CompareSituations
Start with what the agent has to do. Each situation names the feature pages that decide it, then two or three providers worth a look. Every recommendation carries its catch.
What will your agent do? It should answer whenever I message it.
This is the hardest case, because most providers assume a machine that is used in bursts. You need a machine that does not hit a lifetime deadline, does not sleep when nobody is typing, and wakes if it does sleep. Then you need the idle hour to be cheap enough to leave running.
Idle timers, waking and session limits — An always-available agent depends on three separate settings: a lifetime deadline, an idle timer, and a wake path. Providers bundle them differently, and the difference is most of your bill.
Lifecycle: stop, pause and sleep — Providers use seven words for four behaviours. The only question that matters is what is still running when the machine comes back.
Reaching it: links, ports and who can open them — A machine nobody can reach is not an agent. There are four doors in — an HTTPS link, a raw TCP port, SSH, and the provider's API — and the important difference is who can open each one.
Billing models — The meter decides your bill more than the hourly rate does. Four shapes are in play: flat per size, per vCPU and per GB, a plan fee that returns as credit, and measured CPU.
Auto-sleep is off by default and there is no lifetime cap. Its managed-hosting line is a one-click personal agent with a task board, and the Cloud 4 vCPU / 8 GiB shape is about $10.60 a month with 20 GB of disk.
Catch: The Cloud product needs a terminal or API call, stop loses memory, and disk bills until you delete the instance.
Pause keeps the agent's session and bills storage only, and the dashboard creates the machine and opens a clickable desktop.
Catch: The free plan pauses after 30 idle minutes and that cannot be switched off; public URLs have no password unless you make the port private.
persistent: true disables the idle pause, and measured CPU with a 50-millicore floor makes a waiting agent cost about $0.03 an hour in CPU.
Catch: A stopped box still bills storage, there is one US region, and there is no preinstalled agent.
“persistent: true keeps a sandbox running until you stop it, with no idle pause.”
“Instances default to auto_sleep: false and never sleep on their own unless you opt them in.”
What will your agent do? It runs builds, training runs or multi-hour tasks.
Long jobs fail on timers, not on compute. Look for a hard deadline you can turn off, an idle timer that watches the network rather than the CPU, and a machine that does not lose its work when a connection drops.
Idle timers, waking and session limits — An always-available agent depends on three separate settings: a lifetime deadline, an idle timer, and a wake path. Providers bundle them differently, and the difference is most of your bill.
Lifecycle: stop, pause and sleep — Providers use seven words for four behaviours. The only question that matters is what is still running when the machine comes back.
Isolation: what kind of computer you get — Every provider says “sandbox”. Underneath, it is a container, a gVisor container, a microVM or a full virtual machine, and that decides what your agent can install, run and break.
Sizes, regions and hardware — A size is a bundle of CPU, memory and disk, and the bundle decides what you can run. A region decides how far away it is and whose laws it sits under. Neither is as flexible as the word “cloud” suggests.
A full Ubuntu VM with Docker and 51 GB of disk for $26.28 a month, and no idle detection at all.
Catch: Auto-stop counts from creation and defaults to one hour; turn it off. The disk is deleted 14 days after a stop.
Auto-suspend is off by default and the idle timer counts TCP/UDP traffic in either direction, so a build that polls an API stays awake. Docker, systemd and kernel modules work.
Catch: A purely local compile makes no traffic and hibernates at four hours; set the timer to 0. RAM bills on resident memory.
A Firecracker microVM with a 24-hour continuous limit on Pro and snapshots that keep memory.
Catch: The default timeout is five minutes and kills the sandbox; commands do not reset it. Hobby caps continuous runtime at one hour.
A sandbox can run for up to 24 hours with no idle timeout, and a filesystem or memory snapshot carries the work into the next one.
Catch: There is no pause: the sandbox runs or it is terminated. The default lifetime is five minutes, and an idle sandbox bills its full request.
“The timer counts from creation or from the last resume, not from your last activity.”
“On by default, set to 4 hours. After 4 hours without TCP/UDP traffic in either direction, boxd hibernates the machine”
“You can change this by passing a timeout of up to 24 hours”
What will your agent do? It sits idle most of the day and answers a few requests.
