# boxd

> KVM machines in the EU that boot in milliseconds, snapshot with memory, fork live, and hibernate when idle.

Website: https://boxd.sh  
Guide page: https://botperch.com/providers/boxd/  
Checked: 2026-10-28

**Short answer:** One always-on personal agent (2 vCPU / 4 GiB / 20 GiB) costs about $110.90 a month here, the 9th cheapest of the 11 providers that run it as described. The AI model adds about $14.70 a month on top (GLM 5.3, 30 requests a day at 40k tokens each, median zero-retention price; from $6.84 at the cheapest host). Fits well: A build-and-test workload that needs a fork of memory and disk in 100–200 ms.

boxd sells persistent Linux virtual machines: each one a KVM guest with its own kernel, root, systemd and a fixed 100 GB copy-on-write disk. They boot in milliseconds, can be copied while running, and park themselves when idle.
The pattern it is built for is: compose one machine by hand (install tools, sign into agents, leave a service running), save it as a snapshot, then stamp out identical machines from it.
It is one product sold three ways: pay-as-you-go credits, a Custom contract with SSO and audit logs, and a self-hosted version you run on your own hardware.

**Who it is for:** Developers and teams who want a normal Linux server that happens to be a VM, with fast copies: dev workspaces, preview environments, coding agents, one machine per customer.

**Isolation:** KVM microVM with its own kernel, network stack and disk, on boxd's open-source Ignition orchestrator. Docker, systemd, kernel modules and breaking the OS are all allowed and stay inside that one machine. Firecracker use is not documented.

**Sizes and regions:** Four sizes named by either dimension: 1 vCPU / 4 GiB, 2 / 8 (the default), 4 / 16, 8 / 32. Disk is fixed at 100 GB and is not a size choice.

## How it charges

- model: Prepaid credits, no plan and no per-seat fee.
- meter: Per second, settled every 15 minutes, on three meters: vCPU on the machine's size while running, RAM on resident memory while running or in standby, disk on bytes written in every state.
- stopped: Disk only. Hibernated and stopped machines pay for written disk; a machine in standby keeps paying for RAM.
- planFee: None. Custom and self-hosted are contracts with unpublished prices.
- minimum: No minimum charge per machine. There is no free plan: $30 of credit requires a card, and an account without one is capped at two machines.

Per second on three meters: vCPU on the machine's size while running, memory on what is actually resident, disk on bytes written in every state.
- Memory is billed on resident memory; the calculator uses the memory you entered as the resident figure, up to the size's full allocation.
- $30 of credit needs a card; without one an account is capped at two machines.
- Egress and snapshot storage prices are not published, so neither is included.

## Monthly cost for each preset workload

- A personal agent that stays on (Hermes, OpenClaw): $110.90
- A coding agent for one developer: $50.80
- A code interpreter inside your product: $50.32
- A browser agent for a small team: $754.80
- Self-hosted n8n for a small team: $110.90
- A Discord or Slack bot for one server: $55.45
- Claude Code for a team of five: $254.02
- A scraper that runs four times a day: $1.52
- Your own remote MCP server: $45.23
- A: 1,000 short tasks: $25.16
- B: one always-on box: $222.50
- C: three hours a day: $14.90

## Fits well

- A build-and-test workload that needs a fork of memory and disk in 100–200 ms.
- A team that wants a KVM machine with its own kernel, Docker, systemd and kernel modules.
- EU hosting on German bare metal, with an allowlist enforced outside the machine.

## Fits badly

- Procurement that needs an SLA, a status page or a certification before signing.
- A workload whose cost depends on RAM: memory bills on resident use, also in standby.
- Anything needing a REST API, a US region today, or a published egress price.

