; resumes on the next exec, file access or webhook | No: disk is saved every minute and on stop, and resume reboots the machine |
| Clone a running sandbox | Copy a running or suspended sandbox into N warm clones with memory | Snapshot a running sandbox's files, then start new sandboxes from it | Fork a running sandbox (disk) |
| Desktop and computer use | XFCE desktop with Firefox over VNC, with screenshot, mouse and keyboard calls | A browser inside the sandbox for testing; no desktop or computer-use API | 60fps desktop and Chromium, computer use and browser control, embeddable stream |
| Coding agents | You bring and run your own agent; managed images are plain OS bases | Claude Code, Cursor CLI and Codex preinstalled; factory lines with events, steer and follow-ups | Claude Code, Codex, OpenCode and more preinstalled, with a prompt, steer and events API |
| Keeping keys out of the sandbox | Stored secrets are injected into the sandbox | Gateway injects stored credentials into outbound requests; credentials never reach the sandbox | AI credentials proxy for model providers and any HTTPS API you register |
| Inbound traffic | HTTP, WebSocket and gRPC through an authenticated proxy on exposed ports | HTTPS share links anyone with the URL can open, expiring after 24 hours by default; SSH and port-forward through the CLI | HTTPS URLs for up to 50 ports, token-protected, plus raw TCP and a dedicated IP per machine |
| Outbound rules | allow_out and deny_out lists by domain, IP or CIDR, or no internet at all | Gateway rules by host, path and HTTP method, with default deny, rate limits and content filters | Open internet; no provider-side allowlist, you set your own firewall as root |
| Request logs | No per-request outbound log documented | Per-request gateway logs of what each agent called and what was blocked, streamed to your SIEM | Usage API and spend limits; no per-request log of outbound calls |
| Sandboxes at once | 1,000 on Pro; more on Enterprise | Free 5 and Team 50 running sandboxes per launch coverage; more by contract | 100 to 2,000 running sandboxes by plan, raised by adding seats |
| GPUs | GPU sandboxes by request (H100 shown in the docs) | None | None |
| Where it runs | US and EU, or your own cloud account through BYOC | US West, or inside your own cloud account with BYOC | EU only: Germany, Finland, France, with EU data residency |
Every feature Battleships tracks (43)
| Feature | Tensorlake | Islo | boat |
|---|---|---|---|
| Full VM (own kernel) | Yes | Yes | Yes |
| Docker inside | Yes | Yes | Yes |
| Nested virtualization | No | No | Yes |
| Root | Yes | Yes | Yes |
| Systemd | Yes | Not published | Yes |
| Desktop GUI | Yes | No | Yes |
| Browser | Yes | Yes | Yes |
| Computer-use API | Yes | No | Yes |
| SSH | Yes | Yes | Yes |
| Persistent disk | Yes | Yes | Yes |
| Pause/resume | Yes | Yes | Yes |
| Automatic snapshots | Yes | Yes | Yes |
| Fork/clone | Yes | Yes | Yes |
| Live fork (no pause) | Yes | Yes | Yes |
| Memory fork | Yes | No | No |
| Custom image (Docker or snapshot) | Yes | Yes | Yes |
| ≥24 h sessions | Yes | Yes | Yes |
| Idle auto-stop | Yes | Yes | No |
| Wake on request | Yes | Yes | No |
| HTTPS preview URLs | Yes | Yes | Yes |
| Raw TCP inbound | No | No | Yes |
| Public IPv4 | No | No | No |
| Egress allowlist | Yes | Yes | No |
| Secret proxy | No | Yes | Yes |
| Secret proxy for any API | No | Yes | Yes |
| Preinstalled agents | No | Yes | Yes |
| Agent harness API | No | Yes | Yes |
| MCP server | No | No | No |
| GPU | Yes | No | No |
| Windows | No | No | No |
| Arm64 | No | No | No |
| Self-hosting | No | No | No |
| BYOC | Yes | Yes | No |
| Open source | No | No | No |
| Scoped API keys | Not published | Not published | Yes |
| Spend limits | Not published | Not published | Yes |
| Usage per sandbox (API) | No | Yes | Yes |
| Audit logs | Not published | Yes | No |
| SSO | Yes | Yes | No |
| SOC 2 | Yes | Not published | No |
| HIPAA | Yes | Not published | No |
| EU data residency | Yes | No | Yes |
| Zero data retention | Yes | Not published | Yes |
Performance
There is no comparable CPU measurement for Tensorlake or Islo: neither has a published result on the hpc-sandbox-benchmarks Node.js build-and-test loop. boat scores 26.69 runs/s on it at 4 vCPU / 8 GB, on dedicated AMD Ryzen 9 9950X hosts. Tensorlake's docs say its default image starts in a few hundred milliseconds.
