Vercel Sandbox vs Cloudflare Sandbox
Both run each sandbox in a Firecracker microVM with its own kernel. Vercel Sandbox saves your files when a session stops but ends every session after 24 hours; Cloudflare Sandbox lives inside Workers, sleeps when idle, wakes on the next request, and starts from a fresh disk after sleep.
The companies and products
Vercel Sandbox
Vercel is a cloud platform for web apps and agents, and Vercel Sandbox is its product for running untrusted or agent-written code in isolated Linux microVMs.
Each sandbox is a Firecracker microVM with its own kernel, started from a Vercel image, your own OCI image, or a saved snapshot. You drive it with the JavaScript or Python SDK or the sandbox CLI: run commands, move files, open ports, and set network rules. It is aimed at code interpreters, app builders, test runs and agent tools, and Vercel's docs say it is not meant to run nonstop.
Cloudflare Sandbox
Cloudflare Sandbox SDK runs untrusted or AI-generated code in Linux containers on Cloudflare's network, driven from a Cloudflare Worker.
Each sandbox is a Cloudflare Container backed by a Durable Object, and each container runs in its own Firecracker microVM with its own kernel and network. You build a linux/amd64 image, pick an instance type of up to 4 vCPU and 12 GiB, and reach the sandbox through your own Worker. It suits teams already on Workers who want short-lived sandboxes that sleep when idle; for code that only calls known methods, Cloudflare also offers Dynamic Workers, which run JavaScript in V8 isolates.
- Largest instance
- 4 vCPU, 12 GiB memory, 20 GB disk (defaults, can be raised)
- Account limits
- 1,500 vCPU, 6 TiB memory and 30 TB disk running at once
- Compliance
- Cloudflare holds a SOC 2 Type II report
Which use cases each one fits
For each use case, Battleships prices every sandbox provider on the same workload and sorts them from the cheapest monthly bill up. “22nd cheapest of 345” means 21 of the other 344 providers run that workload, with every feature it needs, for less. “With limits” means the provider runs it but misses something, so it is listed after every full match. Open a use case for its whole ranking and what each provider misses.
| Use case and its workload | Vercel Sandbox: price rank | Cloudflare Sandbox: price rank | boat: price rank |
|---|---|---|---|
| Software factory 100 at once · 4 vCPU / 8 GB · 2,200 sessions of 8 h a month Neither has a desktop or browser for an agent to check the UI it built, and Vercel stops at 24 hours while Cloudflare resets its disk on sleep; boat has both and keeps its files. | 244th of 367, with limits $3,351 a month | 162nd of 367, with limits $1,543 a month | 3rd cheapest of 367 $634 a month |
| Always-on AI employees 50 machines 24/7 · 2 vCPU / 4 GB Always-on assistants need to keep running and keep their files: Vercel stops each session at 24 hours, Cloudflare wipes the disk on sleep, and boat has no session cap on paid plans. | 257th of 366, with limits $3,657 a month | 207th of 366, with limits $2,188 a month | 5th cheapest of 366 $657 a month |
| Code interpreter bursts 100 at once · 1 vCPU / 2 GB · 200,000 sessions of 1 min a month Both fit short code-interpreter calls well, since each bills CPU only while code uses it; Cloudflare also wakes a sleeping sandbox on the next request. | 22nd cheapest of 345 $216 a month | 13th cheapest of 345 $144 a month | 186th of 345, with limits $2,000 a month |
| Sandboxes for your users 300 at once · 2 vCPU / 4 GB · 30,000 sessions of 23 min a month Both fit sandboxes for your users; on cost Cloudflare Sandbox ranks 9th, Vercel Sandbox ranks 15th and boat ranks first. | 15th cheapest of 361 $1,267 a month | 9th cheapest of 361 $731 a month | Cheapest of 361 $209 a month |