## Features

- **Isolation** (yes): KVM microVM; root. A KVM microVM with its own kernel, network stack and disk. Docker, systemd, kernel modules and breaking the OS all stay inside the machine. [source](https://docs.boxd.sh/use-cases/sandboxes) [docs](https://docs.boxd.sh/use-cases/sandboxes)
- **Sizes and regions** (partly): 8 vCPU / 32 GiB; one EU region. Four sizes from 1 vCPU / 4 GiB to 8 / 32, all with a fixed 100 GB disk. One EU region, no GPU, no ARM. [source](https://docs.boxd.sh/guides/resources) [docs](https://docs.boxd.sh/guides/resources)
- **Lifecycle** (yes): RAM frozen; 85 ms wake. Four distinct states: standby keeps RAM frozen and bills it, hibernate writes memory to disk with an ~85 ms wake, stop keeps the disk only, destroy removes everything. [source](https://docs.boxd.sh/guides/suspend-resume) [docs](https://docs.boxd.sh/guides/suspend-resume)
- **Snapshots and forks** (yes): RAM + disk; under 200 ms. A snapshot keeps memory and disk, is named and versioned, and boots machines already running; a checkpoint is an in-place undo point; backups are disk-only and off-cluster; a fork copies memory and disk in 100–200 ms. [source](https://docs.boxd.sh/guides/fork) [docs](https://docs.boxd.sh/guides/snapshots)
- **Storage** (yes): 100 GB; billed on write. Every machine has a fixed 100 GB disk, and disk bills on bytes written in every state. Separate disks now have a guide: they outlive the machine they are attached to, and attach to one machine at a time. [source](https://docs.boxd.sh/guides/resources) [docs](https://docs.boxd.sh/guides/disks)
- **Idle and waking** (yes): 4 h without traffic. Runtime is unlimited and auto-suspend is off by default. Auto-hibernate is on by default after four hours without TCP/UDP traffic in either direction, so outbound polling keeps a box awake but a local compile does not. [source](https://docs.boxd.sh/guides/suspend-resume) [docs](https://docs.boxd.sh/guides/suspend-resume)
- **Reaching it** (yes): No auth. Every machine is on name.boxd.sh with no authentication in front of it; subdomain proxies add ports, up to three raw TCP forwards, and SSH on a dedicated port. Bot protection only gates wake-ups. [source](https://docs.boxd.sh/guides/bot-protection) [docs](https://docs.boxd.sh/guides/https)
- **Custom domains** (yes): Native, automatic TLS. Point one domain at a machine or delegate a wildcard subdomain to the organisation; boxd verifies DNS and issues TLS certificates automatically. [source](https://docs.boxd.sh/guides/custom-domains) [docs](https://docs.boxd.sh/guides/custom-domains)
- **Outbound network** (yes): Not published. A per-machine allowlist enforced outside the machine, so root inside cannot loosen it. Forks inherit it; a machine from a snapshot starts unrestricted. [source](https://docs.boxd.sh/guides/egress) [docs](https://docs.boxd.sh/guides/egress)
- **Keys and secrets** (yes): No, host-bound. Sealed secrets injected at boot, and secrets bound to a host where the machine holds an opaque bxds_ string and the proxy swaps in the real key for that host only. [source](https://docs.boxd.sh/guides/egress) [docs](https://docs.boxd.sh/guides/env-secrets)
- **Ways to drive it** (partly): No; CLI. gRPC is the only wire API; there is no REST. TypeScript and Python SDKs, a CLI, real SSH on a dedicated port, a console terminal and a browser desktop. [source](https://docs.boxd.sh/reference/grpc-api) [docs](https://docs.boxd.sh/cli/commands)
- **Built-in agents** (yes): Three preinstalled; no API. Claude Code, Codex and OpenCode are preinstalled, and an in-VM boxd CLI is pre-authenticated so an agent can create sibling machines. Claude logins are account-level and injected at boot. [source](https://docs.boxd.sh/use-cases/coding-agents) [docs](https://docs.boxd.sh/use-cases/coding-agents)
- **Teams and accounts** (partly): Not published. Every account is an organisation with owner, admin and member roles, and keys are fenced to one org. No self-serve audit log, SSO or spend cap is published; machines are EU-only. [source](https://boxd.sh/pricing) [docs](https://docs.boxd.sh/guides/organizations)
- **Billing models** (partly): Three meters. Prepaid credits and three meters: vCPU on the size while running, RAM on resident memory (also in standby), disk on bytes written in every state. No plan fee; storage prices are unpublished. [source](https://boxd.sh/pricing) [docs](https://boxd.sh/pricing)
- **Trials and free tiers** (partly): $30 one-off. A one-off €30/$30 credit after adding a payment method. No free plan; an organisation without a payment method is capped at two machines, with no published allowance. [source](https://boxd.sh/pricing) [docs](https://boxd.sh/pricing)
- **The company** (partly): Azin Tech Op. Co. B.V.; no SLA. Azin Tech Operating Company B.V., KvK 99718340, Amsterdam; a near-identically named holding company sits above it, which is inferred rather than stated. Founders and headcount not published; €2M pre-seed September 2026. No status page and no uptime figure. No SLA. No SOC 2, ISO 27001, HIPAA or trust centre claimed. Residency contradicts itself: the FAQ says no US cloud dependency, while the privacy notice names US clusters and Latitude.sh LLC as infrastructure. Price changes apply immediately for new usage; data may be deleted after 30 days. [source](https://boxd.sh/terms/)

