CompareHead to head
E2B vs Cloudflare Sandbox
E2B: Firecracker microVMs and templates for agent code, sold per running second. Cloudflare Sandbox: A Worker that starts a Firecracker microVM, with no public port, no region pinning, and a disk that is wiped when the instance stops.
Short answer: E2B is the cheaper fit for 1 of 9 common workloads and Cloudflare Sandbox for 2; for the rest neither runs it as described or they cost the same. E2B offers 36 of 78 checked capabilities without a catch, Cloudflare Sandbox 24; they differ on 44. Prices checked 29 October 2026.
What each costs
Monthly machine cost at list prices, before any AI model. A catch means it cannot run the workload exactly as described.
| Workload | E2B | Cloudflare Sandbox |
|---|---|---|
| A personal agent that stays on (Hermes, OpenClaw) | $270.89 on Pro Catch: Sessions end after 24 hours, so an always-on machine has to be restarted by your own code. | $99.41 on Workers Paid Catch: A stopped instance loses its disk; files have to be backed up to R2 or a snapshot and restored. |
| A coding agent for one developer | $202.99 on Pro Catch: 40 GiB of disk is over the 20 GiB limit. | $24.20 on Workers Paid Catch: No size with 4 vCPU allows 40 GiB of disk; the most is 20 GiB on standard-4. A stopped instance loses its disk; files have to be backed up to R2 or a snapshot and restored. |
| A code interpreter inside your product | $55.20 on Hobby | $37.78 on Workers Paid |
| A browser agent for a small team | $828.00 on Hobby | $406.03 on Workers Paid |
| Self-hosted n8n for a small team | $270.89 on Pro Catch: Sessions end after 24 hours, so an always-on machine has to be restarted by your own code. | $98.99 on Workers Paid Catch: A stopped instance loses its disk; files have to be backed up to R2 or a snapshot and restored. |
| A Discord or Slack bot for one server | $60.44 on Hobby Catch: Sessions end after 1 hour, so an always-on machine has to be restarted by your own code. | $47.48 on Workers Paid Catch: A stopped instance loses its disk; files have to be backed up to R2 or a snapshot and restored. |
| Claude Code for a team of five | $414.96 on Pro Catch: 40 GiB of disk is over the 20 GiB limit. | $102.54 on Workers Paid Catch: No size with 4 vCPU allows 40 GiB of disk; the most is 20 GiB on standard-4. A stopped instance loses its disk; files have to be backed up to R2 or a snapshot and restored. |
| A scraper that runs four times a day | $1.66 on Hobby | $5.99 on Workers Paid |
| Your own remote MCP server | $48.62 on Hobby Catch: Sessions end after 1 hour, so an always-on machine has to be restarted by your own code. | $46.95 on Workers Paid Catch: A stopped instance loses its disk; files have to be backed up to R2 or a snapshot and restored. |
Feature by feature
The figure that decides each feature, from each provider's own pages.
| Feature | E2B | Cloudflare Sandbox |
|---|---|---|
| Isolation | Yes Firecracker; non-root user | Yes Firecracker; all root |
| Sizes and regions | Partly 8 vCPU / 8 GiB; no GPU | Partly 4 vCPU / 12 GiB / 20 GB |
| Lifecycle | Partly RAM + disk | No No pause; stop wipes disk |
| Snapshots and forks | Yes RAM + disk; 20 forks | Partly Filesystem only; 30 days |
| Storage | Partly 10–20 GiB; volumes in beta | Partly 20 GB; wiped on stop |
| Idle and waking | Partly 5 min, then killed | Partly No default; 6 h max |
| Reaching it | Partly No auth | Partly No public port |
| Custom domains | Partly Own proxy in front | Partly Worker route + DNS |
| Outbound network | Yes No rate; no static IP | Partly 1 TB a month, then $0.025/GB |
| Keys and secrets | Yes No, proxy | Yes No, Worker injects |
| Ways to drive it | Yes No; SDK | Partly No; Worker code |
| Built-in agents | Partly None preinstalled; guides | Partly None; guides |
| Teams and accounts | Partly Per-project limit | Partly Alerts only |
| Billing models | Partly $0.000014/vCPU-s | Partly $0.072/vCPU-hour active |
| Trials and free tiers | Yes $100 one-off | No None; $5 plan |
| The company | Partly FoundryLabs, Inc.; SOC 2 II | Partly Cloudflare, Inc.; no sandbox SLA |
Where they differ
The 44 capabilities where one does something the other does not, or does it with a catch.