| RL rollouts 1,000 at once · 2 vCPU / 4 GB · 1,000,000 sessions of 3 min a month Vercel fits many short parallel rollouts well, while Cloudflare's 1,500 vCPU account cap makes it a compromise for large runs. | 3rd cheapest of 360 $15,761 a month | 144th of 360, with limits $9,428 a month | 34th of 360, with limits $2,000 a month |
| Agent evals 250 at once · 4 vCPU / 8 GB · 15,000 sessions of 20 min a month | 69th cheapest of 364 $1,508 a month | 45th cheapest of 364 $818 a month | 10th cheapest of 364 $200 a month |
| CI runners 40 at once · 8 vCPU / 16 GB · 6,000 sessions of 12 min a month Vercel runs Docker with sudo and fits CI; Cloudflare's 20 GB disk and Docker with iptables turned off make it a compromise, and boat gives full Docker on a full VM. | 107th cheapest of 377 $1,144 a month | 301st of 377, with limits $704 a month | 4th cheapest of 377 $86 a month |
| 24/7 dev boxes 1 machine 24/7 · 4 vCPU / 8 GB A dev box that stays up all day restarts every 24 hours on Vercel; Cloudflare has no fixed session cap, and boat keeps its disk across free stops. | 276th of 368, with limits $145 a month | 70th cheapest of 368 $93 a month | 18th cheapest of 368 $26 a month |
| Computer-use agents 50 at once · 4 vCPU / 8 GB · 20,000 sessions of 15 min a month Neither ships a desktop today, so you would build one into your image; boat streams a 60fps desktop with a computer-use API. | 235th of 369, with limits $952 a month | 166th of 369, with limits $460 a month | 6th cheapest of 369 $200 a month |
| Browser-use agents 50 at once · 2 vCPU / 4 GB · 30,000 sessions of 10 min a month | 259th of 367, with limits $486 a month | 210th of 367, with limits $233 a month | 7th cheapest of 367 $200 a month |
| Scraping & bots (startup scale) 50 at once · 1 vCPU / 2 GB · 100,000 sessions of 3 min a month | 277th of 346, with limits $468 a month | 250th of 346, with limits $286 a month | 6th cheapest of 346 $90 a month |
| Mass scraping & bots (undetectable) 1,000 at once · 1 vCPU / 2 GB · 3,000,000 sessions of 2 min a month | 234th of 338, with limits $9,960 a month | 169th of 338, with limits $5,741 a month | 71st of 338, with limits $1,800 a month |
| Parallel red teaming 200 at once · 2 vCPU / 4 GB · 5,000 sessions of 30 min a month | 283rd of 360, with limits $554 a month | 239th of 360, with limits $325 a month | 2nd cheapest of 360 $200 a month |
| GPU eval jobs 10 at once · 8 vCPU / 32 GB · 500 sessions of 30 min a month | Can't run it | Can't run it | Can't run it |
| macOS agents 5 at once · 4 vCPU / 8 GB · 1,000 sessions of 20 min a month | Can't run it | Can't run it | Can't run it |
Key features
| Feature | Vercel Sandbox | Cloudflare Sandbox | boat |
|---|---|---|---|
| Isolation | Firecracker microVM with its own kernel | Firecracker microVM per container, own kernel and network | Full VM with its own kernel on dedicated AMD Ryzen 9 9950X hosts |
| Longest session | 24 hours on Pro and Enterprise, 45 minutes on Hobby; resume starts a new session | No fixed cap; stops after inactivity and on irregular host restarts | No cap on paid plans (--no-auto-stop); default TTL 1 hour, changeable |
| Files between sessions | Filesystem snapshot on every stop, kept 30 days after last use by default | Fresh disk after sleep; snapshots (public beta) or R2 backups when your code saves them | Disk kept; snapshot every minute and on stop; a stopped sandbox costs nothing |
| Largest machine | 8 vCPU / 16 GB on Pro, 32 vCPU / 64 GB on Enterprise | 4 vCPU / 12 GiB / 20 GB disk by default (can be raised) | Up to 16 vCPU / 32 GB, depending on plan |
| Docker inside | Yes, with sudo | docker:dind with iptables and IP forwarding turned off | Full Docker, root and systemd |
| Nested virtualization | No | Not documented | Yes, /dev/kvm (Android emulators, VMs) |
| Desktop, browser, computer use | None; headless Linux only | Built-in desktop removed in SDK 0.10.2; bring your own | 60fps desktop and Chromium, computer-use and browser-control APIs, embeddable stream |