## Capabilities

- Its own virtual machine: yes (KVM microVM) [source](https://docs.boxd.sh/use-cases/sandboxes)
- Root access: yes (passwordless sudo) [source](https://docs.boxd.sh/quickstart)
- Docker inside: yes (Docker preinstalled) [source](https://docs.boxd.sh/guides/run-docker)
- Nested virtualisation: not-published [source](https://docs.boxd.sh/use-cases/sandboxes)
- Your own image: partly (snapshot only). You cannot bring a Docker image; the way to get your own setup is to customise a machine and start new ones from a snapshot of it. [source](https://docs.boxd.sh/use-cases/sandboxes)
- Any size you like: no (4 fixed sizes). There are four fixed sizes; naming either cores or memory picks the pair. [source](https://docs.boxd.sh/guides/resources)
- Large machines: yes (8 cores / 32 GiB) [source](https://docs.boxd.sh/guides/resources)
- Resize while running: no (reboot to apply). A size change reboots the machine, so running programs are lost. [source](https://docs.boxd.sh/guides/resources)
- GPUs: no (no GPU). There is no graphics processor option. [source](https://docs.boxd.sh/guides/resources)
- Choose the region: no (one EU region). There is one region, in Germany, and no way to choose another. [source](https://boxd.sh/)
- Runs in the EU: yes (Germany) [source](https://boxd.sh/faq/)
- Pause keeps memory: yes (85 ms wake). A hibernated machine wakes in about 85 ms; standby is faster still. [source](https://docs.boxd.sh/guides/suspend-resume)
- Pre-started pools: no [source](https://docs.boxd.sh/guides/suspend-resume)
- Starts in under a second: yes (Sub-millisecond) [source](https://docs.boxd.sh/guides/suspend-resume)
- Snapshots of files: yes [source](https://docs.boxd.sh/guides/snapshots)
- Snapshots with memory: yes (Under 200 ms) [source](https://docs.boxd.sh/guides/snapshots)
- Copy a running machine: yes (100–200 ms) [source](https://docs.boxd.sh/guides/fork)
- Pick an older snapshot: no [source](https://docs.boxd.sh/guides/snapshots)
- Reusable templates: yes [source](https://docs.boxd.sh/guides/snapshots)
- Automatic backups: yes. Off by default; you turn a schedule on for each machine. [source](https://docs.boxd.sh/cli/commands)
- Files survive a stop: yes [source](https://docs.boxd.sh/guides/suspend-resume)
- Separate volumes: yes. A disk attaches to one machine at a time and lives on one host. [source](https://docs.boxd.sh/guides/disks)
- One volume, several machines: no [source](https://docs.boxd.sh/guides/disks)
- Mount outside storage: no [source](https://docs.boxd.sh/guides/disks)
- Large disk: yes (100 GB) [source](https://docs.boxd.sh/guides/disks)
- Can stay on indefinitely: yes (4 h default, or never) [source](https://docs.boxd.sh/guides/suspend-resume)
- Choose the idle timeout: yes (Any seconds, or off) [source](https://docs.boxd.sh/guides/suspend-resume)
- Wakes on a request: yes [source](https://docs.boxd.sh/guides/suspend-resume)
- Scheduled runs: partly. A schedule runs inside the machine, so it only fires while that machine is awake. [source](https://docs.boxd.sh/guides/automations/jobs)
- Public link to a port: yes (No sign-in at all) [source](https://docs.boxd.sh/guides/https)
- Private link: no. Every machine address is open to the internet, and the provider offers no token or login to put in front of it. [source](https://docs.boxd.sh/guides/https)
- Real SSH: yes (Real SSH) [source](https://docs.boxd.sh/quickstart)
- Terminal in the browser: yes (Console terminal) [source](https://docs.boxd.sh/guides/client-utilities)
- Tunnel to your computer: yes (ssh -L) [source](https://docs.boxd.sh/quickstart)
- Non-web ports: yes (3 forwards) [source](https://docs.boxd.sh/guides/port-forwarding.md)
- Your own domain: yes (Per machine or org) [source](https://docs.boxd.sh/guides/custom-domains.md)
- Automatic HTTPS: yes (Automatic) [source](https://docs.boxd.sh/guides/custom-domains.md)
- Outbound data included: not-published [source](https://docs.boxd.sh/guides/resources.md)
- Allow only some sites: yes (256 entries) [source](https://docs.boxd.sh/guides/egress.md)
- Turn the internet off: yes (Allowlist none) [source](https://docs.boxd.sh/guides/egress.md)
