Tensorlake vs Northflank
Tensorlake is built around sandboxes that suspend when idle, keep their memory and copy into warm clones. Northflank runs sandboxes as one workload on a wider cloud platform with GPUs, many regions and your own cloud, but a pause keeps only attached volumes.
The companies and products
Tensorlake
Tensorlake is a San Francisco company that sells infrastructure for AI agents, with sandboxes as its main product.
Tensorlake Sandboxes are microVMs, backed by Firecracker and Cloud Hypervisor, that you create through an API and that boot in a few hundred milliseconds. Named sandboxes suspend when idle and keep their memory and running processes, and you can copy a running sandbox into several warm clones. Around them Tensorlake sells versioned file systems, hosted Git, an orchestration layer and a bring-your-own-cloud option, aimed at teams running coding agents, evals and RL rollouts.
- Headquarters
- San Francisco
- Investors shown
- Redpoint and Amplify Partners
Northflank
Northflank is a London developer platform for running services, jobs and databases on Kubernetes, and Sandboxes is its product for running untrusted code.
A Northflank sandbox is a container image deployed as a service: CPU sandboxes run in Kata microVMs with their own kernel, and GPU sandboxes run under gVisor. You create and drive them from the JavaScript or Python SDK, the CLI or the dashboard, on Northflank's cloud or inside your own. It suits teams that already want one platform for apps, databases, GPUs and sandboxes.
Which use cases each one fits
For each use case, Battleships prices every sandbox provider on the same workload and sorts them from the cheapest monthly bill up. “5th cheapest of 367” means 4 of the other 366 providers run that workload, with every feature it needs, for less. “With limits” means the provider runs it but misses something, so it is listed after every full match. Open a use case for its whole ranking and what each provider misses.
| Use case and its workload | Tensorlake: price rank | Northflank: price rank | boat: price rank |
|---|---|---|---|
| Software factory 100 at once · 4 vCPU / 8 GB · 2,200 sessions of 8 h a month Tensorlake fits a full software factory, while on Northflank packages installed outside attached volumes reset on every pause; boat keeps the whole disk and adds /dev/kvm. | 5th cheapest of 367 $1,010 a month | 159th of 367, with limits $1,477 a month | 3rd cheapest of 367 $634 a month |
| Always-on AI employees 50 machines 24/7 · 2 vCPU / 4 GB | 9th cheapest of 366 $1,381 a month | 173rd of 366, with limits $1,365 a month | 5th cheapest of 366 $657 a month |
| Code interpreter bursts 100 at once · 1 vCPU / 2 GB · 200,000 sessions of 1 min a month Both fit short code runs; Northflank's per-second plans start at a tenth of a vCPU, and Tensorlake can also restore warm from a memory snapshot. | 24th cheapest of 345 $250 a month | 84th of 345, with limits $115 a month | 186th of 345, with limits $2,000 a month |
| Sandboxes for your users 300 at once · 2 vCPU / 4 GB · 30,000 sessions of 23 min a month | 5th cheapest of 361 $471 a month | 89th of 361, with limits $815 a month | Cheapest of 361 $209 a month |
| RL rollouts 1,000 at once · 2 vCPU / 4 GB · 1,000,000 sessions of 3 min a month Tensorlake is built for RL rollouts, with 1,000 sandboxes at once on Pro and warm clones from one state; Northflank does not publish how many can run at once. | Cheapest of 360 $5,637 a month | 342nd of 360, with limits $1,762 a month | 34th of 360, with limits $2,000 a month |
| Agent evals 250 at once · 4 vCPU / 8 GB · 15,000 sessions of 20 min a month | 24th cheapest of 364 $506 a month | 134th of 364, with limits $689 a month | 10th cheapest of 364 $200 a month |