Node.js build-and-test loop at 4 vCPU / 8 GB, higher is better. Measured with the open hpc-sandbox-benchmarks suite. Tensorlake and Islo have no published run in this suite yet, so there is no like-for-like number to compare.
Pricing in five scenarios
Each bill is priced from the providers' public price lists by the open Battleships engine, with the cheapest plan that runs the scenario.
| Scenario | Tensorlake, a month | Islo, a month | boat, a month |
|---|---|---|---|
| One coding agent, workdays 4 vCPU / 8 GB, 50 GB disk, 8 hours a day, 22 days a month, files kept between days | $250 · Pro | $101 · Free | $20 · $20/mo |
| One agent that never stops 4 vCPU / 8 GB, 50 GB disk, running 24/7 all month | $250 · Pro | $420 · Free | $26 · $20/mo |
| 50 agents in parallel 50 machines of 4 vCPU / 8 GB at once, 8-hour sessions, 1,100 sessions a month, Docker inside | $1,030 · Pro | $4,863 · Team | $317 · $20/mo × 3 seats |
| Sandboxes for your users 2 vCPU / 4 GB, 30,000 sessions of 10 minutes a month, up to 300 at once | $293 · Pro | $1,382 · Team · with limits | $200 · $100/mo × 2 seats |
| 1,000 short jobs at once 2 vCPU / 4 GB, 1,000 at once, 3 minutes each, 200,000 jobs a month | $1,127 · Pro | $3,053 · Team · with limits | $2,000 · $2000/mo · with limits |
Tensorlake: Pro is $250 per billing cycle, which includes 25,000 CU of usage, then $0.01 per CU. CPU is billed only while it is actively working, RAM and disk on what you allocate while running, and small users can buy prepaid packs from $5 instead.
Islo: Islo bills each CPU core and each GB of memory and disk while a sandbox runs, per hour, with no plan fee. An idle sandbox keeps billing until a pause-after-idle timer fires, which can only be set at creation, and egress has no published price.
Islo: You pick a monthly plan from $20, and the whole fee becomes usage credit spent per second on running sandboxes. A stopped sandbox costs nothing and keeps its disk.
Limits in those scenarios
Islo's Team plan is reported at 50 running sandboxes at once, so 300 sandboxes for your users and 1,000 short jobs at once do not fit without a custom contract. Tensorlake's Pro plan allows 1,000 at once, so both of those fit there. Islo publishes no egress price, so its totals leave egress out. boat's limit is how fast new machines start, so the 1,000-job burst gets queued even on the $2,000 plan.
| Scenario | Tensorlake | Islo | boat |
|---|---|---|---|
| One coding agent, workdays | None that bite |
| None that bite |
| One agent that never stops | None that bite |
| None that bite |
| 50 agents in parallel | None that bite |
| None that bite |
| Sandboxes for your users | None that bite |
| None that bite |
| 1,000 short jobs at once | None that bite |
|
|
Which one should you use?
Use Tensorlake when
you fan out about a thousand short rollouts from one warm state, need GPUs or a US or EU region, or want sandboxes in your own cloud account.