| Coding agents | Claude Code, Codex, OpenCode and pi preinstalled; you start them as commands | Run Claude Code, Codex, OpenCode or Pi in your image; OpenCode has an SDK helper | Claude Code, Codex, pi, OpenCode and more built in, with an API to prompt, steer and stream events |
| Custom images | Your own OCI images from a Dockerfile, via Vercel Container Registry | Your own linux/amd64 container image | Named snapshots (templates), shareable by code; no Dockerfile builds |
| Inbound access | Public URLs for up to 15 ports, no built-in auth; no raw TCP or public IP | HTTP and WebSocket previews routed through your Worker; no raw TCP or public IP | HTTPS URLs for up to 50 ports, token-protected by default; raw TCP; dedicated IPv6 or IPv4 |
| Egress rules | Allow-all, deny-all or a domain and CIDR allowlist, changeable while running; static IPs and VPC peering on Enterprise | allowedHosts deny-by-default list plus outbound handlers you write in Worker code | No provider-side allowlist; firewall inside the VM |
| Keys kept outside the sandbox | Credentials brokering injects headers for any HTTPS domain you allow | Your outbound handler adds the token for any HTTP or HTTPS host; you write the code | Managed proxy for model providers and any HTTPS API you register; switch a credential to another account when one runs out |
| Sleep when idle | No idle stop; a session runs until its timeout or stop() | Stops after inactivity and wakes on the next request | TTL based (1 h default, changeable); no idle timer |
| Regions | 19 regions across the US, Europe, Asia, South America, Africa and Australia | Several regions across Cloudflare's network, nearest free instance picked | EU only: Germany, Finland, France |
Every feature Battleships tracks (43)
| Feature | Vercel Sandbox | Cloudflare Sandbox | boat |
|---|---|---|---|
| Full VM (own kernel) | Yes | Yes | Yes |
| Docker inside | Yes | Yes | Yes |
| Nested virtualization | No | No | Yes |
| Root | Yes | Yes | Yes |
| Systemd | Not published | Not published | Yes |
| Desktop GUI | No | No | Yes |
| Browser | No | No | Yes |
| Computer-use API | No | No | Yes |
| SSH | No | Yes | Yes |
| Persistent disk | Yes | No | Yes |
| Pause/resume | Yes | No | Yes |
| Automatic snapshots | Yes | No | Yes |
| Fork/clone | Yes | No | Yes |
| Live fork (no pause) | Yes | No | Yes |
| Memory fork | No | No | No |
| Custom image (Docker or snapshot) | Yes | Yes | Yes |
| ≥24 h sessions | Yes | Yes | Yes |
| Idle auto-stop | No | Yes | No |
| Wake on request | No | Yes | No |
| HTTPS preview URLs | Yes | Yes | Yes |
| Raw TCP inbound | No | No | Yes |
| Public IPv4 | No | No | No |
| Egress allowlist | Yes | Yes | No |
| Secret proxy | Yes | Yes | Yes |
| Secret proxy for any API | Yes | Yes | Yes |
| Preinstalled agents | Yes | Yes | Yes |
| Agent harness API | No | Yes | Yes |
| MCP server | Yes | No | No |
| GPU | No | No | No |
| Windows | No | No | No |
| Arm64 | No | No | No |
| Self-hosting | No | No | No |
| BYOC | No | No | No |
| Open source | No | Yes | No |
| Scoped API keys | Not published | Not published | Yes |
| Spend limits | Yes | No | Yes |
| Usage per sandbox (API) | No | Not published | Yes |
| Audit logs | Not published | Yes | No |
| SSO | Yes | Yes | No |
| SOC 2 | Yes | Yes | No |
| HIPAA | Yes | Yes | No |
| EU data residency | Yes | Yes | Yes |
| Zero data retention | Not published | Not published | Yes |
Performance
On the hpc-sandbox-benchmarks Node.js build-and-test loop at 4 vCPU / 8 GB, boat did 26.69 runs per second and Vercel Sandbox did 12.96, so boat finished about twice as many runs in the same time. Cloudflare Sandbox has no result on that benchmark, so there is no comparable CPU number for it. This measures CPU speed only, not start time.