| CI runners 40 at once · 8 vCPU / 16 GB · 6,000 sessions of 12 min a month Both run fresh build machines; boat's Ryzen 9 9950X hosts are the fastest measured on the CPU benchmark, and neither Tensorlake nor Northflank has a result. | 54th cheapest of 377 $424 a month | 38th cheapest of 377 $352 a month | 4th cheapest of 377 $86 a month |
| 24/7 dev boxes 1 machine 24/7 · 4 vCPU / 8 GB Both are a compromise for a box that stays on all day: Tensorlake suspends idle sandboxes, and Northflank bills the full plan until paused, then keeps only volumes. | 185th of 368, with limits $250 a month | 151st of 368, with limits $59 a month | 18th cheapest of 368 $26 a month |
| Computer-use agents 50 at once · 4 vCPU / 8 GB · 20,000 sessions of 15 min a month Tensorlake has an XFCE desktop with Firefox over VNC for computer use, Northflank sandboxes are headless, and boat ships a 60fps desktop with Chromium. | 9th cheapest of 369 $294 a month | 151st of 369, with limits $371 a month | 6th cheapest of 369 $200 a month |
| Browser-use agents 50 at once · 2 vCPU / 4 GB · 30,000 sessions of 10 min a month Tensorlake has a browser and desktop inside its sandboxes; on Northflank you install and run a browser in your own image. | 13th cheapest of 367 $250 a month | 200th of 367, with limits $194 a month | 7th cheapest of 367 $200 a month |
| Scraping & bots (startup scale) 50 at once · 1 vCPU / 2 GB · 100,000 sessions of 3 min a month | 22nd cheapest of 346 $250 a month | 196th of 346, with limits $117 a month | 6th cheapest of 346 $90 a month |
| Mass scraping & bots (undetectable) 1,000 at once · 1 vCPU / 2 GB · 3,000,000 sessions of 2 min a month | 121st of 338, with limits $3,484 a month | 83rd of 338, with limits $2,049 a month | 71st of 338, with limits $1,800 a month |
| Parallel red teaming 200 at once · 2 vCPU / 4 GB · 5,000 sessions of 30 min a month | 4th cheapest of 360 $250 a month | 141st of 360, with limits $99 a month | 2nd cheapest of 360 $200 a month |
| GPU eval jobs 10 at once · 8 vCPU / 32 GB · 500 sessions of 30 min a month Northflank has GPU sandboxes from L4 to H100 and up billed per hour; Tensorlake offers GPUs only by request, and boat is CPU only. | Can't run it | 4th cheapest of 98 $693 a month | Can't run it |
| macOS agents 5 at once · 4 vCPU / 8 GB · 1,000 sessions of 20 min a month | Can't run it | Can't run it | Can't run it |
Key features
| Feature | Tensorlake | Northflank | boat |
|---|---|---|---|
| Isolation | Firecracker and Cloud Hypervisor microVMs with their own kernel; GPU sandboxes use gVisor | Kata microVM with its own kernel for CPU; gVisor for GPU | Full VM with its own kernel on dedicated AMD Ryzen 9 9950X hosts |
| What survives a stop | Named sandboxes suspend with memory and running processes, billed as snapshot storage | Only attached volumes, which bill while paused; the rest of the disk and all processes reset | The whole disk, saved every minute and on stop; a stopped sandbox costs nothing |
| Idle handling | Idle timeout, 600 s by default, then suspend or terminate | No idle auto-pause: the plan bills until you pause it | Time-to-live (1 h by default, changeable or off); no idle timer |
| Clone a running sandbox | Copy a running or suspended sandbox into N warm clones with memory | Filesystem snapshots of a running or stopping sandbox, opt-in; restore into a new one | Fork a running sandbox (disk) |
| Nested virtualization | No: sandboxes set SANDBOX_KVM_AVAILABLE=0 | Not documented inside a sandbox | Yes, /dev/kvm inside, so Android emulators and VMs run |
| Docker inside | Yes, on the tensorlake/ubuntu-systemd image | Yes, each sandbox has its own kernel | Yes, with root and systemd |