Here the bill is decided by the idle state, not the busy hour. You want a provider whose sleeping machine is nearly free, and a wake path that does not need a person.
Idle timers, waking and session limits — An always-available agent depends on three separate settings: a lifetime deadline, an idle timer, and a wake path. Providers bundle them differently, and the difference is most of your bill.
Billing models — The meter decides your bill more than the hourly rate does. Four shapes are in play: flat per size, per vCPU and per GB, a plan fee that returns as credit, and measured CPU.
Trials and free tiers — “Free trial” covers four different offers: a time-limited trial that converts, a one-off credit, a free plan that never charges, and a recurring allowance. They differ in what you get and what happens on day eight.
Reaching it: links, ports and who can open them — A machine nobody can reach is not an agent. There are four doors in — an HTTPS link, a raw TCP port, SSH, and the provider's API — and the important difference is who can open each one.
CPU is measured with a 50-millicore floor, so an idle-but-running box costs about $0.03 an hour, and a paused box costs storage only.
Catch: An open terminal or SSH session counts as activity and keeps billing; a stopped box still bills storage.
Stopped time is free and a resume can restore the running processes, so a request can find the session as it was.
Catch: The default TTL is one hour and the trial converts to $20 a month; memory restore needs a matching machine within two minutes.
An idle instance bills disk only at $0.09 per GB-month, and a sleep checkpoint keeps memory at no extra charge.
Catch: Any request to any URL wakes a sleeping instance, and a stop discards the checkpoint.
“A sandbox pauses itself after 300 seconds with nothing happening in it: no request, no command still running, no open connection, no network traffic and no CPU use.”
“When the activity stops, a short idle window passes (about 30 seconds today) and the Sprite pauses.”
What will your agent do? It writes code, runs tests and needs a clean environment each time.
This case rewards fast copies and a real Linux machine: Docker, system tools, and a way to snapshot a working environment and start ten more from it. Session limits matter less because each job is short.
Isolation: what kind of computer you get — Every provider says “sandbox”. Underneath, it is a container, a gVisor container, a microVM or a full virtual machine, and that decides what your agent can install, run and break.
Snapshots, forks and templates — Four jobs hide under “snapshot”: a restore point on one machine, a reusable image for new machines, a copy of a running machine, and a backup that survives losing the host. Ask which one you are getting.
Sizes, regions and hardware — A size is a bundle of CPU, memory and disk, and the bundle decides what you can run. A region decides how far away it is and whose laws it sits under. Neither is as flexible as the word “cloud” suggests.
Built-in agents — Some providers ship the machine with coding agents already installed and a way to prompt them. Others ship a computer and expect you to bring the agent.
A live fork copies memory and disk in 100–200 ms, snapshots boot machines already running, and Docker is preinstalled.
Catch: The 4 vCPU size comes with 16 GiB and RAM bills on resident memory, so the bill depends on what the build holds.
Snapshots capture memory and disk and can branch into many running instances, which is built for parallel test fan-out.
Catch: Stop deletes the instance; volumes are S3-compatible object storage, not an attached disk.
Templates can start from any Docker image, and up to 20 forks can be created from a running sandbox.
Catch: Forking pauses the source and drops its connections; the default timeout kills a sandbox after five minutes.
Containers are fast to create, snapshots and forks cover the VM classes, and $200 of free compute pays for the first tests.
Catch: Fork is VM-only; on the default container it is snapshot-then-create. A container stops after 15 idle minutes even during a build.
“A fork is a copy of a machine, the source machine. The copy includes the disk, the memory, and every running process, and carries on with its own name, URL, and ports from that point onwards.”
“With the SDKs and the CLI you can request up to 20 forks at once.”
“Forking creates a duplicate of a Linux VM sandbox's filesystem and memory state in a new sandbox.”
What will your agent do? It clicks through websites, fills forms and watches pages change.
A browser agent needs memory before it needs cores, a desktop you can watch and take over, and a session that survives a page load. Two things break it: a machine sized by vCPU with 4 GB of RAM, and a snapshot that restores the disk but not the logged-in browser profile.
Sizes, regions and hardware — A size is a bundle of CPU, memory and disk, and the bundle decides what you can run. A region decides how far away it is and whose laws it sits under. Neither is as flexible as the word “cloud” suggests.
