# Bot Perch > A plain-language guide to cloud sandbox providers for people running AI agents: what each feature means, what to check, and who to pick for which situation. Covers 16 providers, 16 features, 78 capability checks and 10 use-case guides. Every claim has a source URL, an exact quote and a confidence tag. Prices checked 2026-10-29. The HTML pages work without JavaScript, but these plain files are smaller and carry the same facts. Prices are list rates in US dollars excluding tax; "not published" means the provider says nothing, never an estimate. ## Data - [Provider index](https://botperch.com/data/index.json): every provider with its one-liner and links to its files - Per provider: `https://botperch.com/data/providers/.md` (readable profile, costs, features, capabilities, company, sources) and `https://botperch.com/data/providers/.json` (the full record, rate card and doc links) - [Use-case guides](https://botperch.com/data/use-cases.md): what each agent job needs and how to run it on each provider; one file each at `https://botperch.com/data/use-cases/.md` - [Features](https://botperch.com/data/features.md) ([JSON](https://botperch.com/data/features.json)): what each feature means and each provider's key figure - [Capabilities](https://botperch.com/data/capabilities.md) ([JSON](https://botperch.com/data/capabilities.json)): yes / partly / no per provider, with the catch - [Monthly cost by use case](https://botperch.com/data/rankings.md) and [preset workloads](https://botperch.com/data/presets.json); per preset: `https://botperch.com/data/rankings/.json` - [Glossary](https://botperch.com/data/glossary.md) - [Everything in one file](https://botperch.com/llms-full.txt) ## Providers - [Agent 37](https://botperch.com/data/providers/agent37.md): Hosted Linux computers for agents, sold two ways: a prepaid Cloud API and a one-click personal-agent subscription. - [Blaxel](https://botperch.com/data/providers/blaxel.md): MicroVM sandboxes billed by allocated RAM, now part of Baseten. - [Boat](https://botperch.com/data/providers/boat.md): Ubuntu VMs in the EU, billed per second, with seven coding agents preinstalled and no pause at all. - [boxd](https://botperch.com/data/providers/boxd.md): KVM machines in the EU that boot in milliseconds, snapshot with memory, fork live, and hibernate when idle. - [Cloudflare Sandbox](https://botperch.com/data/providers/cloudflare-sandbox.md): A Worker that starts a Firecracker microVM, with no public port, no region pinning, and a disk that is wiped when the instance stops. - [Daytona](https://botperch.com/data/providers/daytona.md): Linux containers by default and real VMs on request, with a 15-minute idle stop, a 10 GiB disk cap and two regions. - [E2B](https://botperch.com/data/providers/e2b.md): Firecracker microVMs and templates for agent code, sold per running second. - [InstaBox](https://botperch.com/data/providers/instabox.md): Firecracker machines with a browser desktop, sold as a subscription that is also a monthly credit. - [Lizard](https://botperch.com/data/providers/lizard.md): Firecracker sandboxes at a flat hourly price per size, plus an app platform for whatever the agent builds. - [Modal](https://botperch.com/data/providers/modal.md): gVisor containers by default with a five-minute lifetime, no pause at all, and a CPU unit that may be one or two vCPUs depending on which reading you trust. - [Morph](https://botperch.com/data/providers/morph.md): Full VMs with memory-and-disk snapshots, branched into parallel copies, billed in MCUs. - [Runtime](https://botperch.com/data/providers/runtime.md): Firecracker microVMs billed on measured CPU, with the strongest secret handling in this set. - [Sandboxer](https://botperch.com/data/providers/sandboxer.md): Whole Ubuntu microVMs billed per second, sold through monthly plans whose dollars come back as machine time. - [Sprites](https://botperch.com/data/providers/sprites.md): Persistent Fly.io microVMs that suspend after about 30 seconds idle and bill measured CPU and memory. - [Tensorlake](https://botperch.com/data/providers/tensorlake.md): Firecracker microVMs that keep their memory across a pause, sold as prepaid credits or a $250 Pro plan. - [Vercel Sandbox](https://botperch.com/data/providers/vercel-sandbox.md): Firecracker microVMs inside Vercel, billed on active CPU and provisioned memory. ## Use cases - [Run a Hermes agent](https://botperch.com/data/use-cases/hermes-agent.md): I want a personal assistant that answers me on Telegram, remembers what I tell it and runs jobs on a schedule. - [Run an OpenClaw agent](https://botperch.com/data/use-cases/openclaw.md): I want OpenClaw answering me on WhatsApp or Slack, with its own browser and memory, without keeping my laptop on. - [Give a coding agent its own machine](https://botperch.com/data/use-cases/coding-agent.md): I want Claude Code or Codex to work on my code in the cloud, not on my laptop. - [Run code inside your own product](https://botperch.com/data/use-cases/code-interpreter.md): My app lets users or an LLM run code, and I need somewhere safe to run it. - [Run a browser or computer-use agent](https://botperch.com/data/use-cases/browser-agent.md): I want an agent that opens websites, clicks and fills in forms, or uses a whole desktop. - [Host your own n8n](https://botperch.com/data/use-cases/workflow-automation.md): I want n8n running my automations around the clock, on a server I control, without paying per workflow run. - [Host your own Discord or Slack bot](https://botperch.com/data/use-cases/chat-bot.md): I wrote a bot that answers questions in our Discord or Slack using an AI model, and I need somewhere for it to live. - [Give a small team Claude Code in the cloud](https://botperch.com/data/use-cases/claude-code-team.md): Three to five of us want Claude Code running on cloud machines, each with our own login, without sharing one account. - [Run a scraper on a schedule](https://botperch.com/data/use-cases/scheduled-scraper.md): I want a script that checks a few websites four times a day and saves what it finds, without paying for a machine that sits idle. - [Host your own MCP server](https://botperch.com/data/use-cases/mcp-server.md): I built tools for Claude as an MCP server, and I want it at a web address so Claude can use them without anything running on my laptop. ## Notes - About and publisher: https://botperch.com/about/ - Method and limits: https://botperch.com/how-we-checked/ - How costs are calculated: https://botperch.com/costs/how-it-works/ - Source code and data: https://github.com/WyrdWerk/sandbox-guide - Report a mistake: https://github.com/WyrdWerk/sandbox-guide/issues --- # Limits of this research - This is desk research. No provider account was created and no sandbox was started or billed, so every claim about behaviour is a documentation claim, not something we measured. - Prices are the providers' published list rates in US dollars on 2026-10-28, excluding tax. Several providers changed prices during October 2026, so a number here can be out of date within weeks. - Where a provider publishes nothing, the site says 'not published' rather than estimating. Where two pages of the same provider disagree, the site shows both and marks it as a contradiction. - battleships.dev is a comparison dataset built by the Boat (boat.dev) team. We used it as a cross-check, never as a primary source, and it disagreed with live provider pages often enough that its own numbers are not repeated here as fact. --- # Run a Hermes agent > I want a personal assistant that answers me on Telegram, remembers what I tell it and runs jobs on a schedule. Hermes is a personal AI agent you host yourself. It needs a small machine that stays on and keeps its files. Only one of the sixteen providers offers it in one click; most can run it if you can follow terminal instructions; a few are a poor fit for an assistant that never sleeps. Guide page: https://botperch.com/use-cases/hermes-agent/ **Short answer:** The cheapest machine that runs it as described is Agent 37 at $10.60 a month, then Lizard ($19.00) and Boat ($20.00). 11 of 16 providers run it without a catch. Machine cost only, before any AI model, at list prices checked 29 October 2026. [Hermes Agent](https://github.com/NousResearch/hermes-agent) is an open-source (MIT) assistant from Nous Research. You talk to it from Telegram, Slack, WhatsApp, email and [20+ other apps](https://hermes-agent.nousresearch.com/docs/), it keeps a memory of you between conversations, and it writes itself reusable skills from what it does. The model (Claude, GPT, an open model) runs elsewhere and is billed by its own provider. What you host is the small program that holds your memory, your logins and your schedule, and that runs commands, browses and edits files for you. That program is what this page is about. Its own README says to run it "on a $5 VPS, a GPU cluster, or serverless infrastructure that costs nearly nothing when idle". A sandbox provider is one of those choices: the difference is how easy it is to set up, whether it is allowed to stay on, and what it costs when it is waiting. ## What it needs - **Machine size:** At least 1 CPU and 1 GB of memory; 2 CPUs and 2 to 4 GB recommended, and at least 2 GB if it uses the browser. 2 vCPU / 4 GiB / 20 GiB leaves room for Chromium and a growing memory. [source](https://hermes-agent.nousresearch.com/docs/user-guide/docker#resource-limits) - **Does it stay on?:** Yes, usually. By default it fetches Telegram messages by asking Telegram every few seconds, and the docs say plainly that "a polling bot can never sleep". It also runs your scheduled jobs every 60 seconds. Webhook mode lets it sleep on hosts that wake on an incoming request, but scheduled jobs then do not fire while it sleeps. [source](https://hermes-agent.nousresearch.com/docs/user-guide/messaging/telegram) - **What must survive a restart:** Everything in ~/.hermes: memory, past conversations, skills, scheduled jobs, API keys and chat logins. A provider that deletes the disk when the machine stops loses all of it. [source](https://hermes-agent.nousresearch.com/docs/user-guide/configuration) - **Browser, Docker, GPU:** A browser is optional and is the hungriest part. Docker is optional. A GPU is only needed if you run the model yourself. [source](https://hermes-agent.nousresearch.com/docs/reference/faq) - **How busy it is:** Mostly waiting. Battleships' always-on assistant workload averages about 6% CPU, with peaks near 100% when it browses or runs a command. That is why providers that charge only for CPU actually used come out cheap here. [source](https://battleships.dev/data/rankings/employees.json) ## Picks - **Agent 37**, If you do not want a terminal: The only provider of the sixteen that sets up Hermes in one click. Plans run from $3.99 a month (1 vCPU / 4 GB / 8 GB, bring your own model key) to $29.99 (2 vCPU / 8 GB / 20 GB, with a built-in browser). Watch: The free plan sleeps after 15 idle minutes. These Personal plans are a separate product from the Agent 37 Cloud machines the calculator prices. https://www.agent37.com/personal - **Boat**, If you can follow terminal steps: Hermes is preinstalled on a full virtual machine. The small size running all month is $13.14 of usage, inside the $20 monthly plan. Watch: Auto-stop is on by default, so create the machine with it turned off. A stopped machine's disk is kept for only 14 days, and there is no free plan. https://docs.boat.dev/long-running-tasks/always-on-services - **Runtime**, If you want to pay least for waiting: It charges for CPU only while it works, so an assistant that mostly waits costs about $25 a month at 2 vCPU / 4 GiB, and a persistent sandbox never idle-pauses. Watch: No Hermes guide, one US region, and storage keeps billing while the machine is stopped. https://withruntime.com/docs/pricing ## How to run it on each provider - **Agent 37** (one-click; no terminal: yes): Pick Hermes on the Personal plans and it is set up with a dashboard, task board, web terminal and chat channels. The free plan sleeps when idle; paid plans stay up between scheduled jobs. Price: Personal plans from $3.99 a month; $29.99 with a built-in browser. [Agent 37 Personal](https://www.agent37.com/personal) - **Boat** (preinstalled; no terminal: no): Hermes is already installed on every sandbox. Create one with auto-stop turned off, run the setup wizard over SSH, and keep the gateway running as a service. [Boat: always-on services](https://docs.boat.dev/long-running-tasks/always-on-services) - **boxd** (manual; no terminal: no): boxd documents the personal-assistant pattern: create a machine, install the assistant, turn off auto-hibernate (otherwise it sleeps after four quiet hours) and let chat apps reach it. [boxd: personal assistants](https://docs.boxd.sh/use-cases/personal-assistants) - **Sandboxer** (manual; no terminal: no): Nothing preinstalled and no guide. Create a sandbox with auto-stop off, run Hermes' installer over SSH, and keep the gateway running as a service. [Sandboxer: long-running tasks](https://sandboxer.com/docs/long-running) - **Runtime** (manual; no terminal: partly): Start a sandbox from the dashboard and you get a shell in the browser; install Hermes there and mark the sandbox persistent so it never idle-pauses. No Hermes guide. [Runtime: getting started](https://withruntime.com/docs/start) - **InstaBox** (manual; no terminal: partly): The dashboard creates a machine and opens a browser terminal and desktop; installing Hermes and keeping it running is typed by hand. No Hermes template. [InstaBox: getting started](https://instabox.sh/docs/start) - **Lizard** (manual; no terminal: partly): The dashboard creates a sandbox and opens a terminal; Hermes is installed by hand. Lizard's one-click templates cover OpenClaw, not Hermes. [Lizard: sandbox quickstart](https://lizard.build/docs/sandboxes/quickstart) - **Morph** (manual; no terminal: no): Create a Devbox, install Hermes over SSH, and turn on wake-on-HTTP so it pauses between messages and wakes when one arrives. [Morph: Devboxes](https://cloud.morph.so/docs/devboxes/getting-started) - **E2B** (guide; no terminal: no): E2B ships a ready-made hermes template you start from its command line. Sessions end after 24 hours on Pro and one hour on the free plan, so it suits Hermes doing tasks better than an assistant that never stops. [E2B: Hermes Agent](https://docs.e2b.dev/agents/hermes) - **Daytona** (backend; no terminal: partly): A built-in Hermes backend: Hermes on your own machine starts, stops and resumes a Daytona sandbox for its commands. Daytona's dashboard Playground opens a browser terminal if you want to host it there instead. [Hermes: Daytona backend](https://hermes-agent.nousresearch.com/docs/user-guide/configuration) - **Modal** (backend; no terminal: no): A built-in Hermes backend for running its commands. Not an always-on host: Modal sandboxes end after 24 hours and cannot pause. [Hermes: Modal backend](https://hermes-agent.nousresearch.com/docs/user-guide/configuration#modal-backend) - **Vercel Sandbox** (backend; no terminal: no): Vercel publishes an official guide, but it is for the backend mode: Hermes stays on your computer and each task runs in a sandbox. [Vercel: Hermes](https://vercel.com/docs/sandbox/ecosystem/hermes) - **Sprites** (backend; no terminal: no): Fly.io markets Sprites for agents like Hermes, but its only official Hermes integration is the backend mode. Hosting Hermes inside a Sprite means registering it as a service, because a Sprite pauses about 30 seconds after activity stops. [Sprites: agent plugins](https://docs.fly.io/sprites/integrations/agent-plugins.md) - **Blaxel** (manual; no terminal: no): Possible in a sandbox with a volume for its files, installed by hand. Blaxel's agent hosting caps a run at 15 minutes, so it is not the place for an always-on assistant. [Blaxel: get started](https://docs.blaxel.ai/Get-started.md) - **Cloudflare Sandbox** (none; no terminal: no): Neither Cloudflare nor Hermes documents this. Cloudflare sandboxes also lose their disk when they stop, so memory would have to be saved elsewhere. - **Tensorlake** (manual; no terminal: no): Create a named sandbox with `--timeout 0` on Pro, install Hermes and keep it in a background process or under systemd. Suspend is the catch: Hermes polls Telegram every few seconds, so the sandbox has to stay running, and only Pro allows a session with no cap. Everything in `~/.hermes` sits on the ephemeral root disk, so a snapshot or a mounted volume is what saves it if the sandbox is ever terminated. [Tensorlake: timeout and plan limits](https://docs.tensorlake.ai/sandboxes/lifecycle#timeout) ## Monthly machine cost (preset `personal`) One always-on 2 vCPU / 4 GiB / 20 GiB machine that keeps its files. It waits for messages most of the time: about 6% CPU on average, with peaks near 100% when it browses or runs a command. - Agent 37: $10.60 - Lizard: $19.00 - Boat: $20.00 - InstaBox: $20.00 - Runtime: $24.95 - Sandboxer: $40.00 - Morph: $63.00 - Sprites: $77.61 - boxd: $110.90 - Blaxel: $123.29 - Tensorlake: $250.00 - Vercel Sandbox: $73.12 (catch: Sessions end after 24 hours, so an always-on machine has to be restarted by your own code.) - Cloudflare Sandbox: $99.41 (catch: A stopped instance loses its disk; files have to be backed up to R2 or a snapshot and restored.) - Daytona: $122.07 (catch: 20 GiB of disk is over the 10 GiB limit.) - Modal: $143.71 (catch: Sessions end after 24 hours, so an always-on machine has to be restarted by your own code. Modal sandboxes have no stopped state; keeping files needs a Volume or a snapshot.) - E2B: $270.89 (catch: Sessions end after 24 hours, so an always-on machine has to be restarted by your own code.) ## Outside a sandbox Hermes' own docs point to an ordinary virtual private server ("a $5 VPS") or Docker on a machine you own. Neither isolates the agent the way a sandbox does, and neither is set up for you. ## Sources - [Hermes Agent on GitHub](https://github.com/NousResearch/hermes-agent) - [Hermes docs](https://hermes-agent.nousresearch.com/docs/) - [Hermes: resource limits](https://hermes-agent.nousresearch.com/docs/user-guide/docker#resource-limits) - [Hermes: Telegram polling and webhooks](https://hermes-agent.nousresearch.com/docs/user-guide/messaging/telegram) - [Hermes: terminal backends](https://hermes-agent.nousresearch.com/docs/user-guide/configuration) - [Battleships: always-on assistant workload (built by the Boat team)](https://battleships.dev/data/presets.json) --- # Run an OpenClaw agent > I want OpenClaw answering me on WhatsApp or Slack, with its own browser and memory, without keeping my laptop on. OpenClaw is a self-hosted assistant built around one always-on gateway. It has more official hosting guides than Hermes: two of the sixteen providers deploy it in one click, and four more publish a guide or template. Guide page: https://botperch.com/use-cases/openclaw/ **Short answer:** The cheapest machine that runs it as described is Agent 37 at $10.60 a month, then Lizard ($19.00) and Boat ($20.00). 11 of 16 providers run it without a catch. Machine cost only, before any AI model, at list prices checked 29 October 2026. [OpenClaw](https://docs.openclaw.ai/help/faq/what-is-openclaw) is an open-source assistant you run on your own infrastructure, for yourself or a team. It replies on the apps you already use, including WhatsApp, Slack, Telegram, Discord, Signal and iMessage, and can read files, run commands, browse and keep memory. Its centre is the **Gateway**, which the docs call "the always-on control plane": one long-running program that holds every chat connection and hands messages to the agent. Hosting OpenClaw means hosting the Gateway. Models run through their own APIs, so no GPU is needed. A team can share one Gateway, but the docs are clear that one Gateway is one trust domain: people who do not trust each other need separate ones. ## What it needs - **Machine size:** At least 1 core, 1 GB of memory and 500 MB of disk; 2 GB or more recommended. OpenClaw's Fly.io guide uses 2 shared CPUs and 2 GB. 2 vCPU / 4 GiB / 20 GiB gives the browser room. [source](https://docs.openclaw.ai/install/raspberry-pi) - **Does it stay on?:** Yes. The Gateway owns the chat connections, and Telegram uses outbound polling by default. Webhook mode needs a public HTTPS address that is always reachable. [source](https://docs.openclaw.ai/concepts/architecture) - **What must survive a restart:** ~/.openclaw (config, a SQLite database and chat logins) and the agent's workspace (memory and personality files). Lose the WhatsApp credentials and you scan the QR code again. [source](https://docs.openclaw.ai/help/faq/where-things-live-on-disk) - **Browser, Docker, GPU:** A browser is optional; OpenClaw can drive its own Chrome profile. Docker is optional and tool sandboxing is off by default. No GPU for API models. [source](https://docs.openclaw.ai/tools/browser) - **How busy it is:** Mostly waiting: about 6% CPU on average in Battleships' always-on assistant workload, which names OpenClaw, with peaks near 100%. [source](https://battleships.dev/data/presets.json) ## Picks - **Agent 37**, If you do not want a terminal: One-click OpenClaw on the same Personal plans as Hermes, from $3.99 a month, with a built-in browser from the $29.99 plan. Watch: The free plan sleeps after 15 idle minutes, and these plans are separate from the Cloud machines the calculator prices. https://www.agent37.com/personal - **Lizard**, If you want one click and a public address: The Deploy OpenClaw template gives the Gateway an HTTPS address and a token from the browser, inside a $19 monthly plan that comes back as usage. Watch: The template runs on Lizard's app platform, billed at $0.025 per vCPU-hour and $0.0125 per GB-hour, not at the sandbox sizes the calculator uses. https://lizard.build/deploy/openclaw--openclaw - **Daytona**, If you want OpenClaw's own guide: OpenClaw documents Daytona itself, and the default image already has it installed. $200 of free compute covers the first month or so. Watch: Each sandbox's disk is capped at 10 GiB, and a 2 vCPU / 4 GiB machine on all month is about $122. https://docs.openclaw.ai/install/daytona ## How to run it on each provider - **Agent 37** (one-click; no terminal: yes): OpenClaw is one of the six agents on the Personal plans, set up in one click and driven from the browser. Price: Personal plans from $3.99 a month; $29.99 with a built-in browser. [Agent 37 Personal](https://www.agent37.com/personal) - **Lizard** (one-click; no terminal: yes): A Deploy OpenClaw template on Lizard's app platform builds the Gateway, creates its access token and gives it a public HTTPS address. [Lizard: Deploy OpenClaw](https://lizard.build/deploy/openclaw--openclaw) - **Daytona** (guide; no terminal: partly): OpenClaw publishes a Daytona guide, and OpenClaw is preinstalled in Daytona's default image. Create the sandbox with auto-stop off, connect over SSH and run onboarding. [OpenClaw on Daytona](https://docs.openclaw.ai/install/daytona) - **Cloudflare Sandbox** (guide; no terminal: no): An official, experimental template: one always-on container with its database copied to R2 storage. OpenClaw estimates roughly $40 to $50 a month. Setup is by command line with Wrangler. [OpenClaw on Cloudflare Containers](https://docs.openclaw.ai/install/cloudflare) - **E2B** (guide; no terminal: no): A ready-made openclaw template and a gateway guide. Sessions end after 24 hours on Pro, so staying on needs your own restart logic. [E2B: OpenClaw gateway](https://docs.e2b.dev/agents/openclaw/openclaw-gateway) - **Vercel Sandbox** (guide; no terminal: no): A Vercel walkthrough installs OpenClaw in a sandbox and links WhatsApp by QR code. Sessions end after 24 hours on Pro. [Vercel: OpenClaw in a sandbox](https://vercel.com/kb/guide/running-openclaw-in-vercel-sandbox) - **Blaxel** (guide; no terminal: no): An official tutorial, which says the install is manual: a sandbox, a volume for its files, and onboarding in the terminal. [Blaxel: OpenClaw](https://docs.blaxel.ai/Tutorials/OpenClaw.md) - **Boat** (preinstalled; no terminal: no): The OpenClaw command is preinstalled but the Gateway does not start by itself. Turn auto-stop off and run the Gateway as a service. [Boat: always-on services](https://docs.boat.dev/long-running-tasks/always-on-services) - **boxd** (manual; no terminal: no): boxd's personal-assistant page is written around OpenClaw: install it, turn off bot protection so chat apps can reach it, and turn off auto-hibernate. [boxd: personal assistants](https://docs.boxd.sh/use-cases/personal-assistants) - **Sandboxer** (manual; no terminal: no): Install OpenClaw in a sandbox with auto-stop off and run the Gateway as a service. No guide. [Sandboxer: long-running tasks](https://sandboxer.com/docs/long-running) - **Runtime** (manual; no terminal: partly): A browser shell from the dashboard, then a manual install in a persistent sandbox. No guide. [Runtime: getting started](https://withruntime.com/docs/start) - **InstaBox** (manual; no terminal: partly): The dashboard creates a machine with a browser terminal and desktop; the install is typed by hand. [InstaBox: getting started](https://instabox.sh/docs/start) - **Sprites** (manual; no terminal: no): Install it in a Sprite and register the Gateway as a service so it comes back after the Sprite pauses. No guide. [Sprites: quickstart](https://docs.fly.io/sprites/quickstart.md) - **Morph** (manual; no terminal: no): Install it in a Devbox over SSH and expose its port. No guide. [Morph: Devboxes](https://cloud.morph.so/docs/devboxes/getting-started) - **Modal** (none; no terminal: no): Not documented by either side, and Modal sandboxes end after 24 hours. - **Tensorlake** (manual; no terminal: no): SSH into a named sandbox on Pro, install OpenClaw and run the Gateway there, with the sandbox kept awake by the Gateway's own traffic. Tensorlake publishes no OpenClaw guide. Crabbox, the CLI from OpenClaw, does have a Tensorlake provider, but it syncs a repo and runs a test suite — it does not host the Gateway, so it is not a route to an OpenClaw agent. [Tensorlake: a sandbox as your dev environment](https://docs.tensorlake.ai/sandboxes/remote-dev) ## Monthly machine cost (preset `personal`) One always-on 2 vCPU / 4 GiB / 20 GiB machine that keeps its files. It waits for messages most of the time: about 6% CPU on average, with peaks near 100% when it browses or runs a command. - Agent 37: $10.60 - Lizard: $19.00 - Boat: $20.00 - InstaBox: $20.00 - Runtime: $24.95 - Sandboxer: $40.00 - Morph: $63.00 - Sprites: $77.61 - boxd: $110.90 - Blaxel: $123.29 - Tensorlake: $250.00 - Vercel Sandbox: $73.12 (catch: Sessions end after 24 hours, so an always-on machine has to be restarted by your own code.) - Cloudflare Sandbox: $99.41 (catch: A stopped instance loses its disk; files have to be backed up to R2 or a snapshot and restored.) - Daytona: $122.07 (catch: 20 GiB of disk is over the 10 GiB limit.) - Modal: $143.71 (catch: Sessions end after 24 hours, so an always-on machine has to be restarted by your own code. Modal sandboxes have no stopped state; keeping files needs a Volume or a snapshot.) - E2B: $270.89 (catch: Sessions end after 24 hours, so an always-on machine has to be restarted by your own code.) ## Outside a sandbox OpenClaw also documents ordinary hosts. Hostinger sells a one-click managed OpenClaw from $4.99 a month on a two-year term, renewing at $11.99. OpenClaw's Fly.io guide estimates $10 to $15 a month. Railway and Northflank have one-click templates with no price on the guide. Render's free tier sleeps after 15 minutes, which breaks an always-on Gateway. ## Sources - [What is OpenClaw](https://docs.openclaw.ai/help/faq/what-is-openclaw) - [OpenClaw: Gateway architecture](https://docs.openclaw.ai/concepts/architecture) - [OpenClaw: where things live on disk](https://docs.openclaw.ai/help/faq/where-things-live-on-disk) - [OpenClaw: hosting guides](https://docs.openclaw.ai/vps) - [Hostinger OpenClaw](https://www.hostinger.com/openclaw) - [Battleships: always-on assistant workload (built by the Boat team)](https://battleships.dev/data/presets.json) --- # Give a coding agent its own machine > I want Claude Code or Codex to work on my code in the cloud, not on my laptop. A coding agent reads a repository, edits files and runs tests. In a sandbox, a mistake cannot touch your laptop, and the work carries on when the laptop is closed. Several providers ship Claude Code and Codex already installed. Guide page: https://botperch.com/use-cases/coding-agent/ **Short answer:** The cheapest machine that runs it as described is Agent 37 at $6.76 a month, then Runtime ($13.49) and Lizard ($19.00). 12 of 16 providers run it without a catch. Machine cost only, before any AI model, at list prices checked 29 October 2026. Tools like [Claude Code](https://code.claude.com/docs/en/setup) and Codex run in a terminal: you give them a task, they read the code, change it and run commands to check their work. Running them in a cloud sandbox gives each one a disposable Linux machine with your repository on it. Unlike a personal assistant, a coding agent does not need to stay on. It runs while you work and can stop at night, as long as the repository, its caches and the agent's login survive. ## What it needs - **Machine size:** Claude Code needs 4 GB of memory or more. Anthropic's own cloud sessions allow up to about 4 vCPU, 16 GB and 30 GB of disk. 4 vCPU / 8 GiB / 40 GiB covers the agent, tests and a few containers. [source](https://code.claude.com/docs/en/cloud-environments) - **Does it stay on?:** No. It runs during working hours; eight hours on 20 days is 160 hours a month. [source](https://battleships.dev/data/presets.json) - **What must survive a restart:** The repository and uncommitted work, the agent's login (~/.claude for Claude Code), and caches and Docker images if you want a fast start. [source](https://code.claude.com/docs/en/setup) - **Browser, Docker, GPU:** Docker helps when tests need databases or services. A browser matters only for checking web interfaces. No GPU. [source](https://battleships.dev/data/presets.json) - **How busy it is:** Mostly waiting on the model: about 4% CPU on average in Battleships' software-factory workload, with short peaks during builds. [source](https://battleships.dev/data/rankings/fullstack.json) ## Picks - **Boat**, One machine per developer: Claude Code and Codex preinstalled on a full VM with Docker. The 4 vCPU / 8 GB size for 160 hours is about $6 of usage, inside the $20 plan. Watch: Auto-stop is on by default, which suits this job, and a stopped disk is kept for 14 days. https://docs.boat.dev/integrated-agents/harnesses-and-models - **boxd**, If you want memory billed on use: Three coding agents preinstalled, memory billed on what is actually in use, and a 100 GiB disk billed only for what is written. Watch: CPU is billed on the full size while running, and the 4 vCPU size comes with 16 GiB. https://docs.boxd.sh/use-cases/coding-agents - **E2B**, One fresh sandbox per task, from code: Built for starting sandboxes from your own program, with an official coding-agent guide and pausing that keeps memory and files at no charge. Watch: Disk is 10 GiB on the free plan and 20 GiB on Pro, and sessions longer than an hour need the $150 Pro plan. https://e2b.dev/docs/use-cases/coding-agents ## How to run it on each provider - **Boat** (preinstalled; no terminal: no): Seven coding agents on every sandbox, including Claude Code and Codex; boat prompt runs one for you. [Boat: harnesses and models](https://docs.boat.dev/integrated-agents/harnesses-and-models) - **boxd** (preinstalled; no terminal: no): Every machine ships with Claude Code, Codex and OpenCode. [boxd: coding agents](https://docs.boxd.sh/use-cases/coding-agents) - **Sandboxer** (preinstalled; no terminal: no): Claude Code, Codex, OpenCode and others are installed on every machine. [Sandboxer: machines](https://sandboxer.com/docs/machines) - **InstaBox** (preinstalled; no terminal: partly): Claude Code and Codex come installed, with a desktop you can open in the browser. [InstaBox: limits and images](https://instabox.sh/docs/limits) - **Lizard** (preinstalled; no terminal: partly): Choose the claude or codex template when creating a sandbox. [Lizard: sandboxes](https://lizard.build/docs/sandboxes.md) - **Agent 37** (one-click; no terminal: yes): Claude Code and Codex are on the one-click Personal plans, on your own Anthropic or OpenAI account. Price: Personal plans from $3.99 a month; $29.99 with a built-in browser. [Agent 37 Personal](https://www.agent37.com/personal) - **E2B** (guide; no terminal: no): An official guide for running Claude Code, Codex and Amp in E2B sandboxes from code. [E2B: coding agents](https://e2b.dev/docs/use-cases/coding-agents) - **Daytona** (guide; no terminal: no): An official guide for running Claude Code in a sandbox from the Daytona command line. [Daytona: Claude Code](https://www.daytona.io/docs/en/guides/claude/claude-code-run-cli-sandbox) - **Cloudflare Sandbox** (guide; no terminal: no): An official guide: Claude Code edits a GitHub repository in a sandbox and returns a diff. [Cloudflare: Claude Code](https://developers.cloudflare.com/sandbox/coding-agents/claude-code/) - **Vercel Sandbox** (guide; no terminal: no): Each Claude Code session gets its own sandbox, through Vercel's agent harness. [Vercel: Claude Code](https://vercel.com/docs/agent-harnesses/claude-code) - **Tensorlake** (guide; no terminal: no): The first-party route is the `tensorlake-opencode` plugin: OpenCode keeps running on your laptop and its bash, read, write, edit and patch calls run in a sandbox that survives restarts and can mount a volume or a hosted Git repository. Claude Code and Codex are not in the images, but they work over SSH or VS Code Remote-SSH, and Tensorlake has self-hosted guides for Claude Managed Agents, Cursor Cloud Agents and Devin Outposts. [Run OpenCode with Tensorlake Sandboxes](https://docs.tensorlake.ai/sandboxes/opencode) ## Monthly machine cost (preset `coding`) One 4 vCPU / 8 GiB / 40 GiB machine for Claude Code or Codex, eight hours a day on 20 working days, stopped otherwise with the repository kept. The CPU works about 4% of the time on average. - Agent 37: $6.76 - Runtime: $13.49 - Lizard: $19.00 - Boat: $20.00 - InstaBox: $20.00 - Sandboxer: $20.00 - Tensorlake: $24.46 - Morph: $32.27 - Vercel Sandbox: $32.91 - Sprites: $34.15 - boxd: $50.80 - Blaxel: $57.79 - Cloudflare Sandbox: $24.20 (catch: No size with 4 vCPU allows 40 GiB of disk; the most is 20 GiB on standard-4. A stopped instance loses its disk; files have to be backed up to R2 or a snapshot and restored.) - Modal: $46.15 (catch: Modal sandboxes have no stopped state; keeping files needs a Volume or a snapshot.) - Daytona: $55.75 (catch: 40 GiB of disk is over the 10 GiB limit.) - E2B: $202.99 (catch: 40 GiB of disk is over the 20 GiB limit.) ## Outside a sandbox Anthropic runs Claude Code cloud sessions on its own machines for Claude subscribers, and OpenAI runs Codex Cloud for ChatGPT plans. Neither publishes a separate machine price on its docs page. ## Sources - [Claude Code: setup](https://code.claude.com/docs/en/setup) - [Claude Code: cloud environments](https://code.claude.com/docs/en/cloud-environments) - [Claude Code: sandbox environments](https://code.claude.com/docs/en/sandbox-environments) - [Battleships: software-factory workload (built by the Boat team)](https://battleships.dev/data/presets.json) --- # Run code inside your own product > My app lets users or an LLM run code, and I need somewhere safe to run it. A code interpreter is a sandbox your application calls: send code, get back the output, the errors and any files. Each run is short and thrown away, so the price of a second of compute, how quickly a sandbox starts and how many can run at once matter more than anything else. Guide page: https://botperch.com/use-cases/code-interpreter/ **Short answer:** The cheapest machine that runs it as described is Agent 37 at $2.42 a month, then Runtime ($12.83) and Lizard ($19.00). 16 of 16 providers run it without a catch. Machine cost only, before any AI model, at list prices checked 29 October 2026. This is infrastructure you build into a product, not something your users log into. Your server asks the provider's API for a sandbox, runs the code, collects the result and throws the sandbox away. The code is untrusted by definition, so isolation is the first question: whether each run gets its own kernel, and what it can reach on the network. The [isolation](https://botperch.com/features/isolation/) and [outbound network](https://botperch.com/features/outbound-network/) pages compare that. ## What it needs - **Machine size:** Small. Provider minimums run from 0.125 of a core and 128 MiB on Modal upwards. Battleships' interpreter workload uses 1 vCPU / 2 GiB / 5 GiB and fills 80% of that memory, so 2 vCPU / 4 GiB / 10 GiB is the safer size. [source](https://modal.com/docs/guide/resources) - **Does it stay on?:** No. Each run lasts seconds to minutes; 20,000 one-minute runs a month is about 650 a day. [source](https://battleships.dev/data/presets.json) - **What must survive a restart:** Usually nothing. Results go back to your app or your own storage. [source](https://battleships.dev/data/presets.json) - **How busy it is:** About 17% CPU on average in Battleships' interpreter workload. Charging by the second, and only for CPU actually used, both matter here. [source](https://battleships.dev/data/presets.json) ## Picks - **E2B**, The default choice: Built for exactly this. At the workload below it is about $55 a month at list price, and the free plan's one-time $100 credit covers most of the first two months. Watch: The free plan limits sessions to an hour and disk to 10 GiB. Concurrency limits are per plan. https://e2b.dev/pricing - **Runtime**, If runs mostly wait: CPU is billed only while working, so the same workload is about $13 a month. Watch: Smaller company, one US region, and a free tier capped at four sandboxes at once. https://withruntime.com/docs/pricing - **Cloudflare Sandbox**, If your app already runs on Cloudflare: Started from a Worker next to your code, with CPU billed only while working. Watch: The smallest size that has 2 vCPU also has 8 GiB of memory, which you pay for. There is a $5 monthly account minimum. https://developers.cloudflare.com/containers/platform/pricing/ ## How to run it on each provider - **E2B** (guide; no terminal: no): Its original use: a code-interpreter SDK and per-second billing. [E2B docs](https://e2b.dev/docs) - **Daytona** (guide; no terminal: no): Sandboxes started from an SDK, billed per second, with $200 of free compute. [Daytona docs](https://www.daytona.io/docs/en/) - **Modal** (guide; no terminal: no): Sandboxes from Python or JavaScript, sized down to a fraction of a core. [Modal: sandboxes](https://modal.com/docs/guide/sandboxes) - **Vercel Sandbox** (guide; no terminal: no): Firecracker sandboxes from an SDK, with CPU billed only while working. [Vercel Sandbox](https://vercel.com/docs/sandbox) - **Cloudflare Sandbox** (guide; no terminal: no): Sandboxes started from a Worker, with CPU billed only while working. [Cloudflare Sandbox SDK](https://developers.cloudflare.com/sandbox/get-started/) - **Tensorlake** (guide; no terminal: no): Wrap `sandbox.run()` as a `run_code` tool and keep one sandbox per session so installed packages and written files carry between calls; the Tool Calls page has Claude, OpenAI and OpenAI Agents SDK examples. Pre-install the usual libraries in a snapshot so each session starts warm, and turn egress off or to an allowlist before running model-written code. [Tensorlake: tool calls](https://docs.tensorlake.ai/sandboxes/tool-calls) ## Monthly machine cost (preset `interpreter`) 20,000 one-minute runs a month on 2 vCPU / 4 GiB / 10 GiB machines, thrown away after each run; results go to your own storage. The CPU works about 17% of the time. - Agent 37: $2.42 - Runtime: $12.83 - Lizard: $19.00 - Boat: $20.00 - InstaBox: $20.00 - Sandboxer: $20.00 - Tensorlake: $28.60 - Morph: $33.33 - Sprites: $35.90 - Cloudflare Sandbox: $37.78 - Vercel Sandbox: $42.77 - Modal: $49.32 - boxd: $50.32 - Blaxel: $55.20 - E2B: $55.20 - Daytona: $55.38 ## Outside a sandbox Anthropic's hosted code-execution tool runs Claude's code for you with no sandbox to manage: 1 CPU, 5 GiB, no internet, 1,550 hours included and then $0.05 per container-hour. ## Sources - [Battleships: interpreter workload (built by the Boat team)](https://battleships.dev/data/presets.json) - [Modal: resources](https://modal.com/docs/guide/resources) - [Anthropic: code execution tool](https://platform.claude.com/docs/en/agents-and-tools/tool-use/code-execution-tool) --- # Run a browser or computer-use agent > I want an agent that opens websites, clicks and fills in forms, or uses a whole desktop. Browser agents drive a real Chromium, or a whole desktop with a mouse and keyboard. Memory is the constraint, not CPU, and logins are the thing people forget to keep. Guide page: https://botperch.com/use-cases/browser-agent/ **Short answer:** The cheapest machine that runs it as described is Agent 37 at $36.30 a month, then Lizard ($85.79) and Boat ($90.00). 16 of 16 providers run it without a catch. Machine cost only, before any AI model, at list prices checked 29 October 2026. A browser agent reads pages as text or screenshots and clicks, types and scrolls like a person. A computer-use agent does the same with a full desktop. Both need a machine with a display and enough memory for Chromium. Sessions are usually short and thrown away. If the agent must stay logged in to sites, keep its browser profile, which means keeping the disk or saving a snapshot. ## What it needs - **Machine size:** 2 vCPU / 4 GiB / 10 GiB for a browser; Browserless gives the same minimum. A full desktop is more comfortable at 4 vCPU / 8 GiB / 20 GiB. [source](https://battleships.dev/data/presets.json) - **Does it stay on?:** No. Typical sessions are minutes long. [source](https://battleships.dev/data/presets.json) - **What must survive a restart:** Nothing, unless logins must survive: then the browser profile and cookies. [source](https://battleships.dev/data/presets.json) - **How busy it is:** About 3% CPU on average; Chromium's memory is what fills the machine. [source](https://battleships.dev/data/presets.json) ## Picks - **InstaBox**, A desktop you can watch: The agent-browser image comes with a desktop and Chromium you can open from the dashboard, and an idle machine pauses itself and wakes when its preview link is used. Watch: The free plan is one 4 vCPU / 8 GiB machine that pauses after 30 idle minutes. https://instabox.sh/docs/desktop - **Boat**, Full VMs at a flat rate: A full Ubuntu VM with room for a browser, at a flat hourly price per size. Watch: At thousands of sessions a month, the plan's start limits apply, and paid starts come out of the wallet. https://docs.boat.dev/pricing - **Daytona**, Computer use from code: Documents computer use, with sandboxes started from an SDK and per-second billing. Watch: Each sandbox's disk is capped at 10 GiB. https://www.daytona.io/docs/en/ ## How to run it on each provider - **Tensorlake** (guide; no terminal: no): Boot `tensorlake/ubuntu-vnc`, which ships XFCE, TigerVNC, Firefox and Chrome, then either drive the desktop through `connectDesktop()` for screenshots, clicks and typing, or start Chrome with `--remote-debugging-port=9222` and tunnel it to localhost so Playwright, Puppeteer or `chrome-devtools-mcp` drive it as if it were local. Snapshot a warmed profile so parallel agents start with cookies already in place. [Tensorlake: computer use](https://docs.tensorlake.ai/sandboxes/computer-use) ## Monthly machine cost (preset `browser`) 30,000 ten-minute browser sessions a month on 2 vCPU / 4 GiB / 10 GiB machines, thrown away after each. Chromium needs memory more than CPU: about 3% CPU on average. - Agent 37: $36.30 - Lizard: $85.79 - Boat: $90.00 - InstaBox: $90.50 - Sandboxer: $100.00 - Runtime: $157.50 - Tensorlake: $331.00 - Morph: $375.00 - Cloudflare Sandbox: $406.03 - Vercel Sandbox: $462.40 - Sprites: $485.03 - boxd: $754.80 - Blaxel: $828.00 - E2B: $828.00 - Daytona: $830.70 - Modal: $1,159.80 ## Outside a sandbox Browser services such as Browser Use Cloud sell hosted browser time (from $0.02 per browser-hour) without a machine to manage. ## Sources - [Battleships: browser and computer-use workloads (built by the Boat team)](https://battleships.dev/data/presets.json) - [Browser Use pricing](https://browser-use.com/pricing) --- # Host your own n8n > I want n8n running my automations around the clock, on a server I control, without paying per workflow run. n8n is a visual automation tool you can host yourself. It needs a small machine that never sleeps and keeps its database. Two of the sixteen providers set it up in one click; most others can run it if someone follows terminal steps; the task-only sandboxes are the wrong place for it. Guide page: https://botperch.com/use-cases/workflow-automation/ **Short answer:** The cheapest machine that runs it as described is Agent 37 at $10.60 a month, then Lizard ($19.00) and Boat ($20.00). 