- Warm clones for big fan-outs. Useful for RL and evals: Tensorlake copies one prepared sandbox, memory included, into many warm clones, up to 1,000 at once on Pro.
- GPUs and a desktop. Tensorlake offers GPU sandboxes by request and an XFCE desktop with screenshot, mouse and keyboard calls for computer use.
- US and EU regions. Useful if your data must sit in the EU or the US: Tensorlake runs in both, or in your own cloud account.
Use Islo when
you want coding agents preinstalled, per-host egress rules with a log of every outbound call, and pay-as-you-go billing with no plan fee.
- Egress rules and request logs. Useful if you must control what agents reach: Islo allows or blocks each host, path and method, and logs every call.
- Coding agents and keys handled for you. Islo preinstalls Claude Code, Cursor CLI and Codex, and its gateway adds credentials to requests so keys never reach the sandbox.
- No plan fee. Useful for light use: Islo bills cores, memory and disk per hour with no plan fee, while Tensorlake Pro starts at a fixed monthly fee.
Where boat fits
Tensorlake and Islo are both microVM sandboxes made for agents, and each is strong at one thing: warm fan-outs on Tensorlake, egress control on Islo. If your agents do long real work, like builds, emulators, a visible desktop and services other people connect to, boat gives each one a full VM in the EU that does all of that.
Emulators and VMs run inside
Tensorlake sets SANDBOX_KVM_AVAILABLE=0 and Islo documents no /dev/kvm, so an agent testing an Android app or starting its own VM stops at the first boot. boat exposes /dev/kvm on every machine.
Ports you can host on
Tensorlake's proxy carries only HTTP, WebSocket and gRPC, and Islo's share links are open to anyone with the URL and expire after 24 hours by default. boat gives 50 token-protected HTTPS ports plus raw TCP.
A desktop your users can watch
Islo has no screen, so you would install a VNC stack yourself in each image. Tensorlake offers a VNC desktop with Firefox; boat streams a 60fps desktop with Chromium that you can embed in your app.
Use boat when your agents do real work for hours on a full VM: Docker, emulators with /dev/kvm, a 60fps desktop, ports others can reach, and keys kept outside the machine. Compare it one to one: boat vs Tensorlake and boat vs Islo.
Questions people ask
Is Tensorlake cheaper than Islo?
It depends on how much you run. One coding agent on workdays comes to $101 a month on Islo and $250 on Tensorlake Pro, but one agent running all month is $250 on Tensorlake against $420 on Islo, and 50 agents in parallel is $1,030 against $4,863. boat comes to $20, $26 and $317 a month for the same three.
Which is faster, Tensorlake or Islo?
Neither has a published CPU benchmark result, so there is no fair speed comparison between them. boat scores 26.69 runs/s on the hpc-sandbox-benchmarks Node.js loop at 4 vCPU / 8 GB.
Can Tensorlake and Islo run Docker?
Yes, both run Docker inside their microVMs. Neither offers nested virtualization: Tensorlake sets SANDBOX_KVM_AVAILABLE=0 and Islo documents no /dev/kvm. boat runs Docker, systemd and /dev/kvm on every machine.
Which one has a desktop for computer use?
Tensorlake has an XFCE desktop with Firefox over VNC, with screenshot, mouse and keyboard calls. Islo sandboxes are headless with a browser for testing. boat streams a 60fps desktop with Chromium and has a computer-use API.
Can I limit what an agent reaches on the internet?
On both. Tensorlake has allow and deny lists by domain, IP or CIDR, or no internet at all. Islo's gateway goes further, with rules by host, path and HTTP method and a log of every request; boat has open internet and leaves filtering to your own firewall.
Where do Tensorlake and Islo run?
Tensorlake runs in the US and the EU, and Islo runs in US West; both can also run in your own cloud account through BYOC. boat runs only in the EU, in Germany, Finland and France.
Try boat
Install the CLI, then run boat new.
7-day free trial