Node.js build-and-test loop at 4 vCPU / 8 GB, higher is better. Measured with the open hpc-sandbox-benchmarks suite. Cloudflare Sandbox has no published run in this suite yet, so there is no like-for-like number to compare.
Pricing in five scenarios
Each bill is priced from the providers' public price lists by the open Battleships engine, with the cheapest plan that runs the scenario.
| Scenario | Vercel Sandbox, a month | Cloudflare Sandbox, a month | boat, a month |
|---|---|---|---|
| One coding agent, workdays 4 vCPU / 8 GB, 50 GB disk, 8 hours a day, 22 days a month, files kept between days | $57 · Pro | $39 · Workers Paid · with limits | $20 · $20/mo |
| One agent that never stops 4 vCPU / 8 GB, 50 GB disk, running 24/7 all month | $236 · Pro · with limits | $148 · Workers Paid · with limits | $26 · $20/mo |
| 50 agents in parallel 50 machines of 4 vCPU / 8 GB at once, 8-hour sessions, 1,100 sessions a month, Docker inside | $2,884 · Pro | $1,660 · Workers Paid · with limits | $317 · $20/mo × 3 seats |
| Sandboxes for your users 2 vCPU / 4 GB, 30,000 sessions of 10 minutes a month, up to 300 at once | $828 · Pro | $476 · Workers Paid | $200 · $100/mo × 2 seats |
| 1,000 short jobs at once 2 vCPU / 4 GB, 1,000 at once, 3 minutes each, 200,000 jobs a month | $3,152 · Pro | $1,889 · Workers Paid · with limits | $2,000 · $2000/mo · with limits |
Vercel Sandbox: Vercel bills CPU only while your code uses it, but bills memory for the whole time the sandbox runs, idle time included, plus a small fee per sandbox created and a monthly fee per GB of snapshots. The $20 Pro credit is shared with your other Vercel usage.
Cloudflare Sandbox: Cloudflare needs Workers Paid ($5 a month minimum) and bills CPU only while busy; memory and disk are billed on the instance size until the container sleeps. There is no 4 vCPU / 8 GB size, so 4 vCPU always pays for 12 GiB, and Durable Object and Worker requests are billed on top.
Cloudflare Sandbox: boat charges a flat price per size, per second, only while the machine runs; a stopped sandbox costs nothing and keeps its disk. Plans start at $20 a month, and all of the fee is usage credit.
Limits in those scenarios
Cloudflare's disk resets after sleep, so every scenario that keeps 50 GB of files between sessions does not fit there without your own snapshot or backup code. Vercel keeps the files but ends each session at 24 hours, so one agent that never stops restarts every day. For 1,000 short jobs at once, Vercel fits, Cloudflare needs 2,000 vCPU against a 1,500 vCPU account cap that can be raised, and boat's $2,000 plan hits its start limits of 600 an hour and 2,400 a day.
| Scenario | Vercel Sandbox | Cloudflare Sandbox | boat |
|---|---|---|---|
| One coding agent, workdays | None that bite |
| None that bite |
| One agent that never stops |
|
| None that bite |
| 50 agents in parallel | None that bite |
| None that bite |
| Sandboxes for your users | None that bite | None that bite | None that bite |
| 1,000 short jobs at once | None that bite |
|
|
Which one should you use?
Use Vercel Sandbox when
you run many short bursts of untrusted code, want files saved between sessions without extra code, or need to run close to users in 19 regions.
- Files saved on every stop. Useful for work that spans days: each stop saves the filesystem, and the next session boots from it with no code from you.
- Bigger machines and more regions. One Pro sandbox can reach 8 vCPU / 16 GB, and sandboxes run in 19 regions, from Virginia to Tokyo and Sydney.
- Images from your Dockerfile. If you already have a Dockerfile, build it into an OCI image, push it to Vercel's registry and boot sandboxes into it.