| Capability | E2B | Cloudflare Sandbox |
|---|---|---|
| Docker inside | Yes | With a catch Docker works through a special image, but the firewall tool Docker normally uses is turned off, so container networking is limited. |
| Choose the region | With a catch Four regions exist, but outside the United States you have to contact support to be switched on. | No Cloudflare puts each sandbox near the request, and a sandbox cannot be pinned to a location. |
| Runs in the EU | Yes | With a catch Cloudflare has European locations, but a sandbox cannot be required to stay in one, so it may run outside the EU. |
| Pause keeps memory | Yes | No |
| Snapshots of files | Yes | With a catch Snapshots are in public beta, hold at most 20 GB, and are deleted 30 days after they were made or last used. |
| Snapshots with memory | Yes | No |
| Copy a running machine | Yes The source pauses while it is copied and its open connections drop. | No |
| Pick an older snapshot | Yes | With a catch You have to store each snapshot’s ID yourself, and every snapshot is deleted 30 days after it was made or last used. |
| Reusable templates | Yes | With a catch You can start any number of machines from an image you build, but saving a running machine as a reusable template only works through snapshots, which are in beta, keep files only, and expire after 30 days. |
| Automatic backups | No | With a catch A snapshot can be saved automatically when a sandbox stops, but there is no schedule and snapshots expire after 30 days. |
| Mount outside storage | With a catch Mounting a bucket needs a custom template with the right filesystem tool installed; it is not built in. | Yes |
| Wakes on a request | Yes | With a catch A request starts a fresh machine, not the one that stopped; files come back only from a snapshot your code saved. |
| Scheduled runs | No | Yes |
| Public link to a port | Yes | With a catch There is no address for the machine itself; you publish a small program of your own and anyone who can open that address gets in. |
| Private link | No There is no built-in lock: anyone who has the link can open it. | With a catch You have to write the login check in your own small program; the machine brings no token or password of its own. |
| Terminal in the browser | Not published | With a catch The provider gives you code for a terminal you host yourself, not a terminal on its own website. |
| Tunnel to your computer | Not published | No There is no way to map a port inside the machine onto your own computer. |
| Non-web ports | Not published | No Web traffic only: no other kind of connection can be made to the machine from outside. |
| Automatic HTTPS | No The certificate is obtained by the server you run in front of the machine, not by the provider. | Yes |
| Outbound data included | Not published | Yes |
| Fixed outgoing IP | No There is no dedicated or fixed outbound address on any plan, including Enterprise. | Not published |
| Stored secrets | Yes | With a catch There is no saved secret inside the machine; you keep the value in your own small program and add it on the way out. |
| Limited API keys | With a catch A key belongs to one team and there is no published read-only or per-machine scope. | Yes |
| Command-line tool | Yes | With a catch The only command-line tool is Wrangler, which deploys the Worker and can open a shell; it does not create or manage sandboxes. |
| Python SDK | Yes | No |
| Documented HTTP API | Yes | No There is no Cloudflare-hosted API to call; you write a Worker and call it yourself. |
| MCP server | With a catch E2B's MCP support runs other companies' tools inside a sandbox; nothing of E2B's lets your assistant create sandboxes. | No The MCP material is a separate Cloudflare code-mode project, not a server that starts sandboxes. |
| Interactive terminal over the API | Yes | With a catch A live shell exists only inside a web page you build; there is no call that opens a terminal session for a script. |
| Coding agents preinstalled | With a catch A prebuilt Hermes template exists, but the default image has no agent and there is no Claude Code or Codex template. | No The current base images ship no coding agent; you add one in your own Dockerfile, as the guides do. |
| One-click Hermes | With a catch A prebuilt template is ready, but you still create the sandbox with a command and pay by usage. | No No Hermes template; you would install it in your own Dockerfile. |
| Browser built in | With a catch A browser comes with the desktop image or through Kernel cloud browsers, not in the default sandbox image. | No The base images ship no browser; you install one in your own Dockerfile. |
| Desktop for computer use | Yes | No No desktop or computer-use surface is documented. |
| Team workspace | Yes | With a catch People share the Cloudflare account and its Workers, but there is no per-sandbox sharing or sandbox workspace. |
| Roles and permissions | Not published | Yes |
| Single sign-on | Not published | Yes |
| Hard spending cap | Yes | No Budget alerts only send email; they do not pause or cap anything. |
| Usage alerts | Not published | Yes |
| Audit log | Not published | Yes |
| CPU billed only while working | No The bill follows the cores and memory you gave the machine, not what it used. | Yes |
| No monthly fee | Yes | No Sandboxes need the $5-a-month Workers Paid plan before anything can run. |
| Free starting credit | Yes | No There is no starting credit; you pay the $5 monthly plan from the start. |
| Try without a card | Yes | No You need a paid Workers plan, which means a payment method, before a sandbox can run. |
| Uptime promise (SLA) | With a catch Uptime and support terms are set in the Enterprise agreement; Hobby and Pro have no public numeric SLA. | No The 99.99% Workers SLA covers Workers only, not Containers or Sandboxes. |
| Open source or self-hostable | Yes | With a catch The SDK is open source, but the platform it runs on is Cloudflare's and cannot be self-hosted. |
Which to pick
Our reading of the sourced material, not a provider claim.
Pick E2B for
- A microVM with its own kernel, Docker, snapshots that keep memory, and up to 20 forks from a running sandbox.
- An agent that needs a real API and SDKs, plus templates built from any Docker image.
- A team that needs a SOC 2 report and a HIPAA path without an enterprise contract.
Avoid it for
- A long-running agent: the default timeout kills the sandbox after five minutes and commands do not reset it.
- Memory above 8 GiB, or any GPU workload.
- A client-facing link that must be private: public URLs have no authentication by default.
Pick Cloudflare Sandbox for
- A Worker that already holds the credentials and decides what the code can reach: the sandbox never gets a public port.
- One microVM per user or per job, with no shared kernel, at a per-second price that reaches zero when it stops.
- A team already on Cloudflare: one account, one bill, Workers and Durable Objects alongside.
- A JavaScript or Python snippet that does not need a container at all: a Dynamic Worker starts faster.
Avoid it for
- A long job with no inbound requests: code inside does not count as activity, so a two-hour build dies at the timeout.
- Any workload needing more than 4 vCPU, 12 GiB or 20 GB, or a GPU.
- EU data residency: a sandbox cannot be pinned to a region.
- An agent that expects a pause or a resumable machine: stopping deletes the disk and every process.
Want a third provider in the picture? Use side by side, or price your own numbers in the cost calculator.