11 of 16 providers run it without a catch. Machine cost only, before any AI model, at list prices checked 29 October 2026. [n8n](https://docs.n8n.io/) is a workflow automation tool. You draw a workflow on a canvas: a **trigger** (something that starts it, such as a form being sent or a time of day), then steps that call other apps, reshape data or ask an AI model. Its [README](https://github.com/n8n-io/n8n) counts 1,500+ ready-made connections. Hosting it yourself means you run the server, its database, its encryption key and its upgrades. In return there is no per-run fee: n8n's own hosted [n8n Cloud](https://n8n.io/pricing/) is billed by how many workflow runs you use. Most workflows start in one of two ways: a **webhook**, which is a web address another app calls when something happens, or the [Schedule Trigger](https://docs.n8n.io/integrations/builtin/core-nodes/n8n-nodes-base.scheduletrigger), n8n's own built-in clock. Both only work while n8n is running, which decides what kind of machine it needs. ## What it needs - **Machine size:** n8n publishes no self-hosting minimum. Its Cloud plans run from 640 MiB of memory to 4 GiB, and the software alone uses about 180 MiB. Because any single step can pull a large file into memory, 2 vCPU / 4 GiB / 20 GiB is the safer buy. [source](https://docs.n8n.io/deploy/use-n8n-cloud/configure-cloud/manage-your-data/) - **Does it stay on?:** Yes. n8n listens for webhooks only while it runs, and the Schedule Trigger works "in a similar way to the Cron software utility": its clock lives inside the machine. A sleeping machine misses both. A host that wakes on a web request can still catch webhooks after a short delay, but scheduled runs will not fire while it sleeps. [source](https://docs.n8n.io/integrations/builtin/core-nodes/n8n-nodes-base.scheduletrigger) - **What must survive a restart:** The database (workflows, saved logins to other apps, run history; SQLite by default, PostgreSQL for anything larger) and the encryption key n8n creates on first start. Without that key the saved logins cannot be read, and a database backup alone will not bring them back. [source](https://docs.n8n.io/deploy/host-n8n/configure-n8n/basic-configuration/use-environment-variables/database) - **Browser, Docker, GPU:** No browser on the server: the editor opens in yours. The documented install uses Docker (a standard way to package and run software); npm on Node.js 20.19 to 24.x is the alternative. No GPU. [source](https://docs.n8n.io/deploy/host-n8n/install-options/install-using-docker-compose) - **How busy it is:** Mostly waiting. No benchmark measures n8n; Battleships' nearest always-on workload averages about 6% CPU, with peaks near 100% when a large workflow runs. Size for the peak, not the average. [source](https://battleships.dev/data/rankings/employees.json) ## Picks - **Lizard**, If you do not want a terminal: The most complete one-click setup: n8n plus a managed PostgreSQL database and a public HTTPS address, inside the $19 monthly plan that comes back as usage. Watch: The template does not set an encryption key; note the one n8n creates and keep it safe. It runs on Lizard's app platform, not at the sandbox sizes the calculator prices. https://lizard.build/deploy/n8n--n8n - **Agent 37**, If you want the cheapest one click: The agent37-n8n template sets up n8n on its default 2 vCPU / 4 GB instance at $4.76 a month, with auto-sleep off by default. Watch: It uses SQLite on the instance's disk rather than a separate database. Turning auto-sleep on stops scheduled workflows. https://www.agent37.com/docs/agents-api/n8n - **Runtime**, If you can follow terminal steps: CPU is billed only while it works, so an n8n that mostly waits is about $25 a month at 2 vCPU / 4 GiB, in a persistent sandbox with your own domain. Watch: No n8n guide, one US region, and storage keeps billing while the machine is stopped. https://withruntime.com/docs/pricing ## How to run it on each provider - **Lizard** (one-click; no terminal: yes): A Deploy Now template creates an n8n app and a separate managed PostgreSQL database, connects them and gives n8n a public HTTPS address. It does not set an encryption key, attach a volume or add worker processes. [Lizard: Deploy n8n](https://lizard.build/deploy/n8n--n8n) - **Agent 37** (one-click; no terminal: yes): The agent37-n8n template runs the official n8n image with a public editor address and SQLite on a disk that is kept. The dashboard asks only for an owner password, and auto-sleep is off by default; leave it off for scheduled workflows. Price: Default 2 vCPU / 4 GB instance at $4.76 a month. [Agent 37: host n8n](https://www.agent37.com/docs/agents-api/n8n) - **Boat** (manual; no terminal: partly): A full Ubuntu machine with Docker. Install n8n as a service that comes back after a restart, make its port public, and keep the disk. No n8n guide, and no custom domains. [Boat: always-on services](https://docs.boat.dev/long-running-tasks/always-on-services) - **boxd** (manual; no terminal: partly): Docker is preinstalled and running, and custom domains are self-serve. Turn hibernation off so schedules fire. No n8n template or guide. [boxd: run Docker](https://docs.boxd.sh/guides/run-docker) - **Daytona** (manual; no terminal: partly): Create a sandbox with auto-stop turned off (it stops after 15 idle minutes by default), install n8n with npm and make its port public. n8n names Daytona as the sandbox for its own AI Assistant feature, which is not the same as hosting n8n there. [Daytona: auto-stop](https://www.daytona.io/docs/en/sandboxes#auto-stop-interval) - **InstaBox** (manual; no terminal: partly): The agent-browser image includes Docker. Turn auto-pause off, install n8n and publish port 5678. No n8n guide. [InstaBox: concepts](https://instabox.sh/docs/concepts) - **Morph** (manual; no terminal: partly): A Devbox can serve n8n and wake when a request arrives, but a paused Devbox's clock stops, so scheduled workflows need it kept running. No n8n guide. [Morph: wake on request](https://cloud.morph.so/docs/documentation/instances/wake-on) - **Runtime** (manual; no terminal: partly): Docker, persistent sandboxes ("no idle pause") and custom domains are all documented, which is what n8n needs. No n8n guide. [Runtime: pricing and persistent sandboxes](https://withruntime.com/docs/pricing) - **Sandboxer** (manual; no terminal: partly): Create a sandbox with auto-stop and idle pause off, install n8n, run it as a service and make its port public. No n8n guide. [Sandboxer: long-running tasks](https://sandboxer.com/docs/long-running) - **Blaxel** (manual; no terminal: no): Blaxel's n8n page is about n8n calling a Blaxel agent, not about hosting n8n. Running n8n itself would be a manual install with a volume for its database. [Blaxel: n8n integration](https://docs.blaxel.ai/Tutorials/n8n) - **Sprites** (manual; no terminal: no): Command line only, and a Sprite pauses when idle unless something holds it awake. Its fixed large size is far more than n8n uses. No guide. [Sprites: quickstart](https://docs.fly.io/sprites/quickstart.md) - **Cloudflare Sandbox** (manual; no terminal: no): A poor fit: "stopping the instance deletes the files on its disk", so n8n's database and encryption key would have to be kept somewhere else. No guide. [Cloudflare Sandbox: files](https://developers.cloudflare.com/sandbox/files/) - **E2B** (none; no terminal: no): Not suitable: a sandbox session ends after one hour on the free plan and 24 hours on Pro, and n8n has to outlive its schedule. [E2B: pricing](https://e2b.dev/pricing.md) - **Modal** (none; no terminal: no): Not documented. Modal is built for functions and short sandboxes, which end after at most 24 hours. [Modal: sandboxes](https://modal.com/docs/guide/sandboxes) - **Vercel Sandbox** (none; no terminal: no): Not suitable: Vercel sandboxes are made for one task at a time, with no way to keep a web app running. ## Monthly machine cost (preset `automation`) One always-on 2 vCPU / 4 GiB / 20 GiB machine that keeps its database and encryption key: 730 hours, because webhooks and schedules stop when it sleeps. About 6% CPU on average, with peaks near 100% when a big workflow runs. The model line assumes 50 workflow steps a day that ask a cheap model, 10,000 tokens each. - Agent 37: $10.60 - Lizard: $19.00 - Boat: $20.00 - InstaBox: $20.00 - Runtime: $24.88 - Sandboxer: $40.00 - Morph: $63.00 - Sprites: $77.50 - boxd: $110.90 - Blaxel: $123.29 - Tensorlake: $250.00 - Vercel Sandbox: $72.74 (catch: Sessions end after 24 hours, so an always-on machine has to be restarted by your own code.) - Cloudflare Sandbox: $98.99 (catch: A stopped instance loses its disk; files have to be backed up to R2 or a snapshot and restored.) - Daytona: $122.07 (catch: 20 GiB of disk is over the 10 GiB limit.) - Modal: $143.71 (catch: Sessions end after 24 hours, so an always-on machine has to be restarted by your own code. Modal sandboxes have no stopped state; keeping files needs a Volume or a snapshot.) - E2B: $270.89 (catch: Sessions end after 24 hours, so an always-on machine has to be restarted by your own code.) ## Outside a sandbox n8n's own [n8n Cloud](https://n8n.io/pricing/) costs €20 a month on Starter (2,500 workflow runs) and €50 on Pro (10,000), billed annually, with nothing to host. [Activepieces](https://www.activepieces.com/pricing), a similar open-source tool, has a free plan and a $20 flat monthly plan. [Windmill](https://www.windmill.dev/docs/advanced/self_host) is free to host yourself and needs PostgreSQL. ## Sources - [n8n docs](https://docs.n8n.io/) - [n8n on GitHub](https://github.com/n8n-io/n8n) - [n8n Cloud: memory and storage](https://docs.n8n.io/deploy/use-n8n-cloud/configure-cloud/manage-your-data/) - [n8n: database configuration](https://docs.n8n.io/deploy/host-n8n/configure-n8n/basic-configuration/use-environment-variables/database) - [n8n: Webhook node](https://docs.n8n.io/integrations/builtin/core-nodes/n8n-nodes-base.webhook) - [n8n pricing](https://n8n.io/pricing/) - [Agent 37: templates](https://www.agent37.com/docs/agents-api/templates) - [Battleships: always-on assistant workload (built by the Boat team)](https://battleships.dev/data/rankings/employees.json) --- # Host your own Discord or Slack bot > I wrote a bot that answers questions in our Discord or Slack using an AI model, and I need somewhere for it to live. A chat bot is a small program that waits for messages, asks a model and replies. How Discord or Slack delivers those messages decides whether it can ever sleep. No provider hosts your own bot in one click; one provider's guide stands out, and the task-only sandboxes are a poor fit. Guide page: https://botperch.com/use-cases/chat-bot/ **Short answer:** The cheapest machine that runs it as described is Agent 37 at $5.30 a month, then Runtime ($11.86) and Lizard ($19.00). 12 of 16 providers run it without a catch. Machine cost only, before any AI model, at list prices checked 29 October 2026. A support or community bot holds a login token for the chat app, receives each message, assembles some context, calls a model and posts the answer. You write it with a library such as [discord.js](https://github.com/discordjs/discord.js) or Slack's Bolt; the model runs elsewhere and is billed by its own provider. Discord bots normally keep a **WebSocket** open to Discord: a connection that stays open so messages can be pushed down it at any moment. Discord calls these [persistent connections](https://discord.com/developers/docs/topics/gateway) that the bot must keep alive with regular heartbeats. Slack offers the same in [Socket Mode](https://docs.slack.dev/apis/events-api/using-socket-mode). The other way is a public web address that Discord or Slack calls for each message ([Slack Request URLs](https://docs.slack.dev/apis/events-api/using-http-request-urls), [Discord interactions](https://discord.com/developers/docs/interactions/overview)). A bot built that way only needs to be awake when a message arrives. A bot that reads every message in a server needs the open connection, and so a machine that stays on. ## What it needs - **Machine size:** Neither Discord nor Slack publishes one. 1 vCPU / 2 GiB / 10 GiB runs Node or Python, a small history database and one model call at a time, with room for logs. Battleships models this job at 2 vCPU / 4 GiB / 20 GiB. [source](https://battleships.dev/data/presets.json) - **Does it stay on?:** Yes for a bot with an open connection: if it misses a heartbeat, Discord closes the connection, and a bot may only log in to it 1,000 times a day, so a host that keeps sleeping and waking it is a bad host. A bot that only answers through a web address can sleep if the host wakes it on a request. [source](https://discord.com/developers/docs/topics/gateway) - **What must survive a restart:** The bot token (anyone with it controls the bot), conversation history and any settings. Lizard's guide keeps them in a database rather than the machine's disk, and warns to run only one copy per token, or every copy answers every message. [source](https://lizard.build/docs/guides/discord-bot) - **Browser, Docker, GPU:** No browser. Docker is optional. A database is recommended for history; SQLite (a single-file database) is enough for one copy. No GPU. [source](https://lizard.build/docs/guides/discord-bot) - **How busy it is:** Idle almost all the time, busy in short bursts when a message arrives. Battleships' always-on assistant averages about 6% CPU; one community server sees less traffic, so the calculator uses 3%. [source](https://battleships.dev/data/rankings/employees.json) ## Picks - **Lizard**, If you wrote the bot yourself: The only provider with a full official Discord bot guide, including the database for history and the one-copy rule. It fits inside the $19 monthly plan that comes back as usage. Watch: Deployed from the command line, and it runs on Lizard's app platform rather than the sandbox sizes the calculator prices. https://lizard.build/docs/guides/discord-bot - **Runtime**, If you want to pay least for waiting: CPU is billed only while it works, so a bot that mostly waits is about $12 a month at 1 vCPU / 2 GiB, in a sandbox that never idle-pauses. Watch: No bot guide, one US region, and storage keeps billing while the machine is stopped. https://withruntime.com/docs/pricing - **Agent 37**, If you do not want to write code: A ready-made AI agent (OpenClaw or Hermes) answering in your Discord or Slack, set up from the browser, from $3.99 a month with your own model key. Watch: It is not your own bot: you configure an existing agent rather than run your code. These Personal plans are separate from the Cloud machines the calculator prices. https://www.agent37.com/personal ## How to run it on each provider - **Agent 37** (one-click; no terminal: yes): Not your own code: pick OpenClaw or Hermes on a Personal plan and connect it to your own Discord or Slack account, on Basic and above. The bot is that ready-made agent. Price: Personal plans from $3.99 a month; Discord and Slack from the Basic plan. [Agent 37 Personal](https://www.agent37.com/personal) - **Lizard** (guide; no terminal: no): The most complete official walkthrough: a discord.js example deployed with no public port, one copy per token, secrets, and a managed PostgreSQL database for history. Deployed from the command line. [Lizard: host a Discord bot](https://lizard.build/docs/guides/discord-bot) - **Modal** (guide; no terminal: no): An official example, but only for a bot that answers slash commands through a web address. Modal is not built to hold an open connection. [Modal: Discord bot](https://modal.com/docs/examples/discord_bot) - **Boat** (manual; no terminal: partly): Boat documents the pattern: run the bot as a service that comes back by itself after a stop, resume or copy, and keep its public address. No bot-specific guide. [Boat: always-on services](https://docs.boat.dev/long-running-tasks/always-on-services) - **boxd** (manual; no terminal: partly): Turn off auto-hibernate, and turn off bot protection for that machine: it is on by default and "chat apps can't pass" it. [boxd: personal assistants](https://docs.boxd.sh/use-cases/personal-assistants) - **Daytona** (manual; no terminal: partly): Create a sandbox with auto-stop off (the default is 15 idle minutes), install the bot and keep it running under a process manager. No bot guide. [Daytona: auto-stop](https://www.daytona.io/docs/en/sandboxes#auto-stop-interval) - **InstaBox** (manual; no terminal: partly): A general Linux machine with Docker. Turn auto-pause off so the connection stays open. No bot guide. [InstaBox: concepts](https://instabox.sh/docs/concepts) - **Runtime** (manual; no terminal: partly): A persistent sandbox never idle-pauses and can run the bot. No bot guide. [Runtime: pricing and persistent sandboxes](https://withruntime.com/docs/pricing) - **Sandboxer** (manual; no terminal: partly): Turn idle pause off, or create the keep-awake file Sandboxer documents for work it cannot see, and run the bot as a service. No bot guide. [Sandboxer: long-running tasks](https://sandboxer.com/docs/long-running) - **Morph** (manual; no terminal: partly): Only for a bot that answers through a web address: a Devbox wakes on a request, but an idle one is paused, which drops an open connection. [Morph: wake on request](https://cloud.morph.so/docs/documentation/instances/wake-on) - **Sprites** (manual; no terminal: no): Only for a bot that answers through a web address: "services don't keep a Sprite from pausing", so a quiet connection would be paused. [Sprites: services](https://docs.fly.io/sprites/concepts/services.md) - **Blaxel** (manual; no terminal: no): A poor fit for an open connection: Blaxel treats a WebSocket with no traffic for 15 minutes as idle and puts the sandbox on standby. No bot guide. [Blaxel: active and standby](https://docs.blaxel.ai/knowledge-base/configuration-and-operation/understanding-sandbox-active-vs-standby-states-and-billing.md) - **Cloudflare Sandbox** (manual; no terminal: no): A Worker can serve a Slack app that answers through a web address, but a Discord bot with an open connection does not fit a sandbox built around requests and stopping. No bot guide. [Cloudflare Sandbox: lifetime](https://developers.cloudflare.com/sandbox/concepts/lifetime/) - **E2B** (none; no terminal: no): Not suitable: sessions end after one hour on the free plan and 24 hours on Pro. [E2B: pricing](https://e2b.dev/pricing.md) - **Vercel Sandbox** (none; no terminal: no): Not suitable: sandboxes are made for one task and functions for one request, with no documented way to hold a connection open. ## Monthly machine cost (preset `chatbot`) One always-on 1 vCPU / 2 GiB / 10 GiB machine that keeps its history: 730 hours, because a bot holding a Discord or Slack connection cannot sleep. About 3% CPU on average, since one community sees little traffic. The model line assumes 100 replies a day at 10,000 tokens each (instructions plus recent messages). - Agent 37: $5.30 - Runtime: $11.86 - Lizard: $19.00 - Boat: $20.00 - InstaBox: $20.00 - Sandboxer: $20.00 - Morph: $36.50 - Sprites: $38.88 - boxd: $55.45 - Daytona: $60.84 - Blaxel: $61.64 - Tensorlake: $250.00 - Vercel Sandbox: $33.76 (catch: Sessions end after 24 hours, so an always-on machine has to be restarted by your own code.) - Cloudflare Sandbox: $47.48 (catch: A stopped instance loses its disk; files have to be backed up to R2 or a snapshot and restored.) - Modal: $56.86 (catch: Sessions end after 24 hours, so an always-on machine has to be restarted by your own code. Modal sandboxes have no stopped state; keeping files needs a Volume or a snapshot.) - E2B: $60.44 (catch: Sessions end after 1 hour, so an always-on machine has to be restarted by your own code.) ## Outside a sandbox An ordinary host such as [Render](https://render.com/pricing) runs an always-on background worker from $7 a month for 512 MB, or $25 for 1 CPU / 2 GB. A Slack app that answers through a web address fits [Cloudflare Workers](https://developers.cloudflare.com/workers/platform/pricing/): free up to 100,000 requests a day, or a $5 monthly minimum. ## Sources - [Discord: Gateway](https://discord.com/developers/docs/topics/gateway) - [Discord: interactions](https://discord.com/developers/docs/interactions/overview) - [Slack: Socket Mode](https://docs.slack.dev/apis/events-api/using-socket-mode) - [Slack: HTTP Request URLs](https://docs.slack.dev/apis/events-api/using-http-request-urls) - [Lizard: host a Discord bot](https://lizard.build/docs/guides/discord-bot) - [Render pricing](https://render.com/pricing) - [Battleships: always-on assistant workload (built by the Boat team)](https://battleships.dev/data/rankings/employees.json) --- # Give a small team Claude Code in the cloud > Three to five of us want Claude Code running on cloud machines, each with our own login, without sharing one account. Claude Code is built for one person on one machine. For a team that means one machine per developer, each signed in with that developer's own account. Five providers ship it preinstalled and one sets it up in one click; the catch is how logins are kept. Guide page: https://botperch.com/use-cases/claude-code-team/ **Short answer:** The cheapest machine that runs it as described is Boat at $28.80 a month, then Agent 37 ($33.78) and Lizard ($39.92). 12 of 16 providers run it without a catch. Machine cost only, before any AI model, at list prices checked 29 October 2026. [Claude Code](https://code.claude.com/docs/en/overview) is Anthropic's coding agent. A developer starts it in a repository and asks for a change; it reads and edits files and runs commands and tests on the machine where it runs. Vercel's guide puts the hosting constraint plainly: Claude Code "isn't built to be safe for multiple tenants: it's a command-line tool for one user, it keeps its state on disk" ([Vercel](https://vercel.com/docs/agent-harnesses/claude-code)). A shared machine would hold one person's login and mix everyone's unfinished work, so the default is one machine each. For a team, three things have to be decided together: where each copy runs, whose Claude account pays, and what survives when a machine is replaced. The machine does not need to stay on; it runs while people work. ## What it needs - **Machine size:** Anthropic asks for 4 GB of memory or more and gives no CPU or disk minimum. Its own cloud sessions allow 4 vCPU, 16 GB and 30 GB of disk. 4 vCPU / 8 GiB / 40 GiB per developer covers the agent, tests and a few containers, with room for their images. [source](https://code.claude.com/docs/en/setup) - **Does it stay on?:** No. Each machine runs during working hours: eight hours on 20 days is 160 hours each, or 800 for five developers. It can stop between sessions if its disk survives. [source](https://code.claude.com/docs/en/claude-code-on-the-web) - **What must survive a restart:** The repository and any work not yet pushed, and the login: on Linux, ~/.claude/.credentials.json. If the disk is thrown away, the developer signs in again and unpushed work is lost. [source](https://code.claude.com/docs/en/authentication) - **Whose login:** On Claude's Team plan, "team members install Claude Code and log in with their claude.ai accounts", so each machine holds its owner's login. Some platforms store one Claude login for the whole account, which every sandbox uses: convenient alone, wrong for a team that wants usage and access per person. [source](https://code.claude.com/docs/en/authentication) - **How busy it is:** Mostly waiting on the model: about 3% CPU on average in Battleships' software-factory workload, with peaks near half the machine during builds and tests. [source](https://battleships.dev/data/rankings/fullstack.json) ## Picks - **Boat**, One machine per developer: Claude Code preinstalled on a full virtual machine with Docker. Five 4 vCPU / 8 GB machines for 160 hours each come to about $29 of usage: the $20 plan plus about $9 from the wallet. Watch: A stopped machine's disk is kept for only 14 days, so push work before a holiday. There is no free plan. https://docs.boat.dev/integrated-agents/harnesses-and-models - **Sandboxer**, If you want a guide and a dashboard terminal: Claude Code preinstalled, an official guide, and a Terminal tab in the dashboard. The same five machines come to $40 a month. Watch: Usage over the $20 plan is bought in $20 packs, and storage counts against an included quota: going over blocks new sandboxes. https://sandboxer.com/docs/machines - **Agent 37**, If the team does not want a terminal: One-click Claude Code on each developer's own Anthropic account, so logins stay separate. Watch: One instance per developer: five Pro instances are about $150 a month, and team roles need the $99.99 Max plan. These plans are separate from the Cloud machines the calculator prices. https://www.agent37.com/docs/agents-api/templates ## How to run it on each provider - **Agent 37** (one-click; no terminal: yes): The agent37-claude-code template sets up one Claude Code instance on the developer's own Anthropic account. One instance each, so five developers means five; team management and roles are on the Max plan. Price: Personal Pro $29.99 a month per instance; Max with team roles $99.99. [Agent 37: templates](https://www.agent37.com/docs/agents-api/templates) - **Boat** (preinstalled; no terminal: partly): Claude Code is one of seven coding agents on every sandbox. Create one per developer from the dashboard or command line, then run claude. [Boat: harnesses and models](https://docs.boat.dev/integrated-agents/harnesses-and-models) - **boxd** (preinstalled; no terminal: partly): Every machine ships with Claude Code, Codex and OpenCode, and the console opens a terminal or desktop. No shared login feature, so each developer signs in on their own machine. [boxd: coding agents](https://docs.boxd.sh/use-cases/coding-agents) - **InstaBox** (preinstalled; no terminal: partly): The default image includes Claude Code, Codex, Docker and a desktop. Open the machine's terminal from the dashboard. No Claude Code guide. [InstaBox: limits and images](https://instabox.sh/docs/limits) - **Sandboxer** (preinstalled; no terminal: partly): Claude Code is in the preinstalled agent list, Sandboxer publishes a Claude Code guide, and the dashboard has a Terminal tab. [Sandboxer: machines](https://sandboxer.com/docs/machines) - **Lizard** (preinstalled; no terminal: partly): A claude template and a guide. But "credentials belong to your Lizard account, not to a project, and every sandbox you start can use them": five machines would still share one Claude login. [Lizard: Claude Code](https://lizard.build/docs/sandboxes/guides/claude-code) - **Daytona** (guide; no terminal: partly): An official command-line guide. The dashboard Playground opens a terminal in the browser, so nothing is installed locally, but setup is typed commands. [Daytona: Claude Code](https://www.daytona.io/docs/en/guides/claude/claude-code-run-cli-sandbox) - **E2B** (guide; no terminal: no): A prebuilt claude template and a guide, made for a fresh sandbox per task started from code rather than each developer's own machine. [E2B: Claude Code](https://docs.e2b.dev/agents/claude-code) - **Vercel Sandbox** (guide; no terminal: no): An official guide that gives each Claude Code session its own sandbox, built in code. [Vercel: Claude Code](https://vercel.com/docs/agent-harnesses/claude-code) - **Cloudflare Sandbox** (guide; no terminal: no): An official guide: a Worker starts a sandbox where Claude Code edits a GitHub repository and returns the changes. Needs Workers and a container deployment. [Cloudflare: Claude Code](https://developers.cloudflare.com/sandbox/coding-agents/claude-code/) - **Blaxel** (guide; no terminal: no): A written tutorial for running Claude Code in a Blaxel sandbox against a codebase, with command-line and code steps. [Blaxel: Claude Code](https://docs.blaxel.ai/Tutorials/Claude-Code) - **Morph** (guide; no terminal: no): An official example installs Claude Code in a Devbox with Anthropic's installer. Nothing on teams or logins. [Morph: Claude Code](https://cloud.morph.so/docs/examples/claude-code) - **Runtime** (manual; no terminal: no): A sandbox opens with a shell in the browser and can run it, but there is no Claude Code guide or template. [Runtime: getting started](https://withruntime.com/docs/start) - **Sprites** (manual; no terminal: no): Sprites documents Claude Managed Agents, a different Anthropic product, not Claude Code. Installing it in a Sprite is by hand. [Sprites: Claude Managed Agents](https://docs.fly.io/sprites/integrations/claude-managed-agents.md) - **Modal** (none; no terminal: no): Not documented, and Modal sandboxes have no stopped state that keeps a developer's files. ## Monthly machine cost (preset `team`) Five 4 vCPU / 8 GiB / 40 GiB machines, one per developer, eight hours a day on 20 working days (800 machine-hours), stopped otherwise with each repository and login kept. About 3% CPU on average. The model line is 20 requests a day per developer at 300,000 tokens each, at API prices; developers who sign in with Claude subscriptions pay per seat instead. - Boat: $28.80 - Agent 37: $33.78 - Lizard: $39.92 - Sandboxer: $40.00 - InstaBox: $43.26 - Runtime: $66.96 - Tensorlake: $120.95 - Morph: $151.37 - Vercel Sandbox: $162.10 - Sprites: $169.99 - boxd: $254.02 - Blaxel: $288.96 - Cloudflare Sandbox: $102.54 (catch: No size with 4 vCPU allows 40 GiB of disk; the most is 20 GiB on standard-4. A stopped instance loses its disk; files have to be backed up to R2 or a snapshot and restored.) - Daytona: $278.76 (catch: 40 GiB of disk is over the 10 GiB limit.) - Modal: $350.74 (catch: Modal sandboxes have no stopped state; keeping files needs a Volume or a snapshot.) - E2B: $414.96 (catch: 40 GiB of disk is over the 20 GiB limit.) ## Outside a sandbox Anthropic runs Claude Code [cloud sessions](https://code.claude.com/docs/en/sandbox-environments) on its own machines for Claude subscribers, with no separate machine price. [Claude Team](https://claude.com/pricing) is $25 per seat a month ($20 billed annually) for 2 to 150 people, with central billing, single sign-on and each member on their own login. Claude Enterprise starts at 20 seats, which is why a team of five starts on Team. ## Sources - [Claude Code overview](https://code.claude.com/docs/en/overview) - [Claude Code: setup](https://code.claude.com/docs/en/setup) - [Claude Code: authentication](https://code.claude.com/docs/en/authentication) - [Claude Code: cloud environments](https://code.claude.com/docs/en/cloud-environments) - [Vercel: Claude Code harness](https://vercel.com/docs/agent-harnesses/claude-code) - [Lizard: Claude Code credentials](https://lizard.build/docs/sandboxes/guides/claude-code) - [Claude pricing](https://claude.com/pricing) - [Battleships: software-factory workload (built by the Boat team)](https://battleships.dev/data/rankings/fullstack.json) --- # Run a scraper on a schedule > I want a script that checks a few websites four times a day and saves what it finds, without paying for a machine that sits idle. A scheduled scraper runs for minutes a day and is idle the rest. What matters is where the schedule lives and where the results go, not the machine. A schedule inside a sleeping machine does not fire, so look for providers whose platform starts the run. Guide page: https://botperch.com/use-cases/scheduled-scraper/ **Short answer:** The cheapest machine that runs it as described is Modal at $0.00 a month, then Agent 37 ($0.15) and Runtime ($0.50). 16 of 16 providers run it without a catch. Machine cost only, before any AI model, at list prices checked 29 October 2026. A scraper fetches a set of pages, picks out the fields you care about (prices, listings, headlines) and writes them to a file or database. Pages that build themselves with JavaScript need a **headless browser**, a real browser such as Chromium running without a screen, driven by a tool like [Playwright](https://playwright.dev/docs/intro). Plain pages only need a download. The schedule is usually written as a **cron** expression, a short line such as "run at 6, 12, 18 and 24 o'clock" named after the Unix tool that runs jobs on a timetable. The key question is who keeps that clock. Agent 37 says it directly: "a crontab inside the container only runs while the container is running" ([Agent 37](https://www.agent37.com/docs/agents-api/crons)). So there are two designs: a scheduler run by the platform that starts a fresh machine for each run (cheap), or a machine that stays on all month with its own timer (simple, and billed around the clock). ## What it needs - **Machine size:** No vendor publishes one. 1 vCPU / 2 GiB / 10 GiB fits a headless browser and logs; Battleships models one browser visit at 1 vCPU / 2 GiB / 5 GiB. Plain downloads fit in 1 GiB. [source](https://battleships.dev/data/presets.json) - **Does it stay on?:** No, if the schedule lives outside the machine. Four ten-minute runs a day is about 20 machine-hours a month, not 730. A timer inside the machine only works if the machine stays on. [source](https://www.agent37.com/docs/agents-api/crons) - **What must survive a restart:** The results, kept outside the run: Runtime's jobs, for example, start "a fresh sandbox" every time and tell you to put data on a volume. Also cookies if a site needs a login, and a marker of what was already saved so a rerun does not duplicate rows. [source](https://withruntime.com/docs/jobs) - **Browser, Docker, GPU:** A browser only for pages built with JavaScript; it is the largest memory cost. Docker is optional. A database is optional on the machine but needed somewhere. No GPU. [source](https://playwright.dev/docs/intro) - **How busy it is:** Busy while a run is open: about 40% CPU in Battleships' scraping workload, because a browser does real work. Idle for the rest of the day. [source](https://battleships.dev/data/rankings/scrape.json) ## Picks - **boxd**, If you want the machine to wake for the schedule: The platform keeps the schedule and wakes the machine shortly before each run, so it can sleep in between. Four ten-minute runs a day is about $1.50 a month. Watch: The schedule is written as a script file, and the $30 of starting credit needs a card. https://docs.boxd.sh/guides/automations/jobs - **Runtime**, If you want a fresh machine each run: Scheduled jobs start a clean sandbox on a cron and keep each run's output on a Jobs page. CPU is billed only while it works: about $0.50 a month here. Watch: Nothing on a job's own disk survives the run; save results to a volume or your own database. One US region. https://withruntime.com/docs/jobs - **Lizard**, If you do not want to write code: The one-click n8n template gives you a visual schedule, web and browser steps, and a database for the results, inside the $19 monthly plan. Watch: n8n stays on all month to keep its schedule, so it costs more than the run itself. It runs on Lizard's app platform, not the sandbox the calculator prices. https://lizard.build/deploy/n8n--n8n ## How to run it on each provider - **Lizard** (one-click; no terminal: yes): Lizard's sandboxes have no scheduler, but its one-click n8n template gives you n8n's Schedule Trigger and a PostgreSQL database for the results. Build the scrape as a workflow. [Lizard: Deploy n8n](https://lizard.build/deploy/n8n--n8n) - **boxd** (guide; no terminal: partly): The best fit among the sandboxes: a schedule in a script, and the platform "wakes a sleeping machine, on standby or hibernated, shortly before" it is due. A missed slot runs once on wake. [boxd: jobs](https://docs.boxd.sh/guides/automations/jobs) - **Runtime** (guide; no terminal: partly): Scheduled jobs run a command in a fresh sandbox on a cron, keep its output and exit code, and show up on a Jobs page in your account. Results go to a volume or your own storage. [Runtime: scheduled jobs](https://withruntime.com/docs/jobs) - **Cloudflare Sandbox** (guide; no terminal: partly): The schedule is a Workers feature, Cron Triggers: the scheduled Worker can start a sandbox for the scrape. Each run gets up to 15 minutes of CPU on the paid plan. [Cloudflare: Cron Triggers](https://developers.cloudflare.com/workers/configuration/cron-triggers/) - **Vercel Sandbox** (guide; no terminal: partly): Vercel Cron Jobs call a function, which can start a sandbox. The free Hobby plan runs crons only once a day, which is too rare here; Pro allows once a minute. [Vercel: cron job limits](https://vercel.com/docs/cron-jobs/usage-and-pricing) - **Agent 37** (guide; no terminal: partly): Platform crons fire "whether the instance is awake or asleep", but they wake an agent and give it a prompt, and are not offered on the base or n8n templates. For a script, the n8n template with auto-sleep off is the other route. [Agent 37: crons](https://www.agent37.com/docs/agents-api/crons) - **Modal** (guide; no terminal: no): A schedule attaches to a Modal function written in code; the function can do the scrape or start a sandbox. [Modal: scheduled functions](https://modal.com/docs/guide/cron) - **Blaxel** (guide; no terminal: no): Sandbox schedules run a command inside a sandbox on a cron, with a run history; up to 100 per sandbox. Set up from code or the API. [Blaxel: schedules](https://docs.blaxel.ai/Sandboxes/Schedules) - **Boat** (manual; no terminal: partly): No scheduler. A timer inside a machine left on works, but the machine is billed all month; otherwise something outside has to start a sandbox per run. [Boat: always-on services](https://docs.boat.dev/long-running-tasks/always-on-services) - **Daytona** (manual; no terminal: no): No scheduler found. A scheduler of your own calls Daytona's API to create a sandbox for each run. [Daytona docs](https://www.daytona.io/docs/en/) - **E2B** (manual; no terminal: no): No scheduler found. E2B is driven from code, so the schedule lives in your app or another service. [E2B docs](https://e2b.dev/docs) - **InstaBox** (manual; no terminal: no): No scheduler found. A machine wakes on an API call or a visit to its public address, so an outside scheduler can start each run. [InstaBox: concepts](https://instabox.sh/docs/concepts) - **Morph** (manual; no terminal: no): No scheduler found. An outside scheduler can wake a Devbox with a web request, but its own clock stops while it is paused. [Morph: wake on request](https://cloud.morph.so/docs/documentation/instances/wake-on) - **Sandboxer** (manual; no terminal: no): No scheduler found. Idle pause and auto-stop are adjustable, so an outside scheduler plus the API is the route. [Sandboxer: long-running tasks](https://sandboxer.com/docs/long-running) - **Sprites** (manual; no terminal: no): No scheduler found. The Tasks API keeps a Sprite awake during a run, but something outside has to start it. [Sprites: keeping Sprites running](https://docs.fly.io/sprites/keeping-sprites-running.md) ## Monthly machine cost (preset `scraper`) Four ten-minute runs a day, 120 a month (20 machine-hours), each on a fresh 1 vCPU / 2 GiB / 10 GiB machine thrown away afterwards; the results go to your own storage. The CPU is about 40% busy while a headless browser renders pages. No model. - Modal: $0.00 - Agent 37: $0.15 - Runtime: $0.50 - Morph: $1.00 - Tensorlake: $1.20 - Sprites: $1.33 - boxd: $1.52 - Blaxel: $1.66 - E2B: $1.66 - Daytona: $1.67 - Cloudflare Sandbox: $5.99 - Lizard: $19.00 - Boat: $20.00 - InstaBox: $20.00 - Sandboxer: $20.00 - Vercel Sandbox: $20.00 ## Outside a sandbox Many scrapes need no sandbox at all. [Cloudflare Workers Cron Triggers](https://developers.cloudflare.com/workers/platform/pricing/) can fetch and parse pages for free up to 100,000 requests a day, or within the $5 monthly paid plan. [Vercel Cron Jobs](https://vercel.com/docs/cron-jobs/usage-and-pricing) are included on every plan but run only once a day on Hobby. [Modal](https://modal.com/docs/guide/cron) schedules have no plan fee. [n8n's Schedule Trigger](https://docs.n8n.io/integrations/builtin/core-nodes/n8n-nodes-base.scheduletrigger) is free self-hosted, or from €20 a month on n8n Cloud. ## Sources - [Agent 37: crons](https://www.agent37.com/docs/agents-api/crons) - [boxd: jobs](https://docs.boxd.sh/guides/automations/jobs) - [Runtime: scheduled jobs](https://withruntime.com/docs/jobs) - [Cloudflare: Cron Triggers](https://developers.cloudflare.com/workers/configuration/cron-triggers/) - [Vercel: cron jobs](https://vercel.com/docs/cron-jobs) - [Playwright: introduction](https://playwright.dev/docs/intro) - [Battleships: scraping workload (built by the Boat team)](https://battleships.dev/data/rankings/scrape.json) --- # Host your own MCP server > I built tools for Claude as an MCP server, and I want it at a web address so Claude can use them without anything running on my laptop. A remote MCP server is a small web service that gives an AI client your tools. It needs a public HTTPS address that answers, and very little else. One provider deploys one in a click, a few publish guides, and several providers' own MCP servers are something else entirely. Guide page: https://botperch.com/use-cases/mcp-server/ **Short answer:** The cheapest machine that runs it as described is Agent 37 at $5.30 a month, then Runtime ($6.39) and Lizard ($19.00). 12 of 16 providers run it without a catch. Machine cost only, before any AI model, at list prices checked 29 October 2026. The [Model Context Protocol](https://modelcontextprotocol.io/specification/2025-06-18/basic/transports) (MCP) is how AI apps such as Claude find and use outside tools: search your documents, file a ticket, query a database. An **MCP server** is the program that offers those tools. A local server runs on your own computer, started by the app. A remote one runs at a web address and speaks "Streamable HTTP", so Claude or [Claude Code](https://code.claude.com/docs/en/mcp) can connect from anywhere. Claude's guide says a remote server "runs on infrastructure you host and is reachable over the internet" ([Claude](https://claude.com/docs/connectors/building)). Watch the wording on provider sites. Daytona, Sprites, Runtime and E2B all document MCP servers, but theirs let an AI agent control their sandboxes, or run MCP tools privately for your own agent. They are not a way to host your server for Claude. ## What it needs - **Machine size:** No vendor publishes one. A server whose tools call other services is a small web process: 1 vCPU / 1 GiB / 10 GiB covers it, logs and an optional session store. A server whose tools run code or a browser should be sized like that work. [source](https://modelcontextprotocol.io/specification/2025-06-18/basic/transports) - **Does it stay on?:** It must answer whenever the client calls. A host that sleeps can work if it wakes on the incoming request: Lizard's guide sleeps after 10 quiet minutes, and the first call afterwards takes longer. Claude allows 240 seconds per tool call. [source](https://lizard.build/docs/guides/deploy-mcp-server) - **What must survive a restart:** Usually nothing: Cloudflare's template builds a fresh server for each request. If you use OAuth (a standard sign-in so only allowed users can connect), the signing keys and registered clients must survive, or every client has to sign in again. [source](https://developers.cloudflare.com/agents/model-context-protocol/guides/remote-mcp-server/) - **Browser, Docker, GPU:** No browser unless a tool drives one. Docker is optional. A database only if a tool needs one, and it can live elsewhere. No GPU: the model runs on the client's side. [source](https://claude.com/docs/connectors/building) - **How busy it is:** Idle between tool calls and busy for milliseconds during one. There is no benchmark for it; the calculator uses 2%, below Battleships' 6% for an always-on agent, because the server only passes calls on. [source](https://battleships.dev/data/rankings/employees.json) ## Picks - **Cloudflare Sandbox**, If you do not want a terminal: The only one-click route: a Deploy to Workers button creates a working remote MCP server, free up to 100,000 requests a day. Watch: It is a Worker, not a sandbox, so the calculator's Cloudflare Sandbox price does not apply. The free plan allows 10 ms of CPU per request, enough for tools that call other services but not for heavy ones. https://developers.cloudflare.com/agents/model-context-protocol/guides/remote-mcp-server/ - **Lizard**, If you want a guide that covers access: The most complete guide, including a token check and sleep when idle, so a quiet server costs little. Inside the $19 monthly plan that comes back as usage. Watch: Its sample token expires after an hour and the signing key is not saved; use your own token issuer for a lasting server. https://lizard.build/docs/guides/deploy-mcp-server - **Runtime**, If you want an always-on machine and your own domain: CPU is billed only while it works, so a small server answering all month is about $6, with a custom domain. Watch: No MCP guide; you set up the server, HTTPS address and access check yourself. One US region. https://withruntime.com/docs/pricing ## How to run it on each provider - **Cloudflare Sandbox** (one-click; no terminal: yes): A Deploy to Workers button creates a remote MCP server at a workers.dev address ending in /mcp. This is a Cloudflare Worker, not the Sandbox product. Price: Workers Free plan; Workers Paid from $5 a month. [Cloudflare: build a remote MCP server](https://developers.cloudflare.com/agents/model-context-protocol/guides/remote-mcp-server/) - **Lizard** (guide; no terminal: no): A complete guide: Streamable HTTP, a token check so only your clients get in, a health check, a public HTTPS address and sleep when idle. Deployed from the command line. [Lizard: host a remote MCP server](https://lizard.build/docs/guides/deploy-mcp-server) - **Blaxel** (guide; no terminal: no): One command creates a TypeScript or Python MCP server, deployed as a Blaxel Function with a global web address. Command line, not dashboard. [Blaxel: create an MCP server](https://docs.blaxel.ai/Functions/Create-MCP-server) - **Modal** (guide; no terminal: no): An official example deploys a stateless MCP server, written in Python, as a Modal app. [Modal: stateless MCP server](https://modal.com/docs/examples/mcp_server_stateless) - **Sandboxer** (guide; no terminal: partly): A detailed guide runs each MCP server in its own sandbox at a private address with its own token. Suited to clients you control, not to Claude's web connector. [Sandboxer: one MCP server per sandbox](https://sandboxer.com/guides/run-each-mcp-server-in-its-own-sandbox) - **Boat** (manual; no terminal: partly): Run the server and make its port public; Boat gives the port a public address that stays the same after resume. No custom domains, and no MCP guide. [Boat: pricing and public URLs](https://docs.boat.dev/pricing) - **boxd** (manual; no terminal: partly): A machine plus a self-serve custom domain, with HTTPS set up for you, makes a clean MCP host. No MCP guide. [boxd: custom domains](https://docs.boxd.sh/guides/custom-domains) - **InstaBox** (manual; no terminal: partly): A public port works and wakes a paused machine, but published ports have no login: "anyone can reach the whole service". Put the access check in the server. No MCP guide. [InstaBox: ports](https://instabox.sh/docs/ports) - **Morph** (manual; no terminal: partly): Public HTTP services and wake on request make a Devbox a workable host. No MCP guide. [Morph: HTTP services](https://cloud.morph.so/docs/documentation/instances/http-services) - **Runtime** (manual; no terminal: partly): Runtime's catalogue MCP servers run at private addresses for your own agent. Hosting yours for Claude is a normal sandbox with a custom domain; no guide. [Runtime: overview](https://withruntime.com/llms.txt) - **Agent 37** (manual; no terminal: no): No MCP template. A custom image can run the server, and every port gets a public agent37.app address. No MCP guide. [Agent 37: templates](https://www.agent37.com/docs/agents-api/templates) - **Daytona** (manual; no terminal: no): Daytona's own MCP server lets an AI agent control Daytona sandboxes. Hosting your own server is a manual install with no guide. [Daytona: its MCP server](https://www.daytona.io/docs/en/mcp) - **E2B** (manual; no terminal: no): E2B's MCP gateway runs MCP tools inside a sandbox for your agent, which is the opposite direction. Sessions also end after one or 24 hours. [E2B: MCP gateway](https://docs.e2b.dev/mcp-gateway) - **Sprites** (manual; no terminal: no): Sprites publishes a remote MCP server for controlling Sprites. Hosting yours means a service on a port, which wakes on a request; no guide. [Sprites: its remote MCP server](https://docs.fly.io/sprites/integrations/remote-mcp.md) - **Vercel Sandbox** (manual; no terminal: no): A sandbox port gets a public address, but sandboxes are made for one task and end; a Vercel Function would be the simpler host. No MCP guide. [Vercel Sandbox: concepts](https://vercel.com/docs/sandbox/concepts) ## Monthly machine cost (preset `mcp`) One small 1 vCPU / 1 GiB / 10 GiB server that must answer at a public address all month. About 2% CPU, because it only passes tool calls on. Where a provider sleeps an idle machine and wakes it on a request, it is awake about a third of the time (roughly the working day when people call it) and billed as stopped the rest. No model: the AI runs in the client. - Agent 37: $5.30 - Runtime: $6.39 - Lizard: $19.00 - Boat: $20.00 - InstaBox: $20.00 - Sandboxer: $20.00 - Sprites: $22.91 - Blaxel: $31.42 - Morph: $36.50 - boxd: $45.23 - Daytona: $49.01 - Tensorlake: $250.00 - Vercel Sandbox: $20.00 (catch: Sessions end after 24 hours, so an always-on machine has to be restarted by your own code.) - Modal: $39.33 (catch: Sessions end after 24 hours, so an always-on machine has to be restarted by your own code. Modal sandboxes have no stopped state; keeping files needs a Volume or a snapshot.) - Cloudflare Sandbox: $46.95 (catch: A stopped instance loses its