| Desktop and computer use | XFCE desktop with Firefox over VNC, with screenshot, mouse and keyboard calls | Headless; access by SDK, browser terminal or SSH | 60fps desktop and Chromium, computer-use and browser control, embeddable stream |
| Coding agents | You bring and run your own agent; managed images are plain OS bases | Harnesses with Claude Code, Codex, Cursor, OpenCode or Pi; you reach the agent through a terminal or SSH | Seven agents preinstalled, with a prompt, steer and events API |
| Keeping API keys out of the sandbox | Stored secrets are injected into the sandbox | Header injection for listed hosts in the network policy API; otherwise secrets are env vars or files | Credentials proxy for model providers and any HTTPS API; real keys never enter the sandbox |
| Inbound access | HTTP, WebSocket and gRPC through an authenticated proxy; no raw TCP | HTTPS ports on a code.run domain, private by default; public TCP and UDP need a separate load balancer | HTTPS URLs for up to 50 ports, token-protected, plus raw TCP and a dedicated IP per machine |
| Outbound rules | allow_out and deny_out lists by domain, IP or CIDR, or no internet at all | Network policies with allow lists by IP, CIDR or domain, documented for your own cluster | No provider-side allowlist; you set your own firewall as root |
| GPUs | GPU sandboxes by request (H100 shown in the docs) | L4, A100, H100, RTX PRO 6000 and more, billed per hour | None |
| Regions | US and EU | US, Canada, Brazil, UK, EU, Switzerland, Asia, Australia and South Africa | EU only: Germany, Finland, France |
| Your own cloud | BYOC on AWS, GCP, Azure, CoreWeave, Nebius and bare metal | Your own AWS, GCP, Azure, Oracle, CoreWeave and others, or the control plane in your VPC on Enterprise | No |
Every feature Battleships tracks (43)
| Feature | Tensorlake | Northflank | boat |
|---|---|---|---|
| Full VM (own kernel) | Yes | Yes | Yes |
| Docker inside | Yes | Yes | Yes |
| Nested virtualization | No | No | Yes |
| Root | Yes | Not published | Yes |
| Systemd | Yes | Not published | Yes |
| Desktop GUI | Yes | No | Yes |
| Browser | Yes | No | Yes |
| Computer-use API | Yes | No | Yes |
| SSH | Yes | Yes | Yes |
| Persistent disk | Yes | Yes | Yes |
| Pause/resume | Yes | Yes | Yes |
| Automatic snapshots | Yes | Yes | Yes |
| Fork/clone | Yes | Yes | Yes |
| Live fork (no pause) | Yes | Yes | Yes |
| Memory fork | Yes | No | No |
| Custom image (Docker or snapshot) | Yes | Yes | Yes |
| ≥24 h sessions | Yes | Yes | Yes |
| Idle auto-stop | Yes | No | No |
| Wake on request | Yes | No | No |
| HTTPS preview URLs | Yes | Yes | Yes |
| Raw TCP inbound | No | Yes | Yes |
| Public IPv4 | No | No | No |
| Egress allowlist | Yes | Yes | No |
| Secret proxy | No | Yes | Yes |
| Secret proxy for any API | No | Yes | Yes |
| Preinstalled agents | No | Yes | Yes |
| Agent harness API | No | No | Yes |
| MCP server | No | No | No |
| GPU | Yes | Yes | No |
| Windows | No | No | No |
| Arm64 | No | Yes | No |
| Self-hosting | No | Yes | No |
| BYOC | Yes | Yes | No |
| Open source | No | No | No |
| Scoped API keys | Not published | Not published | Yes |
| Spend limits | Not published | Not published | Yes |
| Usage per sandbox (API) | No | Yes | Yes |
| Audit logs | Not published | Yes | No |
| SSO | Yes | Yes | No |
| SOC 2 | Yes | Yes | No |
| HIPAA | Yes | Yes | No |
| EU data residency | Yes | Yes | Yes |
| Zero data retention | Yes | Not published | Yes |
Performance
Neither Tensorlake nor Northflank has a result on the hpc-sandbox-benchmarks Node.js build-and-test loop, so there is no comparable CPU measurement between them. boat did 26.69 runs per second on that test at 4 vCPU / 8 GB, on dedicated AMD Ryzen 9 9950X hosts, the fastest result measured. Tensorlake's own docs say its default image starts in a few hundred milliseconds.