Use Cloudflare Sandbox when
your app already runs on Workers and you want short sandboxes that sleep when idle, wake on the next request, and follow egress rules you write as code.
- Sleeps when idle, wakes on request. Useful for many short, spiky sessions: a sandbox sleeps when idle, wakes on the next request, and bills CPU only while busy.
- No fixed session cap. Cloudflare does not stop a container after a set runtime, so a busy sandbox can keep going past 24 hours.
- Egress rules you can program. If your app already runs on Workers, you can block every host but a list and run your own code on each outbound request.
Where boat fits
Both are built for short runs of code: Vercel ends sessions at 24 hours and Cloudflare wipes the disk when a sandbox sleeps. If your agents work for hours on one machine, with Docker, emulators, a desktop and a browser, look at boat. It gives each agent a full VM that keeps its files and runs as long as you want on paid plans.
Agents keep running and keep their files
On Vercel a long agent task is cut off at 24 hours and every process starts over. On Cloudflare the agent's cloned repo and packages vanish when it sleeps unless you write snapshot or backup code. boat saves the disk every minute, with no session cap.
A desktop and a full machine inside
Neither has a desktop or browser, so an agent cannot open the app it built, and neither offers /dev/kvm for emulators. Cloudflare also runs Docker with iptables off. boat has full Docker, systemd, /dev/kvm and a 60fps desktop with Chromium.
Agents driven from outside
On Vercel you start each agent as a plain command, and on Cloudflare you bake it into your image and write the outbound handler for its keys. boat gives you one API to prompt, steer and stream them, with keys kept in a proxy.
Use boat when your agents work for hours on one machine: builds, tests, full Docker, emulators and a desktop with a browser, on a VM that keeps its files and comes with an API to drive the agents inside from outside. Compare it one to one: boat vs Vercel Sandbox and boat vs Cloudflare Sandbox.
Questions people ask
Is Vercel Sandbox cheaper than Cloudflare Sandbox?
Cloudflare's estimate is lower in all five of our scenarios, but in four of them it does not fit as priced, mostly because its disk resets on sleep. For sandboxes for your users, where both fit, Cloudflare is $476 a month against $828 on Vercel, and boat is $200 a month.
Which is faster?
Vercel Sandbox did 12.96 runs per second on the hpc-sandbox-benchmarks Node.js loop at 4 vCPU / 8 GB, and boat did 26.69. Cloudflare Sandbox has no result on that benchmark, so we cannot compare its CPU speed.
Can they run 24/7?
Vercel sessions last up to 24 hours on Pro and Enterprise, then stop and resume from a snapshot with processes started over. Cloudflare sets no fixed runtime, but a sandbox stops when idle or on irregular host restarts and comes back with a fresh disk. boat machines run with no session cap on paid plans and keep their disk.
Can Vercel Sandbox or Cloudflare Sandbox run Docker?
Yes, both. Vercel runs Docker with sudo, and Cloudflare supports docker:dind with iptables and IP forwarding turned off, because its containers cannot change iptables. boat runs full Docker with root and systemd.
Do they keep my files?
Vercel saves a filesystem snapshot on every stop and boots the next session from it, kept 30 days after last use by default. Cloudflare starts from a fresh disk after sleep unless your code saved a snapshot (public beta) or a backup to R2. boat saves the disk every minute and on stop.
Where do they run?
Vercel Sandbox runs in 19 regions, with iad1 in the US as the default. Cloudflare places containers in several regions of its network and picks the nearest free instance. boat runs only in the EU, in Germany, Finland and France.
Try boat
Install the CLI, then run boat new.
7-day free trial
More comparisons
- boat vs Vercel Sandbox
- boat vs Cloudflare Sandbox
- E2B vs Vercel Sandbox
- Daytona vs Vercel Sandbox
- Modal vs Vercel Sandbox
- Vercel Sandbox vs Blaxel
- Vercel Sandbox vs Runloop
- Vercel Sandbox vs Tensorlake
- Vercel Sandbox vs Morph Cloud
- Vercel Sandbox vs CodeSandbox SDK
- Vercel Sandbox vs Northflank
- Vercel Sandbox vs Fly.io Machines