disk; files have to be backed up to R2 or a snapshot and restored.) - E2B: $48.62 (catch: Sessions end after 1 hour, so an always-on machine has to be restarted by your own code.) ## Outside a sandbox [Cloudflare Workers](https://developers.cloudflare.com/workers/platform/pricing/) on their own are the cheapest home: free up to 100,000 requests a day, or a $5 monthly minimum. [Vercel Functions](https://vercel.com/docs/plans/pro-plan) are free on Hobby, with a $20 monthly Pro fee. [Render](https://render.com/pricing) runs an always-on web service from $7 a month for 512 MB. ## Sources - [MCP specification: transports](https://modelcontextprotocol.io/specification/2025-06-18/basic/transports) - [Claude: build an MCP server](https://claude.com/docs/connectors/building) - [Claude Code: MCP](https://code.claude.com/docs/en/mcp) - [Cloudflare: build a remote MCP server](https://developers.cloudflare.com/agents/model-context-protocol/guides/remote-mcp-server/) - [Lizard: host a remote MCP server](https://lizard.build/docs/guides/deploy-mcp-server) - [Cloudflare Workers pricing](https://developers.cloudflare.com/workers/platform/pricing/) - [Battleships: always-on assistant workload (built by the Boat team)](https://battleships.dev/data/rankings/employees.json) --- # Features that decide whether a sandbox fits ## Isolation: what kind of computer you get Guide page: https://botperch.com/features/isolation/ Every provider says “sandbox”. Underneath, it is a container, a gVisor container, a microVM or a full virtual machine, and that decides what your agent can install, run and break. A sandbox is a boundary before it is a computer. The boundary is drawn by the host: a container shares the host's kernel, a virtual machine has its own. The stronger the boundary, the more the inside behaves like a real server, and the more it costs to start. Four kinds show up in this market. A container shares the host kernel and is the weakest boundary. gVisor intercepts system calls in user space, which is stronger than a container but still not a kernel of its own. A microVM, usually Firecracker or Cloud Hypervisor, has its own kernel and starts in milliseconds. A full VM is the same idea with a conventional machine model, and it is the only kind where nested virtualisation is routinely expected. The boundary and the capability list are different things. A microVM can still refuse kernel modules, omit systemd, or ship without Docker. So the useful question is not “is it a VM?” but “what can I run inside it, and what happens when the agent breaks it?” Watch for: - Docker on the default type: at Agent 37 it needs the vm type at 2.5× the rate. - systemd: Sprites does not run it, and several providers do not document it either way. - Kernel modules: Blaxel refuses them by default; E2B's kernel is missing at least one module. - Nested virtualisation: Runtime exposes /dev/kvm; Sandboxer and Morph document it, Morph as experimental. - Root inside the guest is not root on the host, whatever the provider's marketing implies. Ask a provider: - What boundary does the default instance get, and what does the stronger one cost? Agent 37 charges 2.5× for a real kernel. - Does Docker work on the default type without changing image, size or instance type? - Does the guest run systemd, and if not, what starts services when the machine wakes? - Can the agent load kernel modules or open /dev/kvm, and is either documented as experimental? - Which user does the default template run as, and is root a documented option or a custom image? Boundary, and what it allows, by provider: - Agent 37 (partly): gVisor; VM at 2.5× - Blaxel (partly): microVM; no modules - Boat (yes): Full VM; Docker, root - boxd (yes): KVM microVM; root - Cloudflare Sandbox (yes): Firecracker; all root - Daytona (partly): Containers; VM on request - E2B (yes): Firecracker; non-root user - InstaBox (yes): Firecracker; root + Docker - Lizard (partly): Firecracker; root - Modal (partly): gVisor; VM on request - Morph (yes): Full VM; Docker-in-Docker - Runtime (yes): Firecracker; /dev/kvm - Sandboxer (yes): Cloud Hypervisor; /dev/kvm - Sprites (partly): microVM; no systemd - Vercel Sandbox (partly): Firecracker; root + Docker - Tensorlake (yes): Firecracker; /dev/kvm ## Sizes, regions and hardware Guide page: https://botperch.com/features/sizes-regions/ A size is a bundle of CPU, memory and disk, and the bundle decides what you can run. A region decides how far away it is and whose laws it sits under. Neither is as flexible as the word “cloud” suggests. There are two ways to buy a machine. A fixed menu gives you four or five shapes and nothing else; a configurable machine lets you pick vCPU, memory and disk within bounds. A fixed menu is easier to price and compare. A configurable one lets you match the workload, and makes it harder to know what you are paying for. The second variable is what the size includes. Disk is sometimes a fixed part of the shape, sometimes an allowance you can exceed, and sometimes ephemeral storage that disappears with the session. CPU is sometimes shared, sometimes reserved. Memory is sometimes the billing dimension and sometimes just a ceiling. Regions are the least negotiable part. A provider with one region is not a global product, and a provider that offers a region may still store backups or control-plane data somewhere else. Watch for: - The vCPU ceiling: Agent 37's default type stops at 4, E2B at 8, Vercel at 32 on Enterprise. - Whether disk is included, capped or ephemeral, and whether it bills on capacity or on written bytes. - Shared versus reserved CPU: a shared 4 vCPU is not four cores. - Region choice versus data residency: backups and control-plane data may sit elsewhere. - GPU is not available anywhere here, whatever a workload page implies. Ask a provider: - What is the largest single machine on my plan, and is the top size self-serve or a sales conversation? - Is disk part of the shape or a separate meter, and does it bill on capacity, written bytes or used bytes? - Is CPU shared or reserved, and what does a shared 4 vCPU actually guarantee? - Which region will the machine run in, and where are backups and control-plane data stored? - Can I get a GPU or an ARM machine, or is that a different product I would have to buy separately? Largest shape; regions, by provider: - Agent 37 (partly): 4 vCPU; three regions - Blaxel (partly): 16 GB → 6 cores; 256 GB custom - Boat (partly): 16 vCPU / 32 GB; EU only - boxd (partly): 8 vCPU / 32 GiB; one EU region - Cloudflare Sandbox (partly): 4 vCPU / 12 GiB / 20 GB - Daytona (partly): 4 vCPU / 8 GiB / 10 GiB - E2B (partly): 8 vCPU / 8 GiB; no GPU - InstaBox (partly): 32 vCPU / 64 GiB; US only - Lizard (partly): 8 vCPU / 16 GB; two regions - Modal (partly): No fixed sizes; 1 core = 2 vCPU - Morph (partly): Not published - Runtime (partly): 64 GiB; 1 region - Sandboxer (partly): 16 vCPU / 32 GB; 2 regions - Sprites (partly): 8 vCPU; no choice - Vercel Sandbox (yes): 19 regions - Tensorlake (partly): 16 vCPU / 64 GiB; no region picker ## Lifecycle: stop, pause and sleep Guide page: https://botperch.com/features/lifecycle/ Providers use seven words for four behaviours. The only question that matters is what is still running when the machine comes back. Every provider offers a way to make a machine cheaper while you are not using it. They fall into four behaviours. Disk only: the machine is destroyed and its disk is kept, so files survive and processes do not. Disk and memory: RAM is saved, so the agent's process tree can resume mid-task. Warm memory: the machine is frozen in the host's RAM, which resumes fastest and usually keeps billing for memory. Delete: the disk goes too. The vocabulary is not standardised. InstaBox calls a memory-preserving freeze “pause” and a power-off “stop”. Agent 37 has both, as sleep and stop. boxd has three parked states plus destroy. Lizard's stop deletes the disk. Boat's API calls a stopped sandbox archived, and its homepage still says “pause billing” even though the docs state there is no pause. Memory-preserving resume is usually best-effort. Sandboxer restores memory only if a matching machine is free within two minutes; InstaBox reports processesPreserved false when it cold-boots instead; Agent 37 says memory usually survives a wake but not always. Anything that must outlive a pause belongs in a file. Watch for: - Whether the provider's “pause” keeps RAM, keeps only files, or destroys the machine. - Whether a memory restore is guaranteed or a fallback that silently cold-boots. - What resets: IP address, open sockets, cron timers, systemd units, Docker containers. - Whether stopping a paused machine is allowed; at InstaBox it is an error. - Whether the disk survives a stop at all; at Lizard and Morph, stop deletes it. Ask a provider: - Does your pause keep RAM, keep only files, or destroy the machine — and what does your documentation call each state? - Is the memory restore guaranteed, or a best-effort that silently cold-boots when no matching host is free? - What changes on resume: IP address, open sockets, cron timers, systemd units, Docker containers? - Can a paused machine be stopped, and does stop delete the disk or only the machine? - How long is a stopped disk kept before deletion, and is that in the docs or only in the terms? What a pause keeps, by provider: - Agent 37 (partly): Sleep: RAM + disk - Blaxel (yes): Standby: RAM, no sockets - Boat (no): No pause; disk only - boxd (yes): RAM frozen; 85 ms wake - Cloudflare Sandbox (no): No pause; stop wipes disk - Daytona (partly): VM pause: RAM; container stop - E2B (partly): RAM + disk - InstaBox (partly): RAM; 1 s resume - Lizard (partly): Pause: RAM; fast pause: files - Modal (no): No pause; terminate - Morph (partly): Pause: RAM + disk - Runtime (yes): Pause: RAM frozen - Sandboxer (partly): RAM to disk; 2 min window - Sprites (yes): Warm pause; 100–500 ms - Vercel Sandbox (partly): Filesystem only - Tensorlake (yes): RAM + processes; ~1 s resume ## Snapshots, forks and templates Guide page: https://botperch.com/features/snapshots-forks/ Four jobs hide under “snapshot”: a restore point on one machine, a reusable image for new machines, a copy of a running machine, and a backup that survives losing the host. Ask which one you are getting. A restore point lets you rewind one machine after a bad change. A reusable image lets you start many identical machines from a known-good setup. A fork copies a machine, ideally while it is running, so you can try something without risking the original. A backup survives losing the host or the account. Memory is the dividing line. A snapshot with memory can resume a half-finished agent turn; a disk-only snapshot cannot. Fork is the same split: a disk fork boots cold, a memory fork resumes mid-task. A “live” fork may still pause the source for a moment, and several providers do exactly that. Templates are the third axis. They can be a Docker image, a named snapshot, or a fixed catalogue entry. That decides whether you can carry your own setup forward or are choosing from what the provider built. Watch for: - Whether memory and processes are in the snapshot, and whether the source keeps running. - Whether a restore is in place and destructive, or creates a separate machine. - Whether you can choose an older snapshot; Boat cannot. - Whether snapshots contain credentials; InstaBox's include saved logins. - Whether a fork inherits the source's TTL; Boat's and Sandboxer's do not. Ask a provider: - Does a snapshot include memory and running processes, and does the source keep running while it is taken? - Can I restore an older snapshot, or only the newest one? - Does a restore happen in place and overwrite the current machine, or create a separate one? - Do snapshots and forks carry credentials, saved logins and packages installed outside the home folder? - Does a fork inherit the source's TTL and network rules, and does it resume memory or boot cold? What a snapshot keeps, by provider: - Agent 37 (partly): No snapshots; 7 backups - Blaxel (partly): RAM + disk; preview - Boat (partly): Disk only; newest only - boxd (yes): RAM + disk; under 200 ms - Cloudflare Sandbox (partly): Filesystem only; 30 days - Daytona (partly): Hot: RAM (VM); cold: disk - E2B (yes): RAM + disk; 20 forks - InstaBox (partly): Disk only; may stop source - Lizard (yes): RAM + disk; 1–100 forks - Modal (partly): Filesystem 30 d; memory 7 d - Morph (yes): RAM + disk; branches - Runtime (yes): RAM + disk - Sandboxer (yes): Disk + RAM on stop - Sprites (partly): Filesystem only - Vercel Sandbox (partly): Filesystem only - Tensorlake (yes): Memory or disk; copy ×N ## Storage: disk, volumes and what persists Guide page: https://botperch.com/features/storage/ “Persistent” can mean the whole disk, one mounted folder, or fourteen days. It can also mean a separate volume that outlives the machine, which is a different product from the disk the machine boots with. There are three storage objects in this market. The root disk is part of the machine and disappears or is parked with it. A volume is a separate disk you attach, which can outlive the machine and sometimes attach to another. Object storage is a bucket reached over the network, not a filesystem. What persists is the second question. Some providers keep the whole filesystem, including packages installed outside the home directory. Others keep one folder, usually /workspace or /data, and reset the rest from the template. The difference shows up the first time you install a database in /var/lib. Retention is the third. A stopped machine's disk may be kept indefinitely, kept free for a fixed period, or deleted with the machine. A volume may be node-local and lost with the host. Read the retention line before treating a sandbox as storage. Watch for: - Whether the whole filesystem survives or only one mounted folder. - Whether a volume can attach to more than one machine, and whether sharing is read-only. - How long a stopped machine's disk is kept before deletion. - Whether storage bills on provisioned size or written bytes. - Whether snapshots include credentials and installed packages outside the home folder. Ask a provider: - Does the whole filesystem survive a stop, or only /workspace or /data, and what resets from the template? - How long is a stopped machine's disk kept before deletion, and is that in the docs or only in the terms? - Does storage bill on provisioned capacity, written bytes or used bytes, and does a paused machine still pay for it? - Can a volume attach to more than one machine, and is sharing read-only? - Do snapshots include packages installed outside the home folder, and do they carry saved credentials? Disk, and how long it is kept, by provider: - Agent 37 (partly): Whole disk; $0.09/GB-mo - Blaxel (yes): 1 volume; survives delete - Boat (partly): 14 days after stop - boxd (yes): 100 GB; billed on write - Cloudflare Sandbox (partly): 20 GB; wiped on stop - Daytona (partly): 10 GiB cap; volumes free - E2B (partly): 10–20 GiB; volumes in beta - InstaBox (partly): 20 GiB at /data - Lizard (partly): /workspace only; 1–50 GB - Modal (partly): 512 GiB; billed as memory - Morph (partly): S3 volumes, not a disk - Runtime (yes): Up to 4 volumes - Sandboxer (partly): Whole disk; quota, not bill - Sprites (yes): 100 GB cap; bytes written - Vercel Sandbox (partly): 64 GB ephemeral; drives - Tensorlake (yes): 10–100 GB root; 8 volumes ## Idle timers, waking and session limits Guide page: https://botperch.com/features/idle-timers/ An always-available agent depends on three separate settings: a lifetime deadline, an idle timer, and a wake path. Providers bundle them differently, and the difference is most of your bill. A lifetime limit is a hard deadline counted from creation or last resume. It ends the machine even if it is busy. An idle timer parks the machine when nothing is happening. A wake path decides whether the next request brings it back, or whether someone has to start it. A provider can pass two of the three and fail the use case. Boat has no idle timer and still stops your box after an hour, because its deadline counts from creation. Lizard never sleeps for idleness and deletes the sandbox five minutes after creation if you used the SDK. Agent 37 never stops on its own, but it also never wakes itself if you stopped it. What counts as activity is the quiet variable. Runtime counts an open terminal or SSH session. Sprites counts an in-flight request, output to a session, an open TCP connection or an active task. boxd counts TCP/UDP traffic in either direction, so polling an API keeps a machine awake while a local compile does not. Watch for: - Whether the deadline counts from creation, from last activity, or from network traffic. - What counts as activity: data flow, an open connection, a terminal, or a running command. - Whether a sleeping machine wakes on a request, and how long the wake takes. - Whether an idle hour bills compute, memory, storage, or nothing. - Whether the timer can be turned off or only raised. Ask a provider: - When the timer fires, does the machine pause with memory, stop and keep the disk, or get deleted — and which of those does the provider call stop? - Does the clock count from creation, from the last command, or from any network traffic, and does an open SSH session reset it? - Can the idle timer be turned off, or only raised to a maximum — and what is that maximum? - What does an idle hour cost in each state, and does a paused machine keep billing memory? - After a pause, how long does the first request wait, and do open connections and running processes survive? Idle or lifetime limit, by provider: - Agent 37 (yes): No cap; sleep off - Blaxel (partly): 15 min idle (docs); 5 s (pricing) - Boat (partly): 1 h from create - boxd (yes): 4 h without traffic - Cloudflare Sandbox (partly): No default; 6 h max - Daytona (partly): 15 min container; 60 min VM - E2B (partly): 5 min, then killed - InstaBox (partly): 30 min idle - Lizard (partly): 5 min lifetime (SDK) - Modal (partly): 5 min lifetime; no idle - Morph (partly): Not published - Runtime (yes): 300 s idle - Sandboxer (partly): 1 s – 30 days, or off - Sprites (yes): 30 s warm pause - Vercel Sandbox (partly): 5 min session - Tensorlake (yes): 10 min idle; 2 h to unlimited ## Reaching it: links, ports and who can open them Guide page: https://botperch.com/features/reaching-it/ A machine nobody can reach is not an agent. There are four doors in — an HTTPS link, a raw TCP port, SSH, and the provider's API — and the important difference is who can open each one. Every provider gives you an HTTPS address for a port inside the machine. What differs is the lock. A provider-key link needs an API key or a signed token on every request. A token-in-the-URL link is a password you can paste: convenient, and exactly as safe as the place you pasted it. An open link has no lock at all. The open case is more common than buyers expect. boxd's name.boxd.sh is public to the internet with no authentication in front of it. InstaBox's public ports are unauthenticated by design, though a port can instead be made private behind a token. Agent 37's public port is deliberately credential-free and keeps working until you delete it. In each case the URL is the only secret. The other doors are less visible. SSH is sometimes a real port, sometimes a WebSocket tunnel, sometimes a shell over the provider's own transport. Raw TCP exists at a few providers and is missing at most. The provider's API is always a door, and sometimes the only one. Watch for: - Who can open the link: only you, anyone you send it to, or anyone who guesses it. - Whether the token is per port or per machine. - Whether a request to a sleeping machine wakes it or returns an error. - Whether raw TCP and SSH exist, and whether SSH is a real port or a tunnel. - Whether the URL survives a stop and resume. Ask a provider: - Is there authentication in front of a preview URL by default, or is the URL the only secret? - Is the token per port or per machine, and can it be revoked without recreating the sandbox? - Does a request to a sleeping machine wake it, or return an error page? - Does the URL survive a stop and resume, and does it change when the machine is recreated? - Is SSH a real port or a tunnel, and is raw TCP inbound available at all? Who can open the link, by provider: - Agent 37 (yes): API key, or public - Blaxel (partly): Optional auth - Boat (partly): Token by default - boxd (yes): No auth - Cloudflare Sandbox (partly): No public port - Daytona (partly): Token, or signed URL - E2B (partly): No auth - InstaBox (partly): Public or token-only links - Lizard (partly): One token per sandbox - Modal (yes): Connect token - Morph (partly): Not published - Runtime (yes): Closed until opened - Sandboxer (yes): Token in URL - Sprites (partly): Org token - Vercel Sandbox (partly): Web ports only - Tensorlake (yes): HTTPS per port; auth on by default ## Custom domains Guide page: https://botperch.com/features/custom-domains/ Putting an agent behind your own hostname is a feature some providers sell, some leave to a proxy you run, and several do not offer at all. A custom domain is an HTTPS hostname you control, pointed at a port inside the sandbox. It matters when the URL is the product: a client-facing demo, a webhook receiver, or an agent whose address should not be a provider subdomain that changes. There are three levels. Native: the provider issues a certificate for your hostname and routes it. Do-it-yourself: the provider gives you a stable hostname and you put your own proxy in front. Absent: no documented path, and the preview URL is what you have. The differences are in the details: whether you can delegate a subdomain or must move a whole domain's nameservers, whether certificates are automatic, and whether the domain survives a resume. Watch for: - Whether you must move a whole domain's nameservers or can delegate one subdomain. - Whether the certificate is issued automatically. - Whether the domain survives a stop and resume, or must be re-pointed. - Whether the feature is native or a proxy you operate. - Whether the domain is for sandboxes or only for deployed apps. Ask a provider: - Can I delegate one subdomain with a CNAME, or do I have to move the whole domain's nameservers? - Who issues and renews the certificate, and how long does that take? - Does the hostname survive a stop and resume, or must it be re-pointed? - Is the domain for sandboxes or only for deployed apps? - If it is not native, what exactly do I have to run in front, and who pays for it? Path to your domain, by provider: - Agent 37 (yes): Whole domain only - Blaxel (yes): Native, optional auth - Boat (no): Not supported - boxd (yes): Native, automatic TLS - Cloudflare Sandbox (partly): Worker route + DNS - Daytona (partly): Own proxy - E2B (partly): Own proxy in front - InstaBox (not-published): Not published - Lizard (partly): App services only - Modal (yes): Team+, manual - Morph (not-published): Not published - Runtime (yes): Native, Let's Encrypt - Sandboxer (partly): CNAME plus your TLS - Sprites (not-published): Not published - Vercel Sandbox (not-published): Not published - Tensorlake (partly): BYOC ingress only ## Outbound network: egress, allowlists and static IP Guide page: https://botperch.com/features/outbound-network/ What the agent can reach, what can be blocked, and whether the outside world sees a stable address. This is where an agent that browses meets a firewall that was designed for a web app. Outbound access is usually open by default, because an agent that cannot reach a package registry is not much use. The interesting parts are the controls: can you deny everything, allow a list of hosts, and enforce it outside the machine so root inside cannot loosen it? A static egress IP is a separate product. It matters when a third-party API allowlists your address, or when a rate limit is shared with every other sandbox on the host. Most providers here do not offer one; Runtime sells it for $5 a month, and E2B explicitly does not offer it on any plan. The last question is billing. Egress is free at some providers, metered at others, and unpublished at a few. A generous free allowance can be the difference between a cheap agent and an expensive one. Watch for: - Whether the default is open or closed, and whether a deny-all rule also blocks DNS. - Whether the allowlist is enforced outside the machine, or by a proxy the agent can bypass. - Whether there is a static egress IP, and what it costs. - Whether egress is free, metered, or unpublished. - Whether sandboxes can reach each other over a private network. Ask a provider: - Is the default open or closed, and does a deny-all rule also block DNS? - Is the allowlist enforced outside the machine, or by a proxy the agent can bypass with a raw socket? - Is there a static egress IP, what does it cost, and is it per sandbox or per account? - Is egress free, metered, or unpublished — and what is the allowance before overage? - Can sandboxes reach each other over a private network, or does everything go out to the internet? Egress price, by provider: - Agent 37 (yes): Not published - Blaxel (partly): Included in plan - Boat (partly): $0, no cap stated - boxd (yes): Not published - Cloudflare Sandbox (partly): 1 TB a month, then $0.025/GB - Daytona (partly): Tier 3 for internet - E2B (yes): No rate; no static IP - InstaBox (partly): 100 GiB–50 TiB included - Lizard (partly): 2 TB per 30 days - Modal (yes): $0.04/GiB - Morph (not-published): Charged, no rate - Runtime (yes): $5/mo static IP - Sandboxer (partly): Not billed - Sprites (yes): Not metered - Vercel Sandbox (yes): $0.15/GB - Tensorlake (yes): Allow/deny lists; free egress ## Keys and secrets Guide page: https://botperch.com/features/keys-secrets/ Three different things are called “secrets”: a value in an environment variable, a file on disk, and a placeholder that a proxy swaps for the real key. Only the third keeps the key away from the agent. An agent runs as a process inside the machine, usually with root or sudo. Anything in its environment or on its disk is something it can print, copy into a message, or send to a host an attacker controls. Agent 37 says this plainly: anything in an instance's environment, the agent can read and repeat back. The stronger design keeps the real value outside the machine. The sandbox gets a placeholder that looks like a key but is worthless on its own; an egress proxy recognises it on an outbound request and substitutes the real value, but only for the hosts you named. The details decide how much it protects you. Which headers are rewritten, whether URLs and bodies are covered, whether non-HTTP protocols work, and whether the machine can bypass the proxy by not using it. Watch for: - Whether the agent can read the key or only use it. - Which hosts the key can be sent to, and what happens for any other host. - Whether the proxy covers headers only, or also URLs and bodies. - Whether secrets end up in snapshots and forks. - Whether a process that skips the login shell still sees the secret. Ask a provider: - Can a process inside the machine read the real value, or only a placeholder? - Which hosts is the value sent to, and what happens to a request to any other host? - Does the proxy cover headers only, or also URLs, bodies and WebSocket upgrades? - Do snapshots and forks carry the secret or saved logins, and who can restore them? - Does a systemd unit or a non-login shell see the secret, or only an interactive login? Can the agent read it?, by provider: - Agent 37 (partly): Yes, env vars - Blaxel (yes): No, proxy (preview) - Boat (yes): No, proxy + switch - boxd (yes): No, host-bound - Cloudflare Sandbox (yes): No, Worker injects - Daytona (yes): No, proxy headers only - E2B (yes): No, proxy - InstaBox (yes): No, proxy on 443 - Lizard (partly): Yes, env vars - Modal (partly): Env vars, or beta proxy - Morph (partly): Not published - Runtime (yes): No, placeholder + OIDC - Sandboxer (partly): Yes, env + files - Sprites (yes): No, gateway - Vercel Sandbox (yes): No, proxy - Tensorlake (partly): Env vars only ## Ways to drive it Guide page: https://botperch.com/features/ways-to-drive/ Dashboard, API, SDK, CLI, MCP, SSH, desktop. A provider can have all seven and still be unusable without a terminal, or have three and be genuinely click-driven. The surfaces fall into two groups. A control plane creates, stops and configures machines: dashboard, REST or gRPC API, SDKs, CLI, and increasingly an MCP server an AI assistant can call. An execution plane gets inside: SSH, a web terminal, a desktop, a file API. A dashboard that can create a sandbox is not the same as a product that gives you an agent. Several providers can create a machine with a button and still expect a command to do anything useful with it. Others document a prompt to paste into Claude Code or Cursor as the intended no-code path. MCP is the newest surface and the easiest to misread. A hosted MCP server that manages sandboxes is a control plane. An MCP server running inside the sandbox is a tool surface for the agent. They are different products with the same name. Watch for: - Whether the first machine can be created without a terminal. - Whether the API is REST or gRPC, and whether an SDK exists for your language. - Whether SSH is a real port, a tunnel, a gateway, or absent. - Whether the MCP server manages sandboxes or runs inside one. - Whether there is a desktop you can watch and take over. Ask a provider: - Can I create and open the first machine without a terminal, and what exactly can the dashboard do? - Is the API REST or gRPC, and is there an SDK for my language? - Is SSH a real port, a tunnel or a gateway — and do scp and port forwarding work? - Is the MCP server a control plane that creates sandboxes, or a tool surface inside one? - Is there a desktop I can watch and take over, and does it survive a resume? First machine without a terminal?, by provider: - Agent 37 (yes): Not published - Blaxel (yes): Yes, console - Boat (yes): No; installer - boxd (partly): No; CLI - Cloudflare Sandbox (partly): No; Worker code - Daytona (yes): Yes, playground - E2B (yes): No; SDK - InstaBox (partly): Yes, dashboard - Lizard (partly): Yes, dashboard - Modal (partly): No; SDK - Morph (partly): Yes, dashboard - Runtime (yes): Yes, dashboard - Sandboxer (yes): Yes, dashboard - Sprites (partly): No; CLI - Vercel Sandbox (partly): No; CLI or SDK - Tensorlake (partly): SDK, CLI, SSH; no MCP ## Built-in agents Guide page: https://botperch.com/features/built-in-agents/ Some providers ship the machine with coding agents already installed and a way to prompt them. Others ship a computer and expect you to bring the agent. A preinstalled agent is not a hosted agent. Preinstalled means the binary is on the disk and a login may be configured; the agent loop still runs inside your sandbox and you still pay the model provider, or sign in with your own subscription. Hosted means the provider runs the loop and bills you for it. The useful distinction is threefold: is an agent installed, can you prompt it through the provider's API rather than a terminal, and does the provider manage the model credentials? Very few do all three. Preinstalled agents also change the setup story. A machine with Claude Code and Codex already on it is a working environment for a non-engineer who can type a request, even if nothing else is click-driven. Watch for: - Whether the agent is preinstalled, promptable through an API, or both. - Who pays for the model: the provider, your API key, or your subscription login. - Whether the provider manages model credentials or expects them in the environment. - Whether the agent runs as a hosted service or inside your sandbox. - Whether a non-engineer can start it without a terminal. Ask a provider: - Is the agent preinstalled, promptable through your API, or both? - Who pays for the model — you, my API key, or my subscription login? - Does the provider manage model credentials, or expect them in the environment? - Does the agent loop run inside my sandbox or as a hosted service, and what does that change about billing? - Can a non-engineer start it without a terminal, and what is the first screen they see? Agents installed, and promptable?, by provider: - Agent 37 (yes): Six templates; hosted - Blaxel (partly): MCP server; runtime soon - Boat (yes): Seven harnesses; prompt API - boxd (yes): Three preinstalled; no API - Cloudflare Sandbox (partly): None; guides - Daytona (partly): None; guides - E2B (partly): None preinstalled; guides - InstaBox (yes): Claude Code + Codex - Lizard (yes): Templates; CLI prompt - Modal (no): None; SDK - Morph (partly): None; tmux API - Runtime (no): None preinstalled - Sandboxer (yes): Six harnesses; prompt API - Sprites (no): None; plugins only - Vercel Sandbox (partly): Agents in image; no API - Tensorlake (partly): None; five integrations ## Teams and accounts Guide page: https://botperch.com/features/teams-accounts/ Organisations, key scopes, spend limits, SSO, audit and residency. The features a team needs are rarely the ones a solo builder notices, and several providers only sell them on an enterprise tier. A sandbox account is a billing boundary, a permission boundary and sometimes a data boundary. The first question is what the account owns: keys, wallet, machines, snapshots. The second is who can see and spend what. Spend controls come in three strengths. A hard cap stops machines when reached. A per-key or per-project limit blocks one credential. An alert tells you after the fact. Providers differ on which they offer, and several offer none. Audit and residency are the enterprise questions. A lifecycle activity log is not a compliance audit log. A compute region is not a data-residency guarantee if backups and control-plane records sit elsewhere. Watch for: - Whether the plan price multiplies per seat. - Whether there is a hard spend cap, a per-key limit, or only an alert. - Whether SSO and audit logs are included, enterprise-only, or absent. - Whether backups and control-plane data sit in the same region as compute. - Whether an API key can be scoped to one sandbox or one project. Ask a provider: - Does the plan price multiply per seat, and what does a five-person team pay before usage? - Is there a hard spend cap that stops machines, a per-key limit, or only an alert? - Are SSO and audit logs included, enterprise-only, or absent — and how long is the audit log retained? - Do backups and control-plane data sit in the same region as compute? - Can an API key be scoped to one sandbox or one project, and who can see the wallet? Hard spend cap?, by provider: - Agent 37 (partly): Per-instance budget - Blaxel (partly): No hard cap - Boat (partly): No dollar cap - boxd (partly): Not published - Cloudflare Sandbox (partly): Alerts only - Daytona (partly): Org-wide resource pool - E2B (partly): Per-project limit - InstaBox (partly): Monthly cap stops machines - Lizard (partly): No cap at all - Modal (partly): Environment budgets - Morph (partly): Not published - Runtime (yes): Per-key daily + lifetime - Sandboxer (partly): Per-member caps - Sprites (partly): Not published - Vercel Sandbox (partly): Spend management - Tensorlake (partly): Roles + SSO; no spend cap ## Billing models Guide page: https://botperch.com/features/billing-models/ The meter decides your bill more than the hourly rate does. Four shapes are in play: flat per size, per vCPU and per GB, a plan fee that returns as credit, and measured CPU. Flat per size: you pick a fixed shape and pay an hourly rate for it whether it works or waits. Boat, Sandboxer and Lizard work this way. It is the easiest to predict and the easiest to compare. Per vCPU and per GB: the rate is a sum of parts, so much per vCPU-hour, per GB-hour of memory and per GB-month of disk. Agent 37, InstaBox, E2B and Vercel work this way, and boxd uses three meters of its own. It is flexible and hard to compare, because two providers can quote the same hourly number for different amounts of memory. A plan fee that returns as credit: Sandboxer, InstaBox, Lizard and Boat sell a monthly plan whose dollars convert into usage. That is not a fee, but it is a floor: a light month still costs the plan price, and unused plan time usually expires. Morph's MCU model is a fourth shape: the rate is the largest resource dimension, not the sum. Watch for: - Whether the meter measures reserved size, actual CPU, or resident memory. - Whether the monthly fee returns as usage, and what expires at month end. - What is charged while stopped: compute, memory, storage, or nothing. - Which costs are absent from the pricing page: egress, snapshots, static IPs. - Whether there is a minimum billed duration or a one-minute increment. Ask a provider: - Does the meter measure the shape I reserved, or what the machine actually used? - Does the monthly fee return as usage, and what expires at the end of the month? - What is charged while stopped: compute, memory, storage, or nothing? - Which costs are missing from the pricing page — egress, snapshots, static IPs? - Is there a minimum billed duration or a one-minute increment, and how does it round? The meter, by provider: - Agent 37 (yes): $0.80/vCPU-month - Blaxel (partly): $0.0000115/GB-second - Boat (partly): $0.036/h default - boxd (partly): Three meters - Cloudflare Sandbox (partly): $0.072/vCPU-hour active - Daytona (partly): $0.0504/vCPU-hour - E2B (partly): $0.000014/vCPU-s - InstaBox (yes): $20 plan, then usage - Lizard (partly): $19 plan; flat per size - Modal (partly): $0.141912/core-hour - Morph (partly): $0.05/MCU-hour - Runtime (partly): 50-millicore CPU floor - Sandboxer (partly): $0.036/h default - Sprites (partly): $0.0385/CPU-hour - Vercel Sandbox (partly): $0.128/CPU-hour - Tensorlake (yes): Active CPU; $250 Pro ## Trials and free tiers Guide page: https://botperch.com/features/trials-free-tiers/ “Free trial” covers four different offers: a time-limited trial that converts, a one-off credit, a free plan that never charges, and a recurring allowance. They differ in what you get and what happens on day eight. A time-limited trial gives access for a fixed number of days and then either charges you or stops. A one-off credit is money added to a prepaid balance once, spent at normal rates. A free plan is a permanent tier with hard caps. A recurring allowance is free usage that returns every month. The card is not the dividing line. A trial with a card usually converts when its clock runs out. A credit with a card is spent and then stops. A free plan or allowance with no card never charges, but caps size and runtime instead. Read the ending as three questions: is the card charged, does a paid plan start, and does the allowance stop? The unit matters too. Five dollars is about 100 hours of Agent 37's entry shape, and less than an hour of boxd's largest machine. Twenty-five hours at Boat is capped by a mandatory two-hour auto-stop, so it cannot test an always-on agent. Watch for: - Whether a card is required, and whether a paid plan starts automatically. - Whether the allowance is money, hours or a machine, and at which size. - Whether the free tier can stay up, or is capped by idle pause and session limits. - Whether a second trial is available on the same account or card. - What happens when a credit runs out: block, stop, or charge. Ask a provider: - Is a card required, and does a paid plan start automatically when the trial ends? - Is the allowance money, hours or a machine — and at which size? - Can the free tier stay up, or is it capped by idle pause and session limits? - Is a second trial available on the same account or card? - What happens when the credit runs out: block, stop, or charge? What you get, and what ends it, by provider: - Agent 37 (partly): $5 one-off - Blaxel (partly): Up to $200 credits - Boat (partly): 25 h trial - boxd (partly): $30 one-off - Cloudflare Sandbox (no): None; $5 plan - Daytona (yes): $200 credit, no card - E2B (yes): $100 one-off - InstaBox (yes): Free plan, 1 machine - Lizard (partly): 7 days / $5 - Modal (partly): $30/month credits - Morph (partly): 300 h/month claimed - Runtime (yes): 100 h free, no card - Sandboxer (partly): 7 days / 25 h, then a plan - Sprites (partly): $30 one-off - Vercel Sandbox (partly): Hobby quotas; 14-day Pro - Tensorlake (yes): Free forever, 1 sandbox ## Who is behind it Guide page: https://botperch.com/features/company/ Entity, age, funding, status page, SLA, compliance and the terms that decide whether you can leave. This is the part of a sandbox that documentation testing cannot tell you. A sandbox is a dependency. Your agent's files, its logins and sometimes its only working environment live on someone else's machine. The company decides how long that machine is likely to exist, who owns it after an acquisition, and whether anyone answers when it fails. Four facts are worth establishing before you build. Who is the contracting entity, and in which jurisdiction? How old is the product, and has it changed hands? What does the status page actually measure? And what do the terms say about price changes and deleting your data after you cancel? An SLA is a promise with a remedy, not a status page. Several providers publish none, and several publish a number that covers a platform rather than the sandbox product. Compliance works the same way: a SOC 2 report has an entity and a scope, and neither is implied by a badge. Watch for: - The contracting entity and its jurisdiction, not the brand on the homepage. - What the uptime percentage covers: a component, an API, a platform, or a real sandbox. - Whether an SLA exists at all, which plans it covers, and whether the remedy is credit or cash. - Whether a compliance report names the entity and the product you are buying. - The notice period before a price change, and what happens to prepaid value on cancellation. - The deletion window after termination, including backups, and whether you get an export. Ask a provider: - Which legal entity signs, in which jurisdiction, and does the name on the terms match the name on the invoice? - What exactly does the uptime number measure — a component, an API, a platform, or a real sandbox? - Is there an SLA, which plans does it cover, and is the remedy service credit or cash? - Does the SOC 2 report name the entity and the product I am buying, and what period does it cover? - What is the notice period before a price change, and what happens to prepaid value if I cancel? Contracting entity; promise, by provider: - Agent 37 (partly): Agent 37 Inc.; no SLA - Blaxel (partly): Blaxel, Inc.; acquired - Boat (partly): Dedale AI, Corp.; no SLA - boxd (partly): Azin Tech Op. Co. B.V.; no SLA - Cloudflare Sandbox (partly): Cloudflare, Inc.; no sandbox SLA - Daytona (partly): Daytona Platforms Inc.; 99.95% Tier 4+ - E2B (partly): FoundryLabs, Inc.; SOC 2 II - InstaBox (partly): InsForge AI, Inc.; 99.9% Enterprise - Lizard (partly): Dragon Labs LLC; no SLA - Modal (partly): Modal Labs, Inc.; no public SLA - Morph (partly): Morph Labs, Inc.; no SOC 2 - Runtime (partly): Runtime LLC; 99% API credit - Sandboxer (partly): North Bay Opco I, Inc.; no SLA - Sprites (partly): Fly.io, Inc.; 99.9% Enterprise - Vercel Sandbox (yes): Vercel Inc.; 99.99% platform - Tensorlake (partly): Tensorlake, Inc.; 99.9% SLA --- # Capabilities, checked for every provider Verdicts: yes, partly (with the catch), no, not-published. ## Its own virtual machine Each sandbox is a separate virtual machine (microVM or full VM), not a container sharing a kernel with neighbours. Guide page: https://botperch.com/capabilities/own-vm/ - Agent 37: partly (gVisor; VM costs 2.5x). The standard machine is a gVisor container, which is not a computer of its own; a true virtual machine with its own kernel is a separate type at 2.5 times the price. - Blaxel: yes (microVM) - Boat: yes (full VM, own kernel) - boxd: yes (KVM microVM) - Cloudflare Sandbox: yes (Firecracker microVM) - Daytona: partly (containers by default). By default each sandbox is a container sharing the host's kernel; a real virtual machine is a separate kind you have to choose. - E2B: yes (Firecracker microVM) - InstaBox: yes (Firecracker microVM) - Lizard: yes (Firecracker microVM) - Modal: partly (gVisor by default). The default is a gVisor container, which is not a computer of its own; a true virtual machine with its own kernel is a separate runtime you have to ask for. - Morph: yes (full VM) - Runtime: yes (Firecracker microVM) - Sandboxer: yes (Cloud Hypervisor microVM) - Sprites: yes (microVM) - Vercel Sandbox: yes (Firecracker microVM) - Tensorlake: partly (VM, except GPU). The ordinary machines are real virtual machines, but the graphics-card machines you have to ask for are containers instead. ## Root access You (and the agent) can act as the administrator: install anything, change system settings. Guide page: https://botperch.com/capabilities/root/ - Agent 37: yes (root on request) - Blaxel: yes (root by default) - Boat: yes (passwordless sudo) - boxd: yes (passwordless sudo) - Cloudflare Sandbox: yes (every process is root) - Daytona: yes (root in the sandbox) - E2B: yes (root via template). The default template runs as an ordinary user called user, not root; root has to be set in the template. - InstaBox: yes (passwordless sudo) - Lizard: yes (root by default) - Modal: yes (always root) - Morph: yes (root shell) - Runtime: yes (sudo, then root) - Sandboxer: yes (sudo inside) - Sprites: yes (sudo) - Vercel Sandbox: yes (full root) - Tensorlake: yes (sudo or --user root) ## Docker inside You can run Docker containers inside the sandbox. Guide page: https://botperch.com/capabilities/docker-inside/ - Agent 37: partly (VM type only). Docker only works on the 2.5x VM type; the default machine cannot run a Docker daemon. - Blaxel: yes (docker-in-sandbox image) - Boat: yes (Docker, Compose, BuildKit) - boxd: yes (Docker preinstalled) - Cloudflare Sandbox: partly (docker:dind, no iptables). Docker works through a special image, but the firewall tool Docker normally uses is turned off, so container networking is limited. - Daytona: yes (Docker-in-Docker) - E2B: yes (Docker image documented) - InstaBox: yes (Docker on default image) - Lizard: not-published - Modal: partly (VM runtime only). Docker needs the VM runtime; the default gVisor sandbox cannot run it. - Morph: yes (Docker-in-Docker) - Runtime: yes (enable-docker) - Sandboxer: yes (Docker preinstalled) - Sprites: partly (Docker, with limits). Docker runs, but some containers fail and the usual service manager is missing, so services need the provider's own manager instead. - Vercel Sandbox: yes (Docker inside) - Tensorlake: yes (needs ubuntu-systemd image) ## Nested virtualisation You can start virtual machines inside the sandbox, for tools that need their own VM. Guide page: https://botperch.com/capabilities/nested-virt/ - Agent 37: partly (VM type only). Starting a virtual machine inside needs hardware virtualisation, which only the 2.5x VM type has. - Blaxel: not-published - Boat: yes (/dev/kvm, no flag) - boxd: not-published - Cloudflare Sandbox: not-published - Daytona: partly (Linux VM class only). Nested virtual machines only work on the Linux VM class, and the feature has to be switched on for your organisation. - E2B: not-published - InstaBox: not-published - Lizard: not-published - Modal: partly (Enterprise plan only). Nested virtual machines are an Enterprise-plan option that must be switched on when the sandbox is created. - Morph: partly (experimental). Running another operating system or a