Node.js build-and-test loop at 4 vCPU / 8 GB, higher is better. Measured with the open hpc-sandbox-benchmarks suite. Tensorlake and Northflank have no published run in this suite yet, so there is no like-for-like number to compare.
Pricing in five scenarios
Each bill is priced from the providers' public price lists by the open Battleships engine, with the cheapest plan that runs the scenario.
| Scenario | Tensorlake, a month | Northflank, a month | boat, a month |
|---|---|---|---|
| One coding agent, workdays 4 vCPU / 8 GB, 50 GB disk, 8 hours a day, 22 days a month, files kept between days | $250 · Pro | $32 · Developer Sandbox (free tier) · with limits | $20 · $20/mo |
| One agent that never stops 4 vCPU / 8 GB, 50 GB disk, running 24/7 all month | $250 · Pro | $108 · Developer Sandbox (free tier) · with limits | $26 · $20/mo |
| 50 agents in parallel 50 machines of 4 vCPU / 8 GB at once, 8-hour sessions, 1,100 sessions a month, Docker inside | $1,030 · Pro | $1,322 · Developer Sandbox (free tier) · with limits | $317 · $20/mo × 3 seats |
| Sandboxes for your users 2 vCPU / 4 GB, 30,000 sessions of 10 minutes a month, up to 300 at once | $293 · Pro | $361 · Developer Sandbox (free tier) · with limits | $200 · $100/mo × 2 seats |
| 1,000 short jobs at once 2 vCPU / 4 GB, 1,000 at once, 3 minutes each, 200,000 jobs a month | $1,127 · Pro | $688 · Developer Sandbox (free tier) · with limits | $2,000 · $2000/mo · with limits |
Tensorlake: Pro is $250 per billing cycle, which includes $250 of usage, then $0.01 per CU. CPU is billed only while it is actively working, RAM and disk on what you allocate while running, and a suspended sandbox pays snapshot storage.
Tensorlake: Small users can skip Pro and buy prepaid Usage Credits packs from $5 at higher rates; sandboxes stop when the balance hits zero. The tables price the Pro path, so they overstate very small workloads.
Northflank: Northflank bills per second for the plan size you pick, with no monthly fee, until you pause the sandbox; there is no idle auto-pause. Volumes cost $0.15 per GB a month even while paused, and outbound traffic costs $0.06 per GB.
Northflank: Plans start at $20 a month, and the whole fee becomes usage credit. Running time is billed per second, and a stopped sandbox costs nothing while its whole disk is kept.
Limits in those scenarios
On Northflank the limit that bites in every scenario is what survives a stop: only attached volumes keep their files, so packages installed anywhere else reset. Northflank also does not publish how many sandboxes can run at once, so 300 or 1,000 at a time is not confirmed. Tensorlake fits all five scenarios on Pro, which allows 1,000 sandboxes at once, though its prepaid Usage Credits plan caps each sandbox at 4 vCPU / 16 GB and 24-hour sessions. boat's limit is the burst: even the $2,000 plan queues starts above 90 a minute.
| Scenario | Tensorlake | Northflank | boat |
|---|---|---|---|
| One coding agent, workdays | None that bite |
| None that bite |
| One agent that never stops | None that bite |
| None that bite |
| 50 agents in parallel | None that bite |
| None that bite |
| Sandboxes for your users | None that bite |
| None that bite |
| 1,000 short jobs at once | None that bite |
|
|
Which one should you use?
Use Tensorlake when
you fan out many short rollouts or evals from one warm state, need agents to resume mid-process with their memory, or want idle sandboxes to suspend on their own.
- Memory snapshots and warm clones. For agents that must pick up mid-process, Tensorlake saves a sandbox's memory and copies it into many warm clones.
- Idle sandboxes go to sleep. Tensorlake suspends a named sandbox after 10 idle minutes by default, so a forgotten sandbox stops paying for compute.