Isolation: what kind of computer you get — Every provider says “sandbox”. Underneath, it is a container, a gVisor container, a microVM or a full virtual machine, and that decides what your agent can install, run and break.
Reaching it: links, ports and who can open them — A machine nobody can reach is not an agent. There are four doors in — an HTTPS link, a raw TCP port, SSH, and the provider's API — and the important difference is who can open each one.
Snapshots, forks and templates — Four jobs hide under “snapshot”: a restore point on one machine, a reusable image for new machines, a copy of a running machine, and a backup that survives losing the host. Ask which one you are getting.
Xfce, Chromium and VNC are in the default image, and clicking the desktop takes control from the agent until it goes idle for a minute. The free plan is one 4 vCPU / 8 GiB machine.
Catch: Public ports have no authentication, so make the port private (token-only) unless anyone with the URL may see what the browser is serving; memory above 8 GiB needs a paid plan.
A 1920×1080 desktop at 60 fps over WebRTC, or VNC over HTTPS, on a full Ubuntu VM with Docker and root.
Catch: Fixed shapes only, 8 GB or 16 GB; a browser profile held in memory is lost on stop, and the disk is kept 14 days.
Every running sandbox has an XFCE desktop with Google Chrome that opens in a browser tab over VNC, and xlarge gives 16 vCPU / 32 GB.
Catch: No GPU and no SLA, and outbound traffic shares the node's IP, which matters on sites that rate-limit by address.
Computer use is a first-class API with mouse, keyboard, screenshots and screen recording, plus a VNC desktop and a web terminal in the Playground.
Catch: No GPU desktop, a 15-minute idle stop on containers, and the standard preview token cannot be revoked.
“Click the desktop to take control; it goes back to the agent after a minute idle.”
“The full desktop over Moonlight (WebRTC), 1920x1080 at 60 fps”
“Every running sandbox has a graphical desktop (XFCE with Google Chrome) that you can open in a browser tab.”
“Computer Use enables programmatic control of desktop environments within sandboxes.”
What will your agent do? It gives each of my customers their own machine and address.
This is a fleet problem disguised as a sandbox problem. Every customer machine needs an address that is theirs, a way to keep their files apart, and a price that survives being idle most of the day. The features that decide it are custom domains, lifecycle, storage and account structure.
Custom domains — Putting an agent behind your own hostname is a feature some providers sell, some leave to a proxy you run, and several do not offer at all.
Lifecycle: stop, pause and sleep — Providers use seven words for four behaviours. The only question that matters is what is still running when the machine comes back.
Storage: disk, volumes and what persists — “Persistent” can mean the whole disk, one mounted folder, or fourteen days. It can also mean a separate volume that outlives the machine, which is a different product from the disk the machine boots with.
Teams and accounts — Organisations, key scopes, spend limits, SSO, audit and residency. The features a team needs are rarely the ones a solo builder notices, and several providers only sell them on an enterprise tier.
A whole Ubuntu VM per customer, with its own kernel, IPv6 and disk, for $26.28 a month on the default size; the docs name platforms giving each end user a machine as one of its three audiences.
Catch: Custom domains are explicitly unsupported, there is no region choice, and a stop destroys the machine, so each customer's address is an on.boat.dev name.
A fork copies disk, memory and processes in under 200 ms, so a customer's working environment can be branched per session, and keys are fenced to one organisation.
Catch: One EU region, a fixed 100 GB disk per machine and RAM billed on resident use, so a fleet of small idle machines still pays for memory.
A sandbox's web port can run at your own hostname with HTTPS, and up to four volumes mount at chosen paths for customer data.
Catch: One region, in Virginia, so an EU customer's data sits in the US; volumes keep billing while the sandbox is stopped.
Cloudflare's own guidance is a sandbox for each user or each job, with the Worker deriving the sandbox name from an authenticated identity.
Catch: Names are routing keys, not authorisation; there is no region pinning, and stopping an instance wipes its disk.
“up in under 200ms”
“Custom domain: a sandbox's web port at your own hostname, with HTTPS.”
“A sandbox for each user, or for each job”
What will your agent do? It needs a GPU for inference, rendering or training.