virtual machine inside is described as experimental. - Runtime: yes (/dev/kvm) - Sandboxer: yes (/dev/kvm) - Sprites: not-published - Vercel Sandbox: not-published - Tensorlake: yes (/dev/kvm) ## Your own image Start machines from your own Dockerfile or image instead of the provider's default. Guide page: https://botperch.com/capabilities/custom-image/ - Agent 37: yes (Dockerfile or registry) - Blaxel: yes (Dockerfile images) - Boat: no (one image for everyone). There is no way to bring your own image or build recipe; you install what you need and save a copy of the machine instead. - boxd: partly (snapshot only). You cannot bring a Docker image; the way to get your own setup is to customise a machine and start new ones from a snapshot of it. - Cloudflare Sandbox: yes (your own Dockerfile) - Daytona: yes (Dockerfile or OCI image) - E2B: yes (any Docker image) - InstaBox: partly (operator-built templates). You pick from fixed images or a saved copy; a different starting image needs an operator to build one for you. - Lizard: no (fixed template catalog). You choose from a fixed list of templates and cannot upload your own image. - Modal: yes (any registry image) - Morph: partly (templates and snapshots). There is no documented way to import your own image; you start from a template or from a snapshot you saved. - Runtime: yes (custom images) - Sandboxer: partly (snapshot templates). You cannot start from your own image; you set a machine up and save its disk as a template. - Sprites: no (fixed base image). There is no documented way to start a Sprite from your own image. - Vercel Sandbox: yes (custom image or snapshot) - Tensorlake: yes (Dockerfile builds) ## Any size you like Choose CPU and memory freely instead of picking from a short list of fixed sizes. Guide page: https://botperch.com/capabilities/any-size/ - Agent 37: no (4 fixed shapes). You choose from four fixed combinations of cores and memory, and anything else comes back as the nearest shape. - Blaxel: partly (memory only, cores follow). You set the memory and the number of cores is decided for you, so you cannot pick a memory-heavy or core-heavy machine. - Boat: no (4 fixed sizes). There are four fixed sizes and no way to ask for anything between them. - boxd: no (4 fixed sizes). There are four fixed sizes; naming either cores or memory picks the pair. - Cloudflare Sandbox: partly (custom within 4 cores / 12 GiB). You can set your own cores and memory, but only inside a ceiling of 4 cores and 12 GB, and each core needs at least 3 GB. - Daytona: partly (presets, custom on request). You pick from fixed sizes, and anything different needs a custom limit arranged through support. - E2B: partly (up to 8 cores / 8 GiB). You can choose cores and memory, but only up to 8 of each; more needs a conversation with support. - InstaBox: no (fixed pairs by plan). Each plan sells fixed pairs of cores and memory, and any other combination is refused. - Lizard: no (3 fixed sizes). There are three fixed sizes and no custom option. - Modal: yes (any cores and MiB) - Morph: yes (cores, memory, disk) - Runtime: yes (any combination in bounds) - Sandboxer: no (4 fixed sizes). There are four fixed sizes and no custom size. - Sprites: no (one shape). There is one shape: 8 cores, memory assigned automatically, and no choice. - Vercel Sandbox: partly (even cores only, 2 GB each). You choose cores in steps of two and each core comes with exactly 2 GB of memory, so memory cannot be set on its own. - Tensorlake: yes (any cores and memory) ## Large machines Machines of 16 vCPU or 32 GiB memory or more are available. Guide page: https://botperch.com/capabilities/big-machines/ - Agent 37: partly (4 cores; 16 on the VM type). One page caps every machine at 4 cores, while another prices a 16-core, 32 GB machine on the 2.5x VM type, so the large size is unclear. - Blaxel: partly (up to 256 GB by arrangement). The standard sizes stop at 16 GB of memory; anything larger is a custom deployment you have to arrange. - Boat: yes (16 cores / 32 GB). Only on the $100-a-month plan or above. - boxd: yes (8 cores / 32 GiB) - Cloudflare Sandbox: no (4 cores / 12 GiB). The largest machine is 4 cores and 12 GB of memory, so a 16-core or 32 GB machine is not available. - Daytona: partly (4 cores / 8 GiB; more with GPUs). A normal sandbox stops at 4 cores and 8 GB; larger machines only come attached to graphics cards. - E2B: no (8 cores / 8 GiB). The ceiling is 8 cores and 8 GB of memory, so a 32 GB machine cannot be bought. - InstaBox: yes (32 cores / 64 GiB). Only on the $500-a-month plan or above. - Lizard: no (8 cores / 16 GB). The largest machine is 8 cores and 16 GB, so a 32 GB machine is not offered. - Modal: yes (no published ceiling) - Morph: partly (ceiling not published). The plan allows up to 1024 cores across the account, but the largest single machine is not published. - Runtime: yes (16 cores / 64 GiB) - Sandboxer: yes (16 cores / 32 GB). Only on the $100-a-month plan or above. - Sprites: no (8 cores / 16 GB). The machine is fixed at 8 cores and up to 16 GB of memory, below the 32 GB mark. - Vercel Sandbox: partly (32 cores on Enterprise only). Machines above 8 cores and 16 GB need the Enterprise plan; the self-serve plans stop there. - Tensorlake: yes (16 cores / 64 GB). Only on the $250-a-month plan or above. ## Resize while running Change CPU or memory without stopping the machine or losing what is running. Guide page: https://botperch.com/capabilities/live-resize/ - Agent 37: partly (resize, but memory is lost). You can change the size without stopping the machine, but it may move to another host and everything running in memory is lost. - Blaxel: partly (memory change resets it). You can change the memory, but the sandbox resets, so anything running is lost. - Boat: no (stop first). Changing the size means stopping the machine and starting it again. - boxd: no (reboot to apply). A size change reboots the machine, so running programs are lost. - Cloudflare Sandbox: no (no resize). The size is fixed when the sandbox is deployed; changing it means deploying again. - Daytona: partly (grow only, support must enable). You can add cores and memory while it runs, but you cannot shrink them, and the feature has to be switched on by support first. - E2B: no (fixed at creation). The machine keeps the size it was created with; there is no resize. - InstaBox: partly (only while stopped). Cores and memory change only while the machine is stopped, and take effect at its next start; the free plan cannot resize at all. - Lizard: no (fixed size). The size is chosen when the sandbox is created and cannot be changed. - Modal: no (fixed at creation). Resources are fixed when the sandbox is created; changing them means starting a new one. - Morph: partly (disk live; cores need reboot). Disk space can grow while the machine runs, but changing cores or memory means restarting it. - Runtime: partly (memory, while paused). You can change the memory only while the machine is paused, not while it is working. - Sandboxer: no (stop and recreate). There is no way to change a running machine's size; you create a new one and copy your files across. - Sprites: no (one fixed shape). The shape is fixed, so there is nothing to resize. - Vercel Sandbox: no (fixed for the session). The size is set when the sandbox is created and cannot be changed during its life. - Tensorlake: yes (cores, memory, disk live) ## GPUs Machines with a graphics processor, for running AI models or other GPU work inside the sandbox. Guide page: https://botperch.com/capabilities/gpu/ - Agent 37: no (no GPU). No graphics processor is offered on any machine or plan. - Blaxel: not-published - Boat: no (no GPU). No size has a graphics processor, at any price. - boxd: no (no GPU). There is no graphics processor option. - Cloudflare Sandbox: no (no GPU). There is no graphics processor option; the largest machine is 4 cores of CPU. - Daytona: yes (up to 8 GPUs) - E2B: no (CPU only). There is no graphics processor option in any plan, tool or template. - InstaBox: no (no GPU). No graphics processor is offered on any plan. - Lizard: no (CPUs only). Sandboxes run on processors only; there is no graphics option. - Modal: yes (up to 8 GPUs) - Morph: not-published - Runtime: no (no GPU). Runtime lists a GPU request as an example of something it cannot do. - Sandboxer: no (no GPU). There are no graphics processors. - Sprites: no (no GPU). Sprites are not a graphics environment; Fly sells graphics machines as a separate product. - Vercel Sandbox: no (no GPU). No graphics processor option is published for sandboxes. - Tensorlake: partly (by request). Graphics machines exist but you have to ask on Slack to be given access, and they cannot be resized or run virtual machines inside. ## Choose the region You decide which part of the world the machine runs in. Guide page: https://botperch.com/capabilities/choose-region/ - Agent 37: yes (3 regions) - Blaxel: partly (4 regions, not all open). Four regions are listed, but not all of them are available to self-service accounts without asking. - Boat: no (no region choice). Machines run in Germany, Finland or France, and you cannot say which. - boxd: no (one EU region). There is one region, in Germany, and no way to choose another. - Cloudflare Sandbox: no (placement is automatic). Cloudflare puts each sandbox near the request, and a sandbox cannot be pinned to a location. - Daytona: yes (US or EU) - E2B: partly (4 regions, support needed). Four regions exist, but outside the United States you have to contact support to be switched on. - InstaBox: no (no region setting). There is no region setting anywhere in the tools or docs, so you cannot ask for a European machine. - Lizard: yes (2 regions) - Modal: yes (broad or narrow regions) - Morph: not-published - Runtime: no (one region). Everything runs in one place, in Virginia in the United States. - Sandboxer: yes (US East or EU Central) - Sprites: no (placement automatic). You cannot choose where a Sprite runs; placement is decided for you. - Vercel Sandbox: yes (19 regions) - Tensorlake: yes (US or EU) ## Runs in the EU At least one region inside the European Union, for EU data rules. Guide page: https://botperch.com/capabilities/eu-region/ - Agent 37: partly (France, backups in US). There is a French region, but backups and the account's control records are kept in the United States. - Blaxel: yes (London and Frankfurt) - Boat: yes (Germany, Finland, France) - boxd: yes (Germany) - Cloudflare Sandbox: partly (EU locations, cannot pin). Cloudflare has European locations, but a sandbox cannot be required to stay in one, so it may run outside the EU. - Daytona: yes (eu region) - E2B: yes (europe-west1) - InstaBox: no (US only). There is no European region and no way to ask for one. - Lizard: yes (EU West (Limburg)) - Modal: yes (eu regions) - Morph: not-published - Runtime: no (US only). Everything runs in Virginia in the United States. - Sandboxer: yes (Helsinki) - Sprites: partly (EU possible, not chosen). A Sprite may run in Europe because placement follows you, but you cannot require it to. - Vercel Sandbox: yes (European regions) - Tensorlake: yes (EU endpoint) ## Pause keeps memory Pausing keeps memory and running programs, so the machine resumes exactly where it was. Guide page: https://botperch.com/capabilities/pause-memory/ - Agent 37: partly. A sleep usually comes back where it left off, but a wake that has to rebuild starts fresh and loses what was running. - Blaxel: yes (Standby: 25 ms). Network connections do not survive; only files and processes do. - Boat: no - boxd: yes (85 ms wake). A hibernated machine wakes in about 85 ms; standby is faster still. - Cloudflare Sandbox: no - Daytona: partly. Only the full virtual machine can be paused with memory; a container sandbox loses what was running. - E2B: yes - InstaBox: partly (RAM; 1 s resume). A resume can come back without the running programs, and the machine reports that it did. - Lizard: yes. A fast pause keeps only the files, so it is the option to avoid if work must survive. - Modal: no - Morph: yes - Runtime: yes - Sandboxer: partly (2 min window). Memory comes back only if a machine of the same processor type is free within two minutes; otherwise it boots fresh with the files. - Sprites: yes (100–500 ms). After a longer idle spell it is stopped and memory is dropped, and you are not told which happened. - Vercel Sandbox: no - Tensorlake: yes. Only named sandboxes can be suspended; an unnamed one runs until it ends. ## Pre-started pools Keep machines ready in advance so new work starts without waiting for a boot. Guide page: https://botperch.com/capabilities/warm-pool/ - Agent 37: no - Blaxel: no - Boat: no - boxd: no - Cloudflare Sandbox: no - Daytona: partly. Pools exist, but they must be switched on for your organisation by asking support. - E2B: no - InstaBox: no - Lizard: not-published - Modal: partly. You have to build and run the pool yourself; there is no setting that keeps machines waiting. - Morph: no - Runtime: partly. There is no pool to size or refill; you keep spare paused machines yourself and wake one for each task. - Sandboxer: partly. The provider keeps machines ready, but you cannot say how many or which setup; a size the region does not keep boots instead. - Sprites: no - Vercel Sandbox: no - Tensorlake: yes ## Starts in under a second The provider documents new or resumed machines being ready in under a second. Guide page: https://botperch.com/capabilities/fast-start/ - Agent 37: not-published - Blaxel: yes (Under 25 ms) - Boat: no (A few seconds). A resume or a new machine takes a few seconds, not under one. - boxd: yes (Sub-millisecond) - Cloudflare Sandbox: not-published - Daytona: yes (Under 90 ms) - E2B: not-published - InstaBox: partly (About a second). A resume usually takes about a second, which is not under one. - Lizard: yes (228 ms median) - Modal: yes (Sub-second) - Morph: not-published - Runtime: yes (About 0.1 s) - Sandboxer: yes (0.18 s median) - Sprites: yes (100–500 ms) - Vercel Sandbox: yes (Sub-second) - Tensorlake: yes (Hundreds of ms) ## Snapshots of files Save the machine's files at a moment and restore them later. Guide page: https://botperch.com/capabilities/snapshot-files/ - Agent 37: partly (No snapshots; 7 backups). There is no snapshot you can save under a name; the only restore points are seven nightly copies of the home folder. - Blaxel: partly. Snapshots work but are in private preview, so the provider does not recommend them for production. - Boat: yes (Every minute) - boxd: yes - Cloudflare Sandbox: partly (20 GB; 30 days). Snapshots are in public beta, hold at most 20 GB, and are deleted 30 days after they were made or last used. - Daytona: yes - E2B: yes - InstaBox: yes - Lizard: yes - Modal: yes (30 days default) - Morph: yes - Runtime: yes - Sandboxer: yes - Sprites: yes - Vercel Sandbox: yes (30-day default) - Tensorlake: yes ## Snapshots with memory A snapshot also keeps memory and running programs. Guide page: https://botperch.com/capabilities/snapshot-memory/ - Agent 37: no - Blaxel: partly. A snapshot keeps memory and running programs, but the whole feature is in private preview. - Boat: no - boxd: yes (Under 200 ms) - Cloudflare Sandbox: no - Daytona: partly. Memory snapshots are only for full virtual machines; container sandboxes get files only. - E2B: yes - InstaBox: no - Lizard: yes - Modal: partly (Experimental; 7 days). Memory snapshots are still labelled experimental and are deleted after seven days, which cannot be extended. - Morph: yes - Runtime: yes - Sandboxer: yes - Sprites: no - Vercel Sandbox: no - Tensorlake: yes ## Copy a running machine Make copies of a machine while it keeps running. Guide page: https://botperch.com/capabilities/fork-running/ - Agent 37: yes. The copy has the same files, but nothing that was running keeps running. - Blaxel: partly. You can copy a running machine, but the feature is in private preview. - Boat: yes. The copy has the same files, but nothing that was running keeps running. - boxd: yes (100–200 ms) - Cloudflare Sandbox: no - Daytona: yes - E2B: yes (Up to 20 at once). The source pauses while it is copied and its open connections drop. - InstaBox: partly (A few seconds). A copy is made in a few seconds and carries the files but not the running programs. - Lizard: yes (1–100 copies). A fork is refused when the source has a volume attached. - Modal: no - Morph: yes - Runtime: yes. The source is frozen while the copy is captured, so it pauses for a moment. - Sandboxer: partly. A fork copies the files and boots fresh; the running programs are not copied. - Sprites: no - Vercel Sandbox: partly. A fork starts from a snapshot of the current state, and taking one stops the session it copies. - Tensorlake: yes ## Pick an older snapshot Restore any earlier snapshot, not only the latest one. Guide page: https://botperch.com/capabilities/older-snapshot/ - Agent 37: partly (7 nightly backups). You can pick one of seven nightly copies, but you cannot save a snapshot of your own and return to it later. - Blaxel: yes - Boat: partly. You cannot roll a machine back to an older point; an older saved copy can only start a new machine. - boxd: no - Cloudflare Sandbox: partly (30-day expiry). You have to store each snapshot’s ID yourself, and every snapshot is deleted 30 days after it was made or last used. - Daytona: yes - E2B: yes - InstaBox: yes - Lizard: yes - Modal: yes - Morph: yes - Runtime: yes - Sandboxer: partly. The automatic copies keep only the latest two; anything older you have to save yourself under a name. - Sprites: yes (v0, v1, v2…) - Vercel Sandbox: yes (Keep last 1–10) - Tensorlake: yes ## Reusable templates Turn a set-up machine into a template and start many new machines from it. Guide page: https://botperch.com/capabilities/templates/ - Agent 37: yes - Blaxel: yes - Boat: yes - boxd: yes - Cloudflare Sandbox: partly. You can start any number of machines from an image you build, but saving a running machine as a reusable template only works through snapshots, which are in beta, keep files only, and expire after 30 days. - Daytona: yes - E2B: yes - InstaBox: yes - Lizard: yes - Modal: yes - Morph: yes - Runtime: yes - Sandboxer: yes - Sprites: no - Vercel Sandbox: yes - Tensorlake: yes ## Automatic backups The provider takes backups for you on a schedule. Guide page: https://botperch.com/capabilities/backups/ - Agent 37: yes (Nightly; 7 slots). Covers only /home/node, and a restore puts the files back in place. - Blaxel: no - Boat: partly (Every minute). These are automatic snapshots kept with the machine, not an off-site backup, and only the newest one is kept, so there is no history to go back through. - boxd: yes. Off by default; you turn a schedule on for each machine. - Cloudflare Sandbox: partly (On stop, 30 days). A snapshot can be saved automatically when a sandbox stops, but there is no schedule and snapshots expire after 30 days. - Daytona: no - E2B: no - InstaBox: no - Lizard: no - Modal: no - Morph: no - Runtime: yes (Daily, or your cron). Backups cover volumes only; a sandbox's own disk has no copy. - Sandboxer: partly (Every 10 minutes). These are automatic snapshots kept on the same host as the machine, not an off-site backup, so they do not survive losing that host. - Sprites: no - Vercel Sandbox: partly (On every stop). A copy is saved each time the machine stops, but there is no schedule and only the last few are kept. - Tensorlake: partly. Only the storage you mount is saved automatically; a machine's own disk has no copy. ## Files survive a stop Stopping the machine keeps its disk; starting it again finds the files where they were. Guide page: https://botperch.com/capabilities/files-survive-stop/ - Agent 37: yes. The disk bills at $0.09 per GB-month until you delete the instance. - Blaxel: yes - Boat: yes (14 days). The disk is deleted 14 days after a stop unless you saved it. - boxd: yes - Cloudflare Sandbox: no - Daytona: yes - E2B: no - InstaBox: yes - Lizard: no - Modal: no - Morph: no - Runtime: yes. A stopped disk is billed and kept until you delete the sandbox. - Sandboxer: yes - Sprites: yes (100 GB) - Vercel Sandbox: yes - Tensorlake: partly (48 h after terminate). A terminated machine can be brought back for 48 hours; after that its files are gone. ## Separate volumes Storage that lives on after the machine is deleted and can be attached to a new one. Guide page: https://botperch.com/capabilities/volumes/ - Agent 37: no - Blaxel: yes. Only one volume attaches to a sandbox, and it attaches to one sandbox at a time. - Boat: no - boxd: yes. A disk attaches to one machine at a time and lives on one host. - Cloudflare Sandbox: partly (20 GB disk). There is no separate disk that outlives the machine; a bucket can be mounted, and a snapshot lasts 30 days. - Daytona: yes. Volumes are network filesystems, not block disks, so a database table store is a poor fit. - E2B: partly. Volumes exist but are in private beta and need access from support. - InstaBox: no - Lizard: yes (1–50 GB). A volume attaches to one sandbox at a time and lives on one node. - Modal: yes (Up to 1 TiB free) - Morph: partly. The volume is object storage reached over S3, not a disk attached to the machine. - Runtime: yes (Up to 4) - Sandboxer: no - Sprites: no - Vercel Sandbox: yes - Tensorlake: yes ## One volume, several machines Several machines can use the same storage at once. Guide page: https://botperch.com/capabilities/shared-volume/ - Agent 37: no - Blaxel: partly. Shared storage is a separate product called Agent Drive; a volume itself serves one machine at a time. - Boat: no - boxd: no - Cloudflare Sandbox: partly. The shared option is a bucket, not a disk, so files are not locked and two machines can overwrite each other. - Daytona: yes. Writes are not transactional, so two machines writing one file means the last write wins. - E2B: partly. One volume can serve several sandboxes, but volumes are in private beta. - InstaBox: no - Lizard: no - Modal: yes (Hundreds of writers). Two machines writing the same file means the last write wins. - Morph: partly. Sharing happens through an S3 bucket, not a disk several machines mount. - Runtime: partly. Only one machine can write a volume at a time; others can hold a read-only copy taken when they start. - Sandboxer: no - Sprites: no - Vercel Sandbox: partly. Only one machine can write a drive; others get a read-only copy taken when they mount it. - Tensorlake: yes. Same-path writes are last-writer-wins, so two machines editing one file can clash. ## Mount outside storage Attach an S3-style bucket or another outside filesystem as a folder. Guide page: https://botperch.com/capabilities/mount-buckets/ - Agent 37: no - Blaxel: no - Boat: no - boxd: no - Cloudflare Sandbox: yes - Daytona: yes - E2B: partly. Mounting a bucket needs a custom template with the right filesystem tool installed; it is not built in. - InstaBox: no - Lizard: no - Modal: yes - Morph: no - Runtime: yes - Sandboxer: no - Sprites: no - Vercel Sandbox: no - Tensorlake: no ## Large disk Disks of 100 GiB or more are available. Guide page: https://botperch.com/capabilities/big-disk/ - Agent 37: no (80 GB max). The largest shape offers 80 GB of disk, short of 100 GB. - Blaxel: not-published - Boat: yes (251 GB) - boxd: yes (100 GB) - Cloudflare Sandbox: no (20 GB max). The largest disk is 20 GB, short of 100 GB. - Daytona: no (10 GiB cap). The organisation ceiling is 10 GiB of disk per sandbox, though some Windows presets list 50 GiB. - E2B: no (20 GiB max). The largest included disk is 20 GiB, short of 100 GB. - InstaBox: yes (Up to 1024 GiB) - Lizard: no (50 GB max). The largest size offers 50 GB of disk, short of 100 GB. - Modal: yes (512 GiB) - Morph: not-published - Runtime: yes (400 GiB) - Sandboxer: yes (251 GB) - Sprites: yes (100 GB) - Vercel Sandbox: yes (1 TiB drive) - Tensorlake: yes (100 GB root) ## Can stay on indefinitely A machine can run for weeks without being stopped for idleness or a session limit. Guide page: https://botperch.com/capabilities/stay-on/ - Agent 37: yes. Auto-sleep is off unless you turn it on. - Blaxel: partly (7 or 30 days on low tiers). On the two lowest tiers a sandbox is deleted after 7 or 30 days; only higher tiers allow it to wait indefinitely. - Boat: yes - boxd: yes (4 h default, or never) - Cloudflare Sandbox: partly (6 h max). An instance stops when nothing has used it for up to 6 hours, the setting is lost on a restart, and Cloudflare promises no set running time. - Daytona: yes - E2B: partly (1 h Hobby, 24 h Pro). A sandbox cannot run longer than an hour on the free plan or 24 hours on Pro, whether or not it is busy. - InstaBox: partly (Paid plans only). Only paid plans can switch off the idle pause; on the free plan a machine always pauses after 30 idle minutes, though nothing is deleted and it wakes when used. - Lizard: yes - Modal: partly (24 h maximum). No sandbox can run longer than 24 hours, however busy it is. - Morph: yes - Runtime: yes - Sandboxer: yes - Sprites: partly (30 s idle). A Sprite pauses about 30 seconds after its last activity; a task can hold it awake, but you cannot switch the pause off. - Vercel Sandbox: partly (45 min Hobby, 24 h Pro). A single session cannot last beyond 45 minutes on the free plan or 24 hours on paid plans. - Tensorlake: partly (2 h free, 24 h credits). A free sandbox stops after 2 idle hours and a credit-plan sandbox after 24; only Pro and Enterprise are unlimited. ## Choose the idle timeout You set how long an idle machine waits before it pauses or stops, including never. Guide page: https://botperch.com/capabilities/choose-idle/ - Agent 37: yes (5 min to 1 day, or off) - Blaxel: no - Boat: partly (1 h from start). The clock counts from when the machine started, not from when it was last used, so a busy machine is stopped too. - boxd: yes (Any seconds, or off) - Cloudflare Sandbox: partly (Up to 6 h). You can set the wait up to 6 hours, but the setting is lost when the object restarts and there is no never. - Daytona: yes (Minutes, or 0) - E2B: partly (5 min, max 24 h). The clock counts down from creation and commands do not reset it, and the default action is to kill rather than pause. - InstaBox: partly (5–30 min or off). Only paid plans can choose; the free plan is fixed at 30 minutes and cannot turn it off. - Lizard: no - Modal: partly. You can set an idle timeout, but reaching it ends the machine rather than pausing it. - Morph: partly. You can switch the idle pause off, but the docs never say how long it waits or what values you can set. - Runtime: yes (300 s, or never) - Sandboxer: yes (15–120 min, or 0) - Sprites: no - Vercel Sandbox: no - Tensorlake: yes ## Wakes on a request A paused machine starts again by itself when a web request or message arrives. Guide page: https://botperch.com/capabilities/wake-on-request/ - Agent 37: yes - Blaxel: yes - Boat: no - boxd: yes - Cloudflare Sandbox: partly. A request starts a fresh machine, not the one that stopped; files come back only from a snapshot your code saved. - Daytona: no - E2B: yes - InstaBox: partly. Only a machine the platform paused for being idle wakes on a request; one you paused yourself has to be resumed. - Lizard: no - Modal: no - Morph: yes - Runtime: yes - Sandboxer: yes - Sprites: yes - Vercel Sandbox: yes - Tensorlake: yes ## Scheduled runs Start a machine or a job on a schedule, like a cron job, without your own server. Guide page: https://botperch.com/capabilities/schedules/ - Agent 37: yes - Blaxel: yes (100 per sandbox) - Boat: no - boxd: partly. A schedule runs inside the machine, so it only fires while that machine is awake. - Cloudflare Sandbox: yes - Daytona: no - E2B: no - InstaBox: no - Lizard: no - Modal: yes - Morph: no - Runtime: yes - Sandboxer: partly. A cron or timer runs inside the machine, so it never fires while the machine is stopped or paused. - Sprites: no - Vercel Sandbox: yes - Tensorlake: no ## Public link to a port A web address that reaches a program running in the sandbox. Guide page: https://botperch.com/capabilities/public-url/ - Agent 37: yes (Any port) - Blaxel: yes (Public or private) - Boat: yes (Up to 50 ports) - boxd: yes (No sign-in at all) - Cloudflare Sandbox: partly (Through your Worker). There is no address for the machine itself; you publish a small program of your own and anyone who can open that address gets in. - Daytona: yes (public flag) - E2B: yes (Anyone with the link) - InstaBox: yes (16 ports) - Lizard: no. Every preview link needs the machine's access token, so there is no open address to share. - Modal: partly (Open raw port only). A normal web port needs a connect token; only a port exposed as raw traffic is open to anyone. - Morph: not-published - Runtime: yes (Paid top-up) - Sandboxer: yes (--public) - Sprites: yes (public or org-only) - Tensorlake: yes (Per-port switch) - Vercel Sandbox: yes (Exposed ports) ## Private link A link only you or people with a token or login can open. Guide page: https://botperch.com/capabilities/private-url/ - Agent 37: yes (Key or signed link) - Blaxel: yes (Token per preview) - Boat: yes (Token in link) - boxd: no. Every machine address is open to the internet, and the provider offers no token or login to put in front of it. - Cloudflare Sandbox: partly (Login is your code). You have to write the login check in your own small program; the machine brings no token or password of its own. - Daytona: yes (Token or signed link) - E2B: no. There is no built-in lock: anyone who has the link can open it. - InstaBox: yes (Token in link) - Lizard: yes (One token per machine) - Modal: yes (Connect token) - Morph: not-published - Runtime: yes (Token by default) - Sandboxer: yes (Token in link) - Sprites: yes (Org token) - Tensorlake: yes (Project key) - Vercel Sandbox: no. An exposed port is open to anyone with the link; there is no token or login in front of it. ## Real SSH Connect with a standard SSH client from your own computer. Guide page: https://botperch.com/capabilities/ssh/ - Agent 37: yes (Over one connection) - Blaxel: no. There is no SSH address or SSH server; the only shell is the provider's own terminal. - Boat: yes (Port 22) - boxd: yes (Real SSH) - Cloudflare Sandbox: partly (One provider tool). You cannot point a normal SSH client at the machine; the only way in is a Cloudflare command-line tool. - Daytona: yes (Token, 60 min) - E2B: partly (You build the image). SSH only works if you build a custom image with an SSH server and a relay inside it. - InstaBox: yes (Gateway, short cert) - Lizard: partly (Own client only). Its shell command works, but it is the provider's own client rather than a standard SSH connection, so ordinary SSH tools cannot connect. - Modal: partly (Install it yourself). The machine has no SSH server; you have to install one and open a port for it. - Morph: yes (Built in) - Runtime: partly (Through the CLI). The connection goes through the provider's own command rather than a plain SSH address. - Sandboxer: yes (sshEndpoint) - Sprites: partly (Install a server). You must install an SSH server inside the machine and reach it through the provider's proxy. - Tensorlake: yes (Standard ssh) - Vercel Sandbox: partly (SSH-like shell). The command line is the provider's own tool that feels like SSH; a standard SSH client cannot connect. ## Terminal in the browser Open a command line on the machine from the provider's website. Guide page: https://botperch.com/capabilities/web-terminal/ - Agent 37: yes (Port 7681) - Blaxel: yes (Console tab) - Boat: not-published - boxd: yes (Console terminal) - Cloudflare Sandbox: partly (You build it). The provider gives you code for a terminal you host yourself, not a terminal on its own website. - Daytona: yes (Dashboard) - E2B: not-published - InstaBox: yes (Dashboard) - Lizard: yes (Terminal tab) - Modal: not-published - Morph: not-published - Runtime: yes (Console) - Sandboxer: yes (Dashboard tab) - Sprites: not-published - Tensorlake: not-published - Vercel Sandbox: yes (Dashboard tab) ## Tunnel to your computer Reach a port inside the sandbox as if it were on your own machine (port forwarding). Guide page: https://botperch.com/capabilities/tunnel/ - Agent 37: yes (ssh -L) - Blaxel: not-published - Boat: yes (ssh -L) - boxd: yes (ssh -L) - Cloudflare Sandbox: no. There is no way to map a port inside the machine onto your own computer. - Daytona: not-published - E2B: not-published - InstaBox: yes (ssh -L, yours only) - Lizard: not-published - Modal: not-published - Morph: yes (ssh -L) - Runtime: yes (Through the API) - Sandboxer: yes (sbx forward) - Sprites: yes (sprite proxy) - Tensorlake: yes (Local tunnel) - Vercel Sandbox: no. Exposed ports are reachable on the internet, but there is no documented way to map one onto your own computer. ## Non-web ports Reach services that are not HTTP, such as a database or game server, over TCP. Guide page: https://botperch.com/capabilities/raw-tcp/ - Agent 37: no. Only web traffic gets through; a database or game server cannot be reached directly. - Blaxel: not-published - Boat: yes (IPv6 only sometimes) - boxd: yes (3 forwards) - Cloudflare Sandbox: no. Web traffic only: no other kind of connection can be made to the machine from outside. - Daytona: not-published - E2B: not-published - InstaBox: partly (Preview, 5 per workspace). Raw non-web traffic is in a preview only administrators can use, and later will be paid-plan only with five ports per workspace. - Lizard: no. Preview links carry web traffic only, so a database or game port cannot be published. - Modal: yes (Raw tunnels) - Morph: not-published - Runtime: yes (5 per machine) - Sandboxer: partly (Through SSH only). There is no public non-web port; you reach one by opening a tunnel from your own computer. - Sprites: partly (Through your computer). You can map a database port onto your own computer, but there is no public address for non-web traffic. - Tensorlake: partly (Through a tunnel). The public address carries web traffic and SSH only; a database needs a tunnel from your own computer. - Vercel Sandbox: no. Only web ports can be exposed, so a database or game server cannot be reached from outside. ## Your own domain Serve what the machine runs at your own web address. Guide page: https://botperch.com/capabilities/custom-domain/ - Agent 37: partly (Dedicated domain only). You must hand over the whole domain and the records that direct it, so it cannot also run your website or email, and it needs $100 of top-ups first. - Blaxel: yes (Wildcard subdomains) - Boat: no. Custom domains are explicitly unsupported; a redirect from your domain to the provider's name does not work either. - boxd: yes (Per machine or org) - Cloudflare Sandbox: partly (Through your Worker). You point a catch-all address at your own small program rather than at the machine, so routing is yours to run. - Daytona: partly (Own proxy). You have to run your own forwarding service under your domain; the provider does not attach the domain for you. - E2B: partly (Own proxy). You have to run a server of your own in front of the machine to use your domain. - InstaBox: not-published - Lizard: partly (Apps only). Custom domains work for deployed apps, not for a sandbox's preview link. - Modal: partly (Team+, manual). Only Team and Enterprise plans get it, and you must move the domain's name servers and ask support to finish setup. - Morph: not-published - Runtime: yes (Your hostname) - Sandboxer: partly (CNAME and your certificate). You point a name at the provider's address and supply the security certificate yourself; a native feature is only planned. - Sprites: not-published - Tensorlake: not-published - Vercel Sandbox: not-published ## Automatic HTTPS The provider gets and renews the security certificate for your domain. Guide page: https://botperch.com/capabilities/auto-https/ - Agent 37: yes (Platform certificate) - Blaxel: yes (Issued per domain) - Boat: no. There is no custom domain, so there is no certificate for the provider to manage. - boxd: yes (Automatic) - Cloudflare Sandbox: yes (Zone certificate) - Daytona: no. You run the forwarding service, so you also get and renew the certificate. - E2B: no. The certificate is obtained by the server you run in front of the machine, not by the provider. - InstaBox: not-published - Lizard: partly (Apps only). Certificates are handled for deployed apps, but a sandbox preview has no domain to certify. - Modal: partly (Team+, manual). Certificates come with the domain, but only on Team and Enterprise plans and after a manual setup step. - Morph: not-published - Runtime: yes (Let's Encrypt) - Sandboxer: no. You point the name and terminate the certificate yourself. - Sprites: not-published - Tensorlake: not-published - Vercel Sandbox: not-published ## Outbound data included Data the machine sends out is free or comes with a published allowance. Guide page: https://botperch.com/capabilities/egress-included/ - Agent 37: not-published (No rate published) - Blaxel: yes (Included in plan) - Boat: yes ($0) - boxd: not-published - Cloudflare Sandbox: yes (1 TB a month) - Daytona: not-published - E2B: not-published - InstaBox: yes (100 GiB free) - Lizard: yes (2 TB per 30 days) - Modal: yes (1 TiB, then $0.04) - Morph: not-published (Charged, no rate) - Runtime: yes (100 GiB a month) - Sandboxer: yes (Not billed) - Sprites: yes (Not metered) - Tensorlake: not-published - Vercel Sandbox: partly (20 GB a month). Only 20 GB a month is included; beyond that, traffic costs $0.15 a gigabyte. ## Allow only some sites Limit which internet addresses the machine can reach. Guide page: https://botperch.com/capabilities/egress-allowlist/ - Agent 37: yes (100 IPv4 entries) - Blaxel: partly (Proxy filter). The filter only sees programs that use its settings; anything else gets out unless stricter enforcement is switched on. - Boat: partly (Firewall inside). The rules live inside the machine, where the agent has administrator rights and can undo them, and they are lost when the machine is restored. - boxd: yes (256 entries) - Cloudflare Sandbox: yes (Hosts or handler) - Daytona: yes (Domain or address list) - E2B: yes (Domain or address list) - InstaBox: no. There is no setting that limits which sites a machine may reach. - Lizard: not-published - Modal: yes (Domain or address list) - Morph: not-published - Runtime: yes (Allow list) - Sandboxer: no. There is no allowlist or outbound firewall setting; every machine can reach the whole internet. - Sprites: yes (Domain list) - Tensorlake: yes (Domains or addresses) - Vercel Sandbox: yes (Domain or address list) ## Turn the internet off Run a machine with no internet access at all. Guide page: https://botperch.com/capabilities/no-internet/ - Agent 37: yes (deny-all) - Blaxel: not-published - Boat: partly (Firewall inside). You can block traffic with the machine's own firewall, but the agent has administrator rights there and the rules are lost on restore. - boxd: yes (Allowlist none) - Cloudflare Sandbox: yes (Off by default) - Daytona: yes (block-all) - E2B: yes (On/off switch) - InstaBox: not-published - Lizard: not-published - Modal: yes (block_network) - Morph: not-published - Runtime: yes (internet: false) - Sandboxer: partly (Firewall inside). There is no provider setting; you block traffic with the machine's own firewall, which the agent can undo. - Sprites: partly (Deny every domain). You can deny every domain by policy, but the machine keeps its network and the rule works by refusing name lookups. - Tensorlake: yes (--no-internet) - Vercel Sandbox: yes (deny-all) ## Fixed outgoing IP Traffic leaves from a known IP address that other services can whitelist. Guide page: https://botperch.com/capabilities/static-ip/ - Agent 37: not-published - Blaxel: partly (Private preview). Dedicated addresses are in a private preview you must ask to join, and can only be attached when a machine is created. - Boat: not-published - boxd: not-published - Cloudflare Sandbox: not-published - Daytona: not-published - E2B: no. There is no dedicated or fixed outbound address on any plan, including Enterprise. - InstaBox: not-published - Lizard: not-published - Modal: partly (Team+, 5 addresses). Only Team and Enterprise plans get it, and each account can create one or three gateways holding up to five addresses each. - Morph: not-published - Runtime: yes ($5 a month) - Sandboxer: no (Shared host address). Outbound traffic shares the host machine's address with every other sandbox on it, so other services see one shared address. - Sprites: not-published - Tensorlake: not-published - Vercel Sandbox: not-published ## Stored secrets Save API keys with the provider and have them appear in the machine as environment variables. Guide page: https://botperch.com/capabilities/secrets-store/ - Agent 37: yes (Environment variables) - Blaxel: yes (Variables and secrets) - Boat: yes (Variables and files) - boxd: yes (Org-wide) - Cloudflare Sandbox: partly (Worker bindings). There is no saved secret inside the machine; you keep the value in your own small program and add it on the way out. - Daytona: yes (Stored secrets) - E2B: yes (Per project) - InstaBox: yes (Org secrets) - Lizard: yes (At create time) - Modal: yes (Inline secrets) - Morph: yes (Template manager) - Runtime: yes (Stored once) - Sandboxer: yes (Variables and files) - Sprites: not-published - Tensorlake: no. There is no saved secret: you pass the value with each command or session. - Vercel Sandbox: partly (Passed each time). There is no saved list of secrets for a sandbox; you pass the values each time you create or run one. ## Secrets the agent cannot read Keys are added to outgoing requests by the provider, so the agent never sees them. Guide page: https://botperch.com/capabilities/hidden-secrets/ - Agent 37: no. There is no service that adds keys for you; a key you give the machine is a key the agent can print. - Blaxel: partly (Public preview). The feature is a public preview, and programs that ignore its settings can bypass it. - Boat: partly (Model keys only). Only model-provider keys go through the key service; other API keys are ordinary variables the agent can read. - boxd: yes (Stand-in string) - Cloudflare Sandbox: yes (Added by your Worker) - Daytona: yes (Header only) - E2B: yes (Outside the machine) - InstaBox: yes (Web headers only) - Lizard: no. There is no service that adds keys for you; keys are variables the agent can read. - Modal: partly (Beta). The feature that hides keys is in beta and cannot be changed once set up. - Morph: not-published - Runtime: yes (Placeholder) - Sandboxer: no. Keys are written into the machine as variables and files, so the agent can read them. - Sprites: partly (Catalogue only). Only the services in its catalogue are covered; any other key has to go into the machine. - Tensorlake: no. There is no service that adds keys to requests; the machine holds whatever you pass it. - Vercel Sandbox: yes (Outside the machine) ## Limited API keys Create API keys that can do only some things, or only in one project. Guide page: https://botperch.com/capabilities/scoped-keys/ - Agent 37: partly (Workspace only). A key is limited to one workspace but can do everything in it, and there is no read-only key. - Blaxel: partly (Workspace only). A service-account key is limited to one workspace but has no narrower permissions. - Boat: yes (Action sets) - boxd: partly (No scopes). Keys are per person and can be revoked, but there is no way to make one read-only or limit it to one machine. - Cloudflare Sandbox: yes (Account tokens) - Daytona: yes (Permission scopes) - E2B: partly (One key per team). A key belongs to one team and there is no published read-only or per-machine scope. - InstaBox: yes (Per-resource scopes) - Lizard: yes (Project or workspace) - Modal: partly (Workspace role). Permissions come from a person's workspace role, not from a key that can only do one thing. - Morph: yes (Token scopes) - Runtime: yes (Read-only keys) - Sandboxer: yes (Action and machine sets) - Sprites: not-published - Tensorlake: yes (Project-scoped) - Vercel Sandbox: partly (Team tokens). Tokens are limited to a team, but no read-only or sandbox-only scope is published. ## Create from the website Start a machine by clicking in the provider's dashboard, with no terminal. Guide page: https://botperch.com/capabilities/dashboard-create/ - Agent 37: yes - Blaxel: yes - Boat: no - boxd: no - Cloudflare Sandbox: no - Daytona: yes - E2B: no - InstaBox: yes - Lizard: yes - Modal: no - Morph: yes - Runtime: yes - Sandboxer: no - Sprites: no - Vercel Sandbox: no - Tensorlake: no ## Command-line tool An official command-line tool. Guide page: https://botperch.com/capabilities/cli/ - Agent 37: yes - Blaxel: yes - Boat: yes - boxd: yes - Cloudflare Sandbox: partly. The only command-line tool is Wrangler, which deploys the Worker and can open a shell; it does not create or manage sandboxes. - Daytona: yes - E2B: yes - InstaBox: yes - Lizard: yes - Modal: yes - Morph: yes - Runtime: yes - Sandboxer: yes - Sprites: yes - Vercel Sandbox: yes - Tensorlake: yes ## Python SDK An official library for Python programs. Guide page: https://botperch.com/capabilities/python-sdk/ - Agent 37: yes - Blaxel: yes - Boat: yes - boxd: yes - Cloudflare Sandbox: no - Daytona: yes - E2B: yes - InstaBox: partly. A Python library is named in one place but has no page, package name or install command. - Lizard: yes - Modal: yes - Morph: yes - Runtime: yes - Sandboxer: yes - Sprites: no - Vercel Sandbox: yes - Tensorlake: yes ## TypeScript SDK An official library for JavaScript or TypeScript programs. Guide page: https://botperch.com/capabilities/ts-sdk/ - Agent 37: no - Blaxel: yes - Boat: yes - boxd: yes - Cloudflare Sandbox: yes - Daytona: yes - E2B: yes - InstaBox: yes - Lizard: yes - Modal: yes - Morph: yes - Runtime: yes - Sandboxer: yes - Sprites: yes - Vercel Sandbox: yes - Tensorlake: yes ## Documented HTTP API A documented web API that any language can call. Guide page: https://botperch.com/capabilities/rest-api/ - Agent 37: yes - Blaxel: yes - Boat: yes - boxd: no. The only wire API is gRPC, so a browser or a plain HTTP client cannot call it. - Cloudflare Sandbox: no. There is no Cloudflare-hosted API to call; you write a Worker and call it yourself. - Daytona: yes - E2B: yes - InstaBox: yes - Lizard: yes - Modal: no. The documented interface is the SDK and its gRPC connection; there is no separate HTTP API to call. - Morph: yes - Runtime: yes - Sandboxer: yes - Sprites: yes - Vercel Sandbox: no. Sandbox is driven through the SDKs and the CLI; no HTTP API is documented. - Tensorlake: yes ## MCP server An official MCP server, so an AI assistant can create and use sandboxes itself. Guide page: https://botperch.com/capabilities/mcp-server/ - Agent 37: no. MCP is a client feature here: instances reach out to Composio and Perflo, but nothing lets an assistant create an instance. - Blaxel: yes - Boat: no. The only MCP server searches the documentation; it cannot start or drive a sandbox. - boxd: no. boxd installs other products' MCP servers into its agents; it publishes no server that creates machines. - Cloudflare Sandbox: no. The MCP material is a separate Cloudflare code-mode project, not a server that starts sandboxes. - Daytona: yes - E2B: partly. E2B's MCP support runs other companies' tools inside a sandbox; nothing of E2B's lets your assistant create sandboxes. - InstaBox: no. No MCP server is published for the InstaBox API, so an assistant cannot create machines through one. - Lizard: yes - Modal: no. The only MCP guidance is how to deploy someone else's MCP server inside