- Fixed outgoing IP: not-published [source](https://docs.boxd.sh/guides/egress.md)
- Stored secrets: yes (Org-wide) [source](https://docs.boxd.sh/guides/env-secrets.md)
- Secrets the agent cannot read: yes (Stand-in string) [source](https://docs.boxd.sh/guides/egress.md)
- Limited API keys: partly (No scopes). Keys are per person and can be revoked, but there is no way to make one read-only or limit it to one machine. [source](https://docs.boxd.sh/guides/resources.md)
- Create from the website: no [source](https://docs.boxd.sh/quickstart.md)
- Command-line tool: yes [source](https://docs.boxd.sh/cli/installation.md)
- Python SDK: yes [source](https://docs.boxd.sh/reference/python-sdk.md)
- TypeScript SDK: yes [source](https://docs.boxd.sh/reference/typescript-sdk.md)
- Documented HTTP API: no. The only wire API is gRPC, so a browser or a plain HTTP client cannot call it. [source](https://docs.boxd.sh/reference/grpc-api.md)
- MCP server: no. boxd installs other products' MCP servers into its agents; it publishes no server that creates machines. [source](https://docs.boxd.sh/cli/commands.md)
- Interactive terminal over the API: yes [source](https://docs.boxd.sh/cli/commands.md)
- Files over the API: yes [source](https://docs.boxd.sh/guides/file-operations.md)
- Coding agents preinstalled: yes (3 agents) [source](https://docs.boxd.sh/use-cases/coding-agents.md)
- Send it a prompt: no. boxd runs the machine, not the agent loop; Anthropic or OpenAI runs the loop in the documented integrations. [source](https://docs.boxd.sh/use-cases/claude-managed-agents.md)
- One-click Hermes: no. No Hermes template, harness or guide is documented. [source](https://docs.boxd.sh/use-cases/coding-agents.md)
- One-click OpenClaw: no. No OpenClaw template, harness or guide is documented. [source](https://docs.boxd.sh/use-cases/coding-agents.md)
- Browser built in: yes [source](https://docs.boxd.sh/guides/client-utilities.md)
- Desktop for computer use: yes [source](https://docs.boxd.sh/guides/desktop.md)
- Runs other platforms' agents: yes [source](https://docs.boxd.sh/use-cases/openai-agents-api.md)
- Team workspace: yes [source](https://boxd.sh/pricing)
- Roles and permissions: yes [source](https://docs.boxd.sh/cli/commands.md)
- Single sign-on: partly. SAML is sold on Enterprise and you have to ask for it. [source](https://boxd.sh/faq/)
- Hard spending cap: not-published [source](https://boxd.sh/pricing)
- Usage alerts: not-published [source](https://boxd.sh/pricing)
- Audit log: partly. Audit logs are sold with SSO on the Custom/Enterprise line; on self-serve plans the only record is the SSH command history. [source](https://boxd.sh/pricing)
- Billed per second: yes (per second) [source](https://boxd.sh/pricing)
- CPU billed only while working: no (full cores while running). The processor is charged at the machine's full size for as long as it runs. [source](https://boxd.sh/pricing)
- Paused costs only storage: partly (pause keeps paying for memory). Pausing keeps the memory in place and you keep paying for it; only hibernating or stopping brings the bill down to disk alone. [source](https://boxd.sh/pricing)
- No monthly fee: yes (none) [source](https://boxd.sh/pricing)
- Flat monthly price: no (three meters). Cores, memory and disk are metered separately, so there is no single monthly price. [source](https://boxd.sh/pricing)
- Ongoing free tier: no (one-off credit). Free usage is a one-off credit that needs a card, not a monthly allowance. [source](https://boxd.sh/pricing)
- Free starting credit: yes (€30) [source](https://boxd.sh/pricing)
- Try without a card: yes (2 machines without one) [source](https://docs.boxd.sh/guides/resources)
- Public status page: not-published [source](https://boxd.sh/faq/)
- Uptime promise (SLA): not-published [source](https://boxd.sh/terms/)
- SOC 2 report: no. boxd says it is working on SOC 2 and ISO 27001 and offers security details by email instead. [source](https://boxd.sh/faq/)
- Data processing agreement: yes [source](https://boxd.sh/terms/)
- Open source or self-hostable: yes (Annual licence) [source](https://boxd.sh/faq/)