Modal and Daytona both sell GPU sandboxes, up to 8 GPUs each, and Cloudflare does not. The rest of the original twelve publish nothing, so this is still a case where the honest answer may be a different product: Fly sells GPU Machines separately from Sprites.
Sizes, regions and hardware — A size is a bundle of CPU, memory and disk, and the bundle decides what you can run. A region decides how far away it is and whose laws it sits under. Neither is as flexible as the word “cloud” suggests.
Isolation: what kind of computer you get — Every provider says “sandbox”. Underneath, it is a container, a gVisor container, a microVM or a full virtual machine, and that decides what your agent can install, run and break.
Billing models — The meter decides your bill more than the hourly rate does. Four shapes are in play: flat per size, per vCPU and per GB, a plan fee that returns as credit, and measured CPU.
GPU sandboxes up to 8 per container across B300, B200, H200, H100, A100, L4, T4 and L40S, priced per GPU-second.
Catch: GPU sandboxes are preemptible, gVisor only, and cannot use memory snapshots.
GPU sandboxes attach up to 8 GPUs, each adding up to 16 vCPU / 192 GB / 512 GB, across H100, H200, B200, B300, RTX PRO 6000, RTX 4090, RTX 5090 and AMD MI355X.
Catch: Shared GPU capacity ignores your region choice, GPU sandboxes vanish on stop, spot GPUs can be killed without notice, and the $200 free credit cannot be spent on them.
Fly sells GPU Machines as a separate product on the same platform, and says plainly that Sprites is not a GPU environment.
Catch: A GPU Machine is a different Fly product with a different lifecycle and API; nothing in the Sprites API starts one.
“Currently B300, B200, H200, H100, A100, L4, T4 and L40S instances support up to 8 GPUs”
“each GPU adds up to 16 vCPUs, 192GB RAM, and 512GB disk”
“Sprites are not a GPU environment. Fly.io sells GPU Machines separately”
What will your agent do? It processes data that has to stay in the European Union.
A compute region is not a residency guarantee. Backups, control-plane records and support access can sit elsewhere, and two providers here are EU-only while one stores backups in the US. The questions that decide it are where the disk is, where the backups are, and which entity signs.
Sizes, regions and hardware — A size is a bundle of CPU, memory and disk, and the bundle decides what you can run. A region decides how far away it is and whose laws it sits under. Neither is as flexible as the word “cloud” suggests.
Who is behind it — Entity, age, funding, status page, SLA, compliance and the terms that decide whether you can leave. This is the part of a sandbox that documentation testing cannot tell you.
Teams and accounts — Organisations, key scopes, spend limits, SSO, audit and residency. The features a team needs are rarely the ones a solo builder notices, and several providers only sell them on an enterprise tier.
Storage: disk, volumes and what persists — “Persistent” can mean the whole disk, one mounted folder, or fourteen days. It can also mean a separate volume that outlives the machine, which is a different product from the disk the machine boots with.
Sandboxes run on machines in Germany, Finland and France, and egress is not billed.
Catch: No region choice, no custom domains, and the contracting entity is a Delaware corporation under Delaware law.
Marketed as EU-only on German bare metal, with an allowlist enforced outside the machine and a Dutch contracting entity.
Catch: Its privacy notice describes EU and US clusters on a Delaware infrastructure vendor, which contradicts the FAQ's no-US-dependency line.
Two regions, EU West in Limburg and US East in Virginia, and you pick one per resource.
Catch: Nothing promises backups stay in the chosen region, there is no SLA outside Enterprise, and the company publishes no SOC 2.
Two shared regions, us and eu, plus dedicated and bring-your-own-compute regions, with a DPA that names the Irish Data Protection Commission.
Catch: Region choice does not guarantee where control-plane metadata lives, and the company's Delaware incorporation is unconfirmed.
“Sandboxes run on machines in Germany, Finland and France.”
“Latitude.sh LLC (Delaware, United States): bare-metal server infrastructure for our European Union and United States clusters.”
“The current configured regions include US East (Virginia), us-east-1, and EU West (Limburg), eu-west-lim-a.”
“Europe | eu”
The reasoning behind each pick is on the feature pages, with a source for every claim. Prices are list prices checked on 29 October 2026.