Modal. - Morph: no - Runtime: yes - Sandboxer: yes - Sprites: no - Vercel Sandbox: no. No MCP server manages sandboxes; Vercel's MCP material is about building MCP servers on Vercel. - Tensorlake: no ## Interactive terminal over the API A program can open a live terminal session (PTY) in the sandbox, not just run one command. Guide page: https://botperch.com/capabilities/pty/ - Agent 37: yes - Blaxel: yes - Boat: yes - boxd: yes - Cloudflare Sandbox: partly. A live shell exists only inside a web page you build; there is no call that opens a terminal session for a script. - Daytona: yes - E2B: yes - InstaBox: yes - Lizard: yes - Modal: yes - Morph: yes - Runtime: yes - Sandboxer: yes - Sprites: yes - Vercel Sandbox: yes - Tensorlake: yes ## Files over the API Read and write files in the sandbox through the SDK or API. Guide page: https://botperch.com/capabilities/file-api/ - Agent 37: yes - Blaxel: yes - Boat: yes - boxd: yes - Cloudflare Sandbox: yes - Daytona: yes - E2B: yes - InstaBox: yes - Lizard: yes - Modal: yes - Morph: yes - Runtime: yes - Sandboxer: yes - Sprites: yes - Vercel Sandbox: yes - Tensorlake: yes ## Coding agents preinstalled Claude Code, Codex or similar are already installed in the default image. Guide page: https://botperch.com/capabilities/agents-preinstalled/ - Agent 37: yes (6 templates) - Blaxel: no. The default image is a bare sandbox; agents are code you deploy or an MCP server you connect. - Boat: yes (7 harnesses) - boxd: yes (3 agents) - Cloudflare Sandbox: no. The current base images ship no coding agent; you add one in your own Dockerfile, as the guides do. - Daytona: partly. OpenClaw is in the default snapshot, but Claude Code and Codex are not; those need an install step. - E2B: partly. A prebuilt Hermes template exists, but the default image has no agent and there is no Claude Code or Codex template. - InstaBox: yes - Lizard: yes (5 agents) - Modal: no. Nothing is preinstalled and there is no agent API; the agent is code you run. - Morph: no. Devboxes boot from templates you build; no agent is in the default image. - Runtime: no. The default image ships languages and tools but no coding agent; you install the agent yourself. - Sandboxer: yes (6 harnesses) - Sprites: no. Sprites provide plugins and integrations for agents, but no agent is in the image. - Vercel Sandbox: yes - Tensorlake: no. The managed images ship an OS, a desktop and tooling; no coding agent is installed. ## Send it a prompt The provider runs an agent for you: you send a prompt, it does the work in the sandbox. Guide page: https://botperch.com/capabilities/prompt-api/ - Agent 37: yes - Blaxel: no. There is no prompt endpoint; Agent Runtime, the product that would run the loop, is marked Soon. - Boat: yes - boxd: no. boxd runs the machine, not the agent loop; Anthropic or OpenAI runs the loop in the documented integrations. - Cloudflare Sandbox: no. Your Worker holds the credentials and the agent runs as a process you start; there is no prompt endpoint. - Daytona: no. No agent is hosted and there is no prompt call; you install and drive the agent. - E2B: no. Guides show agents running in a sandbox, but no API takes a prompt and runs one for you. - InstaBox: no. There is no prompt endpoint; the API offers exec, files, desktop and snapshots. - Lizard: partly. You can send a prompt from the command line, but the SDK and API have no prompt call, so a program cannot start an agent. - Modal: no. Modal sells the computer, not an agent loop; the docs show SDK code you write. - Morph: no. The tmux API lets your program type into an agent, but Morph runs no agent loop of its own. - Runtime: no. Runtime has no agent-run API; its own docs say no bridge harness has run on it yet. - Sandboxer: yes - Sprites: no. Sprites host an agent you install; there is no prompt endpoint. - Vercel Sandbox: no. Agents are in the image but there is no API that runs one; you open a terminal or use the CLI. - Tensorlake: no. Tensorlake exposes a sandbox as a tool for your own agent; it does not run an agent from a prompt. ## One-click Hermes Hermes Agent can be set up without a terminal. Guide page: https://botperch.com/capabilities/one-click-hermes/ - Agent 37: yes ($0-99.99/mo) - Blaxel: no. No Hermes template or guide is published; you would install it yourself. - Boat: partly. Hermes is already installed on every machine, but you still need a terminal command to start it and prompt it. - boxd: no. No Hermes template, harness or guide is documented. - Cloudflare Sandbox: no. No Hermes template; you would install it in your own Dockerfile. - Daytona: no. Daytona documents OpenClaw but not Hermes, so there is no one-click route. - E2B: partly. A prebuilt template is ready, but you still create the sandbox with a command and pay by usage. - InstaBox: no. No Hermes template, guide or one-click route is documented. - Lizard: no. The deploy catalog has no Hermes template; only a manual install in a sandbox. - Modal: no. Hermes lists Modal as a terminal backend, not as a one-click host. - Morph: no. No Hermes template or guide is published. - Runtime: no. No Hermes template or guide is published. - Sandboxer: no. Its six harnesses do not include Hermes, and there is no template. - Sprites: no. Hermes is named on the marketing page, but there is no template or guided route. - Vercel Sandbox: no. A Hermes guide exists, but you follow terminal steps; nothing is one click. - Tensorlake: no. No Hermes template or guide is published. ## One-click OpenClaw OpenClaw can be set up without a terminal. Guide page: https://botperch.com/capabilities/one-click-openclaw/ - Agent 37: yes ($0-99.99/mo) - Blaxel: no. A tutorial walks through OpenClaw in a sandbox, but it is terminal work, not one click. - Boat: partly. OpenClaw is installed on every machine, but its gateway does not start by itself and you need a terminal. - boxd: no. No OpenClaw template, harness or guide is documented. - Cloudflare Sandbox: no. No OpenClaw template; the guides cover Claude Code, Codex, OpenCode and Pi. - Daytona: partly. OpenClaw is in the default snapshot, but you still run a command to start and configure it. - E2B: no. No OpenClaw template or guide is published. - InstaBox: no. No OpenClaw template or guide is published. - Lizard: yes - Modal: no. No OpenClaw template or guide is published. - Morph: no. No OpenClaw template or guide is published. - Runtime: no. No OpenClaw template or guide is published. - Sandboxer: no. Its harness list does not include OpenClaw, and there is no template. - Sprites: no. OpenClaw is named on the marketing page, but there is no template or guided route. - Vercel Sandbox: no. No OpenClaw template or one-click route is documented. - Tensorlake: no. No OpenClaw template or guide is published. ## Browser built in A web browser (Chrome or Chromium) ready for an agent to drive. Guide page: https://botperch.com/capabilities/browser/ - Agent 37: yes - Blaxel: no. No browser is installed or offered; you would add Chrome to your own image. - Boat: yes (Chrome 151) - boxd: yes - Cloudflare Sandbox: no. The base images ship no browser; you install one in your own Dockerfile. - Daytona: not-published - E2B: partly. A browser comes with the desktop image or through Kernel cloud browsers, not in the default sandbox image. - InstaBox: yes - Lizard: yes - Modal: no. No browser, desktop or computer-use API is documented; the sandbox is a headless container. - Morph: partly. A documented example runs headless Chrome in a container, but no browser is installed for you. - Runtime: yes - Sandboxer: yes - Sprites: no. No browser is installed or offered; a browser is something you run and reach through a proxy. - Vercel Sandbox: no. No browser is documented in the image or as an API; agents in the image are terminal tools. - Tensorlake: yes ## Desktop for computer use A graphical desktop an agent can see and click, for computer-use agents. Guide page: https://botperch.com/capabilities/desktop/ - Agent 37: yes - Blaxel: no. No graphical desktop is documented; the browser surfaces are a terminal and preview URLs. - Boat: yes (1080p 60 fps) - boxd: yes - Cloudflare Sandbox: no. No desktop or computer-use surface is documented. - Daytona: yes - E2B: yes - InstaBox: yes - Lizard: yes - Modal: no. No desktop, VNC or computer-use API is documented. - Morph: yes - Runtime: yes - Sandboxer: yes - Sprites: no. No desktop is documented; interactive access is a terminal console. - Vercel Sandbox: no. No desktop, VNC or computer-use API is published for Sandbox. - Tensorlake: yes ## Runs other platforms' agents Documented as the machine for Cursor cloud agents, Devin, Claude Managed Agents or similar. Guide page: https://botperch.com/capabilities/hosts-other-agents/ - Agent 37: yes - Blaxel: yes - Boat: no. No page documents another platform's cloud agents using Boat as their machine. - boxd: yes - Cloudflare Sandbox: yes - Daytona: yes - E2B: yes - InstaBox: no. No page documents another platform's cloud agents using InstaBox. - Lizard: no. No page documents another platform's cloud agents using Lizard. - Modal: yes - Morph: no. No page documents another platform's cloud agents using Morph. - Runtime: yes - Sandboxer: no. Its agent pages cover SDKs and frameworks, not another platform's hosted cloud agents. - Sprites: no. Its ecosystem lists coding tools, not another platform's cloud agents. - Vercel Sandbox: yes - Tensorlake: yes ## Team workspace Several people share machines, billing and keys. Guide page: https://botperch.com/capabilities/team-workspace/ - Agent 37: yes - Blaxel: yes - Boat: yes - boxd: yes - Cloudflare Sandbox: partly. People share the Cloudflare account and its Workers, but there is no per-sandbox sharing or sandbox workspace. - Daytona: yes - E2B: yes - InstaBox: yes - Lizard: yes - Modal: yes - Morph: yes - Runtime: yes - Sandboxer: yes - Sprites: yes - Vercel Sandbox: yes - Tensorlake: yes ## Roles and permissions Give people different powers, such as read-only or admin. Guide page: https://botperch.com/capabilities/roles/ - Agent 37: yes - Blaxel: yes - Boat: yes - boxd: yes - Cloudflare Sandbox: yes - Daytona: partly. Roles decide who can manage the organisation, but any member or key can still run commands in any running sandbox. - E2B: not-published - InstaBox: yes - Lizard: partly. Role-based access is listed only on the Enterprise plan; the Pro plan marks it not included. - Modal: partly (Team plan and above). Role-based access starts on the Team plan; the free-to-start Starter plan has no roles. - Morph: not-published - Runtime: yes (4 roles) - Sandboxer: partly. Only two roles exist; there is no read-only role or finer permission. - Sprites: yes - Vercel Sandbox: yes - Tensorlake: partly (Admin and member only). Every plan gets two fixed roles, admin and member, at organization and project level; fuller role-based access is listed under the Enterprise plan. ## Single sign-on Log in through your company's identity provider (SAML or OIDC). Guide page: https://botperch.com/capabilities/sso/ - Agent 37: not-published - Blaxel: partly. Single sign-on works only after Blaxel switches on a setting for your account. - Boat: not-published - boxd: partly. SAML is sold on Enterprise and you have to ask for it. - Cloudflare Sandbox: yes - Daytona: partly. SSO is available only on the Enterprise plan for collaborative organisations. - E2B: not-published - InstaBox: partly. Company sign-in, SAML and automatic user sync are listed only on the Enterprise plan. - Lizard: partly. SSO and SAML are Enterprise-only; the Pro plan marks them not included. - Modal: partly. Okta SSO is listed with audit logs and HIPAA on the Enterprise plan. - Morph: not-published - Runtime: yes - Sandboxer: not-published - Sprites: not-published - Vercel Sandbox: partly ($300/month). SAML single sign-on is a paid add-on at $300 a month. - Tensorlake: partly. SSO is listed on the Enterprise plan, and the docs say access must be enabled for your organisation. ## Hard spending cap Set a limit the bill cannot go over; machines stop instead. Guide page: https://botperch.com/capabilities/spend-cap/ - Agent 37: no. There is no dollar limit you can set; per-instance budgets only cap model spending, and the prepaid wallet is the only ceiling. - Blaxel: not-published - Boat: partly. A personal account has no dollar cap; organisations can cap a member's machine time, which stops their new sandboxes. - boxd: not-published - Cloudflare Sandbox: no. Budget alerts only send email; they do not pause or cap anything. - Daytona: partly. The ceiling is a prepaid pool of computing resources rather than a dollar amount, and running sandboxes are not stopped when it runs out. - E2B: yes - InstaBox: yes - Lizard: no. There is no spending cap at all; only sandbox, CPU, memory and disk caps. - Modal: yes - Morph: not-published - Runtime: yes - Sandboxer: partly. A member's machine time can be capped, and a zero balance stops new sandboxes, but there is no account-wide dollar cap. - Sprites: not-published - Vercel Sandbox: partly. Spend Management can pause projects at an amount you set, but it is a project pause rather than a sandbox stop. - Tensorlake: partly. Prepaid credit packs cannot be overspent, but the Pro plan bills overage beyond its included usage. ## Usage alerts Get told when spending passes an amount you set. Guide page: https://botperch.com/capabilities/usage-alerts/ - Agent 37: not-published - Blaxel: yes (90% of quota) - Boat: not-published - boxd: not-published - Cloudflare Sandbox: yes - Daytona: not-published - E2B: not-published - InstaBox: yes - Lizard: not-published - Modal: not-published - Morph: not-published - Runtime: partly. The console warns when credit or free usage is about to run out, but you cannot set your own threshold. - Sandboxer: yes - Sprites: not-published - Vercel Sandbox: yes - Tensorlake: not-published ## Audit log A record of who did what in the account. Guide page: https://botperch.com/capabilities/audit-log/ - Agent 37: not-published - Blaxel: not-published - Boat: not-published - boxd: partly. Audit logs are sold with SSO on the Custom/Enterprise line; on self-serve plans the only record is the SSH command history. - Cloudflare Sandbox: yes - Daytona: partly. The log exists, but exporting it for an audit is not shipped yet. - E2B: not-published - InstaBox: partly. Audit logs are listed only on the Enterprise plan. - Lizard: partly. Audit logs are Enterprise-only; the Pro plan marks them not included. - Modal: partly. Audit logs are listed with SSO and HIPAA on the Enterprise plan. - Morph: not-published - Runtime: yes (400 days) - Sandboxer: not-published - Sprites: no. Fly states plainly that there is no customer-facing audit log of organisation activity or staff access. - Vercel Sandbox: partly. Audit Logs are a Vercel Enterprise feature; Sandbox-specific coverage is not established. - Tensorlake: partly. Audit logs are not self-serve: you ask support for them. ## Billed per second Usage is counted to the second rather than by the hour or month. Guide page: https://botperch.com/capabilities/per-second/ - Agent 37: no (per minute). Usage is counted by the minute, not the second, so every short task rounds up. - Blaxel: yes (per second) - Boat: yes (per second) - boxd: yes (per second) - Cloudflare Sandbox: yes (per 10 ms) - Daytona: yes (per second) - E2B: yes (per second) - InstaBox: yes (per second) - Lizard: yes (per second) - Modal: yes (per second) - Morph: yes (per second) - Runtime: yes (per second) - Sandboxer: yes (per second) - Sprites: yes (per second) - Vercel Sandbox: partly (memory rounds to a minute). Memory is counted in whole minutes, so a 20-second task is charged for a full minute of memory. - Tensorlake: yes (per second) ## CPU billed only while working An idle processor costs nothing or very little. Guide page: https://botperch.com/capabilities/active-cpu/ - Agent 37: no (full rate while awake). A running machine pays its full compute rate whether it is working or waiting. - Blaxel: no (memory-based meter). The meter runs on the memory you allocated for as long as the sandbox is active, busy or not. - Boat: no (flat rate per size). A running machine costs the same whether it is working or waiting. - boxd: no (full cores while running). The processor is charged at the machine's full size for as long as it runs. - Cloudflare Sandbox: yes (active CPU only) - Daytona: no (reserved size). You pay for the cores and memory you reserved, not the ones the work used. - E2B: no (allocated size). The bill follows the cores and memory you gave the machine, not what it used. - InstaBox: no (size while running). A waiting machine costs the same as a busy one of the same size. - Lizard: no (idle is billed). Waiting time is charged at the same rate as working time. - Modal: no (request or use, whichever is higher). A machine that reserves more than it uses pays for the reservation. - Morph: no (largest resource counts). The rate follows the largest of cores, memory and disk, so spare capacity is paid for. - Runtime: yes (measured, 50 mcore floor) - Sandboxer: no (flat rate per size). The price depends on the size you picked, not on how hard it works. - Sprites: yes (actual CPU) - Vercel Sandbox: yes (active CPU only) - Tensorlake: yes (active CPU only) ## Paused costs only storage A paused or stopped machine bills for its kept files only, not CPU or memory. Guide page: https://botperch.com/capabilities/cheap-pause/ - Agent 37: yes (disk only) - Blaxel: yes (storage only) - Boat: yes (nothing for 14 days) - boxd: partly (pause keeps paying for memory). Pausing keeps the memory in place and you keep paying for it; only hibernating or stopping brings the bill down to disk alone. - Cloudflare Sandbox: yes (nothing while stopped) - Daytona: yes (disk only) - E2B: yes (nothing while paused) - InstaBox: yes (storage only) - Lizard: yes (compute stops) - Modal: no (no pause). There is no pause: a sandbox bills until it is shut down, and its saved copy is stored separately. - Morph: yes (snapshot only) - Runtime: yes (storage only) - Sandboxer: yes (nothing while stopped) - Sprites: yes (compute stops) - Vercel Sandbox: yes (compute stops) - Tensorlake: yes (storage only) ## No monthly fee Pay only for what you use, with no plan fee. Guide page: https://botperch.com/capabilities/no-monthly-fee/ - Agent 37: yes (none) - Blaxel: yes (none) - Boat: no ($20 minimum plan). The smallest plan is $20 a month, and unused time expires, so a light month still costs $20. - boxd: yes (none) - Cloudflare Sandbox: no ($5 Workers plan). Sandboxes need the $5-a-month Workers Paid plan before anything can run. - Daytona: yes (none) - E2B: yes (none on Hobby) - InstaBox: no ($20 minimum plan). The free plan is capped at one machine, and anything more needs a $20-a-month plan. - Lizard: no ($19 plan). There is one plan at $19 a month, which includes $19 of usage. - Modal: yes (Starter $0) - Morph: yes (Developer $0) - Runtime: yes (none) - Sandboxer: no ($20 minimum plan). The smallest plan is $20 a month, and included time does not carry over. - Sprites: yes (none) - Vercel Sandbox: partly (Hobby free; Pro $20). The free Hobby plan is for personal projects only; commercial use needs the $20-a-month Pro plan. - Tensorlake: yes (prepaid credit) ## Flat monthly price A fixed price per month for a machine, so the bill is predictable. Guide page: https://botperch.com/capabilities/flat-price/ - Agent 37: no (metered parts). The bill is cores plus memory plus disk, so it moves with the shape you choose. - Blaxel: no (per GB-second). The price follows the memory you allocate and the seconds it runs. - Boat: yes ($26 a month for default) - boxd: no (three meters). Cores, memory and disk are metered separately, so there is no single monthly price. - Cloudflare Sandbox: no (per 10 ms). The bill is a sum of active processor time, memory and disk. - Daytona: no (metered parts). The bill is cores plus memory plus disk per second. - E2B: no (per second parts). The bill is cores plus memory per second. - InstaBox: no (metered parts). The bill is cores plus memory per second, plus storage. - Lizard: yes ($0.0324/h medium) - Modal: no (request or use). The bill follows the higher of what you asked for and what you used. - Morph: no (one rate per unit). The price is a single rate per unit hour, not a fixed monthly price per machine. - Runtime: no (measured parts). The bill is measured processor time plus reserved memory plus storage. - Sandboxer: yes ($26.28 a month default) - Sprites: no (actual use). The bill follows the processor and memory actually used, so it varies with the work. - Vercel Sandbox: no (active CPU plus memory). The bill is active processor time plus memory for as long as the sandbox runs. - Tensorlake: no (metered parts). The bill is processor time plus memory plus disk plus storage. ## Ongoing free tier Something keeps working for free every month, not only at the start. Guide page: https://botperch.com/capabilities/free-tier/ - Agent 37: no (one-off $5 credit). There is no monthly free allowance; the only free usage is a one-off $5 credit. - Blaxel: no (one-off credits). Free usage is a one-off promotional credit, not something that returns each month. - Boat: no (trial only). There is no free tier; the only free usage is a seven-day trial that needs a card. - boxd: no (one-off credit). Free usage is a one-off credit that needs a card, not a monthly allowance. - Cloudflare Sandbox: no (none). Sandboxes only run on the paid Workers plan. - Daytona: no (one-off $200). The $200 is a one-time credit, not something that returns every month. - E2B: no (one-off $100). The $100 is a one-time credit, not a monthly allowance. - InstaBox: yes (1 machine, 4 cores / 8 GiB) - Lizard: no (7-day trial). There is no free tier, only a seven-day trial that needs a card. - Modal: partly ($30 a month, card needed). Thirty dollars of free compute returns each month, but a payment method must be on file before anything runs. - Morph: partly (300 hours claimed). The signup page promises 300 free hours a month, but the pricing page shows no free compute and asks you to buy units. - Runtime: yes (100 hours a month) - Sandboxer: no (trial only). There is no free tier, only a seven-day trial that becomes a $20 plan. - Sprites: no (one-off $30). Free usage is a one-time $30 credit, not a monthly allowance. - Vercel Sandbox: partly (Hobby, personal use only). The free Hobby plan is limited to personal projects and stops creating sandboxes when its allowance runs out. - Tensorlake: yes (1 machine, 1 core / 1 GB) ## Free starting credit Credit to spend when you sign up. Guide page: https://botperch.com/capabilities/free-credit/ - Agent 37: yes ($5) - Blaxel: yes (up to $200) - Boat: no (none). There is no credit; the free offer is 25 hours of machine time inside a trial. - boxd: yes (€30) - Cloudflare Sandbox: no (none). There is no starting credit; you pay the $5 monthly plan from the start. - Daytona: yes ($200) - E2B: yes ($100) - InstaBox: no (none). There is no starting credit; the free plan is a machine, and paid plans include usage equal to their fee. - Lizard: partly ($5 inside a trial). The $5 comes only as part of a seven-day trial and needs a card. - Modal: yes ($30 a month) - Morph: partly (300 hours claimed). One page promises 300 free hours a month, while the pricing page lists no free units. - Runtime: partly (matched credit). There is no plain signup credit; whatever you add in your first 30 days is doubled, up to $1,000. - Sandboxer: no (none). There is no credit; the trial is 25 hours of machine time that becomes a paid plan. - Sprites: yes ($30) - Vercel Sandbox: partly ($20 in a 14-day trial). The credit is part of a 14-day Pro trial, not a standing signup credit. - Tensorlake: no (none). There is no starting credit; the free plan is a small machine and credit is bought in packs. ## Try without a card You can start without entering a payment card. Guide page: https://botperch.com/capabilities/no-card/ - Agent 37: no (card for the credit). A card is needed to get the credit that makes the first machine runnable. - Blaxel: yes (no card) - Boat: no (card at checkout). Checkout asks for a card before the trial starts. - boxd: yes (2 machines without one) - Cloudflare Sandbox: no (paid plan first). You need a paid Workers plan, which means a payment method, before a sandbox can run. - Daytona: yes (no card) - E2B: yes (no card) - InstaBox: yes (free plan) - Lizard: no (card for the trial). You add a card to start the trial, though nothing is charged at that point. - Modal: no (card required). A payment method must be on file before you can use Modal at all. - Morph: not-published - Runtime: yes (no card) - Sandboxer: no (card for the trial). The trial needs a card up front and becomes a paid plan after seven days. - Sprites: not-published - Vercel Sandbox: not-published - Tensorlake: yes (free plan, no card) ## Public status page A page showing outages and incidents. Guide page: https://botperch.com/capabilities/status-page/ - Agent 37: yes - Blaxel: yes - Boat: yes - boxd: not-published - Cloudflare Sandbox: yes - Daytona: yes - E2B: yes - InstaBox: not-published - Lizard: yes - Modal: yes - Morph: yes - Runtime: yes - Sandboxer: yes - Sprites: yes - Vercel Sandbox: yes - Tensorlake: yes ## Uptime promise (SLA) A written promise about availability, usually with credits if broken. Guide page: https://botperch.com/capabilities/sla/ - Agent 37: no. There is no uptime promise unless you negotiate one in writing. - Blaxel: partly. A standard plan carries no numeric uptime promise; only the Custom plan lists custom SLAs. - Boat: no. The terms disclaim uninterrupted service and no SLA is published. - boxd: not-published - Cloudflare Sandbox: no. The 99.99% Workers SLA covers Workers only, not Containers or Sandboxes. - Daytona: partly (99.95%, Tier 4+). The 99.95% target exists, but service credits go only to Tier 4 and above. - E2B: partly. Uptime and support terms are set in the Enterprise agreement; Hobby and Pro have no public numeric SLA. - InstaBox: partly (99.9%, Enterprise). A 99.9% promise is listed only on the Enterprise plan, with no published measurement or credits. - Lizard: partly. SLAs come with Enterprise support; no public numeric uptime promise exists. - Modal: no. There is no public SLA; one is attached to the order only if you bought a plan that includes it. - Morph: no. No public uptime target or credit schedule is published; a separately signed SLA would control. - Runtime: yes (99% API) - Sandboxer: no. There is no SLA during early access. - Sprites: partly. Fly's 99.9% promise is for Enterprise plans and credits must be claimed; Sprites coverage is not named. - Vercel Sandbox: partly (99.99%, Enterprise). The 99.99% Enterprise SLA covers the platform and does not name Sandbox. - Tensorlake: no. The only published SLA is a 24-hour response to a P1 support ticket, not an uptime promise. ## SOC 2 report An independent security audit report you can request. Guide page: https://botperch.com/capabilities/soc2/ - Agent 37: partly (Type I only). Only a SOC 2 Type I report is available, on request; Type II is still in progress. - Blaxel: yes (SOC 2, HIPAA, ISO) - Boat: no. SOC 2 is in progress, so there is no report to request yet. - boxd: no. boxd says it is working on SOC 2 and ISO 27001 and offers security details by email instead. - Cloudflare Sandbox: yes - Daytona: yes (Type II) - E2B: yes (Type II) - InstaBox: not-published - Lizard: no. The SOC 2 report is listed as coming soon. - Modal: yes (Type II) - Morph: not-published - Runtime: partly. The SOC 2 and ISO certificates belong to its Virginia data centre, not to Runtime, so there is no Runtime-owned report. - Sandboxer: not-published - Sprites: partly. Fly's SOC 2 report describes the platform and does not name Sprites. - Vercel Sandbox: partly. Vercel holds SOC 2 Type 2, but Sandbox's place in the audit scope is not published. - Tensorlake: yes (Type 2) ## Data processing agreement A GDPR data processing agreement is offered. Guide page: https://botperch.com/capabilities/dpa/ - Agent 37: not-published - Blaxel: not-published - Boat: partly. You have to email support to get a data processing agreement. - boxd: yes - Cloudflare Sandbox: yes - Daytona: yes - E2B: yes - InstaBox: not-published - Lizard: yes - Modal: yes - Morph: not-published - Runtime: yes - Sandboxer: partly. You have to write to privacy@ to get a data processing addendum. - Sprites: yes - Vercel Sandbox: yes - Tensorlake: yes ## Open source or self-hostable The sandbox software can be run on your own servers. Guide page: https://botperch.com/capabilities/open-source/ - Agent 37: no. The platform is a hosted service; only template Dockerfiles and images are published. - Blaxel: no. The sandbox platform is hosted only; there is no self-hosted or open-source edition. - Boat: no. Boat runs its own machines in Germany, Finland and France; no self-hosted edition is published. - boxd: yes (Annual licence) - Cloudflare Sandbox: partly. The SDK is open source, but the platform it runs on is Cloudflare's and cannot be self-hosted. - Daytona: partly (BYOC, Enterprise). Only the sandbox compute runs on your own machines, only after Daytona enables it, and the control plane stays Daytona's. - E2B: yes (Embed, one machine) - InstaBox: no. InstaBox is a hosted service; no self-hosted or open-source edition is published. - Lizard: no. Lizard is hosted only; the docs describe its own infrastructure and no self-hosted edition. - Modal: no. The client libraries are open source; the platform is not. - Morph: no. Morph Cloud is hosted; no self-hosted or open-source edition is published. - Runtime: no. Runtime runs everything in its own Virginia region and publishes no self-hosted edition. - Sandboxer: no. Sandboxer runs on dedicated servers it operates; no self-hosted edition is published. - Sprites: no. Sprites is a hosted Fly product; no self-hosted edition is published. - Vercel Sandbox: no. Vercel Sandbox is hosted on Vercel; no self-hosted edition is published. - Tensorlake: partly (BYOC, Enterprise). Self-hosting is offered only on the Enterprise plan and only in your own AWS account; the software is not open source. --- # Monthly cost by use case Every provider priced for each preset workload by the guide's cost engine, from list rates checked 2026-10-29. Illustrations, not quotes: tax, egress and discounts are left out. Providers that cannot run the workload exactly as described are listed after the ones that can, with the reason. ## A personal agent that stays on (Hermes, OpenClaw) (`personal`) One always-on 2 vCPU / 4 GiB / 20 GiB machine that keeps its files. It waits for messages most of the time: about 6% CPU on average, with peaks near 100% when it browses or runs a command. 1. Agent 37: $10.60/month on Cloud API wallet, 4/8: 4 vCPU / 8 GiB / 20 GiB 2. Lizard: $19.00/month on Pro, Small: 2 vCPU / 4 GiB / 5 GiB + 15 GiB volume 3. Boat: $20.00/month on $20 plan, small: 2 vCPU / 4 GiB / 51 GiB 4. InstaBox: $20.00/month on Pro, 2 vCPU / 4 GiB / 20 GiB 5. Runtime: $24.95/month on Prepaid credit, 2 vCPU / 4 GiB / 20 GiB 6. Sandboxer: $40.00/month on $20 plan, default: 4 vCPU / 8 GiB / 50 GiB 7. Morph: $63.00/month on Team, 2 vCPU / 4 GiB / 20 GiB 8. Sprites: $77.61/month on Pay as you go, 2 vCPU / 4 GiB / 20 GiB 9. boxd: $110.90/month on Prepaid credit, 2/8: 2 vCPU / 8 GiB / 20 GiB 10. Blaxel: $123.29/month on Pay as you go, 2 vCPU / 4 GiB / 20 GiB 11. Tensorlake: $250.00/month on Pro, 2 vCPU / 4 GiB / 20 GiB 12. Vercel Sandbox: $73.12/month on Pro, 2 vCPU / 4 GiB / 20 GiB. Catch: Sessions end after 24 hours, so an always-on machine has to be restarted by your own code. 13. Cloudflare Sandbox: $99.41/month on Workers Paid, standard-4: 4 vCPU / 12 GiB / 20 GiB. Catch: A stopped instance loses its disk; files have to be backed up to R2 or a snapshot and restored. 14. Daytona: $122.07/month on Pay as you go, 2 vCPU / 4 GiB / 20 GiB. Catch: 20 GiB of disk is over the 10 GiB limit. 15. Modal: $143.71/month on Starter, 2 vCPU / 4 GiB / 20 GiB. Catch: Sessions end after 24 hours, so an always-on machine has to be restarted by your own code. Modal sandboxes have no stopped state; keeping files needs a Volume or a snapshot. 16. E2B: $270.89/month on Pro, 2 vCPU / 4 GiB / 20 GiB. Catch: Sessions end after 24 hours, so an always-on machine has to be restarted by your own code. ## A coding agent for one developer (`coding`) One 4 vCPU / 8 GiB / 40 GiB machine for Claude Code or Codex, eight hours a day on 20 working days, stopped otherwise with the repository kept. The CPU works about 4% of the time on average. 1. Agent 37: $6.76/month on Cloud API wallet, 4/16: 4 vCPU / 16 GiB / 40 GiB 2. Runtime: $13.49/month on Prepaid credit, 4 vCPU / 8 GiB / 40 GiB 3. Lizard: $19.00/month on Pro, Medium: 4 vCPU / 8 GiB / 20 GiB + 20 GiB volume 4. Boat: $20.00/month on $20 plan, default: 4 vCPU / 8 GiB / 51 GiB 5. InstaBox: $20.00/month on Pro, 4 vCPU / 8 GiB / 40 GiB 6. Sandboxer: $20.00/month on $20 plan, default: 4 vCPU / 8 GiB / 50 GiB 7. Tensorlake: $24.46/month on Usage Credits, 4 vCPU / 8 GiB / 40 GiB 8. Morph: $32.27/month on Developer, 4 vCPU / 8 GiB / 40 GiB 9. Vercel Sandbox: $32.91/month on Pro, 4 vCPU / 8 GiB / 40 GiB 10. Sprites: $34.15/month on Pay as you go, 4 vCPU / 8 GiB / 40 GiB 11. boxd: $50.80/month on Prepaid credit, 4/16: 4 vCPU / 16 GiB / 40 GiB 12. Blaxel: $57.79/month on Pay as you go, 4 vCPU / 8 GiB / 40 GiB 13. Cloudflare Sandbox: $24.20/month on Workers Paid, standard-4: 4 vCPU / 12 GiB / 20 GiB. Catch: No size with 4 vCPU allows 40 GiB of disk; the most is 20 GiB on standard-4. A stopped instance loses its disk; files have to be backed up to R2 or a snapshot and restored. 14. Modal: $46.15/month on Starter, 4 vCPU / 8 GiB / 40 GiB. Catch: Modal sandboxes have no stopped state; keeping files needs a Volume or a snapshot. 15. Daytona: $55.75/month on Pay as you go, 4 vCPU / 8 GiB / 40 GiB. Catch: 40 GiB of disk is over the 10 GiB limit. 16. E2B: $202.99/month on Pro, 4 vCPU / 8 GiB / 40 GiB. Catch: 40 GiB of disk is over the 20 GiB limit. ## A code interpreter inside your product (`interpreter`) 20,000 one-minute runs a month on 2 vCPU / 4 GiB / 10 GiB machines, thrown away after each run; results go to your own storage. The CPU works about 17% of the time. 1. Agent 37: $2.42/month on Cloud API wallet, 2/4: 2 vCPU / 4 GiB / 10 GiB 2. Runtime: $12.83/month on Prepaid credit, 2 vCPU / 4 GiB / 10 GiB 3. Lizard: $19.00/month on Pro, Small: 2 vCPU / 4 GiB / 5 GiB + 5 GiB volume 4. Boat: $20.00/month on $20 plan, small: 2 vCPU / 4 GiB / 51 GiB 5. InstaBox: $20.00/month on Pro, 2 vCPU / 4 GiB / 10 GiB 6. Sandboxer: $20.00/month on $20 plan, small: 2 vCPU / 4 GiB / 12 GiB 7. Tensorlake: $28.60/month on Usage Credits, 2 vCPU / 4 GiB / 10 GiB 8. Morph: $33.33/month on Developer, 2 vCPU / 4 GiB / 10 GiB 9. Sprites: $35.90/month on Pay as you go, 2 vCPU / 4 GiB / 10 GiB 10. Cloudflare Sandbox: $37.78/month on Workers Paid, standard-3: 2 vCPU / 8 GiB / 16 GiB 11. Vercel Sandbox: $42.77/month on Pro, 2 vCPU / 4 GiB / 10 GiB 12. Modal: $49.32/month on Starter, 2 vCPU / 4 GiB / 10 GiB 13. boxd: $50.32/month on Prepaid credit, 2/8: 2 vCPU / 8 GiB / 10 GiB 14. Blaxel: $55.20/month on Pay as you go, 2 vCPU / 4 GiB / 10 GiB 15. E2B: $55.20/month on Hobby, 2 vCPU / 4 GiB / 10 GiB 16. Daytona: $55.38/month on Pay as you go, 2 vCPU / 4 GiB / 10 GiB ## A browser agent for a small team (`browser`) 30,000 ten-minute browser sessions a month on 2 vCPU / 4 GiB / 10 GiB machines, thrown away after each. Chromium needs memory more than CPU: about 3% CPU on average. 1. Agent 37: $36.30/month on Cloud API wallet, 2/4: 2 vCPU / 4 GiB / 10 GiB 2. Lizard: $85.79/month on Pro, Small: 2 vCPU / 4 GiB / 5 GiB + 5 GiB volume 3. Boat: $90.00/month on $20 plan, small: 2 vCPU / 4 GiB / 51 GiB 4. InstaBox: $90.50/month on Pro, 2 vCPU / 4 GiB / 10 GiB 5. Sandboxer: $100.00/month on $20 plan, small: 2 vCPU / 4 GiB / 12 GiB 6. Runtime: $157.50/month on Prepaid credit, 2 vCPU / 4 GiB / 10 GiB 7. Tensorlake: $331.00/month on Usage Credits, 2 vCPU / 4 GiB / 10 GiB 8. Morph: $375.00/month on Scale, 2 vCPU / 4 GiB / 10 GiB 9. Cloudflare Sandbox: $406.03/month on Workers Paid, standard-3: 2 vCPU / 8 GiB / 16 GiB 10. Vercel Sandbox: $462.40/month on Pro, 2 vCPU / 4 GiB / 10 GiB 11. Sprites: $485.03/month on Pay as you go, 2 vCPU / 4 GiB / 10 GiB 12. boxd: $754.80/month on Prepaid credit, 2/8: 2 vCPU / 8 GiB / 10 GiB 13. Blaxel: $828.00/month on Pay as you go, 2 vCPU / 4 GiB / 10 GiB 14. E2B: $828.00/month on Hobby, 2 vCPU / 4 GiB / 10 GiB 15. Daytona: $830.70/month on Pay as you go, 2 vCPU / 4 GiB / 10 GiB 16. Modal: $1,159.80/month on Starter, 2 vCPU / 4 GiB / 10 GiB ## Self-hosted n8n for a small team (`automation`) One always-on 2 vCPU / 4 GiB / 20 GiB machine that keeps its database and encryption key: 730 hours, because webhooks and schedules stop when it sleeps. About 6% CPU on average, with peaks near 100% when a big workflow runs. The model line assumes 50 workflow steps a day that ask a cheap model, 10,000 tokens each. 1. Agent 37: $10.60/month on Cloud API wallet, 4/8: 4 vCPU / 8 GiB / 20 GiB 2. Lizard: $19.00/month on Pro, Small: 2 vCPU / 4 GiB / 5 GiB + 15 GiB volume 3. Boat: $20.00/month on $20 plan, small: 2 vCPU / 4 GiB / 51 GiB 4. InstaBox: $20.00/month on Pro, 2 vCPU / 4 GiB / 20 GiB 5. Runtime: $24.88/month on Prepaid credit, 2 vCPU / 4 GiB / 20 GiB 6. Sandboxer: $40.00/month on $20 plan, default: 4 vCPU / 8 GiB / 50 GiB 7. Morph: $63.00/month on Team, 2 vCPU / 4 GiB / 20 GiB 8. Sprites: $77.50/month on Pay as you go, 2 vCPU / 4 GiB / 20 GiB 9. boxd: $110.90/month on Prepaid credit, 2/8: 2 vCPU / 8 GiB / 20 GiB 10. Blaxel: $123.29/month on Pay as you go, 2 vCPU / 4 GiB / 20 GiB 11. Tensorlake: $250.00/month on Pro, 2 vCPU / 4 GiB / 20 GiB 12. Vercel Sandbox: $72.74/month on Pro, 2 vCPU / 4 GiB / 20 GiB. Catch: Sessions end after 24 hours, so an always-on machine has to be restarted by your own code. 13. Cloudflare Sandbox: $98.99/month on Workers Paid, standard-4: 4 vCPU / 12 GiB / 20 GiB. Catch: A stopped instance loses its disk; files have to be backed up to R2 or a snapshot and restored. 14. Daytona: $122.07/month on Pay as you go, 2 vCPU / 4 GiB / 20 GiB. Catch: 20 GiB of disk is over the 10 GiB limit. 15. Modal: $143.71/month on Starter, 2 vCPU / 4 GiB / 20 GiB. Catch: Sessions end after 24 hours, so an always-on machine has to be restarted by your own code. Modal sandboxes have no stopped state; keeping files needs a Volume or a snapshot. 16. E2B: $270.89/month on Pro, 2 vCPU / 4 GiB / 20 GiB. Catch: Sessions end after 24 hours, so an always-on machine has to be restarted by your own code. ## A Discord or Slack bot for one server (`chatbot`) One always-on 1 vCPU / 2 GiB / 10 GiB machine that keeps its history: 730 hours, because a bot holding a Discord or Slack connection cannot sleep. About 3% CPU on average, since one community sees little traffic. The model line assumes 100 replies a day at 10,000 tokens each (instructions plus recent messages). 1. Agent 37: $5.30/month on Cloud API wallet, 2/4: 2 vCPU / 4 GiB / 10 GiB 2. Runtime: $11.86/month on Prepaid credit, 1 vCPU / 2 GiB / 10 GiB 3. Lizard: $19.00/month on Pro, Small: 2 vCPU / 4 GiB / 5 GiB + 5 GiB volume 4. Boat: $20.00/month on $20 plan, small: 2 vCPU / 4 GiB / 51 GiB 5. InstaBox: $20.00/month on Pro, 1 vCPU / 2 GiB / 10 GiB 6. Sandboxer: $20.00/month on $20 plan, small: 2 vCPU / 4 GiB / 12 GiB 7. Morph: $36.50/month on Developer, 1 vCPU / 2 GiB / 10 GiB 8. Sprites: $38.88/month on Pay as you go, 1 vCPU / 2 GiB / 10 GiB 9. boxd: $55.45/month on Prepaid credit, 1/4: 1 vCPU / 4 GiB / 10 GiB 10. Daytona: $60.84/month on Pay as you go, 1 vCPU / 2 GiB / 10 GiB 11. Blaxel: $61.64/month on Pay as you go, 1 vCPU / 2 GiB / 10 GiB 12. Tensorlake: $250.00/month on Pro, 1 vCPU / 2 GiB / 10 GiB 13. Vercel Sandbox: $33.76/month on Pro, 1 vCPU / 2 GiB / 10 GiB. Catch: Sessions end after 24 hours, so an always-on machine has to be restarted by your own code. 14. Cloudflare Sandbox: $47.48/month on Workers Paid, standard-2: 1 vCPU / 6 GiB / 12 GiB. Catch: A stopped instance loses its disk; files have to be backed up to R2 or a snapshot and restored. 15. Modal: $56.86/month on Starter, 1 vCPU / 2 GiB / 10 GiB. Catch: Sessions end after 24 hours, so an always-on machine has to be restarted by your own code. Modal sandboxes have no stopped state; keeping files needs a Volume or a snapshot. 16. E2B: $60.44/month on Hobby, 1 vCPU / 2 GiB / 10 GiB. Catch: Sessions end after 1 hour, so an always-on machine has to be restarted by your own code. ## Claude Code for a team of five (`team`) Five 4 vCPU / 8 GiB / 40 GiB machines, one per developer, eight hours a day on 20 working days (800 machine-hours), stopped otherwise with each repository and login kept. About 3% CPU on average. The model line is 20 requests a day per developer at 300,000 tokens each, at API prices; developers who sign in with Claude subscriptions pay per seat instead. 1. Boat: $28.80/month on $20 plan, default: 4 vCPU / 8 GiB / 51 GiB 2. Agent 37: $33.78/month on Cloud API wallet, 4/16: 4 vCPU / 16 GiB / 40 GiB 3. Lizard: $39.92/month on Pro, Medium: 4 vCPU / 8 GiB / 20 GiB + 20 GiB volume 4. Sandboxer: $40.00/month on $20 plan, default: 4 vCPU / 8 GiB / 50 GiB 5. InstaBox: $43.26/month on Pro, 4 vCPU / 8 GiB / 40 GiB 6. Runtime: $66.96/month on Prepaid credit, 4 vCPU / 8 GiB / 40 GiB 7. Tensorlake: $120.95/month on Usage Credits, 4 vCPU / 8 GiB / 40 GiB 8. Morph: $151.37/month on Team, 4 vCPU / 8 GiB / 40 GiB 9. Vercel Sandbox: $162.10/month on Pro, 4 vCPU / 8 GiB / 40 GiB 10. Sprites: $169.99/month on Pay as you go, 4 vCPU / 8 GiB / 40 GiB 11. boxd: $254.02/month on Prepaid credit, 4/16: 4 vCPU / 16 GiB / 40 GiB 12. Blaxel: $288.96/month on Pay as you go, 4 vCPU / 8 GiB / 40 GiB 13. Cloudflare Sandbox: $102.54/month on Workers Paid, standard-4: 4 vCPU / 12 GiB / 20 GiB. Catch: No size with 4 vCPU allows 40 GiB of disk; the most is 20 GiB on standard-4. A stopped instance loses its disk; files have to be backed up to R2 or a snapshot and restored. 14. Daytona: $278.76/month on Pay as you go, 4 vCPU / 8 GiB / 40 GiB. Catch: 40 GiB of disk is over the 10 GiB limit. 15. Modal: $350.74/month on Starter, 4 vCPU / 8 GiB / 40 GiB. Catch: Modal sandboxes have no stopped state; keeping files needs a Volume or a snapshot. 16. E2B: $414.96/month on Pro, 4 vCPU / 8 GiB / 40 GiB. Catch: 40 GiB of disk is over the 20 GiB limit. ## A scraper that runs four times a day (`scraper`) Four ten-minute runs a day, 120 a month (20 machine-hours), each on a fresh 1 vCPU / 2 GiB / 10 GiB machine thrown away afterwards; the results go to your own storage. The CPU is about 40% busy while a headless browser renders pages. No model. 1. Modal: $0.00/month on Starter, 1 vCPU / 2 GiB / 10 GiB 2. Agent 37: $0.15/month on Cloud API wallet, 2/4: 2 vCPU / 4 GiB / 10 GiB 3. Runtime: $0.50/month on Prepaid credit, 1 vCPU / 2 GiB / 10 GiB 4. Morph: $1.00/month on Developer, 1 vCPU / 2 GiB / 10 GiB 5. Tensorlake: $1.20/month on Usage Credits, 1 vCPU / 2 GiB / 10 GiB 6. Sprites: $1.33/month on Pay as you go, 1 vCPU / 2 GiB / 10 GiB 7. boxd: $1.52/month on Prepaid credit, 1/4: 1 vCPU / 4 GiB / 10 GiB 8. Blaxel: $1.66/month on Pay as you go, 1 vCPU / 2 GiB / 10 GiB 9. E2B: $1.66/month on Hobby, 1 vCPU / 2 GiB / 10 GiB 10. Daytona: $1.67/month on Pay as you go, 1 vCPU / 2 GiB / 10 GiB 11. Cloudflare Sandbox: $5.99/month on Workers Paid, standard-2: 1 vCPU / 6 GiB / 12 GiB 12. Lizard: $19.00/month on Pro, Small: 2 vCPU / 4 GiB / 5 GiB + 5 GiB volume 13. Boat: $20.00/month on $20 plan, small: 2 vCPU / 4 GiB / 51 GiB 14. InstaBox: $20.00/month on Pro, 1 vCPU / 2 GiB / 10 GiB 15. Sandboxer: $20.00/month on $20 plan, small: 2 vCPU / 4 GiB / 12 GiB 16. Vercel Sandbox: $20.00/month on Pro, 1 vCPU / 2 GiB / 10 GiB ## Your own remote MCP server (`mcp`) One small 1 vCPU / 1 GiB / 10 GiB server that must answer at a public address all month. About 2% CPU, because it only passes tool calls on. Where a provider sleeps an idle machine and wakes it on a request, it is awake about a third of the time (roughly the working day when people call it) and billed as stopped the rest. No model: the AI runs in the client. 1. Agent 37: $5.30/month on Cloud API wallet, 2/4: 2 vCPU / 4 GiB / 10 GiB 2. Runtime: $6.39/month on Prepaid credit, 1 vCPU / 1 GiB / 10 GiB 3. Lizard: $19.00/month on Pro, Small: 2 vCPU / 4 GiB / 5 GiB + 5 GiB volume 4. Boat: $20.00/month on $20 plan, small: 2 vCPU / 4 GiB / 51 GiB 5. InstaBox: $20.00/month on Pro, 1 vCPU / 1 GiB / 10 GiB 6. Sandboxer: $20.00/month on $20 plan, small: 2 vCPU / 4 GiB / 12 GiB 7. Sprites: $22.91/month on Pay as you go, 1 vCPU / 1 GiB / 10 GiB 8. Blaxel: $31.42/month on Pay as you go, 1 vCPU / 1 GiB / 10 GiB 9. Morph: $36.50/month on Developer, 1 vCPU / 1 GiB / 10 GiB 10. boxd: $45.23/month on Prepaid credit, 1/4: 1 vCPU / 4 GiB / 10 GiB 11. Daytona: $49.01/month on Pay as you go, 1 vCPU / 1 GiB / 10 GiB 12. Tensorlake: $250.00/month on Pro, 1 vCPU / 1 GiB / 10 GiB 13. Vercel Sandbox: $20.00/month on Pro, 1 vCPU / 1 GiB / 10 GiB. Catch: Sessions end after 24 hours, so an always-on machine has to be restarted by your own code. 14. Modal: $39.33/month on Starter, 1 vCPU / 1 GiB / 10 GiB. Catch: Sessions end after 24 hours, so an always-on machine has to be restarted by your own code. Modal sandboxes have no stopped state; keeping files needs a Volume or a snapshot. 15. Cloudflare Sandbox: $46.95/month on Workers Paid, standard-2: 1 vCPU / 6 GiB / 12 GiB. Catch: A stopped instance loses its disk; files have to be backed up to R2 or a snapshot and restored. 16. E2B: $48.62/month on Hobby, 1 vCPU / 1 GiB / 10 GiB. Catch: Sessions end after 1 hour, so an always-on machine has to be restarted by your own code. ## A: 1,000 short tasks (`a`) The site's shared workload A: 1,000 ten-minute tasks a month on 2 vCPU / 4 GiB, deleted after each. 1. Agent 37: $1.21/month on Cloud API wallet, 2/4: 2 vCPU / 4 GiB / 10 GiB 2. Runtime: $9.17/month on Prepaid credit, 2 vCPU / 4 GiB / 10 GiB 3. Modal: $9.66/month on Starter, 2 vCPU / 4 GiB / 10 GiB 4. Morph: $16.67/month on Developer, 2 vCPU / 4 GiB / 10 GiB 5. Lizard: $19.00/month on Pro, Small: 2 vCPU / 4 GiB / 5 GiB + 5 GiB volume 6. Boat: $20.00/month on $20 plan, small: 2 vCPU / 4 GiB / 51 GiB 7. InstaBox: $20.00/month on Pro, 2 vCPU / 4 GiB / 10 GiB 8. Sandboxer: $20.00/month on $20 plan, small: 2 vCPU / 4 GiB / 12 GiB 9. Tensorlake: $22.00/month on Usage Credits, 2 vCPU / 4 GiB / 10 GiB 10. Sprites: $22.18/month on Pay as you go, 2 vCPU / 4 GiB / 10 GiB 11. boxd: $25.16/month on Prepaid credit, 2/8: 2 vCPU / 8 GiB / 10 GiB 12. Blaxel: $27.60/month on Pay as you go, 2 vCPU / 4 GiB / 10 GiB 13. E2B: $27.60/month on Hobby, 2 vCPU / 4 GiB / 10 GiB 14. Daytona: $27.69/month on Pay as you go, 2 vCPU / 4 GiB / 10 GiB 15. Cloudflare Sandbox: $28.95/month on Workers Paid, standard-3: 2 vCPU / 8 GiB / 16 GiB 16. Vercel Sandbox: $35.47/month on Pro, 2 vCPU / 4 GiB / 10 GiB ## B: one always-on box (`b`) The site's shared workload B: one 4 vCPU / 8 GiB / 50 GiB machine running all month. 