## Usability

- Dashboard: Yes, at boxd.sh/app, with Machines, Backups, Domains, Integrations, Organizations and Billing pages plus a desktop viewer. It is secondary: every guide's first instruction is a CLI command, and the sign-in page leads with Download the CLI.
- Without code: Partly, and less than the marketing suggests. A non-coder can watch and drive a machine someone else set up (desktop, browser, files), and can copy a prompt for an AI agent to do the setup. There is no template gallery and no one-click agent.
- Signup: GitHub or Google, then a card for the $30 credit and for more than two machines. There is no waitlist in the EU; the US region has one. Every account starts with a 25-minute onboarding call.
- Docs: Mintlify docs with a full CLI reference, gRPC proto, SDK references and machine-readable bundles. Support is a founder by email. There is no status page.
- Trips people up: The first step is a terminal command: install the CLI, log in, create a machine.
- Trips people up: Machine sounds like a physical server you rent; it is a VM that sleeps and keeps charging for disk.
- Trips people up: The pricing vocabulary is engineer-facing: resident memory, GiB-hour, written disk.
- Trips people up: The headline hourly price assumes 2 GiB of an 8 GiB machine is in use.
- Trips people up: Whatever you serve is on the open internet at name.boxd.sh, with no auth in front.
- Trips people up: Sleep is invisible: a cron job or long build stops when the machine hibernates, and the clock freezes.

## Company

- Legal entity: Azin Tech Operating Company B.V., KvK 99718340, registered in Amsterdam. Boxd is a trading name. [source](https://boxd.sh/terms/)
- Founded: Registered 5 February 2026; the first public blog post is 14 August 2026. No founding date is published. [source](https://drimble.nl/bedrijf/amsterdam/000057849749/melchior-holding-bv.html)
- Funding: €2M pre-seed led by BlueYard Capital, announced 16 September 2026. No later round is published. [source](https://boxd.sh/blog/we-raised-2m-to-kill-localhost/)
- Headcount: Not published. The blog counts three authors, which is a floor rather than a headcount.
- Status and SLA: No status page, no published uptime figure and no SLA. Support is a founder-led 25-minute onboarding call.
- Certification: No SOC 2, ISO 27001, HIPAA or PCI claim on the site, the terms or the privacy notice.
- Data residency: Marketed as EU-only with no US cloud dependency, but the privacy notice describes EU and US clusters on a Delaware infrastructure vendor. [source](https://boxd.sh/privacy/)

## Caveats

- **The bill follows resident RAM, not the shape** (open): A 4 vCPU machine is 16 GiB, but boxd bills the memory it actually holds: $222.50 a month at 8 GiB resident and $304.26 at 16 GiB. boxd's own calculator assumes 2 GiB on an 8 GiB machine, which is a best case rather than a typical one.
- **Public URLs are open, and bot protection gates only wake-ups** (open): There is no authentication in front of name.boxd.sh. Bot protection is on by default, but it only asks a browser check when a request would wake a sleeping machine, and it applies to the main address, never to subdomain proxies or custom domains. A webhook, API client or uptime monitor that hits a sleeping machine gets a 503 check page and the machine does not wake.
- **The machine quota is stated as both 50 and 100** (contradiction): Docs and FAQ say 50 machines per organisation; the pricing page says 100 included, raiseable on request.
- **Inbound public IPv4 is contradictory** (contradiction): The docs say every machine's domain points at the proxy's shared public IP, and SSH runs on a dedicated port on that shared proxy IP. The FAQ says machines come with a public IPv4. No price for an inbound IPv4 is published. Both statements are current, so the answer is unresolved.
- **EU-only, except for the US cluster in its own privacy notice** (contradiction): The FAQ says managed boxd runs on EU hardware with no US cloud dependency. The privacy notice names a Delaware infrastructure vendor and two clusters, and says choosing the US cluster transfers data to the United States. The residency answer depends on which page you read.
- **Static egress IP is unconfirmed** (open): No boxd page mentions a dedicated or static outbound address, and none prices one. battleships.dev lists it as a feature. We could not confirm it, so it is neither offered nor ruled out here.
- **Prices moved about 20% in 19 days** (open): The 9 October capture showed €0.049/vCPU-hour, €0.015/GiB-hour and 50 machines; the 28 October page shows €0.039, €0.012 and 100 machines. Any cost figure needs a date.
- **Storage prices are not published** (open): Snapshots, checkpoints, backups and extra disks all exist, and none has a published price. Egress has no price or allowance either.
- **No status page and no REST API** (open): status.boxd.sh does not resolve and boxd.sh/status is a 404. The only wire API is gRPC; there is no HTTP/JSON endpoint for machines.

## Sources

- [Docs](https://docs.boxd.sh/)
- [Lifecycle and resources](https://docs.boxd.sh/guides/resources)
- [Snapshots](https://docs.boxd.sh/guides/snapshots)
- [Fork](https://docs.boxd.sh/guides/fork)
- [Egress and host-bound secrets](https://docs.boxd.sh/guides/egress)
- [Pricing](https://boxd.sh/pricing)
- [FAQ](https://boxd.sh/faq/)