- Large fan-out with a published limit. Tensorlake Pro allows 1,000 sandboxes at once, which suits RL rollouts and evals that start many runs together.
Use Northflank when
you need GPUs next to the agent, regions outside Europe and the US, or sandboxes on the same platform as your apps, jobs and databases.
- GPU sandboxes. For agents that train or run models, Northflank has GPU sandboxes from L4 and A100 up to H100, billed per hour.
- Regions around the world. For users far from Europe and the US, Northflank also runs in Asia, Australia, South America and Africa.
- One platform for apps and sandboxes. For teams that want services, jobs, databases and sandboxes in one place, billed per second with no monthly fee.
Where boat fits
If your agents do long work on one machine, installing packages, running Docker, emulators and a desktop, look at boat. It gives each agent a full VM that keeps its whole disk, with coding agents built in that you drive from outside, keys kept out of the machine, and HTTPS on 50 ports plus raw TCP. Tensorlake still wins on warm memory snapshots, and Northflank on GPUs and regions.
The whole disk comes back, and stops are free
On Northflank a pause wipes everything outside attached volumes, which still bill while paused. On Tensorlake a suspended sandbox pays snapshot storage, and an ephemeral one ends after 10 idle minutes. boat saves the whole disk every minute and on stop.
Emulators, VMs and a 60fps desktop inside
Tensorlake sandboxes set SANDBOX_KVM_AVAILABLE=0 and Northflank does not document /dev/kvm, so an Android emulator has nowhere to run. Northflank is headless and Tensorlake streams a VNC desktop; boat ships a 60fps desktop with Chromium.
Agents driven from outside, keys kept outside
On Tensorlake you install your own agent and its secrets are injected into the sandbox. Northflank Harnesses are reached through a terminal or SSH. boat preinstalls seven agents with a prompt, steer and events API, and a proxy keeps keys outside.
Use boat when your agents work on one machine for hours or days and should find it as they left it: installs, Docker, emulators and a desktop, with coding agents built in and keys kept outside the machine. Compare it one to one: boat vs Tensorlake and boat vs Northflank.
Questions people ask
Is Tensorlake cheaper than Northflank?
It depends on scale. Tensorlake Pro has a $250 monthly minimum, so one coding agent on workdays is $250 on Tensorlake against $32 on Northflank, though Northflank keeps only files on attached volumes. 50 agents in parallel is $1,030 on Tensorlake and $1,322 on Northflank, while 1,000 short jobs at once is $1,127 against $688.
Which is faster, Tensorlake or Northflank?
Neither has a result on the hpc-sandbox-benchmarks CPU test, so there is no fair speed comparison between them. boat did 26.69 runs per second on that test. Tensorlake's docs say its default image starts in a few hundred milliseconds.
Do Tensorlake and Northflank keep memory when a sandbox stops?
Tensorlake does: named sandboxes suspend with memory and running processes, and memory snapshots restore warm. Northflank keeps only attached volumes when paused, and the rest of the disk and all processes are lost. boat keeps the whole disk, but a resume boots the machine again.
Can Tensorlake and Northflank run Docker or Android emulators?
Both run Docker inside, Tensorlake on its ubuntu-systemd image. Neither offers nested virtualization: Tensorlake sets SANDBOX_KVM_AVAILABLE=0 and Northflank does not document it. boat exposes /dev/kvm, so Android emulators and VMs run inside.
Which one has GPUs?
Northflank has GPU sandboxes with L4, A100, H100, RTX PRO 6000 and more, billed per hour. Tensorlake offers GPU sandboxes by request, with no published rate. boat has no GPUs.
Where do Tensorlake and Northflank run?
Tensorlake runs in the US and the EU, or in your own cloud account through BYOC. Northflank runs in many regions from the US and Canada to Asia, Australia and South Africa, and also in your own cloud. boat runs only in the EU, in Germany, Finland and France.
Try boat
Install the CLI, then run boat new.
7-day free trial