1. Boat: $26.28/month on $20 plan, default: 4 vCPU / 8 GiB / 51 GiB 2. Lizard: $27.85/month on Pro, Medium: 4 vCPU / 8 GiB / 20 GiB + 30 GiB volume 3. InstaBox: $28.84/month on Pro, 4 vCPU / 8 GiB / 50 GiB 4. Agent 37: $30.10/month on Cloud API wallet, 4/32: 4 vCPU / 32 GiB / 50 GiB 5. Sandboxer: $40.00/month on $20 plan, default: 4 vCPU / 8 GiB / 50 GiB 6. Runtime: $54.54/month on Prepaid credit, 4 vCPU / 8 GiB / 50 GiB 7. Morph: $136.00/month on Team, 4 vCPU / 8 GiB / 50 GiB 8. Sprites: $164.91/month on Pay as you go, 4 vCPU / 8 GiB / 50 GiB 9. boxd: $222.50/month on Prepaid credit, 4/16: 4 vCPU / 16 GiB / 50 GiB 10. Blaxel: $247.78/month on Pay as you go, 4 vCPU / 8 GiB / 50 GiB 11. Tensorlake: $250.00/month on Pro, 4 vCPU / 8 GiB / 50 GiB 12. Cloudflare Sandbox: $107.82/month on Workers Paid, standard-4: 4 vCPU / 12 GiB / 20 GiB. Catch: No size with 4 vCPU allows 50 GiB of disk; the most is 20 GiB on standard-4. A stopped instance loses its disk; files have to be backed up to R2 or a snapshot and restored. 13. Vercel Sandbox: $161.18/month on Pro, 4 vCPU / 8 GiB / 50 GiB. Catch: Sessions end after 24 hours, so an always-on machine has to be restarted by your own code. 14. E2B: $241.78/month on Hobby, 4 vCPU / 8 GiB / 50 GiB. Catch: 50 GiB of disk is over the 10 GiB limit. Sessions end after 1 hour, so an always-on machine has to be restarted by your own code. 15. Daytona: $245.32/month on Pay as you go, 4 vCPU / 8 GiB / 50 GiB. Catch: 50 GiB of disk is over the 10 GiB limit. 16. Modal: $317.42/month on Starter, 4 vCPU / 8 GiB / 50 GiB. Catch: Sessions end after 24 hours, so an always-on machine has to be restarted by your own code. Modal sandboxes have no stopped state; keeping files needs a Volume or a snapshot. ## C: three hours a day (`c`) The site's shared workload C: one 2 vCPU / 4 GiB / 20 GiB machine, three hours a day for 30 days, stopped otherwise with its files kept. 1. Agent 37: $2.88/month on Cloud API wallet, 4/8: 4 vCPU / 8 GiB / 20 GiB 2. Runtime: $4.76/month on Prepaid credit, 2 vCPU / 4 GiB / 20 GiB 3. Tensorlake: $8.25/month on Usage Credits, 2 vCPU / 4 GiB / 20 GiB 4. Morph: $9.15/month on Developer, 2 vCPU / 4 GiB / 20 GiB 5. Sprites: $10.19/month on Pay as you go, 2 vCPU / 4 GiB / 20 GiB 6. boxd: $14.90/month on Prepaid credit, 2/8: 2 vCPU / 8 GiB / 20 GiB 7. Blaxel: $17.30/month on Pay as you go, 2 vCPU / 4 GiB / 20 GiB 8. Lizard: $19.00/month on Pro, Small: 2 vCPU / 4 GiB / 5 GiB + 15 GiB volume 9. Boat: $20.00/month on $20 plan, small: 2 vCPU / 4 GiB / 51 GiB 10. InstaBox: $20.00/month on Pro, 2 vCPU / 4 GiB / 20 GiB 11. Sandboxer: $20.00/month on $20 plan, default: 4 vCPU / 8 GiB / 50 GiB 12. Vercel Sandbox: $20.00/month on Pro, 2 vCPU / 4 GiB / 20 GiB 13. E2B: $164.90/month on Pro, 2 vCPU / 4 GiB / 20 GiB 14. Modal: $0.00/month on Starter, 2 vCPU / 4 GiB / 20 GiB. Catch: Modal sandboxes have no stopped state; keeping files needs a Volume or a snapshot. 15. Daytona: $16.09/month on Pay as you go, 2 vCPU / 4 GiB / 20 GiB. Catch: 20 GiB of disk is over the 10 GiB limit. 16. Cloudflare Sandbox: $17.04/month on Workers Paid, standard-4: 4 vCPU / 12 GiB / 20 GiB. Catch: A stopped instance loses its disk; files have to be backed up to R2 or a snapshot and restored. --- # Agent 37 > Hosted Linux computers for agents, sold two ways: a prepaid Cloud API and a one-click personal-agent subscription. Website: https://www.agent37.com Guide page: https://botperch.com/providers/agent37/ Checked: 2026-10-28 **Short answer:** One always-on personal agent (2 vCPU / 4 GiB / 20 GiB) costs about $10.60 a month here, the cheapest of the 11 providers that run it as described. Fits well: An always-on agent that must not sleep: auto-sleep is off by default and there is no lifetime cap. Agent 37 is an early-stage company (Y Combinator, Fall 2026) running two products under one brand. Agent37 Cloud is a prepaid API for persistent sandboxes: a gVisor container by default, or a full VM as an option, whose whole disk survives between runs and which can sleep when idle. Managed hosting is the consumer side: a flat monthly plan for a pre-installed OpenClaw, Hermes, Claude Code, Codex, OpenCode or Grok agent, with a browser dashboard, task board and chat channels. It has no public API of its own. The split matters for this site. A non-technical buyer usually wants the second product, while almost every feature described here belongs to the first. **Who it is for:** Developers building one sandbox per end user, and non-technical buyers who want a personal agent without touching an API. **Isolation:** gVisor container by default: a user-space kernel, stronger than a plain container but weaker than a VM, and Docker does not work inside it. The vm type gives a full VM with its own kernel at 2.5× compute; performance gives dedicated cores at 4×. **Sizes and regions:** Four shapes, with 4 vCPU as the ceiling on the default type: 2/4, 4/8, 4/16 and 4/32 vCPU/GB. Disk is any whole number of GB inside each shape's range, defaulting to 4, 6, 12 or 24 GB. ## How it charges - model: Prepaid wallet, no subscription and no plan fee. - meter: Per minute, priced from the shape you reserved: $0.80 per vCPU-month, $0.70 per GB-month, $0.09 per GB-month of disk. - stopped: Disk only. A sleep checkpoint keeps memory at no extra charge; a stopped instance loses memory and still pays for disk. - planFee: None on the Cloud API. The personal plans ($3.99 to $99.99 a month) are a separate product. - minimum: No minimum charge, but creating an instance requires one day of its running cost in the wallet. Per minute on the shape you reserve, with disk billed every hour until you delete the instance. - Creating an instance needs one day of its running cost in the wallet. - Stopping loses memory; a sleep checkpoint keeps it at no extra charge. - The managed personal-agent plans ($3.99 to $99.99 a month) are a separate product and are not priced here. - Egress is not published. ## Monthly cost for each preset workload - A personal agent that stays on (Hermes, OpenClaw): $10.60 - A coding agent for one developer: $6.76 - A code interpreter inside your product: $2.42 - A browser agent for a small team: $36.30 - Self-hosted n8n for a small team: $10.60 - A Discord or Slack bot for one server: $5.30 - Claude Code for a team of five: $33.78 - A scraper that runs four times a day: $0.15 - Your own remote MCP server: $5.30 - A: 1,000 short tasks: $1.21 - B: one always-on box: $30.10 - C: three hours a day: $2.88 ## Fits well - An always-on agent that must not sleep: auto-sleep is off by default and there is no lifetime cap. - A small budget with no plan floor: per-minute billing, no minimum, and stopped time is disk only. - A machine you want to reach from a browser: desktop templates, a web terminal and tunnelled SSH. ## Fits badly - Docker on the default type, which is a gVisor container; the vm type costs 2.5× the compute rate. - A procurement review that needs SSO, an audit log or a finished compliance report today. - Any workload that needs a static egress IP or a published egress rate. ## Features - **Isolation** (partly): gVisor; VM at 2.5×. A gVisor container by default, with no Docker; the vm type gives a real kernel at 2.5× compute, and performance gives dedicated cores at 4×. [source](https://www.agent37.com/docs/agents-api/instances/create) [docs](https://www.agent37.com/docs/agents-api/vm-instances) - **Sizes and regions** (partly): 4 vCPU; three regions. Four shapes with a 4 vCPU ceiling on the default type, 2–80 GB of disk by shape, and three regions. EU and India require the 2.5× vm type. [source](https://www.agent37.com/docs/agents-api/instance-sizing) [docs](https://www.agent37.com/docs/agents-api/instances/create) - **Lifecycle** (partly): Sleep: RAM + disk. Sleep keeps memory and processes as a checkpoint and bills disk only; stop keeps the disk and loses memory. A wake that has to rebuild boots fresh, and stopping a sleeper discards its checkpoint. [source](https://www.agent37.com/docs/agents-api/instances/sleep) [docs](https://www.agent37.com/docs/agents-api/instance-lifecycle) - **Snapshots and forks** (partly): No snapshots; 7 backups. No snapshot product. Free nightly backups of /home/node with seven restore points, restored in place only; a live fork copies the disk but not memory; templates are Dockerfile-built images. [source](https://www.agent37.com/docs/agents-api/instance-backups) [docs](https://www.agent37.com/docs/agents-api/instances/fork) - **Storage** (partly): Whole disk; $0.09/GB-mo. The whole disk persists and bills at $0.09 per GB-month until you delete the instance. No volumes. Backups cover only /home/node, so a database in /var/lib is not in them. [source](https://www.agent37.com/docs/agents-api/billing) [docs](https://www.agent37.com/docs/agents-api/billing) - **Idle and waking** (yes): No cap; sleep off. No lifetime cap, and auto-sleep is off by default, so a box stays up and bills compute by the minute until you stop or delete it. Any request to any URL wakes a sleeping instance. [source](https://www.agent37.com/docs/agents-api/instance-auto-sleep) [docs](https://www.agent37.com/docs/agents-api/instance-auto-sleep) - **Reaching it** (yes): API key, or public. Every port gets an HTTPS URL; instance and preview URLs require an API key or a time-boxed signed URL. A public port is deliberately unauthenticated and permanent. SSH is tunnelled; no raw TCP. [source](https://www.agent37.com/docs/agents-api/concepts) [docs](https://www.agent37.com/docs/agents-api/urls) - **Custom domains** (yes): Whole domain only. Custom domains are supported, but only by delegating a whole dedicated domain's nameservers; a subdomain of an existing domain cannot be registered. [source](https://www.agent37.com/docs/agents-api/urls) [docs](https://www.agent37.com/docs/agents-api/domains) - **Outbound network** (yes): Not published. Allow-all, deny-all or an IPv4 allowlist of up to 100 entries, changeable live. DNS counts as a connection, and private ranges stay blocked. No static egress IP or published egress price. [source](https://www.agent37.com/docs/agents-api/instance-network) [docs](https://www.agent37.com/docs/agents-api/instance-network) - **Keys and secrets** (partly): Yes, env vars. Instances boot with a per-instance token for four managed services, but there is no general secret manager: your own keys go in environment variables the agent can read. [source](https://www.agent37.com/docs/agents-api/browser-use) [docs](https://www.agent37.com/docs/agents-api/instance-environment) - **Ways to drive it** (yes): Not published. REST on two planes, a Python SDK, the npx agent37 CLI, tunnelled SSH, a web terminal on port 7681 and a desktop in some templates. No control-plane MCP. [source](https://www.agent37.com/docs/agents-api/urls) [docs](https://www.agent37.com/docs/agents-api/overview) - **Built-in agents** (yes): Six templates; hosted. Six agent templates (Hermes, OpenClaw, Claude Code, Codex, Grok, OpenCode) plus Pi and n8n, and a separate managed-hosting product where the agent is the product. Claude Code and Codex use your own account. [source](https://www.agent37.com/personal) [docs](https://www.agent37.com/docs/agents-api/templates) - **Teams and accounts** (partly): Per-instance budget. Workspaces own keys, wallet and instances; teams have admin and user roles; each instance has a budget ceiling. No audit log or SSO is published, and backups are stored in the US. [source](https://www.agent37.com/docs/agents-api/concepts) [docs](https://www.agent37.com/docs/agents-api/members) - **Billing models** (yes): $0.80/vCPU-month. Prepaid wallet, per minute, priced from the reserved shape: $0.80 per vCPU-month, $0.70 per GB-month, $0.09 per GB-month of disk. No plan fee, no minimum, stopped time is disk only. [source](https://www.agent37.com/docs/agents-api/billing) [docs](https://www.agent37.com/docs/agents-api/billing) - **Trials and free tiers** (partly): $5 one-off. A one-off $5 Cloud credit after adding a card, and a managed-hosting free plan with no card. The credit is not granted to workspaces created through the signup API. [source](https://www.agent37.com/docs/agents-api/billing) [docs](https://www.agent37.com/pricing) - **The company** (partly): Agent 37 Inc.; no SLA. Agent 37 Inc., New York law; state of incorporation not published. Founded 2026 by Vishnu Krishnaprasad, YC Fall 2026; funding amount not published. Status components report 100% over 30/60/90 days, provider-reported. No SLA unless agreed in writing. SOC 2 Type I on request, Type II in progress; ISO and HIPAA not published. Deleted Cloud instances keep a recovery copy 7 days; dashboard hosting is kept until you ask; account data goes within 30 days. [source](https://www.agent37.com/terms) ## Capabilities - Its own virtual machine: partly (gVisor; VM costs 2.5x). The standard machine is a gVisor container, which is not a computer of its own; a true virtual machine with its own kernel is a separate type at 2.5 times the price. [source](https://www.agent37.com/cloud) - Root access: yes (root on request) [source](https://www.agent37.com/docs/agents-api/exec) - Docker inside: partly (VM type only). Docker only works on the 2.5x VM type; the default machine cannot run a Docker daemon. [source](https://www.agent37.com/docs/agents-api/vm-instances) - Nested virtualisation: partly (VM type only). Starting a virtual machine inside needs hardware virtualisation, which only the 2.5x VM type has. [source](https://www.agent37.com/docs/agents-api/vm-instances) - Your own image: yes (Dockerfile or registry) [source](https://www.agent37.com/docs/agents-api/custom-image) - Any size you like: no (4 fixed shapes). You choose from four fixed combinations of cores and memory, and anything else comes back as the nearest shape. [source](https://www.agent37.com/docs/agents-api/instance-sizing) - Large machines: partly (4 cores; 16 on the VM type). One page caps every machine at 4 cores, while another prices a 16-core, 32 GB machine on the 2.5x VM type, so the large size is unclear. [source](https://www.agent37.com/docs/agents-api/instance-sizing) - Resize while running: partly (resize, but memory is lost). You can change the size without stopping the machine, but it may move to another host and everything running in memory is lost. [source](https://www.agent37.com/docs/agents-api/instance-lifecycle) - GPUs: no (no GPU). No graphics processor is offered on any machine or plan. [source](https://www.agent37.com/docs/agents-api/instance-sizing) - Choose the region: yes (3 regions) [source](https://www.agent37.com/docs/agents-api/instances/create) - Runs in the EU: partly (France, backups in US). There is a French region, but backups and the account's control records are kept in the United States. [source](https://www.agent37.com/docs/agents-api/instances/create) - Pause keeps memory: partly. A sleep usually comes back where it left off, but a wake that has to rebuild starts fresh and loses what was running. [source](https://www.agent37.com/docs/agents-api/instances/sleep) - Pre-started pools: no [source](https://www.agent37.com/docs/agents-api/instance-lifecycle) - Starts in under a second: not-published [source](https://www.agent37.com/docs/agents-api/instances/sleep) - Snapshots of files: partly (No snapshots; 7 backups). There is no snapshot you can save under a name; the only restore points are seven nightly copies of the home folder. [source](https://www.agent37.com/docs/agents-api/instance-backups) - Snapshots with memory: no [source](https://www.agent37.com/docs/agents-api/instances/fork) - Copy a running machine: yes. The copy has the same files, but nothing that was running keeps running. [source](https://www.agent37.com/docs/agents-api/instances/fork) - Pick an older snapshot: partly (7 nightly backups). You can pick one of seven nightly copies, but you cannot save a snapshot of your own and return to it later. [source](https://www.agent37.com/docs/agents-api/instance-backups) - Reusable templates: yes [source](https://www.agent37.com/docs/agents-api/templates) - Automatic backups: yes (Nightly; 7 slots). Covers only /home/node, and a restore puts the files back in place. [source](https://www.agent37.com/docs/agents-api/instance-backups) - Files survive a stop: yes. The disk bills at $0.09 per GB-month until you delete the instance. [source](https://www.agent37.com/docs/agents-api/instance-lifecycle) - Separate volumes: no [source](https://www.agent37.com/docs/agents-api/instance-lifecycle) - One volume, several machines: no [source](https://www.agent37.com/docs/agents-api/instance-lifecycle) - Mount outside storage: no [source](https://www.agent37.com/docs/agents-api/instances/create) - Large disk: no (80 GB max). The largest shape offers 80 GB of disk, short of 100 GB. [source](https://www.agent37.com/docs/agents-api/billing) - Can stay on indefinitely: yes. Auto-sleep is off unless you turn it on. [source](https://www.agent37.com/docs/agents-api/instance-auto-sleep) - Choose the idle timeout: yes (5 min to 1 day, or off) [source](https://www.agent37.com/docs/agents-api/instance-auto-sleep) - Wakes on a request: yes [source](https://www.agent37.com/docs/agents-api/instance-auto-sleep) - Scheduled runs: yes [source](https://www.agent37.com/docs/agents-api/crons) - Public link to a port: yes (Any port) [source](https://www.agent37.com/docs/agents-api/public-ports) - Private link: yes (Key or signed link) [source](https://www.agent37.com/docs/agents-api/concepts) - Real SSH: yes (Over one connection) [source](https://www.agent37.com/docs/agents-api/ssh) - Terminal in the browser: yes (Port 7681) [source](https://www.agent37.com/docs/agents-api/urls) - Tunnel to your computer: yes (ssh -L) [source](https://www.agent37.com/docs/agents-api/ssh) - Non-web ports: no. Only web traffic gets through; a database or game server cannot be reached directly. [source](https://www.agent37.com/docs/agents-api/urls) - Your own domain: partly (Dedicated domain only). You must hand over the whole domain and the records that direct it, so it cannot also run your website or email, and it needs $100 of top-ups first. [source](https://www.agent37.com/docs/agents-api/domains) - Automatic HTTPS: yes (Platform certificate) [source](https://www.agent37.com/docs/agents-api/domains) - Outbound data included: not-published (No rate published) [source](https://www.agent37.com/pricing) - Allow only some sites: yes (100 IPv4 entries) [source](https://www.agent37.com/docs/agents-api/instance-network) - Turn the internet off: yes (deny-all) [source](https://www.agent37.com/docs/agents-api/instance-network) - Fixed outgoing IP: not-published [source](https://www.agent37.com/docs/agents-api/instance-network) - Stored secrets: yes (Environment variables) [source](https://www.agent37.com/docs/agents-api/browser-use) - Secrets the agent cannot read: no. There is no service that adds keys for you; a key you give the machine is a key the agent can print. [source](https://www.agent37.com/docs/agents-api/browser-use) - Limited API keys: partly (Workspace only). A key is limited to one workspace but can do everything in it, and there is no read-only key. [source](https://www.agent37.com/docs/agents-api/concepts) - Create from the website: yes [source](https://www.agent37.com/terms) - Command-line tool: yes [source](https://www.agent37.com/docs/agents-api/templates.md) - Python SDK: yes [source](https://www.agent37.com/docs/python-sdk.md) - TypeScript SDK: no [source](https://www.agent37.com/docs/quickstart.md) - Documented HTTP API: yes [source](https://www.agent37.com/docs/agents-api/overview.md) - MCP server: no. MCP is a client feature here: instances reach out to Composio and Perflo, but nothing lets an assistant create an instance. [source](https://www.agent37.com/docs/agents-api/managed-services.md) - Interactive terminal over the API: yes [source](https://www.agent37.com/docs/agents-api/ssh.md) - Files over the API: yes [source](https://www.agent37.com/docs/agents-api/files.md) - Coding agents preinstalled: yes (6 templates) [source](https://www.agent37.com/docs/agents-api/templates.md) - Send it a prompt: yes [source](https://www.agent37.com/docs/agents-api/chat.md) - One-click Hermes: yes ($0-99.99/mo) [source](https://www.agent37.com/personal) - One-click OpenClaw: yes ($0-99.99/mo) [source](https://www.agent37.com/personal) - Browser built in: yes [source](https://www.agent37.com/docs/agents-api/desktop.md) - Desktop for computer use: yes [source](https://www.agent37.com/docs/agents-api/vm-instances.md) - Runs other platforms' agents: yes [source](https://www.agent37.com/docs/agents-api/cursor.md) - Team workspace: yes [source](https://www.agent37.com/docs/agents-api/members.md) - Roles and permissions: yes [source](https://www.agent37.com/docs/agents-api/members.md) - Single sign-on: not-published [source](https://www.agent37.com/docs/agents-api/members.md) - Hard spending cap: no. There is no dollar limit you can set; per-instance budgets only cap model spending, and the prepaid wallet is the only ceiling. [source](https://www.agent37.com/docs/agents-api/budgets.md) - Usage alerts: not-published [source](https://www.agent37.com/docs/agents-api/billing.md) - Audit log: not-published [source](https://www.agent37.com/docs/agents-api/overview.md) - Billed per second: no (per minute). Usage is counted by the minute, not the second, so every short task rounds up. [source](https://www.agent37.com/pricing) - CPU billed only while working: no (full rate while awake). A running machine pays its full compute rate whether it is working or waiting. [source](https://www.agent37.com/pricing) - Paused costs only storage: yes (disk only) [source](https://www.agent37.com/docs/agents-api/billing) - No monthly fee: yes (none) [source](https://www.agent37.com/pricing) - Flat monthly price: no (metered parts). The bill is cores plus memory plus disk, so it moves with the shape you choose. [source](https://www.agent37.com/docs/agents-api/billing) - Ongoing free tier: no (one-off $5 credit). There is no monthly free allowance; the only free usage is a one-off $5 credit. [source](https://www.agent37.com/docs/agents-api/billing) - Free starting credit: yes ($5) [source](https://www.agent37.com/docs/agents-api/billing) - Try without a card: no (card for the credit). A card is needed to get the credit that makes the first machine runnable. [source](https://www.agent37.com/docs/agents-api/billing) - Public status page: yes [source](https://www.agent37.com/personal) - Uptime promise (SLA): no. There is no uptime promise unless you negotiate one in writing. [source](https://www.agent37.com/terms) - SOC 2 report: partly (Type I only). Only a SOC 2 Type I report is available, on request; Type II is still in progress. [source](https://www.agent37.com/cloud) - Data processing agreement: not-published [source](https://www.agent37.com/terms) - Open source or self-hostable: no. The platform is a hosted service; only template Dockerfiles and images are published. [source](https://www.agent37.com/terms) ## Usability - Dashboard: Yes, two of them: agent37.com/dashboard/cloud for keys, billing, team and metrics, and a separate dashboard for the personal-agent product. The docs never describe creating a Cloud sandbox by clicking, so the documented path is an API call or the CLI. - Without code: On managed hosting, yes, that is the whole product: one click, a task board, a web terminal, a file browser and a live desktop. On the Cloud API, no: every create path in the docs is POST /v1/instances, npx agent37, or a code snippet. - Signup: Cloud needs a card to unlock the $5 starter credit, or you can sign up through the API with no credit and fund it first. The personal free plan needs no card. - Docs: Mintlify docs, over 60 pages, runnable examples for every endpoint, and llms.txt bundles so an agent can read the whole manual. Support is a founder's email, a dashboard chat bubble and a booking link. There is a public status page. - Trips people up: The vocabulary is developer-native: instance, template, exec, signed URL, default port. - Trips people up: The first step on the Cloud product is a terminal or an HTTP request. - Trips people up: Two dashboards and two products share one brand, and the pricing page covers only the Cloud one. - Trips people up: Sleep versus stop is a billing decision disguised as a lifecycle decision. - Trips people up: Stopped is not free: disk bills until you delete the instance. - Trips people up: Managed model calls fail by default because the per-instance budget starts at zero. ## Company - Legal entity: Agent 37 Inc., under New York law; the state of incorporation is not published. [source](https://www.agent37.com/terms) - Founded: 2026, by Vishnu Krishnaprasad; Y Combinator Fall 2026. [source](https://trust.agent37.com) - Funding: Y Combinator Fall 2026. The amount, round and other investors are not published. [source](https://www.ycombinator.com/companies/agent-37) - Headcount: Not published. The sole named founder is also the sales and escalation contact. - Status and SLA: Status components reported 100% over 30, 60 and 90 days at check. No SLA unless agreed in writing. [source](https://www.agent37.com/terms) - Certification: SOC 2 Type I on request under NDA; Type II in progress. No ISO 27001 or HIPAA claim. [source](https://www.agent37.com/privacy) ## Caveats - **The vCPU ceiling contradicts itself** (contradiction): The sizing page says 4 vCPU is the ceiling on every instance type and that a request for 16 vCPU comes back as 4. The VM page prices 8 vCPU / 16 GB and 16 vCPU / 32 GB. Both pages are current. - **battleships.dev models Agent 37 as having memory snapshots** (contradiction): Its snapshot: mem and $0.03 figure describe the sleep checkpoint and cold storage, not a snapshot product you can name, list or clone. There is no snapshot product. - **Egress has no published price** (open): No per-GB rate, free allowance or overage policy appears on the pricing page or in the billing docs. - **Whether the Cloud dashboard can create a sandbox by clicking** (open): Every documented create path is an API call or CLI command. The absence may be a documentation gap rather than a product gap. - **Regions outside the US require the 2.5× VM type, and backups are stored in the US** (open): EU and India regions keep the instance and its disk local, but backups and the control-plane record are stored in the US. - **The $5 starter credit has moved before** (rechecking): battleships.dev recorded a conflict between a $5 website claim and $1 in the billing docs. The billing docs said $5 on 2026-10-28, so it appears resolved, but the number has changed at least once. ## Sources - [Docs: overview](https://www.agent37.com/docs) - [Docs: lifecycle](https://www.agent37.com/docs/agents-api/instance-lifecycle) - [Docs: billing](https://www.agent37.com/docs/agents-api/billing) - [Docs: URLs and auth](https://www.agent37.com/docs/agents-api/urls) - [Docs: backups](https://www.agent37.com/docs/agents-api/instance-backups) - [Docs: fork](https://www.agent37.com/docs/agents-api/instances/fork) - [Pricing](https://www.agent37.com/pricing) - [Personal agent plans](https://www.agent37.com/personal) --- # Blaxel > MicroVM sandboxes billed by allocated RAM, now part of Baseten. Website: https://blaxel.ai Guide page: https://botperch.com/providers/blaxel/ Checked: 2026-10-28 **Short answer:** One always-on personal agent (2 vCPU / 4 GiB / 20 GiB) costs about $123.29 a month here, the 10th cheapest of the 11 providers that run it as described. Fits well: A sandbox that must resume in milliseconds: standby preserves process state and resume is claimed under 25 ms. Blaxel runs sandboxes as microVMs for agent workloads, alongside agent hosting, MCP servers, batch jobs and a model gateway. Baseten acquired Blaxel on 10 September 2026. The announcement says the product continues and features keep shipping, and Baseten sign-in now connects to a Blaxel workspace. **Who it is for:** Teams building agent platforms that want instant sandboxes, a built-in MCP surface and optional agent hosting. **Isolation:** MicroVM boundary per sandbox, root by default with an optional unprivileged user. The default kernel refuses module loading and kernel tracing to every process, including root; iptables requires enabling at creation. **Sizes and regions:** Memory drives CPU: 8 GB gets 4 cores and 16 GB gets 6. Custom deployments advertise up to 256 GB of RAM. Regions: Oregon, North Virginia, London and Frankfurt. ## How it charges - model: Pay-as-you-go against a wallet, with quota tiers set by top-up. - meter: $0.0000115 per GB of allocated RAM per second while active; CPU is included in that rate. Snapshot storage $0.20 per GB-month and volumes $0.12 per GB-month. - stopped: Standby stops memory charges but keeps billing snapshot and volume storage. - planFee: No subscription: tiers are wallet top-ups ($0, $20, $50) that raise quotas. - minimum: No published minimum billed duration. Up to $200 in promotional credits is advertised; the actual grant is not published. Per second on allocated memory while active, CPU included; standby bills storage only. - Standby keeps a snapshot, billed at $0.20 per GB-month; its size is not published, so it is not added. - Up to $200 of promotional credit is advertised; the actual grant is not published. ## Monthly cost for each preset workload - A personal agent that stays on (Hermes, OpenClaw): $123.29 - A coding agent for one developer: $57.79 - A code interpreter inside your product: $55.20 - A browser agent for a small team: $828.00 - Self-hosted n8n for a small team: $123.29 - A Discord or Slack bot for one server: $61.64 - Claude Code for a team of five: $288.96 - A scraper that runs four times a day: $1.66 - Your own remote MCP server: $31.42 - A: 1,000 short tasks: $27.60 - B: one always-on box: $247.78 - C: three hours a day: $17.30 ## Fits well - A sandbox that must resume in milliseconds: standby preserves process state and resume is claimed under 25 ms. - Secrets that should never sit in the machine: the proxy injects headers, body fields and secrets server-side. - A team that wants SDKs in three languages, a console and a per-sandbox MCP server. ## Fits badly - A buyer who needs the contracting entity settled now: the terms still name Blaxel, not Baseten. - A workload that needs kernel modules or iptables without opting in at creation. - Production dependence on snapshots, which are in private preview. ## Features - **Isolation** (partly): microVM; no modules. A microVM boundary, root by default, but the default kernel refuses module loading and kernel tracing, and iptables needs enabling at creation. [source](https://docs.blaxel.ai/Sandboxes/Non-root-user.md) [docs](https://docs.blaxel.ai/Sandboxes/Non-root-user.md) - **Sizes and regions** (partly): 16 GB → 6 cores; 256 GB custom. Memory drives CPU: 8 GB gets 4 cores and 16 GB gets 6. Custom deployments go to 256 GB. Four regions, no published GPU. [source](https://docs.blaxel.ai/Sandboxes/Overview.md) [docs](https://docs.blaxel.ai/Infrastructure/Regions.md) - **Lifecycle** (yes): Standby: RAM, no sockets. Standby preserves process and filesystem state and stops memory charges, but external network connections do not survive. Archive exports filesystem changes only and restarts processes with new IDs. [source](https://docs.blaxel.ai/Sandboxes/Overview.md) [docs](https://docs.blaxel.ai/Sandboxes/Overview.md) - **Snapshots and forks** (partly): RAM + disk; preview. A snapshot captures filesystem, running processes and memory, and outlives the sandbox, but it is in private preview and not recommended for production. Fork runs from the snapshot. [source](https://docs.blaxel.ai/Sandboxes/Fork.md) [docs](https://docs.blaxel.ai/Sandboxes/Fork.md) - **Storage** (yes): 1 volume; survives delete. A volume survives sandbox deletion, but only one volume attaches to a sandbox and a volume attaches to one sandbox at a time. Agent Drive is the shared filesystem, priced separately. [source](https://docs.blaxel.ai/Sandboxes/Volumes.md) [docs](https://docs.blaxel.ai/Sandboxes/Volumes.md) - **Idle and waking** (partly): 15 min idle (docs); 5 s (pricing). Standby after 15 minutes of idle WebSocket or TCP activity according to the docs, or about 5 seconds according to the pricing page. Resume from standby is claimed under 25 ms. [source](https://docs.blaxel.ai/Sandboxes/Overview.md) [docs](https://docs.blaxel.ai/Sandboxes/Standby-control.md) - **Reaching it** (partly): Optional auth. Specific ports can be exposed, and preview URLs back a running sandbox with optional auth and custom domains. Default ingress authentication is not published. [source](https://docs.blaxel.ai/llms.txt) [docs](https://docs.blaxel.ai/Sandboxes/Preview-url.md) - **Custom domains** (yes): Native, optional auth. Preview URLs back a running sandbox with optional auth and custom domains. [source](https://docs.blaxel.ai/llms.txt) [docs](https://docs.blaxel.ai/Infrastructure/Custom-domains.md) - **Outbound network** (partly): Included in plan. A proxy can filter domains, but tools that ignore proxy environment variables are not filtered unless domain filter enforcement is enabled. Egress is included in the plan. [source](https://docs.blaxel.ai/Sandboxes/Proxy-domains.md) [docs](https://docs.blaxel.ai/Sandboxes/Proxy-domains.md) - **Keys and secrets** (yes): No, proxy (preview). The proxy intercepts outbound HTTPS and injects headers, body fields and secrets server-side, but the feature is in public preview and tools that ignore proxy variables can bypass filtering. [source](https://docs.blaxel.ai/Sandboxes/Proxy-secrets-injection.md) [docs](https://docs.blaxel.ai/Sandboxes/Proxy-secrets-injection.md) - **Ways to drive it** (yes): Yes, console. Python, TypeScript and Go SDKs, an HTTP API, a per-sandbox MCP server, a console terminal and a CLI. [source](https://blaxel.ai/pricing) [docs](https://docs.blaxel.ai/cli-reference/introduction.md) - **Built-in agents** (partly): MCP server; runtime soon. Every sandbox exposes an MCP server that agents use to operate it, and agent hosting is a separate product line, but Agent Runtime is labelled coming soon. [source](https://docs.blaxel.ai/llms.txt) [docs](https://docs.blaxel.ai/Agents/Overview.md) - **Teams and accounts** (partly): No hard cap. Workspace roles are admin, member and viewer; service accounts have scoped tokens; SAML and directory sync require a feature flag. No hard spend cap or full audit coverage is published. [source](https://docs.blaxel.ai/Security/Workspace-access-control.md) [docs](https://docs.blaxel.ai/Security/Workspace-access-control.md) - **Billing models** (partly): $0.0000115/GB-second. Active compute is billed on allocated RAM per second at $0.0000115 per GB-second, with CPU included. Snapshots and volumes bill separately; tiers are wallet top-ups, not subscriptions. [source](https://blaxel.ai/pricing) [docs](https://blaxel.ai/pricing) - **Trials and free tiers** (partly): Up to $200 credits. Up to $200 in promotional credits advertised on pay-as-you-go. The actual grant, expiry and card requirement are not published. Quota tiers are wallet top-ups, not fees. [source](https://blaxel.ai/pricing) [docs](https://blaxel.ai/pricing) - **The company** (partly): Blaxel, Inc.; acquired. Blaxel, Inc. (formerly Beamlit), Delaware, acquired by Baseten on 10 September 2026; the linked terms still name Blaxel and predate the deal. Six founders including CEO Paul Sinaï and CTO Christophe Ploujoux; founded 2024; $7.3M seed. Status reports Sandboxes 99.33% and Platform 99.30% for Jul–Oct 2026, provider-reported. No standard numeric SLA; Custom lists custom SLAs. Claims SOC 2, HIPAA and ISO 27001; HIPAA add-on $250/month. On termination it may delete data at its discretion, with a 90-day maximum retention. [source](https://www.baseten.co/blog/blaxel-is-joining-baseten-to-build-the-future-of-agentic-cloud/) ## Capabilities - Its own virtual machine: yes (microVM) [source](https://docs.blaxel.ai/Sandboxes/Non-root-user.md) - Root access: yes (root by default) [source](https://docs.blaxel.ai/Sandboxes/Non-root-user.md) - Docker inside: yes (docker-in-sandbox image) [source](https://docs.blaxel.ai/Tutorials/Docker.md) - Nested virtualisation: not-published [source](https://docs.blaxel.ai/Sandboxes/Overview.md) - Your own image: yes (Dockerfile images) [source](https://docs.blaxel.ai/Sandboxes/Templates.md) - Any size you like: partly (memory only, cores follow). You set the memory and the number of cores is decided for you, so you cannot pick a memory-heavy or core-heavy machine. [source](https://docs.blaxel.ai/Sandboxes/Overview.md) - Large machines: partly (up to 256 GB by arrangement). The standard sizes stop at 16 GB of memory; anything larger is a custom deployment you have to arrange. [source](https://blaxel.ai/pricing) - Resize while running: partly (memory change resets it). You can change the memory, but the sandbox resets, so anything running is lost. [source](https://docs.blaxel.ai/api-reference/compute/update-sandbox.md) - GPUs: not-published [source](https://blaxel.ai/pricing) - Choose the region: partly (4 regions, not all open). Four regions are listed, but not all of them are available to self-service accounts without asking. [source](https://docs.blaxel.ai/Infrastructure/Regions.md) - Runs in the EU: yes (London and Frankfurt) [source](https://docs.blaxel.ai/Infrastructure/Regions.md) - Pause keeps memory: yes (Standby: 25 ms). Network connections do not survive; only files and processes do. [source](https://docs.blaxel.ai/Sandboxes/Overview.md) - Pre-started pools: no [source](https://docs.blaxel.ai/Sandboxes/Overview.md) - Starts in under a second: yes (Under 25 ms) [source](https://docs.blaxel.ai/Sandboxes/Overview.md) - Snapshots of files: partly. Snapshots work but are in private preview, so the provider does not recommend them for production. [source](https://docs.blaxel.ai/Sandboxes/Fork.md) - Snapshots with memory: partly. A snapshot keeps memory and running programs, but the whole feature is in private preview. [source](https://docs.blaxel.ai/Sandboxes/Fork.md) - Copy a running machine: partly. You can copy a running machine, but the feature is in private preview. [source](https://docs.blaxel.ai/Sandboxes/Fork.md) - Pick an older snapshot: yes [source](https://docs.blaxel.ai/Sandboxes/Fork.md) - Reusable templates: yes [source](https://docs.blaxel.ai/Sandboxes/Overview.md) - Automatic backups: no [source](https://docs.blaxel.ai/Sandboxes/Expiration.md) - Files survive a stop: yes [source](https://docs.blaxel.ai/Sandboxes/Overview.md) - Separate volumes: yes. Only one volume attaches to a sandbox, and it attaches to one sandbox at a time. [source](https://docs.blaxel.ai/Sandboxes/Volumes.md) - One volume, several machines: partly. Shared storage is a separate product called Agent Drive; a volume itself serves one machine at a time. [source](https://docs.blaxel.ai/Sandboxes/Volumes.md) - Mount outside storage: no [source](https://docs.blaxel.ai/Volumes/Overview.md) - Large disk: not-published [source](https://docs.blaxel.ai/Volumes/Overview.md) - Can stay on indefinitely: partly (7 or 30 days on low tiers). On the two lowest tiers a sandbox is deleted after 7 or 30 days; only higher tiers allow it to wait indefinitely. [source](https://docs.blaxel.ai/Sandboxes/Expiration.md) - Choose the idle timeout: no [source](https://docs.blaxel.ai/Sandboxes/Standby-control.md) - Wakes on a request: yes [source](https://docs.blaxel.ai/Sandboxes/Overview.md) - Scheduled runs: yes (100 per sandbox) [source](https://docs.blaxel.ai/Sandboxes/Schedules.md) - Public link to a port: yes (Public or private) [source](https://docs.blaxel.ai/Sandboxes/Preview-url.md) - Private link: yes (Token per preview) [source](https://docs.blaxel.ai/Sandboxes/Preview-url.md) - Real SSH: no. There is no SSH address or SSH server; the only shell is the provider's own terminal. [source](https://docs.blaxel.ai/Sandboxes/Overview.md) - Terminal in the browser: yes (Console tab) [source](https://docs.blaxel.ai/Sandboxes/Overview.md) - Tunnel to your computer: not-published [source](https://docs.blaxel.ai/Sandboxes/Overview.md) - Non-web ports: not-published [source](https://docs.blaxel.ai/Sandboxes/Preview-url.md) - Your own domain: yes (Wildcard subdomains) [source](https://docs.blaxel.ai/Infrastructure/Custom-domains.md) - Automatic HTTPS: yes (Issued per domain) [source](https://docs.blaxel.ai/Infrastructure/Custom-domains.md) - Outbound data included: yes (Included in plan) [source](https://blaxel.ai/pricing) - Allow only some sites: partly (Proxy filter). The filter only sees programs that use its settings; anything else gets out unless stricter enforcement is switched on. [source](https://docs.blaxel.ai/Sandboxes/Proxy-domains.md) - Turn the internet off: not-published [source](https://docs.blaxel.ai/Sandboxes/Proxy-domains.md) - Fixed outgoing IP: partly (Private preview). Dedicated addresses are in a private preview you must ask to join, and can only be attached when a machine is created. [source](https://docs.blaxel.ai/Infrastructure/Dedicated-egress-gateways.md) - Stored secrets: yes (Variables and secrets) [source](https://docs.blaxel.ai/Sandboxes/Variables-and-secrets.md) - Secrets the agent cannot read: partly (Public preview). The feature is a public preview, and programs that ignore its settings can bypass it. [source](https://docs.blaxel.ai/Sandboxes/Proxy-secrets-injection.md) - Limited API keys: partly (Workspace only). A service-account key is limited to one workspace but has no narrower permissions. [source](https://docs.blaxel.ai/Security/Access-tokens.md) - Create from the website: yes [source](https://docs.blaxel.ai/Sandboxes/Overview.md) - Command-line tool: yes [source](https://docs.blaxel.ai/cli-reference/introduction.md) - Python SDK: yes [source](https://blaxel.ai/pricing) - TypeScript SDK: yes [source](https://blaxel.ai/pricing) - Documented HTTP API: yes [source](https://blaxel.ai/pricing) - MCP server: yes [source](https://docs.blaxel.ai/llms.txt) - Interactive terminal over the API: yes [source](https://docs.blaxel.ai/Sandboxes/Overview.md) - Files over the API: yes [source](https://docs.blaxel.ai/Sandboxes/Filesystem.md) - Coding agents preinstalled: no. The default image is a bare sandbox; agents are code you deploy or an MCP server you connect. [source](https://docs.blaxel.ai/Sandboxes/Overview.md) - Send it a prompt: no. There is no prompt endpoint; Agent Runtime, the product that would run the loop, is marked Soon. [source](https://blaxel.ai/company/security) - One-click Hermes: no. No Hermes template or guide is published; you would install it yourself. [source](https://docs.blaxel.ai/llms.txt) - One-click OpenClaw: no. A tutorial walks through OpenClaw in a sandbox, but it is terminal work, not one click. [source](https://docs.blaxel.ai/Tutorials/OpenClaw.md) - Browser built in: no. No browser is installed or offered; you would add Chrome to your own image. [source](https://docs.blaxel.ai/Sandboxes/Overview.md) - Desktop for computer use: no. No graphical desktop is documented; the browser surfaces are a terminal and preview URLs. [source](https://docs.blaxel.ai/Sandboxes/Overview.md) - Runs other platforms' agents: yes [source](https://docs.blaxel.ai/Tutorials/Claude-Managed-Agents.md) - Team workspace: yes [source](https://docs.blaxel.ai/Security/Workspace-access-control.md) - Roles and permissions: yes [source](https://docs.blaxel.ai/Security/Workspace-access-control.md) - Single sign-on: partly. Single sign-on works only after Blaxel switches on a setting for your account. [source](https://docs.blaxel.ai/Security/SSO-Directory-sync.md) - Hard spending cap: not-published [source](https://docs.blaxel.ai/Security/Quotas.md) - Usage alerts: yes (90% of quota) [source](https://docs.blaxel.ai/Security/Quotas.md) - Audit log: not-published [source](https://blaxel.ai/company/security) - Billed per second: yes (per second) [source](https://blaxel.ai/pricing) - CPU billed only while working: no (memory-based meter). The meter runs on the memory you allocated for as long as the sandbox is active, busy or not. [source](https://docs.blaxel.ai/Sandboxes/Overview.md) - Paused costs only storage: yes (storage only) [source](https://docs.blaxel.ai/Sandboxes/Overview.md) - No monthly fee: yes (none) [source](https://blaxel.ai/pricing) - Flat monthly price: no (per GB-second). The price follows the memory you allocate and the seconds it runs. [source](https://blaxel.ai/pricing) - Ongoing free tier: no (one-off credits). Free usage is a one-off promotional credit, not something that returns each month. [source](https://blaxel.ai/pricing) - Free starting credit: yes (up to $200) [source](https://blaxel.ai/company/security) - Try without a card: yes (no card) [source](https://blaxel.ai/company/security) - Public status page: yes [source](https://blaxel.ai/company/security) - Uptime promise (SLA): partly. A standard plan carries no numeric uptime promise; only the Custom plan lists custom SLAs. [source](https://blaxel.ai/pricing) - SOC 2 report: yes (SOC 2, HIPAA, ISO) [source](https://blaxel.ai/company/security) - Data processing agreement: not-published [source](https://blaxel.ai/terms) - Open source or self-hostable: no. The sandbox platform is hosted only; there is no self-hosted or open-source edition. [source](https://docs.blaxel.ai/Sandboxes/Overview.md) ## Usability - Dashboard: A console creates a sandbox by choosing an image, resources, TTL and region, with a browser terminal. - Without code: The console can create and inspect a sandbox, but useful work still needs commands or a developer. - Signup: Baseten or Blaxel sign-in. Card requirement and credit expiry are not published. - Docs: Documentation covers sandboxes, snapshots, volumes, MCP and SSO. A status page is linked from the site. Support is Discord community plus paid tiers. - Trips people up: Standby keeps memory but drops external connections. - Trips people up: Free and low tiers enforce expiration dates on sandboxes. - Trips people up: Snapshots are in private preview. - Trips people up: A volume attaches to one sandbox at a time; Agent Drive is the shared option. ## Company - Legal entity: Blaxel, Inc. (formerly Beamlit, Inc.), a Delaware corporation. [source](https://blaxel.ai/legal/terms/2025-12-10-blaxel-terms-and-conditions.pdf) - Ownership: Acquired by Baseten on 10 September 2026. The linked terms predate the deal and still name Blaxel. [source](https://www.baseten.co/blog/blaxel-is-joining-baseten-to-build-the-future-of-agentic-cloud/) - Founded and funded: 2024, by six founders including CEO Paul Sinaï. A $7.3M seed led by First Round. [source](https://blaxel.ai/company/about) - Headcount: 12, per Y Combinator's directory. The figure is undated and not a post-acquisition count. [source](https://www.ycombinator.com/companies/blaxel) - Status and SLA: Sandboxes 99.33% over July–October 2026. Custom SLAs only; no standard uptime commitment published. [source](https://status.blaxel.ai/) - Certification: SOC 2, HIPAA and ISO 27001 claimed; the full SOC 2 report is on request through its compliance portal. [source](https://blaxel.ai/company/security) ## Caveats - **Idle timing is stated two ways** (contradiction): The docs say a sandbox goes to standby after 15 minutes of idle WebSocket/TCP activity; the pricing FAQ says it scales to zero after about 5 seconds. - **Snapshots and archive are private previews** (open): The snapshot docs say the feature is in private preview and not recommended for production; archive is also preview. - **Ownership changed in September 2026** (open): Baseten acquired Blaxel on 10 September 2026. The product continues, but a permanent standalone guarantee is not published. - **Low tiers delete sandboxes on a timer** (open): Tier 0 and Tier 1 enforce expiration dates of up to 7 and 30 days; activity is counted at resume or suspend, not in between. - **Volume and shared-filesystem semantics differ** (open): A volume attaches to one sandbox at a time; Agent Drive is the multi-mount shared filesystem, and the two are separate products. ## Sources - [Sandbox overview](https://docs.blaxel.ai/Sandboxes/Overview.md) - [Snapshots and fork](https://docs.blaxel.ai/Sandboxes/Fork.md) - [Volumes](https://docs.blaxel.ai/Sandboxes/Volumes.md) - [Proxy secrets](https://docs.blaxel.ai/Sandboxes/Proxy-secrets-injection.md) - [Pricing](https://blaxel.ai/pricing) - [Baseten acquisition](https://www.baseten.co/blog/blaxel-is-joining-baseten-to-build-the-future-of-agentic-cloud/) --- # Boat > Ubuntu VMs in the EU, billed per second, with seven coding agents preinstalled and no pause at all. Website: https://boat.dev Guide page: https://botperch.com/providers/boat/ Checked: 2026-10-28 **Short answer:** One always-on personal agent (2 vCPU / 4 GiB / 20 GiB) costs about $20.00 a month here, the 3rd cheapest of the 11 providers that run it as described. Fits well: An ordinary Ubuntu server per agent: own kernel, Docker, SSH, root and a desktop for $26.28 a month always on. Boat sells whole Ubuntu virtual machines, one per sandbox, priced per second, aimed at running coding agents and agent-generated code. Each has its own kernel, a dedicated IPv6 (sometimes IPv4), Docker, SSH, SCP and a 60 fps virtual desktop. It is built around three audiences: people running agents on their own work, platforms giving each end user a machine, and teams that want a cheap always-available dev box. Seven coding-agent harnesses are preinstalled on every machine and can be prompted by name through one API call. Boat also runs an AI credentials proxy so sandboxes hold placeholder model keys. **Who it is for:** People who want a normal Ubuntu server per agent, cheap always-on capacity in the EU, and preinstalled coding agents without building an image. **Isolation:** Full Ubuntu 24.04 KVM virtual machine with its own kernel, root, Docker and SSH. Shared vCPUs on a dedicated host. No GPU and no ARM: x86-64 only. **Sizes and regions:** Four fixed sizes, all with 51 GB of disk except the largest: small 2 vCPU / 4 GB, default 4 / 8, large 8 / 16 (111 GB), xlarge 16 / 32 (251 GB). No custom size, no extra disk, no volumes. ## How it charges - model: Monthly plan that is prepaid machine time plus limits, with a separate dollar wallet for overage. - meter: Per second while the machine exists, at a flat hourly rate per size: $0.018, $0.036, $0.072 or $0.200. - stopped: Zero machine time, and the disk is kept free for 14 days. After that the data is gone unless you saved a snapshot. - planFee: The plan is not a fee: $20 buys $20 of VM time, but unused plan time expires monthly. Overages, extra saved snapshots and paid starts draw from the wallet. - minimum: $20 a month, and there is no free tier. The 7-day trial needs a card and is capped at 25 hours of compute. A flat hourly price per size, per second while the machine exists; the $20 plan is prepaid machine time. - A stopped machine's disk is kept free for 14 days; after that it is gone unless saved as a snapshot. - Many starts in one day can hit the start limit; paid starts draw from the wallet. - No free tier; the 7-day trial needs a card. - Boat says it does not bill egress. ## Monthly cost for each preset workload - A personal agent that stays on (Hermes, OpenClaw): $20.00 - A coding agent for one developer: $20.00 - A code interpreter inside your product: $20.00 - A browser agent for a small team: $90.00 - Self-hosted n8n for a small team: $20.00 - A Discord or Slack bot for one server: $20.00 - Claude Code for a team of five: $28.80 - A scraper that runs four times a day: $20.00 - Your own remote MCP server: $20.00 - A: 1,000 short tasks: $20.00 - B: one always-on box: $26.28 - C: three hours a day: $20.00 ## Fits well - An ordinary Ubuntu server per agent: own kernel, Docker, SSH, root and a desktop for $26.28 a month always on. - A coding agent out of the box: seven harnesses preinstalled and promptable through one API call. - EU hosting with no egress bill and free automatic disk snapshots. ## Fits badly - A workload that needs to resume mid-process: there is no pause, and every resume is a reboot with a new IP. - Point-in-time recovery: snapshots are newest-only and disk-only. - Anything that needs a custom domain, a region choice, a GPU or an ARM machine. ## Features - **Isolation** (yes): Full VM; Docker, root. A full Ubuntu VM with its own kernel, Docker, SSH and root. The closest thing here to an ordinary server. [source](https://docs.boat.dev/quickstart) [docs](https://docs.boat.dev/security) - **Sizes and regions** (partly): 16 vCPU / 32 GB; EU only. Four fixed sizes from 2 vCPU / 4 GB / 51 GB to 16 vCPU / 32 GB / 251 GB. No custom size, no extra disk, EU-only, no region choice. [source](https://docs.boat.dev/pricing) [docs](https://docs.boat.dev/machines) - **Lifecycle** (no): No pause; disk only. There is no pause. Stop saves the disk, removes the machine and loses memory and hand-started processes; resume boots a new machine from the disk with a new IP. [source](https://docs.boat.dev/snapshots/stop) [docs](https://docs.boat.dev/concepts) - **Snapshots and forks** (partly): Disk only; newest only. Snapshots are automatic, disk-only and taken every minute, but only the newest is usable: there is no point-in-time restore. Saved snapshots are named and never expire. [source](https://docs.boat.dev/snapshots/resume-and-fork) [docs](https://docs.boat.dev/snapshots/resume-and-fork) - **Storage** (partly): 14 days after stop. The whole disk persists, with 51 GB on the smaller sizes and no volume product. A stopped sandbox's disk is kept free for 14 days, then deleted. [source](https://docs.boat.dev/faq) [docs](https://docs.boat.dev/data-retention) - **Idle and waking** (partly): 1 h from create. No idle detection, but a hard auto-stop counts from create or resume: one hour by default, 30 days maximum, and off is allowed. A stop destroys the machine, so a URL cannot wake it. [source](https://docs.boat.dev/long-running-tasks/auto-stop) [docs](https://docs.boat.dev/long-running-tasks/auto-stop) - **Reaching it** (partly): Token by default. An HTTPS route per port, token-gated by default and --public to remove it; SSH on port 22; raw TCP by opening the sandbox firewall, but only IPv6 is guaranteed. [source](https://docs.boat.dev/hosting) [docs](https://docs.boat.dev/hosting) - **Custom domains** (no): Not supported. Custom domains are explicitly unsupported. A CNAME to an on.boat.dev name does not work, and certificates are issued only for on.boat.dev names. [source](https://docs.boat.dev/hosting) [docs](https://docs.boat.dev/hosting#custom-domain) - **Outbound network** (partly): $0, no cap stated. Outbound is open by default with no API for network rules; ufw inside the sandbox is the control, and firewall rules do not survive a snapshot. Egress is not billed. [source](https://docs.boat.dev/pricing) [docs](https://docs.boat.dev/hosting/firewall) - **Keys and secrets** (yes): No, proxy + switch. Environment variables and secret files, a safe-for-third-parties switch that withholds everything of yours, and an AI credentials proxy so sandboxes hold placeholder model keys. [source](https://docs.boat.dev/ai-credentials) [docs](https://docs.boat.dev/environments/secrets) - **Ways to drive it** (yes): No; installer. REST, Python and TypeScript SDKs, a CLI, SSH and SCP, a 60 fps desktop and a dashboard. The MCP server is for documentation, not for managing sandboxes. [source](https://docs.boat.dev/quickstart) [docs](https://docs.boat.dev/sdks/overview) - **Built-in agents** (yes): Seven harnesses; prompt API. Seven coding-agent harnesses preinstalled on every machine, promptable through one API call with steering, interrupts and parallel conversations. [source](https://docs.boat.dev/integrated-agents) [docs](https://docs.boat.dev/integrated-agents) - **Teams and accounts** (partly): No dollar cap. Organisations with owner, admin and member roles, scoped keys and per-member caps. No audit log or SSO is published, and start budgets are pooled across the organisation. [source](https://docs.boat.dev/organizations/seats-and-limits) [docs](https://docs.boat.dev/organizations) - **Billing models** (partly): $0.036/h default. A monthly plan that is prepaid machine time plus limits, with a separate dollar wallet for overage. Per second while running; stopped is zero machine time and the disk is kept 14 days. [source](https://docs.boat.dev/pricing) [docs](https://docs.boat.dev/billing) - **Trials and free tiers** (partly): 25 h trial. A seven-day trial with a card and no free tier: 25 hours in total, two sandboxes at once, small and default sizes, a mandatory two-hour auto-stop and no new saved snapshots. [source](https://docs.boat.dev/free-trial) [docs](https://docs.boat.dev/free-trial) - **The company** (partly): Dedale AI, Corp.; no SLA. Dedale AI, Corp., Delaware, Dover address. Founded 2026 by Anicet Nougaret (CEO) and Kirill Makarov (CTO), YC Fall 2026; no priced round published. Seven customer-facing status components range 98.83%–100% over 90 days, pooled 99.74%; Sandbox Fork is lowest and Stop + Resume covers about a third of the window. No SLA; the terms disclaim uptime. SOC 2 in progress; no ISO, HIPAA or SSO. No price-change notice; closing the account cancels immediately and forfeits prepaid value. [source](https://boat.dev/terms) ## Capabilities - Its own virtual machine: yes (full VM, own kernel) [source](https://docs.boat.dev/machines) - Root access: yes (passwordless sudo) [source](https://docs.boat.dev/machines) - Docker inside: yes (Docker, Compose, BuildKit) [source](https://docs.boat.dev/machines) - Nested virtualisation: yes (/dev/kvm, no flag) [source](https://docs.boat.dev/machines/virtualization) - Your own image: no (one image for everyone). There is no way to bring your own image or build recipe; you install what you need and save a copy of the machine instead. [source](https://docs.boat.dev/faq) - Any size you like: no (4 fixed sizes). There are four fixed sizes and no way to ask for anything between them. [source](https://docs.boat.dev/pricing) - Large machines: yes (16 cores / 32 GB). Only on the $100-a-month plan or above. [source](https://docs.boat.dev/pricing) - Resize while running: no (stop first). Changing the size means stopping the machine and starting it again. [source](https://docs.boat.dev/machines) - GPUs: no (no GPU). No size has a graphics processor, at any price. [source](https://docs.boat.dev/machines) - Choose the region: no (no region choice). Machines run in Germany, Finland or France, and you cannot say which. [source](https://docs.boat.dev/compliance) - Runs in the EU: yes (Germany, Finland, France) [source](https://docs.boat.dev/compliance) - Pause keeps memory: no [source](https://docs.boat.dev/snapshots/stop) - Pre-started pools: no [source](https://docs.boat.dev/readiness) - Starts in under a second: no (A few seconds). A resume or a new machine takes a few seconds, not under one. [source](https://docs.boat.dev/readiness) - Snapshots of files: yes (Every minute) [source](https://docs.boat.dev/snapshots/resume-and-fork) - Snapshots with memory: no [source](https://docs.boat.dev/snapshots/resume-and-fork) - Copy a running machine: yes. The copy has the same files, but nothing that was running keeps running. [source](https://docs.boat.dev/snapshots/resume-and-fork) - Pick an older snapshot: partly. You cannot roll a machine back to an older point; an older saved copy can only start a new machine. [source](https://docs.boat.dev/snapshots/resume-and-fork) - Reusable templates: yes [source](https://docs.boat.dev/snapshots/templates) - Automatic backups: partly (Every minute). These are automatic snapshots kept with the machine, not an off-site backup, and only the newest one is kept, so there is no history to go back through. [source](https://docs.boat.dev/snapshots/templates) - Files survive a stop: yes (14 days). The disk is deleted 14 days after a stop unless you saved it. [source](https://docs.boat.dev/snapshots/resume-and-fork) - Separate volumes: no [source](https://docs.boat.dev/snapshots/templates) - One volume, several machines: no [source](https://docs.boat.dev/snapshots/templates) - Mount outside storage: no [source](https://docs.boat.dev/machines) - Large disk: yes (251 GB) [source](https://docs.boat.dev/machines) - Can stay on indefinitely: yes [source](https://docs.boat.dev/snapshots/resume-and-fork) - Choose the idle timeout: partly (1 h from start). The clock counts from when the machine started, not from when it was last used, so a busy machine is stopped too. [source](https://docs.boat.dev/long-running-tasks/auto-stop) - Wakes on a request: no [source](https://docs.boat.dev/snapshots/stop) - Scheduled runs: no [source](https://docs.boat.dev/snapshots/resume-and-fork) - Public link to a port: yes (Up to 50 ports) [source](https://docs.boat.dev/hosting) - Private link: yes (Token in link) [source](https://docs.boat.dev/hosting) - Real SSH: yes (Port 22) [source](https://docs.boat.dev/ssh-access) - Terminal in the browser: not-published [source](https://docs.boat.dev/ssh-access) - Tunnel to your computer: yes (ssh -L) [source](https://docs.boat.dev/ssh-access) - Non-web ports: yes (IPv6 only sometimes) [source](https://docs.boat.dev/hosting) - Your own domain: no. Custom domains are explicitly unsupported; a redirect from your domain to the provider's name does not work either. [source](https://docs.boat.dev/hosting) - Automatic HTTPS: no. There is no custom domain, so there is no certificate for the provider to manage. [source](https://docs.boat.dev/hosting) - Outbound data included: yes ($0) [source](https://docs.boat.dev/pricing) - Allow only some sites: partly (Firewall inside). The rules live inside the machine, where the agent has administrator rights and can undo them, and they are lost when the machine is restored. [source](https://docs.boat.dev/hosting/firewall) - Turn the internet off: partly (Firewall inside). You can block traffic with the machine's own firewall, but the agent has administrator rights there and the rules are lost on restore. [source](https://docs.boat.dev/hosting/firewall) - Fixed outgoing IP: not-published [source](https://docs.boat.dev/pricing) - Stored secrets: yes (Variables and files) [source](https://docs.boat.dev/environments/secrets) - Secrets the agent cannot read: partly (Model keys only). Only model-provider keys go through the key service; other API keys are ordinary variables the agent can read. [source](https://docs.boat.dev/ai-credentials) - Limited API keys: yes (Action sets) [source](https://docs.boat.dev/api-keys/scopes) - Create from the website: no [source](https://docs.boat.dev/account.md) - Command-line tool: yes [source](https://docs.boat.dev/quickstart.md) - Python SDK: yes [source](https://docs.boat.dev/sdks/overview.md) - TypeScript SDK: yes [source](https://docs.boat.dev/sdks/overview.md) - Documented HTTP API: yes [source](https://docs.boat.dev/api/v1.md) - MCP server: no. The only MCP server searches the documentation; it cannot start or drive a sandbox. [source](https://docs.boat.dev/ai-tools.md) - Interactive terminal over the API: yes [source](https://docs.boat.dev/ssh-access.md) - Files over the API: yes [source](https://docs.boat.dev/account.md) - Coding agents preinstalled: yes (7 harnesses) [source](https://docs.boat.dev/integrated-agents.md) - Send it a prompt: yes [source](https://docs.boat.dev/api/reference/agent/prompt-sandbox-agent.md) - One-click Hermes: partly. Hermes is already installed on every machine, but you still need a terminal command to start it and prompt it. [source](https://docs.boat.dev/machines/tools.md) - One-click OpenClaw: partly. OpenClaw is installed on every machine, but its gateway does not start by itself and you need a terminal. [source](https://docs.boat.dev/machines/tools.md) - Browser built in: yes (Chrome 151) [source](https://docs.boat.dev/machines/tools.md) - Desktop for computer use: yes (1080p 60 fps) [source](https://docs.boat.dev/desktop-streaming.md) - Runs other platforms' agents: no. No page documents another platform's cloud agents using Boat as their machine. [source](https://docs.boat.dev/integrations/harbor.md) - Team workspace: yes [source](https://docs.boat.dev/organizations.md) - Roles and permissions: yes [source](https://docs.boat.dev/organizations.md) - Single sign-on: not-published [source](https://docs.boat.dev/organizations.md) - Hard spending cap: partly. A personal account has no dollar cap; organisations can cap a member's machine time, which stops their new sandboxes. [source](https://docs.boat.dev/billing.md) - Usage alerts: not-published [source](https://docs.boat.dev/billing.md) - Audit log: not-published [source](https://docs.boat.dev/account.md) - Billed per second: yes (per second) [source](https://docs.boat.dev/pricing) - CPU billed only while working: no (flat rate per size). A running machine costs the same whether it is working or waiting. [source](https://docs.boat.dev/pricing) - Paused costs only storage: yes (nothing for 14 days) [source](https://docs.boat.dev/faq) - No monthly fee: no ($20 minimum plan). The smallest plan is $20 a month, and unused time expires, so a light month still costs $20. [source](https://docs.boat.dev/pricing) - Flat monthly price: yes ($26 a month for default) [source](https://docs.boat.dev/pricing) - Ongoing free tier: no (trial only). There is no free tier; the only free usage is a seven-day trial that needs a card. [source](https://docs.boat.dev/faq) - Free starting credit: no (none). There is no credit; the free offer is 25 hours of machine time inside a trial. [source](https://docs.boat.dev/free-trial) - Try without a card: no (card at checkout). Checkout asks for a card before the trial starts. [source](https://docs.boat.dev/free-trial) - Public status page: yes [source](https://docs.boat.dev/compliance.md) - Uptime promise (SLA): no. The terms disclaim uninterrupted service and no SLA is published. [source](https://boat.dev/terms) - SOC 2 report: no. SOC 2 is in progress, so there is no report to request yet. [source](https://docs.boat.dev/security.md) - Data processing agreement: partly. You have to email support to get a data processing agreement. [source](https://boat.dev/terms) - Open source or self-hostable: no. Boat runs its own machines in Germany, Finland and France; no self-hosted edition is published. [source](https://docs.boat.dev/compliance.md) ## Usability - Dashboard: Yes: sandboxes with type, monthly cost and a desktop button, snapshots you can browse and download, environment settings, AI sign-ins, organisation, billing and account. - Without code: Partly. You can watch and drive a machine, connect an AI subscription and edit what new sandboxes get, all by clicking. Creating and prompting a sandbox is boat new then boat prompt; there is no wizard and no gallery. - Signup: A card, and a terminal for the installer. There is no free tier; the first plan starts with a 7-day trial through Stripe Checkout. Agents can sign themselves up through auth.md, but a human still claims the account and enters the card. - Docs: About 100 Mintlify pages, each also as Markdown, plus llms.txt and a docs MCP server. Support is email and Discord, with a public status page. - Trips people up: The first step is a shell command. - Trips people up: The default 1-hour auto-stop kills work mid-session. - Trips people up: Persistent means 14 days, not forever. - Trips people up: Stop is not off: it saves the disk, destroys the machine, and changes the IP. - Trips people up: The plan is not a cheap idle subscription: $20 buys time that expires. - Trips people up: Money lives in two places, plan credit and wallet, with different expiry rules. ## Company - Legal entity: Dedale AI, Corp., a Delaware corporation with a Dover mailing address. Card statements show DEDALE AI. [source](https://boat.dev/terms) - Founders: Anicet Nougaret (CEO) and Kirill Makarov (CTO); Y Combinator Fall 2026. [source](https://www.everydev.ai/developers/ascii-dev) - Funding: A reported $500k pre-seed from Entrepreneur First and Founders, Inc. No priced round is published. [source](https://nordic9.com/news/ascii-raised-500k-in-pre-seed-funding-from-entrepreneurs-first-ef-and-founders-inc/) - History: Launched as box in July 2026 and renamed boat on 15 September 2026; box surfaces still answer. [source](https://docs.boat.dev/migrating-from-box) - Status and SLA: No SLA on any plan, and the terms disclaim uptime and availability. [source](https://boat.dev/terms) - Certification: SOC 2 in progress. No published report, ISO 27001 or HIPAA claim. [source](https://docs.boat.dev/security) ## Caveats - **There is no pause** (open): Stop saves the disk, removes the machine, and loses memory and hand-started processes. Every resume is a reboot with a new IP, although Docker containers and enabled systemd units come back. - **Snapshots are disk-only and newest-only** (open): Boat snapshots the disk every minute while a sandbox runs, but only the newest snapshot can be resumed or forked. There is no point-in-time restore. - **The disk expires 14 days after a stop** (contradiction): Docs and FAQ say 14 days; the Terms say up to about 30 days. A box untouched for two weeks returns 409 snapshot_data_expired. - **Its docs and marketing disagree on stop and on the number of sizes** (contradiction): The homepage still says three sizes and pause billing; the docs list four sizes and state there is no pause. - **battleships.dev's Boat record has drifted** (open): battleships.dev is built by the Boat team, but its Boat entry is dated 2026-09-30 and disagrees with today's docs on disk sizes, egress caps, snapshot retention and whether xlarge needs an operator. ## Sources - [Docs: quickstart](https://docs.boat.dev/quickstart) - [Docs: concepts and states](https://docs.boat.dev/concepts) - [Docs: stop and snapshots](https://docs.boat.dev/snapshots/stop) - [Docs: auto-stop](https://docs.boat.dev/long-running-tasks/auto-stop) - [Docs: hosting](https://docs.boat.dev/hosting) - [Docs: AI credentials](https://docs.boat.dev/ai-credentials) - [Pricing](https://docs.boat.dev/pricing) --- # boxd > KVM machines in the EU that boot in milliseconds, snapshot with memory, fork live, and hibernate when idle. Website: https://boxd.sh Guide page: https://botperch.com/providers/boxd/ Checked: 2026-10-28 **Short answer:** One always-on personal agent (2 vCPU / 4 GiB / 20 GiB) costs about $110.90 a month here, the 9th cheapest of the 11 providers that run it as described. Fits well: A build-and-test workload that needs a fork of memory and disk in 100–200 ms. boxd sells persistent Linux virtual machines: each one a KVM guest with its own kernel, root, systemd and a fixed 100 GB copy-on-write disk. They boot in milliseconds, can be copied while running, and park themselves when idle. The pattern it is built for is: compose one machine by hand (install tools, sign into agents, leave a service running), save it as a snapshot, then stamp out identical machines from it. It is one product sold three ways: pay-as-you-go credits, a Custom contract with SSO and audit logs, and a self-hosted version you run on your own hardware. **Who it is for:** Developers and teams who want a normal Linux server that happens to be a VM, with fast copies: dev workspaces, preview environments, coding agents, one machine per customer. **Isolation:** KVM microVM with its own kernel, network stack and disk, on boxd's open-source Ignition orchestrator. Docker, systemd, kernel modules and breaking the OS are all allowed and stay inside that one machine. Firecracker use is not documented. **Sizes and regions:** Four sizes named by either dimension: 1 vCPU / 4 GiB, 2 / 8 (the default), 4 / 16, 8 / 32. Disk is fixed at 100 GB and is not a size choice. ## How it charges - model: Prepaid credits, no plan and no per-seat fee. - meter: Per second, settled every 15 minutes, on three meters: vCPU on the machine's size while running, RAM on resident memory while running or in standby, disk on bytes written in every state. - stopped: Disk only. Hibernated and stopped machines pay for written disk; a machine in standby keeps paying for RAM. - planFee: None. Custom and self-hosted are contracts with unpublished prices. - minimum: No minimum charge per machine. There is no free plan: $30 of credit requires a card, and an account without one is capped at two machines. Per second on three meters: vCPU on the machine's size while running, memory on what is actually resident, disk on bytes written in every state. - Memory is billed on resident memory; the calculator uses the memory you entered as the resident figure, up to the size's full allocation. - $30 of credit needs a card; without one an account is capped at two machines. - Egress and snapshot storage prices are not published, so neither is included. ## Monthly cost for each preset workload - A personal agent that stays on (Hermes, OpenClaw): $110.90 - A coding agent for one developer: $50.80 - A code interpreter inside your product: $50.32 - A browser agent for a small team: $754.80 - Self-hosted n8n for a small team: $110.90 - A Discord or Slack bot for one server: $55.45 - Claude Code for a team of five: $254.02 - A scraper that runs four times a day: $1.52 - Your own remote MCP server: $45.23 - A: 1,000 short tasks: $25.16 - B: one always-on box: $222.50 - C: three hours a day: $14.90 ## Fits well - A build-and-test workload that needs a fork of memory and disk in 100–200 ms. - A team that wants a KVM machine with its own kernel, Docker, systemd and kernel modules. - EU hosting on German bare metal, with an allowlist enforced outside the machine. ## Fits badly - Procurement that needs an SLA, a status page or a certification before signing. - A workload whose cost depends on RAM: memory bills on resident use, also in standby. - Anything needing a REST API, a US region today, or a published egress price. ## Features - **Isolation** (yes): KVM microVM; root. A KVM microVM with its own kernel, network stack and disk. Docker, systemd, kernel modules and breaking the OS all stay inside the machine. [source](https://docs.boxd.sh/use-cases/sandboxes) [docs](https://docs.boxd.sh/use-cases/sandboxes) - **Sizes and regions** (partly): 8 vCPU / 32 GiB; one EU region. Four sizes from 1 vCPU / 4 GiB to 8 / 32, all with a fixed 100 GB disk. One EU region, no GPU, no ARM. [source](https://docs.boxd.sh/guides/resources) [docs](https://docs.boxd.sh/guides/resources) - **Lifecycle** (yes): RAM frozen; 85 ms wake. Four distinct states: standby keeps RAM frozen and bills it, hibernate writes memory to disk with an ~85 ms wake, stop keeps the disk only, destroy removes everything. [source](https://docs.boxd.sh/guides/suspend-resume) [docs](https://docs.boxd.sh/guides/suspend-resume) - **Snapshots and forks** (yes): RAM + disk; under 200 ms. A snapshot keeps memory and disk, is named and versioned, and boots machines already running; a checkpoint is an in-place undo point; backups are disk-only and off-cluster; a fork copies memory and disk in 100–200 ms. [source](https://docs.boxd.sh/guides/fork) [docs](https://docs.boxd.sh/guides/snapshots) - **Storage** (yes): 100 GB; billed on write. Every machine has a fixed 100 GB disk, and disk bills on bytes written in every state. Separate disks now have a guide: they outlive the machine they are attached to, and attach to one machine at a time. [source](https://docs.boxd.sh/guides/resources) [docs](https://docs.boxd.sh/guides/disks) - **Idle and waking** (yes): 4 h without traffic. Runtime is unlimited and auto-suspend is off by default. Auto-hibernate is on by default after four hours without TCP/UDP traffic in either direction, so outbound polling keeps a box awake but a local compile does not. [source](https://docs.boxd.sh/guides/suspend-resume) [docs](https://docs.boxd.sh/guides/suspend-resume) - **Reaching it** (yes): No auth. Every machine is on name.boxd.sh with no authentication in front of it; subdomain proxies add ports, up to three raw TCP forwards, and SSH on a dedicated port. Bot protection only gates wake-ups. [source](https://docs.boxd.sh/guides/bot-protection) [docs](https://docs.boxd.sh/guides/https) - **Custom domains** (yes): Native, automatic TLS. Point one domain at a machine or delegate a wildcard subdomain to the organisation; boxd verifies DNS and issues TLS certificates automatically. [source](https://docs.boxd.sh/guides/custom-domains) [docs](https://docs.boxd.sh/guides/custom-domains) - **Outbound network** (yes): Not published. A per-machine allowlist enforced outside the machine, so root inside cannot loosen it. Forks inherit it; a machine from a snapshot starts unrestricted. [source](https://docs.boxd.sh/guides/egress) [docs](https://docs.boxd.sh/guides/egress) - **Keys and secrets** (yes): No, host-bound. Sealed secrets injected at boot, and secrets bound to a host where the machine holds an opaque bxds_ string and the proxy swaps in the real key for that host only. [source](https://docs.boxd.sh/guides/egress) [docs](https://docs.boxd.sh/guides/env-secrets) - **Ways to drive it** (partly): No; CLI. gRPC is the only wire API; there is no REST. TypeScript and Python SDKs, a CLI, real SSH on a dedicated port, a console terminal and a browser desktop. [source](https://docs.boxd.sh/reference/grpc-api) [docs](https://docs.boxd.sh/cli/commands) - **Built-in agents** (yes): Three preinstalled; no API. Claude Code, Codex and OpenCode are preinstalled, and an in-VM boxd CLI is pre-authenticated so an agent can create sibling machines. Claude logins are account-level and injected at boot. [source](https://docs.boxd.sh/use-cases/coding-agents) [docs](https://docs.boxd.sh/use-cases/coding-agents) - **Teams and accounts** (partly): Not published. Every account is an organisation with owner, admin and member roles, and keys are fenced to one org. No self-serve audit log, SSO or spend cap is published; machines are EU-only. [source](https://boxd.sh/pricing) [docs](https://docs.boxd.sh/guides/organizations) - **Billing models** (partly): Three meters. Prepaid credits and three meters: vCPU on the size while running, RAM on resident memory (also in standby), disk on bytes written in every state. No plan fee; storage prices are unpublished. [source](https://boxd.sh/pricing) [docs](https://boxd.sh/pricing) - **Trials and free tiers** (partly): $30 one-off. A one-off €30/$30 credit after adding a payment method. No free plan; an organisation without a payment method is capped at two machines, with no published allowance. [source](https://boxd.sh/pricing) [docs](https://boxd.sh/pricing) - **The company** (partly): Azin Tech Op. Co. B.V.; no SLA. Azin Tech Operating Company B.V., KvK 99718340, Amsterdam; a near-identically named holding company sits above it, which is inferred rather than stated. Founders and headcount not published; €2M pre-seed September 2026. No status page and no uptime figure. No SLA. No SOC 2, ISO 27001, HIPAA or trust centre claimed. Residency contradicts itself: the FAQ says no US cloud dependency, while the privacy notice names US clusters and Latitude.sh LLC as infrastructure. Price changes apply immediately for new usage; data may be deleted after 30 days. [source](https://boxd.sh/terms/) ## Capabilities - Its own virtual machine: yes (KVM microVM) [source](https://docs.boxd.sh/use-cases/sandboxes) - Root access: yes (passwordless sudo) [source](https://docs.boxd.sh/quickstart) - Docker inside: yes (Docker preinstalled) [source](https://docs.boxd.sh/guides/run-docker) - Nested virtualisation: not-published [source](https://docs.boxd.sh/use-cases/sandboxes) - Your own image: partly (snapshot only). You cannot bring a Docker image; the way to get your own setup is to customise a machine and start new ones from a snapshot of it. [source](https://docs.boxd.sh/use-cases/sandboxes) - Any size you like: no (4 fixed sizes). There are four fixed sizes; naming either cores or memory picks the pair. [source](https://docs.boxd.sh/guides/resources) - Large machines: yes (8 cores / 32 GiB) [source](https://docs.boxd.sh/guides/resources) - Resize while running: no (reboot to apply). A size change reboots the machine, so running programs are lost. [source](https://docs.boxd.sh/guides/resources) - GPUs: no (no GPU). There is no graphics processor option. [source](https://docs.boxd.sh/guides/resources) - Choose the region: no (one EU region). There is one region, in Germany, and no way to choose another. [source](https://boxd.sh/) - Runs in the EU: yes (Germany) [source](https://boxd.sh/faq/) - Pause keeps memory: yes (85 ms wake). A hibernated machine wakes in about 85 ms; standby is faster still. [source](https://docs.boxd.sh/guides/suspend-resume) - Pre-started pools: no [source](https://docs.boxd.sh/guides/suspend-resume) - Starts in under a second: yes (Sub-millisecond) [source](https://docs.boxd.sh/guides/suspend-resume) - Snapshots of files: yes [source](https://docs.boxd.sh/guides/snapshots) - Snapshots with memory: yes (Under 200 ms) [source](https://docs.boxd.sh/guides/snapshots) - Copy a running machine: yes (100–200 ms) [source](https://docs.boxd.sh/guides/fork) - Pick an older snapshot: no [source](https://docs.boxd.sh/guides/snapshots) - Reusable templates: yes [source](https://docs.boxd.sh/guides/snapshots) - Automatic backups: yes. Off by default; you turn a schedule on for each machine. [source](https://docs.boxd.sh/cli/commands) - Files survive a stop: yes [source](https://docs.boxd.sh/guides/suspend-resume) - Separate volumes: yes. A disk attaches to one machine at a time and lives on one host. [source](https://docs.boxd.sh/guides/disks) - One volume, several machines: no [source](https://docs.boxd.sh/guides/disks) - Mount outside storage: no [source](https://docs.boxd.sh/guides/disks) - Large disk: yes (100 GB) [source](https://docs.boxd.sh/guides/disks) - Can stay on indefinitely: yes (4 h default, or never) [source](https://docs.boxd.sh/guides/suspend-resume) - Choose the idle timeout: yes (Any seconds, or off) [source](https://docs.boxd.sh/guides/suspend-resume) - Wakes on a request: yes [source](https://docs.boxd.sh/guides/suspend-resume) - Scheduled runs: partly. A schedule runs inside the machine, so it only fires while that machine is awake. [source](https://docs.boxd.sh/guides/automations/jobs) - Public link to a port: yes (No sign-in at all) [source](https://docs.boxd.sh/guides/https) - Private link: no. Every machine address is open to the internet, and the provider offers no token or login to put in front of it. [source](https://docs.boxd.sh/guides/https) - Real SSH: yes (Real SSH) [source](https://docs.boxd.sh/quickstart) - Terminal in the browser: yes (Console terminal) [source](https://docs.boxd.sh/guides/client-utilities) - Tunnel to your computer: yes (ssh -L) [source](https://docs.boxd.sh/quickstart) - Non-web ports: yes (3 forwards) [source](https://docs.boxd.sh/guides/port-forwarding.md) - Your own domain: yes (Per machine or org) [source](https://docs.boxd.sh/guides/custom-domains.md) - Automatic HTTPS: yes (Automatic) [source](https://docs.boxd.sh/guides/custom-domains.md) - Outbound data included: not-published [source](https://docs.boxd.sh/guides/resources.md) - Allow only some sites: yes (256 entries) [source](https://docs.boxd.sh/guides/egress.md) - Turn the internet off: yes (Allowlist none) [source](https://docs.boxd.sh/guides/egress.md) - Fixed outgoing IP: not-published [source](https://docs.boxd.sh/guides/egress.md) - Stored secrets: yes (Org-wide) [source](https://docs.boxd.sh/guides/env-secrets.md) - Secrets the agent cannot read: yes (Stand-in string) [source](https://docs.boxd.sh/guides/egress.md) - Limited API keys: partly (No scopes). Keys are per person and can be revoked, but there is no way to make one read-only or limit it to one machine. [source](https://docs.boxd.sh/guides/resources.md) - Create from the website: no [source](https://docs.boxd.sh/quickstart.md) - Command-line tool: yes [source](https://docs.boxd.sh/cli/installation.md) - Python SDK: yes [source](https://docs.boxd.sh/reference/python-sdk.md) - TypeScript SDK: yes [source](https://docs.boxd.sh/reference/typescript-sdk.md) - Documented HTTP API: no. The only wire API is gRPC, so a browser or a plain HTTP client cannot call it. [source](https://docs.boxd.sh/reference/grpc-api.md) - MCP server: no. boxd installs other products' MCP servers into its agents; it publishes no server that creates machines. [source](https://docs.boxd.sh/cli/commands.md) - Interactive terminal over the API: yes [source](https://docs.boxd.sh/cli/commands.md) - Files over the API: yes [source](https://docs.boxd.sh/guides/file-operations.md) - Coding agents preinstalled: yes (3 agents) [source](https://docs.boxd.sh/use-cases/coding-agents.md) - Send it a prompt: no. boxd runs the machine, not the agent loop; Anthropic or OpenAI runs the loop in the documented integrations. [source](https://docs.boxd.sh/use-cases/claude-managed-agents.md) - One-click Hermes: no. No Hermes template, harness or guide is documented. [source](https://docs.boxd.sh/use-cases/coding-agents.md) - One-click OpenClaw: no. No OpenClaw template, harness or guide is documented. [source](https://docs.boxd.sh/use-cases/coding-agents.md) - Browser built in: yes [source](https://docs.boxd.sh/guides/client-utilities.md) - Desktop for computer use: yes [source](https://docs.boxd.sh/guides/desktop.md) - Runs other platforms' agents: yes [source](https://docs.boxd.sh/use-cases/openai-agents-api.md) - Team workspace: yes [source](https://boxd.sh/pricing) - Roles and permissions: yes [source](https://docs.boxd.sh/cli/commands.md) - Single sign-on: partly. SAML is sold on Enterprise and you have to ask for it. [source](https://boxd.sh/faq/) - Hard spending cap: not-published [source](https://boxd.sh/pricing) - Usage alerts: not-published [source](https://boxd.sh/pricing) - Audit log: partly. Audit logs are sold with SSO on the Custom/Enterprise line; on self-serve plans the only record is the SSH command history. [source](https://boxd.sh/pricing) - Billed per second: yes (per second) [source](https://boxd.sh/pricing) - CPU billed only while working: no (full cores while running). The processor is charged at the machine's full size for as long as it runs. [source](https://boxd.sh/pricing) - Paused costs only storage: partly (pause keeps paying for memory). Pausing keeps the memory in place and you keep paying for it; only hibernating or stopping brings the bill down to disk alone. [source](https://boxd.sh/pricing) - No monthly fee: yes (none) [source](https://boxd.sh/pricing) - Flat monthly price: no (three meters). Cores, memory and disk are metered separately, so there is no single monthly price. [source](https://boxd.sh/pricing) - Ongoing free tier: no (one-off credit). Free usage is a one-off credit that needs a card, not a monthly allowance. [source](https://boxd.sh/pricing) - Free starting credit: yes (€30) [source](https://boxd.sh/pricing) - Try without a card: yes (2 machines without one) [source](https://docs.boxd.sh/guides/resources) - Public status page: not-published [source](https://boxd.sh/faq/) - Uptime promise (SLA): not-published [source](https://boxd.sh/terms/) - SOC 2 report: no. boxd says it is working on SOC 2 and ISO 27001 and offers security details by email instead. [source](https://boxd.sh/faq/) - Data processing agreement: yes [source](https://boxd.sh/terms/) - Open source or self-hostable: yes (Annual licence) [source](https://boxd.sh/faq/) ## Usability - Dashboard: Yes, at boxd.sh/app, with Machines, Backups, Domains, Integrations, Organizations and Billing pages plus a desktop viewer. It is secondary: every guide's first instruction is a CLI command, and the sign-in page leads with Download the CLI. - Without code: Partly, and less than the marketing suggests. A non-coder can watch and drive a machine someone else set up (desktop, browser, files), and can copy a prompt for an AI agent to do the setup. There is no template gallery and no one-click agent. - Signup: GitHub or Google, then a card for the $30 credit and for more than two machines. There is no waitlist in the EU; the US region has one. Every account starts with a 25-minute onboarding call. - Docs: Mintlify docs with a full CLI reference, gRPC proto, SDK references and machine-readable bundles. Support is a founder by email. There is no status page. - Trips people up: The first step is a terminal command: install the CLI, log in, create a machine. - Trips people up: Machine sounds like a physical server you rent; it is a VM that sleeps and keeps charging for disk. - Trips people up: The pricing vocabulary is engineer-facing: resident memory, GiB-hour, written disk. - Trips people up: The headline hourly price assumes 2 GiB of an 8 GiB machine is in use. - Trips people up: Whatever you serve is on the open internet at name.boxd.sh, with no auth in front. - Trips people up: Sleep is invisible: a cron job or long build stops when the machine hibernates, and the clock freezes. ## Company - Legal entity: Azin Tech Operating Company B.V., KvK 99718340, registered in Amsterdam. Boxd is a trading name. [source](https://boxd.sh/terms/) - Founded: Registered 5 February 2026; the first public blog post is 14 August 2026. No founding date is published. [source](https://drimble.nl/bedrijf/amsterdam/000057849749/melchior-holding-bv.html) - Funding: €2M pre-seed led by BlueYard Capital, announced 16 September 2026. No later round is published. [source](https://boxd.sh/blog/we-raised-2m-to-kill-localhost/) - Headcount: Not published. The blog counts three authors, which is a floor rather than a headcount. - Status and SLA: No status page, no published uptime figure and no SLA. Support is a founder-led 25-minute onboarding call. - Certification: No SOC 2, ISO 27001, HIPAA or PCI claim on the site, the terms or the privacy notice. - Data residency: Marketed as EU-only with no US cloud dependency, but the privacy notice describes EU and US clusters on a Delaware infrastructure vendor. [source](https://boxd.sh/privacy/) ## Caveats - **The bill follows resident RAM, not the shape** (open): A 4 vCPU machine is 16 GiB, but boxd bills the memory it actually holds: $222.50 a month at 8 GiB resident and $304.26 at 16 GiB. boxd's own calculator assumes 2 GiB on an 8 GiB machine, which is a best case rather than a typical one. - **Public URLs are open, and bot protection gates only wake-ups** (open): There is no authentication in front of name.boxd.sh. Bot protection is on by default, but it only asks a browser check when a request would wake a sleeping machine, and it applies to the main address, never to subdomain proxies or custom domains. A webhook, API client or uptime monitor that hits a sleeping machine gets a 503 check page and the machine does not wake. - **The machine quota is stated as both 50 and 100** (contradiction): Docs and FAQ say 50 machines per organisation; the pricing page says 100 included, raiseable on request. - **Inbound public IPv4 is contradictory** (contradiction): The docs say every machine's domain points at the proxy's shared public IP, and SSH runs on a dedicated port on that shared proxy IP. The FAQ says machines come with a public IPv4. No price for an inbound IPv4 is published. Both statements are current, so the answer is unresolved. - **EU-only, except for the US cluster in its own privacy notice** (contradiction): The FAQ says managed boxd runs on EU hardware with no US cloud dependency. The privacy notice names a Delaware infrastructure vendor and two clusters, and says choosing the US cluster transfers data to the United States. The residency answer depends on which page you read. - **Static egress IP is unconfirmed** (open): No boxd page mentions a dedicated or static outbound address, and none prices one. battleships.dev lists it as a feature. We could not confirm it, so it is neither offered nor ruled out here. - **Prices moved about 20% in 19 days** (open): The 9 October capture showed €0.049/vCPU-hour, €0.015/GiB-hour and 50 machines; the 28 October page shows €0.039, €0.012 and 100 machines. Any cost figure needs a date. - **Storage prices are not published** (open): Snapshots, checkpoints, backups and extra disks all exist, and none has a published price. Egress has no price or allowance either. - **No status page and no REST API** (open): status.boxd.sh does not resolve and boxd.sh/status is a 404. The only wire API is gRPC; there is no HTTP/JSON endpoint for machines. ## Sources - [Docs](https://docs.boxd.sh/) - [Lifecycle and resources](https://docs.boxd.sh/guides/resources) - [Snapshots](https://docs.boxd.sh/guides/snapshots) - [Fork](https://docs.boxd.sh/guides/fork) - [Egress and host-bound secrets](https://docs.boxd.sh/guides/egress) - [Pricing](https://boxd.sh/pricing) - [FAQ](https://boxd.sh/faq/) --- # Cloudflare Sandbox > A Worker that starts a Firecracker microVM, with no public port, no region pinning, and a disk that is wiped when the instance stops. Website: https://developers.cloudflare.com/sandbox/ Guide page: https://botperch.com/providers/cloudflare-sandbox/ Checked: 2026-10-28 **Short answer:** One always-on personal agent (2 vCPU / 4 GiB / 20 GiB) costs about $99.41 a month here, with a catch: A stopped instance loses its disk; files have to be backed up to R2 or a snapshot and restored. Fits well: A Worker that already holds the credentials and decides what the code can reach: the sandbox never gets a public port. Cloudflare Sandboxes are a feature of the Workers platform: you write a Worker, its Durable Object starts a Linux container on Cloudflare's network, and that container runs untrusted or generated code with its own kernel. There is no separate sandbox service to sign up for and no sandbox console. Identity is a Durable Object name, compute is a container instance, and persistence is a snapshot you take yourself or a bucket you mount. A second, lighter environment called Dynamic Workers runs JavaScript, Python or WebAssembly inside the Workers runtime when the code only needs to call methods you pass in. **Who it is for:** Teams already running a Worker who want untrusted code execution next to their application, with the Worker holding the credentials and deciding reachability. **Isolation:** A Firecracker microVM per container, with its own kernel and network. Your image runs as a Linux container inside it, and every process has root capabilities, so there is no privilege boundary between users inside one sandbox. No memory snapshot, no pause, no fork. Docker-in-Docker works with iptables and IP forwarding off; linux/amd64 only. **Sizes and regions:** Six presets from lite (1/16 vCPU, 256 MiB, 2 GB) to standard-4 (4 vCPU, 12 GiB, 20 GB). Custom sizes are capped at 4 vCPU / 12 GiB / 20 GB, with at least 3 GiB of memory per vCPU. No GPU and no ARM. Placement is chosen by Cloudflare near the request, and a sandbox cannot be pinned to a region. ## How it charges - model: Per-10-millisecond Containers usage on the account's Workers Paid bill, plus Workers, Durable Objects, egress, R2 and optionally Logs. - meter: Active CPU $0.072 per vCPU-hour, provisioned memory $0.009 per GiB-hour and provisioned disk $0.000252 per GB-hour while the instance runs. Egress is $0.025 per GB in North America and Europe. - stopped: Nothing. A stopped instance is not billed, and its disk and processes are gone. - planFee: Workers Paid has a $5 a month minimum for the account. There is no sandbox-specific plan or fee. - minimum: No free tier for containers: the Free column is N/A for memory, CPU and disk. The plan includes about $0.73 of container usage a month. Per 10 ms on the Workers Paid bill: CPU only while working, memory and disk for as long as the instance runs. - Egress is $0.025 per GB in North America and Europe and is not included. - Workers, Durable Objects and R2 usage are billed separately. ## Monthly cost for each preset workload - A personal agent that stays on (Hermes, OpenClaw): $99.41 (catch: A stopped instance loses its disk; files have to be backed up to R2 or a snapshot and restored.) - A coding agent for one developer: $24.20 (catch: No size with 4 vCPU allows 40 GiB of disk; the most is 20 GiB on standard-4. A stopped instance loses its disk; files have to be backed up to R2 or a snapshot and restored.) - A code interpreter inside your product: $37.78 - A browser agent for a small team: $406.03 - Self-hosted n8n for a small team: $98.99 (catch: A stopped instance loses its disk; files have to be backed up to R2 or a snapshot and restored.) - A Discord or Slack bot for one server: $47.48 (catch: A stopped instance loses its disk; files have to be backed up to R2 or a snapshot and restored.) - Claude Code for a team of five: $102.54 (catch: No size with 4 vCPU allows 40 GiB of disk; the most is 20 GiB on standard-4. A stopped instance loses its disk; files have to be backed up to R2 or a snapshot and restored.) - A scraper that runs four times a day: $5.99 - Your own remote MCP server: $46.95 (catch: A stopped instance loses its disk; files have to be backed up to R2 or a snapshot and restored.) - A: 1,000 short tasks: $28.95 - B: one always-on box: $107.82 (catch: No size with 4 vCPU allows 50 GiB of disk; the most is 20 GiB on standard-4. A stopped instance loses its disk; files have to be backed up to R2 or a snapshot and restored.) - C: three hours a day: $17.04 (catch: A stopped instance loses its disk; files have to be backed up to R2 or a snapshot and restored.) ## Fits well - A Worker that already holds the credentials and decides what the code can reach: the sandbox never gets a public port. - One microVM per user or per job, with no shared kernel, at a per-second price that reaches zero when it stops. - A team already on Cloudflare: one account, one bill, Workers and Durable Objects alongside. - A JavaScript or Python snippet that does not need a container at all: a Dynamic Worker starts faster. ## Fits badly - A long job with no inbound requests: code inside does not count as activity, so a two-hour build dies at the timeout. - Any workload needing more than 4 vCPU, 12 GiB or 20 GB, or a GPU. - EU data residency: a sandbox cannot be pinned to a region. - An agent that expects a pause or a resumable machine: stopping deletes the disk and every process. ## Features - **Isolation** (yes): Firecracker; all root. One Firecracker microVM per container with its own kernel and network; the image runs as a Linux container inside it. Every process has root capabilities, so there is no privilege boundary between users. No memory snapshot, pause or fork. [source](https://developers.cloudflare.com/containers/concepts/architecture/) [docs](https://developers.cloudflare.com/containers/concepts/architecture/) - **Sizes and regions** (partly): 4 vCPU / 12 GiB / 20 GB. Six presets from lite to standard-4; custom sizes are capped at 4 vCPU / 12 GiB / 20 GB with at least 3 GiB of memory per vCPU. No GPU, linux/amd64 only, and placement is chosen by Cloudflare near the request. [source](https://developers.cloudflare.com/containers/platform/limits/) [docs](https://developers.cloudflare.com/containers/platform/limits/) - **Lifecycle** (no): No pause; stop wipes disk. The instance runs only until something stops it; its processes and the files on its disk end with it. A snapshot carries files into a new instance, not memory. There is no paused state. [source](https://developers.cloudflare.com/sandbox/concepts/lifetime/) [docs](https://developers.cloudflare.com/sandbox/concepts/lifetime/) - **Snapshots and forks** (partly): Filesystem only; 30 days. snapshotContainer() saves the writable root filesystem of a running instance, 20 GB maximum, and expires 30 days after creation or last restore. No memory and no fork. Directory backups to R2 have no expiry. [source](https://developers.cloudflare.com/sandbox/concepts/lifetime/) [docs](https://developers.cloudflare.com/sandbox/files/save-and-restore-a-workspace/) - **Storage** (partly): 20 GB; wiped on stop. 20 GB maximum disk, deleted when the instance stops. A snapshot keeps the root filesystem for 30 days; an R2 directory backup or S3/R2 mount outlives every instance. [source](https://developers.cloudflare.com/sandbox/files/) [docs](https://developers.cloudflare.com/sandbox/files/) - **Idle and waking** (partly): No default; 6 h max. No default inactivity timeout in Sandboxes 1.0, a 6-hour maximum, and the value is lost on a Durable Object restart. Code inside does not count as activity. The 10-minute default belongs to the legacy 0.x SDK. [source](https://developers.cloudflare.com/sandbox/concepts/lifetime/) [docs](https://developers.cloudflare.com/sandbox/concepts/lifetime/#activity-keeps-an-instance-running) - **Reaching it** (partly): No public port. HTTP from the internet reaches the instance only through your Worker. No built-in preview auth, token or IP allowlist. SSH exists only through Wrangler, does not start a stopped container and does not keep one alive. [source](https://developers.cloudflare.com/sandbox/previews/) [docs](https://developers.cloudflare.com/sandbox/previews/) - **Custom domains** (partly): Worker route + DNS. Not a sandbox feature: a wildcard DNS record and a Worker route send every preview hostname to your Worker. TLS and authentication are yours. [source](https://developers.cloudflare.com/sandbox/previews/serve-previews-on-their-own-hostnames/) [docs](https://developers.cloudflare.com/sandbox/previews/serve-previews-on-their-own-hostnames/) - **Outbound network** (partly): 1 TB a month, then $0.025/GB. Off by default; only ports 80 and 443 through allowedHosts or an outbound handler. No static egress IP or private network. 1 TB a month is included in North America and Europe, then $0.025/GB; 500 GB elsewhere, then $0.04–$0.05. [source](https://developers.cloudflare.com/sandbox/concepts/security/) [docs](https://developers.cloudflare.com/containers/configuration/outbound-traffic/) - **Keys and secrets** (yes): No, Worker injects. The credential stays in the Worker and is added by an outbound handler after the request leaves. Add it only to HTTPS. Once a value is in the sandbox, all code there can read it and send it anywhere. [source](https://developers.cloudflare.com/sandbox/concepts/security/) [docs](https://developers.cloudflare.com/sandbox/network/) - **Ways to drive it** (partly): No; Worker code. TypeScript in a Worker is the only first-class surface, with a Durable Object container API and the Wrangler CLI. No hosted REST API, no Python or Go SDK, no control-plane MCP and no webhooks. [source](https://developers.cloudflare.com/sandbox/previews/) [docs](https://developers.cloudflare.com/sandbox/reference/) - **Built-in agents** (partly): None; guides. No preinstalled agents in the 1.0 images. Guides cover Claude Code, Codex, OpenCode and Pi, plus templates where the vendor's loop runs in its own service. The Agents SDK exposes a sandbox tool. [source](https://developers.cloudflare.com/sandbox/coding-agents/claude-code/) [docs](https://developers.cloudflare.com/sandbox/coding-agents/) - **Teams and accounts** (partly): Alerts only. Budget alerts are informational and do not cap usage. Concurrency is account-wide: 1,500 vCPU, 6 TiB and 30 TB. No per-sandbox IAM; the account audit log records control-plane actions only. [source](https://developers.cloudflare.com/billing/manage/budget-alerts/) [docs](https://developers.cloudflare.com/fundamentals/manage-members/) - **Billing models** (partly): $0.072/vCPU-hour active. Per 10 ms while running: active CPU $0.072/vCPU-hour, provisioned memory $0.009/GiB-hour and provisioned disk $0.000252/GB-hour. A stopped instance bills nothing. [source](https://developers.cloudflare.com/containers/platform/pricing/) [docs](https://developers.cloudflare.com/containers/platform/pricing/) - **Trials and free tiers** (no): None; $5 plan. No free tier for containers; the Free column is N/A. Workers Paid has a $5 monthly minimum and includes 25 GiB-hours, 375 vCPU-minutes and 200 GB-hours of container usage. [source](https://developers.cloudflare.com/sandbox/) [docs](https://developers.cloudflare.com/workers/platform/pricing/) - **The company** (partly): Cloudflare, Inc.; no sandbox SLA. Cloudflare, Inc., Delaware, incorporated July 2009, NYSE: NET, 5,156 staff. The Workers SLA covers Workers only; no sandbox SLA. SOC 2 Type II and ISO 27001 are company-wide, with no published scope for Containers or Sandboxes. [source](https://www.cloudflare.com/workers-service-level-agreement/) ## Capabilities - Its own virtual machine: yes (Firecracker microVM) [source](https://developers.cloudflare.com/containers/concepts/architecture/) - Root access: yes (every process is root) [source](https://developers.cloudflare.com/sandbox/concepts/security/) - Docker inside: partly (docker:dind, no iptables). Docker works through a special image, but the firewall tool Docker normally uses is turned off, so container networking is limited. [source](https://developers.cloudflare.com/containers/faq/) - Nested virtualisation: not-published [source](https://developers.cloudflare.com/containers/platform/limits/) - Your own image: yes (your own Dockerfile) [source](https://developers.cloudflare.com/workers/wrangler/configuration/) - Any size you like: partly (custom within 4 cores / 12 GiB). You can set your own cores and memory, but only inside a ceiling of 4 cores and 12 GB, and each core needs at least 3 GB. [source](https://developers.cloudflare.com/containers/platform/limits/) - Large machines: no (4 cores / 12 GiB). The largest machine is 4 cores and 12 GB of memory, so a 16-core or 32 GB machine is not available. [source](https://developers.cloudflare.com/containers/platform/limits/) - Resize while running: no (no resize). The size is fixed when the sandbox is deployed; changing it means deploying again. [source](https://developers.cloudflare.com/containers/platform/limits/) - GPUs: no (no GPU). There is no graphics processor option; the largest machine is 4 cores of CPU. [source](https://developers.cloudflare.com/containers/platform/limits/) - Choose the region: no (placement is automatic). Cloudflare puts each sandbox near the request, and a sandbox cannot be pinned to a location. [source](https://developers.cloudflare.com/containers/concepts/placement/) - Runs in the EU: partly (EU locations, cannot pin). Cloudflare has European locations, but a sandbox cannot be required to stay in one, so it may run outside the EU. [source](https://developers.cloudflare.com/workers/wrangler/configuration/) - Pause keeps memory: no [source](https://developers.cloudflare.com/sandbox/concepts/lifetime/) - Pre-started pools: no [source](https://developers.cloudflare.com/sandbox/concepts/lifetime/) - Starts in under a second: not-published [source](https://developers.cloudflare.com/sandbox/concepts/lifetime/) - Snapshots of files: partly (20 GB; 30 days). Snapshots are in public beta, hold at most 20 GB, and are deleted 30 days after they were made or last used. [source](https://developers.cloudflare.com/sandbox/concepts/lifetime/) - Snapshots with memory: no [source](https://developers.cloudflare.com/sandbox/concepts/lifetime/) - Copy a running machine: no [source](https://developers.cloudflare.com/sandbox/concepts/lifetime/) - Pick an older snapshot: partly (30-day expiry). You have to store each snapshot’s ID yourself, and every snapshot is deleted 30 days after it was made or last used. [source](https://developers.cloudflare.com/sandbox/concepts/lifetime/) - Reusable templates: partly. You can start any number of machines from an image you build, but saving a running machine as a reusable template only works through snapshots, which are in beta, keep files only, and expire after 30 days. [source](https://developers.cloudflare.com/sandbox/files/save-and-restore-a-workspace/) - Automatic backups: partly (On stop, 30 days). A snapshot can be saved automatically when a sandbox stops, but there is no schedule and snapshots expire after 30 days. [source](https://developers.cloudflare.com/sandbox/concepts/lifetime/) - Files survive a stop: no [source](https://developers.cloudflare.com/sandbox/concepts/lifetime/) - Separate volumes: partly (20 GB disk). There is no separate disk that outlives the machine; a bucket can be mounted, and a snapshot lasts 30 days. [source](https://developers.cloudflare.com/sandbox/concepts/lifetime/) - One volume, several machines: partly. The shared option is a bucket, not a disk, so files are not locked and two machines can overwrite each other. [source](https://developers.cloudflare.com/sandbox/files/) - Mount outside storage: yes [source](https://developers.cloudflare.com/sandbox/files/mount-an-r2-bucket/) - Large disk: no (20 GB max). The largest disk is 20 GB, short of 100 GB. [source](https://developers.cloudflare.com/containers/platform/limits/) - Can stay on indefinitely: partly (6 h max). An instance stops when nothing has used it for up to 6 hours, the setting is lost on a restart, and Cloudflare promises no set running time. [source](https://developers.cloudflare.com/sandbox/concepts/lifetime/) - Choose the idle timeout: partly (Up to 6 h). You can set the wait up to 6 hours, but the setting is lost when the object restarts and there is no never. [source](https://developers.cloudflare.com/sandbox/concepts/lifetime/) - Wakes on a request: partly. A request starts a fresh machine, not the one that stopped; files come back only from a snapshot your code saved. [source](https://developers.cloudflare.com/sandbox/concepts/lifetime/) - Scheduled runs: yes [source](https://developers.cloudflare.com/containers/examples/cron/) - Public link to a port: partly (Through your Worker). There is no address for the machine itself; you publish a small program of your own and anyone who can open that address gets in. [source](https://developers.cloudflare.com/sandbox/previews/) - Private link: partly (Login is your code). You have to write the login check in your own small program; the machine brings no token or password of its own. [source](https://developers.cloudflare.com/sandbox/concepts/security/) - Real SSH: partly (One provider tool). You cannot point a normal SSH client at the machine; the only way in is a Cloudflare command-line tool. [source](https://developers.cloudflare.com/containers/guides/ssh/) - Terminal in the browser: partly (You build it). The provider gives you code for a terminal you host yourself, not a terminal on its own website. [source](https://developers.cloudflare.com/sandbox/commands/open-a-terminal-in-the-browser/) - Tunnel to your computer: no. There is no way to map a port inside the machine onto your own computer. [source](https://developers.cloudflare.com/containers/concepts/architecture/) - Non-web ports: no. Web traffic only: no other kind of connection can be made to the machine from outside. [source](https://developers.cloudflare.com/containers/concepts/architecture/) - Your own domain: partly (Through your Worker). You point a catch-all address at your own small program rather than at the machine, so routing is yours to run. [source](https://developers.cloudflare.com/sandbox/previews/serve-previews-on-their-own-hostnames/) - Automatic HTTPS: yes (Zone certificate) [source](https://developers.cloudflare.com/sandbox/previews/serve-previews-on-their-own-hostnames/) - Outbound data included: yes (1 TB a month) [source](https://developers.cloudflare.com/containers/pricing/) - Allow only some sites: yes (Hosts or handler) [source](https://developers.cloudflare.com/containers/configuration/outbound-traffic/) - Turn the internet off: yes (Off by default) [source](https://developers.cloudflare.com/sandbox/concepts/security/) - Fixed outgoing IP: not-published [source](https://developers.cloudflare.com/containers/pricing/) - Stored secrets: partly (Worker bindings). There is no saved secret inside the machine; you keep the value in your own small program and add it on the way out. [source](https://developers.cloudflare.com/sandbox/concepts/security/) - Secrets the agent cannot read: yes (Added by your Worker) [source](https://developers.cloudflare.com/sandbox/concepts/security/) - Limited API keys: yes (Account tokens) [source](https://developers.cloudflare.com/fundamentals/api/reference/permissions/) - Create from the website: no [source](https://developers.cloudflare.com/sandbox/manage/) - Command-line tool: partly. The only command-line tool is Wrangler, which deploys the Worker and can open a shell; it does not create or manage sandboxes. [source](https://developers.cloudflare.com/containers/guides/ssh/) - Python SDK: no [source](https://developers.cloudflare.com/sandbox/reference/) - TypeScript SDK: yes [source](https://developers.cloudflare.com/sandbox/reference/) - Documented HTTP API: no. There is no Cloudflare-hosted API to call; you write a Worker and call it yourself. [source](https://developers.cloudflare.com/sandbox/sdk/bridge/) - MCP server: no. The MCP material is a separate Cloudflare code-mode project, not a server that starts sandboxes. [source](https://developers.cloudflare.com/sandbox/commands/open-a-terminal-in-the-browser/) - Interactive terminal over the API: partly. A live shell exists only inside a web page you build; there is no call that opens a terminal session for a script. [source](https://developers.cloudflare.com/sandbox/commands/open-a-terminal-in-the-browser/) - Files over the API: yes [source](https://developers.cloudflare.com/sandbox/files/) - Coding agents preinstalled: no. The current base images ship no coding agent; you add one in your own Dockerfile, as the guides do. [source](https://developers.cloudflare.com/sandbox/sdk/migrate/changes-in-1-0/) - Send it a prompt: no. Your Worker holds the credentials and the agent runs as a process you start; there is no prompt endpoint. [source](https://developers.cloudflare.com/sandbox/coding-agents/) - One-click Hermes: no. No Hermes template; you would install it in your own Dockerfile. [source](https://developers.cloudflare.com/sandbox/coding-agents/) - One-click OpenClaw: no. No OpenClaw template; the guides cover Claude Code, Codex, OpenCode and Pi. [source](https://developers.cloudflare.com/sandbox/coding-agents/) - Browser built in: no. The base images ship no browser; you install one in your own Dockerfile. [source](https://developers.cloudflare.com/sandbox/sdk/migrate/changes-in-1-0/) - Desktop for computer use: no. No desktop or computer-use surface is documented. [source](https://developers.cloudflare.com/sandbox/) - Runs other platforms' agents: yes [source](https://developers.cloudflare.com/sandbox/coding-agents/) - Team workspace: partly. People share the Cloudflare account and its Workers, but there is no per-sandbox sharing or sandbox workspace. [source](https://developers.cloudflare.com/fundamentals/manage-members/) - Roles and permissions: yes [source](https://developers.cloudflare.com/fundamentals/manage-members/) - Single sign-on: yes [source](https://developers.cloudflare.com/fundamentals/manage-members/dashboard-sso/) - Hard spending cap: no. Budget alerts only send email; they do not pause or cap anything. [source](https://developers.cloudflare.com/billing/manage/budget-alerts/) - Usage alerts: yes [source](https://developers.cloudflare.com/billing/manage/budget-alerts/) - Audit log: yes [source](https://developers.cloudflare.com/fundamentals/account/account-security/audit-logs/) - Billed per second: yes (per 10 ms) [source](https://developers.cloudflare.com/containers/platform/pricing/) - CPU billed only while working: yes (active CPU only) [source](https://developers.cloudflare.com/containers/platform/pricing/) - Paused costs only storage: yes (nothing while stopped) [source](https://developers.cloudflare.com/sandbox/concepts/lifetime/) - No monthly fee: no ($5 Workers plan). Sandboxes need the $5-a-month Workers Paid plan before anything can run. [source](https://developers.cloudflare.com/sandbox/) - Flat monthly price: no (per 10 ms). The bill is a sum of active processor time, memory and disk. [source](https://developers.cloudflare.com/containers/platform/pricing/) - Ongoing free tier: no (none). Sandboxes only run on the paid Workers plan. [source](https://developers.cloudflare.com/sandbox/) - Free starting credit: no (none). There is no starting credit; you pay the $5 monthly plan from the start. [source](https://developers.cloudflare.com/sandbox/) - Try without a card: no (paid plan first). You need a paid Workers plan, which means a payment method, before a sandbox can run. [source](https://developers.cloudflare.com/sandbox/) - Public status page: yes [source](https://developers.cloudflare.com/billing/manage/budget-alerts/) - Uptime promise (SLA): no. The 99.99% Workers SLA covers Workers only, not Containers or Sandboxes. [source](https://www.cloudflare.com/workers-service-level-agreement/) - SOC 2 report: yes [source](https://www.cloudflare.com/cloudflare-customer-dpa/) - Data processing agreement: yes [source](https://www.cloudflare.com/cloudflare-customer-dpa/) - Open source or self-hostable: partly. The SDK is open source, but the platform it runs on is Cloudflare's and cannot be self-hosted. [source](https://developers.cloudflare.com/sandbox/reference/) ## Usability - Dashboard: A Cloudflare account dashboard for Workers, containers, instance IDs and logs. There is no sandbox console and no create-a-sandbox button. - Without code: No. The first step is a Worker with a Durable Object, and the image build needs Docker locally. - Signup: A Cloudflare account and the Workers Paid plan at a $5 monthly minimum, which needs a payment method. No waitlist. - Docs: 121 sandbox pages, each with a Markdown twin, plus llms.txt. Support is the community portal, cases, chat or phone depending on plan; no response-time commitment is published for Workers Paid. - Trips people up: The 10-minute idle stop belongs to the deprecated 0.x SDK, not to Sandboxes 1.0. - Trips people up: Stopping the instance deletes the files on its disk. - Trips people up: The 2 vCPU / 4 GiB and 4 vCPU / 8 GiB shapes do not exist. - Trips people up: Sandbox names are routing keys, not authentication. - Trips people up: A deploy does not update a running sandbox. ## Company - Legal entity: Cloudflare, Inc., a Delaware corporation incorporated in July 2009 and listed on the NYSE as NET since 13 September 2019. [source](https://www.sec.gov/Archives/edgar/data/1477333/000147733326000016/cloud-20251231.htm) - Leadership: Matthew Prince is CEO and co-chair; Michelle Zatlyn is President and co-chair; Thomas Seifert is CFO. [source](https://cloudflare.net/governance/leadership/default.aspx) - Scale: 5,156 full-time employees at 31 December 2025, and about 332,000 paying customers. [source](https://www.sec.gov/Archives/edgar/data/1477333/000147733326000016/cloud-20251231.htm) - Status: A Containers component on the status page; no Sandboxes component and no sandbox-specific uptime percentage. [source](https://www.cloudflarestatus.com/api/v2/components.json) - SLA: No sandbox SLA on any plan. The Workers SLA covers Workers only and does not extend to Containers or Sandboxes. [source](https://www.cloudflare.com/workers-service-level-agreement/) - Certification: SOC 2 Type II, ISO 27001, PCI DSS L1 and a HIPAA AoC, all company-wide. No public statement puts Containers or Sandboxes inside that scope. [source](https://www.cloudflare.com/trust-hub/compliance-resources/soc-2/) - Price changes: Thirty days' notice before a fee change. [source](https://www.cloudflare.com/terms/) ## Caveats - **The 10-minute idle stop is 0.x behaviour, not the current product** (contradiction): The legacy Container class and the 0.x SDK stop after 10 minutes by default. Sandboxes 1.0 has no default inactivity timeout, a 6-hour maximum, and stops shortly after the Durable Object goes inactive. The 0.x SDK gets fixes only until 31 December 2026. - **Start time is milliseconds on the product page and 1–3 seconds in the docs** (contradiction): The product page promises milliseconds; the Containers FAQ says a cold start is often 1–3 seconds depending on image size and execution time. - **Outbound internet is off by default, required, or on by default depending on the page** (contradiction): The sandbox security guide says enableInternet: false is the default; the API reference says the field is required when options are passed; the Containers guide says the other API allows internet by default. Treat egress as an explicit per-start decision. - **Instance maximums are called defaults that can be increased, and a hard table** (contradiction): The limits page says all maximums can be increased, directly above a custom-instance table that states 4 vCPU, 12 GiB and 20 GB as constraints. Whether support can lift them is not published. - **“Start building for free” does not include a free sandbox** (contradiction): The product page invites you to start for free; the Containers rate card lists N/A for memory, CPU and disk on the Free plan, and the docs require Workers Paid. - **A sandbox cannot be pinned to a region** (open): Containers support region and jurisdiction constraints, but the durable_object policy that sandboxes use rejects placement constraints. Placement is chosen for latency and can change when an instance restarts. - **A stop wipes the disk** (open): Stopping the instance deletes the files on its disk. Only a snapshot (30 days, 20 GB maximum) or an R2 directory backup or mount survives it. - **There is no sandbox SLA** (open): The Workers SLA covers Workers only, and no Containers or Sandboxes SLA page exists. The status page has no Sandboxes component, so an outage surfaces as a Workers, Durable Objects or Containers incident. - **Compliance scope for this product is unpublished** (open): Cloudflare holds SOC 2 Type II, ISO 27001, PCI DSS L1 and a HIPAA AoC company-wide. No public statement says the audit boundary includes Containers or Sandboxes, and the reports sit behind the dashboard. ## Sources - [Sandboxes overview](https://developers.cloudflare.com/sandbox/) - [Sandbox lifetime](https://developers.cloudflare.com/sandbox/concepts/lifetime/) - [Sandbox security](https://developers.cloudflare.com/sandbox/concepts/security/) - [Container lifecycle](https://developers.cloudflare.com/containers/concepts/architecture/) - [Limits and instance types](https://developers.cloudflare.com/containers/platform/limits/) - [Containers pricing](https://developers.cloudflare.com/containers/platform/pricing/) - [Placement](https://developers.cloudflare.com/containers/concepts/placement/) - [Workers SLA](https://www.cloudflare.com/workers-service-level-agreement/) --- # Daytona > Linux containers by default and real VMs on request, with a 15-minute idle stop, a 10 GiB disk cap and two regions. Website: https://www.daytona.io Guide page: https://botperch.com/providers/daytona/ Checked: 2026-10-28 **Short answer:** One always-on personal agent (2 vCPU / 4 GiB / 20 GiB) costs about $122.07 a month here, with a catch: 20 GiB of disk is over the 10 GiB limit. Fits well: A Docker or Windows workload: the VM and Windows classes have their own kernel, and Docker-in-Docker is documented. Daytona sells sandboxes for AI-generated code: a Linux container by default, or a Linux VM, Windows, GPU or macOS sandbox when the workload needs one. The unit is created and driven through five SDKs, a CLI, a REST API and an MCP server. The classes are not interchangeable. Pause, resume, fork and memory snapshots exist only on the VM classes; archive exists only on containers; GPU sandboxes run in containers and vanish on stop. It began as an open-source development-environment company. That repository is archived, and the managed platform is closed source. **Who it is for:** Teams building an agent product who want a fast container by default and a full VM when Docker, Windows or a real kernel is needed. **Isolation:** Linux containers by default: dedicated namespaces, enforced resource limits and root inside, sharing the runner's kernel. Linux VM and Windows sandboxes have their own kernel. Docker-in-Docker is documented; nested virtualisation is Linux-VM only and must be enabled for the organisation. GPU sandboxes are containers with exclusive GPU allocation. **Sizes and regions:** Default 1 vCPU / 1 GB / 3 GiB; the organisation ceiling is 4 vCPU / 8 GB / 10 GiB of disk. Named presets include daytona-medium 2/4/8 and daytona-large 4/8/10; Windows presets go to 4/16/50. GPU sandboxes attach up to 8 GPUs, each adding up to 16 vCPU / 192 GB / 512 GB. Two shared regions, us and eu. ## How it charges - model: Per-second billing on reserved resources, with no plan fee. Tiers are prepaid top-ups that set an organisation-wide pool. - meter: vCPU $0.0504/hour, memory $0.0162/GiB-hour and disk $0.000108/GiB-hour after the first 5 GiB. Windows adds $0.0858/vCPU-hour, which reads either as a replacement rate or a surcharge. - stopped: Stopped and paused sandboxes bill reserved disk only; memory is not billed. Archived and deleted sandboxes bill nothing. - planFee: No plan fee. Tier 1 needs only a verified email; Tier 2 is a $25 top-up, Tier 3 $500, and Tier 4 $2,000 every 30 days. - minimum: $200 of free compute with no card, but it cannot be spent on GPU sandboxes. Per second on reserved vCPU, memory and disk; stopped sandboxes bill disk only. - $200 of free compute with no card, not usable on GPU sandboxes. - The 10 GiB per-sandbox disk cap contradicts 50 GiB Windows presets; the cap is applied here. ## Monthly cost for each preset workload - A personal agent that stays on (Hermes, OpenClaw): $122.07 (catch: 20 GiB of disk is over the 10 GiB limit.) - A coding agent for one developer: $55.75 (catch: 40 GiB of disk is over the 10 GiB limit.) - A code interpreter inside your product: $55.38 - A browser agent for a small team: $830.70 - Self-hosted n8n for a small team: $122.07 (catch: 20 GiB of disk is over the 10 GiB limit.) - A Discord or Slack bot for one server: $60.84 - Claude Code for a team of five: $278.76 (catch: 40 GiB of disk is over the 10 GiB limit.) - A scraper that runs four times a day: $1.67 - Your own remote MCP server: $49.01 - A: 1,000 short tasks: $27.69 - B: one always-on box: $245.32 (catch: 50 GiB of disk is over the 10 GiB limit.) - C: three hours a day: $16.09 (catch: 20 GiB of disk is over the 10 GiB limit.) ## Fits well - A Docker or Windows workload: the VM and Windows classes have their own kernel, and Docker-in-Docker is documented. - A fast container for untrusted code, priced per reserved vCPU and second, with $200 of free compute and no card. - A GPU sandbox alongside the CPU ones: up to 8 GPUs per sandbox, though on shared capacity and preemptible. - Browser or desktop agents: a VNC desktop and a computer-use API are first-class. ## Fits badly - A workload that needs more than 10 GiB of disk on a Linux sandbox; the 50 GiB presets are Windows only. - An agent that runs long jobs with no inbound traffic: a container stops after 15 idle minutes even mid-build. - Full internet on a small account: Tier 1 and 2 are network-restricted and cannot be overridden per sandbox. - A strict per-tenant boundary: any organisation member or API key can exec in any running sandbox. ## Features - **Isolation** (partly): Containers; VM on request. Linux containers by default: dedicated namespaces, enforced resource limits and root inside, sharing the runner's kernel. Linux VM and Windows classes have their own kernel. Docker-in-Docker is documented; nested virtualisation is Linux-VM only and must be enabled. [source](https://www.daytona.io/docs/en/isolation.md) [docs](https://www.daytona.io/docs/en/isolation) - **Sizes and regions** (partly): 4 vCPU / 8 GiB / 10 GiB. Default 1 vCPU / 1 GB / 3 GiB; the organisation ceiling is 4 vCPU / 8 GB / 10 GiB, with daytona-large at 4/8/10. Windows presets reach 4/16/50 and GPU sandboxes attach up to 8 GPUs. Two shared regions, us and eu. [source](https://www.daytona.io/docs/en/sandboxes.md) [docs](https://www.daytona.io/docs/en/regions) - **Lifecycle** (partly): VM pause: RAM; container stop. Pause exists only on Linux VM and Windows sandboxes; a container stop keeps the filesystem and loses memory. Stopped and paused sandboxes bill reserved disk only, and archive is container-only. [source](https://www.daytona.io/docs/en/sandboxes.md) [docs](https://www.daytona.io/docs/en/sandboxes#sandbox-lifecycle) - **Snapshots and forks** (partly): Hot: RAM (VM); cold: disk. Cold snapshots capture the filesystem from a stopped sandbox; hot snapshots capture filesystem and memory from a started VM. Containers support cold only. Fork duplicates a Linux VM's filesystem and memory. Snapshots go inactive after 14 days unused. [source](https://www.daytona.io/docs/en/sandboxes.md) [docs](https://www.daytona.io/docs/en/snapshots) - **Storage** (partly): 10 GiB cap; volumes free. The whole disk persists and bills in stopped and paused states at $0.000108/GiB-hour. Volumes are S3-backed FUSE mounts, 100 per organisation, free, and not usable for block storage such as database tables. [source](https://www.daytona.io/docs/en/volumes.md) [docs](https://www.daytona.io/docs/en/volumes) - **Idle and waking** (partly): 15 min container; 60 min VM. Container and GPU auto-stop after 15 idle minutes by default; VM classes auto-pause after 60. Only lifecycle calls, preview requests, SSH and Toolbox calls reset it. An optional TTL destroys in any state; a stopped container archives after 7 days. [source](https://www.daytona.io/docs/en/sandboxes.md) [docs](https://www.daytona.io/docs/en/sandboxes#auto-stop-interval) - **Reaching it** (partly): Token, or signed URL. Preview links are authenticated unless public is true. The standard token is sandbox-wide, opens the terminal and toolbox, and cannot be revoked; signed URLs are per port, 60 seconds by default and 24 hours maximum. [source](https://www.daytona.io/docs/en/preview.md) [docs](https://www.daytona.io/docs/en/preview) - **Custom domains** (partly): Own proxy. No native custom domain. The documented route is your own preview proxy, which can also start stopped sandboxes before forwarding. [source](https://www.daytona.io/docs/en/custom-preview-proxy.md) [docs](https://www.daytona.io/docs/en/custom-preview-proxy) - **Outbound network** (partly): Tier 3 for internet. Tier 1 and 2 are restricted and cannot be overridden per sandbox; Tier 3 and 4 get full internet. Per-sandbox controls are block-all, CIDR, domain or an upstream proxy. No static egress IP or egress price is published. [source](https://www.daytona.io/docs/en/network-limits.md) [docs](https://www.daytona.io/docs/en/network-limits) - **Keys and secrets** (yes): No, proxy headers only. A dtn_secret_… placeholder is swapped by an outbound proxy in HTTPS request headers only; bodies and query strings fail. A secret without an allowlist is substituted for every host. [source](https://www.daytona.io/docs/en/secrets.md) [docs](https://www.daytona.io/docs/en/secrets) - **Ways to drive it** (yes): Yes, playground. A dashboard Playground, web terminal, VNC desktop, five SDKs, a REST API, a CLI, a first-party MCP server, and webhooks that need support to enable. [source](https://www.daytona.io/docs/en/playground.md) [docs](https://www.daytona.io/docs/en/tools/cli) - **Built-in agents** (partly): None; guides. No hosted agent or preinstalled harness. First-party guides cover Claude Code, Codex, Cursor, Devin, Gemini CLI, OpenCode, Amp and Kiro; computer use is a first-class API. [source](https://trust.daytona.io/) [docs](https://www.daytona.io/docs/en/guides/openclaw) - **Teams and accounts** (partly): Org-wide resource pool. Tiers are prepaid top-ups that set an org-wide vCPU, memory and disk pool. Any member or API key can address any running sandbox. SSO is Enterprise; audit logs are role-gated and export is coming soon. [source](https://www.daytona.io/docs/en/organizations.md) [docs](https://www.daytona.io/docs/en/organizations) - **Billing models** (partly): $0.0504/vCPU-hour. Reserved vCPU at $0.0504/hour, memory at $0.0162/GiB-hour and disk at $0.000108/GiB-hour, billed per second with no plan fee. Windows adds $0.0858/vCPU-hour, which may replace or add to the Linux rate. [source](https://www.daytona.io/pricing) [docs](https://www.daytona.io/docs/en/billing) - **Trials and free tiers** (yes): $200 credit, no card. A $200 free compute credit with no card, and Tier 1 access by email verification. The credit is not available for GPU sandboxes; its expiry is not published. [source](https://www.daytona.io/pricing) [docs](https://www.daytona.io/docs/en/limits#tiers) - **The company** (partly): Daytona Platforms Inc.; 99.95% Tier 4+. Daytona Platforms Inc., New York address, Delaware law; Delaware incorporation unconfirmed. Founded 2023; $91M raised after a $60M Series B at a $1B valuation. SLA 99.95% with credits for Tier 4+; A SOC 2 Type II report covering December 2025 to March 2026 is available from the trust centre; ISO 27001 is in progress. [source](https://www.daytona.io/sla) ## Capabilities - Its own virtual machine: partly (containers by default). By default each sandbox is a container sharing the host's kernel; a real virtual machine is a separate kind you have to choose. [source](https://www.daytona.io/docs/en/sandboxes) - Root access: yes (root in the sandbox) [source](https://www.daytona.io/docs/en/isolation) - Docker inside: yes (Docker-in-Docker) [source](https://www.daytona.io/docs/en/snapshots) - Nested virtualisation: partly (Linux VM class only). Nested virtual machines only work on the Linux VM class, and the feature has to be switched on for your organisation. [source](https://www.daytona.io/docs/en/sandboxes) - Your own image: yes (Dockerfile or OCI image) [source](https://www.daytona.io/docs/en/declarative-builder) - Any size you like: partly (presets, custom on request). You pick from fixed sizes, and anything different needs a custom limit arranged through support. [source](https://www.daytona.io/docs/en/sandboxes) - Large machines: partly (4 cores / 8 GiB; more with GPUs). A normal sandbox stops at 4 cores and 8 GB; larger machines only come attached to graphics cards. [source](https://www.daytona.io/docs/en/sandboxes) - Resize while running: partly (grow only, support must enable). You can add cores and memory while it runs, but you cannot shrink them, and the feature has to be switched on by support first. [source](https://www.daytona.io/docs/en/sandboxes) - GPUs: yes (up to 8 GPUs) [source](https://www.daytona.io/docs/en/gpu-sandboxes) - Choose the region: yes (US or EU) [source](https://www.daytona.io/docs/en/regions) - Runs in the EU: yes (eu region) [source](https://www.daytona.io/docs/en/regions) - Pause keeps memory: partly. Only the full virtual machine can be paused with memory; a container sandbox loses what was running. [source](https://www.daytona.io/docs/en/sandboxes.md) - Pre-started pools: partly. Pools exist, but they must be switched on for your organisation by asking support. [source](https://www.daytona.io/docs/en/warm-pools) - Starts in under a second: yes (Under 90 ms) [source](https://www.daytona.io/) - Snapshots of files: yes [source](https://www.daytona.io/docs/en/snapshots.md) - Snapshots with memory: partly. Memory snapshots are only for full virtual machines; container sandboxes get files only. [source](https://www.daytona.io/docs/en/snapshots.md) - Copy a running machine: yes [source](https://www.daytona.io/docs/en/sandboxes.md) - Pick an older snapshot: yes [source](https://www.daytona.io/docs/en/snapshots.md) - Reusable templates: yes [source](https://www.daytona.io/docs/en/snapshots.md) - Automatic backups: no [source](https://www.daytona.io/docs/en/snapshots.md) - Files survive a stop: yes [source](https://www.daytona.io/docs/en/sandboxes.md) - Separate volumes: yes. Volumes are network filesystems, not block disks, so a database table store is a poor fit. [source](https://www.daytona.io/docs/en/volumes.md) - One volume, several machines: yes. Writes are not transactional, so two machines writing one file means the last write wins. [source](https://www.daytona.io/docs/en/volumes.md) - Mount outside storage: yes [source](https://www.daytona.io/docs/en/mount-external-storage) - Large disk: no (10 GiB cap). The organisation ceiling is 10 GiB of disk per sandbox, though some Windows presets list 50 GiB. [source](https://www.daytona.io/docs/en/sandboxes.md) - Can stay on indefinitely: yes [source](https://www.daytona.io/docs/en/sandboxes.md) - Choose the idle timeout: yes (Minutes, or 0) [source](https://www.daytona.io/docs/en/sandboxes.md) - Wakes on a request: no [source](https://www.daytona.io/docs/en/sandboxes.md) - Scheduled runs: no [source](https://www.daytona.io/docs/en/regions) - Public link to a port: yes (public flag) [source](https://www.daytona.io/docs/en/preview.md) - Private link: yes (Token or signed link) [source](https://www.daytona.io/docs/en/preview.md) - Real SSH: yes (Token, 60 min) [source](https://www.daytona.io/docs/en/ssh-access.md) - Terminal in the browser: yes (Dashboard) [source](https://www.daytona.io/docs/en/web-terminal.md) - Tunnel to your computer: not-published [source](https://www.daytona.io/docs/en/ssh-access.md) - Non-web ports: not-published [source](https://www.daytona.io/docs/en/preview.md) - Your own domain: partly (Own proxy). You have to run your own forwarding service under your domain; the provider does not attach the domain for you. [source](https://www.daytona.io/docs/en/custom-preview-proxy.md) - Automatic HTTPS: no. You run the forwarding service, so you also get and renew the certificate. [source](https://www.daytona.io/docs/en/custom-preview-proxy.md) - Outbound data included: not-published [source](https://www.daytona.io/pricing) - Allow only some sites: yes (Domain or address list) [source](https://www.daytona.io/docs/en/network-limits.md) - Turn the internet off: yes (block-all) [source](https://www.daytona.io/docs/en/network-limits.md) - Fixed outgoing IP: not-published [source](https://www.daytona.io/docs/en/network-limits.md) - Stored secrets: yes (Stored secrets) [source](https://www.daytona.io/docs/en/secrets.md) - Secrets the agent cannot read: yes (Header only) [source](https://www.daytona.io/docs/en/secrets.md) - Limited API keys: yes (Permission scopes) [source](https://www.daytona.io/docs/en/api-keys.md) - Create from the website: yes [source](https://www.daytona.io/docs/en/playground.md) - Command-line tool: yes [source](https://www.daytona.io/docs/en/mcp.md) - Python SDK: yes [source](https://www.daytona.io/docs/en/architecture.md) - TypeScript SDK: yes [source](https://www.daytona.io/docs/en/architecture.md) - Documented HTTP API: yes [source](https://www.daytona.io/docs/en/architecture.md) - MCP server: yes [source](https://www.daytona.io/docs/en/mcp.md) - Interactive terminal over the API: yes [source](https://www.daytona.io/docs/en/pty.md) - Files over the API: yes [source](https://www.daytona.io/docs/en/file-system-operations.md) - Coding agents preinstalled: partly. OpenClaw is in the default snapshot, but Claude Code and Codex are not; those need an install step. [source](https://www.daytona.io/docs/en/guides/openclaw/openclaw-run-secure-sandbox.md) - Send it a prompt: no. No agent is hosted and there is no prompt call; you install and drive the agent. [source](https://www.daytona.io/docs/en/guides/claude/claude-code-run-cli-sandbox.md) - One-click Hermes: no. Daytona documents OpenClaw but not Hermes, so there is no one-click route. [source](https://www.daytona.io/docs/en/guides/openclaw/openclaw-run-secure-sandbox.md) - One-click OpenClaw: partly. OpenClaw is in the default snapshot, but you still run a command to start and configure it. [source](https://www.daytona.io/docs/en/guides/openclaw/openclaw-run-secure-sandbox.md) - Browser built in: not-published [source](https://www.daytona.io/docs/en/computer-use.md) - Desktop for computer use: yes [source](https://www.daytona.io/docs/en/computer-use.md) - Runs other platforms' agents: yes [source](https://www.daytona.io/docs/en/guides/claude/claude-code-run-cli-sandbox.md) - Team workspace: yes [source](https://www.daytona.io/docs/en/organizations.md) - Roles and permissions: partly. Roles decide who can manage the organisation, but any member or key can still run commands in any running sandbox. [source](https://www.daytona.io/docs/en/organizations.md) - Single sign-on: partly. SSO is available only on the Enterprise plan for collaborative organisations. [source](https://www.daytona.io/docs/en/sso.md) - Hard spending cap: partly. The ceiling is a prepaid pool of computing resources rather than a dollar amount, and running sandboxes are not stopped when it runs out. [source](https://www.daytona.io/docs/en/billing.md) - Usage alerts: not-published [source](https://www.daytona.io/docs/en/billing.md) - Audit log: partly. The log exists, but exporting it for an audit is not shipped yet. [source](https://www.daytona.io/docs/en/audit-logs.md) - Billed per second: yes (per second) [source](https://www.daytona.io/pricing) - CPU billed only while working: no (reserved size). You pay for the cores and memory you reserved, not the ones the work used. [source](https://www.daytona.io/docs/en/billing) - Paused costs only storage: yes (disk only) [source](https://www.daytona.io/docs/en/billing) - No monthly fee: yes (none) [source](https://www.daytona.io/pricing) - Flat monthly price: no (metered parts). The bill is cores plus memory plus disk per second. [source](https://www.daytona.io/docs/en/billing) - Ongoing free tier: no (one-off $200). The $200 is a one-time credit, not something that returns every month. [source](https://www.daytona.io/pricing) - Free starting credit: yes ($200) [source](https://www.daytona.io/pricing) - Try without a card: yes (no card) [source](https://www.daytona.io/pricing) - Public status page: yes [source](https://status.app.daytona.io/) - Uptime promise (SLA): partly (99.95%, Tier 4+). The 99.95% target exists, but service credits go only to Tier 4 and above. [source](https://www.daytona.io/sla) - SOC 2 report: yes (Type II) [source](https://trust.daytona.io/) - Data processing agreement: yes [source](https://www.daytona.io/dpa) - Open source or self-hostable: partly (BYOC, Enterprise). Only the sandbox compute runs on your own machines, only after Daytona enables it, and the control plane stays Daytona's. [source](https://www.daytona.io/docs/en/bring-your-own-compute.md) ## Usability - Dashboard: Yes: a dashboard with a browser Playground for creating sandboxes and running SDK operations, plus Terminal and VNC tabs. - Without code: Partly. The Playground creates a sandbox and generates SDK snippets; operating one from the browser works, but building one is still a form of code. - Signup: Google or GitHub login, no card, $200 of free compute. Tier 1 needs only a verified email; GPU sandboxes cannot use the free credit. - Docs: Agent-readable docs with llms.txt and a 3.3 MB llms-full.txt, five SDKs, a CLI and a first-party MCP server. Support is email, Slack, chat, video and forums with no response-time commitment. - Trips people up: The 15-minute idle stop ignores a running build or inference job. - Trips people up: The standard preview token opens the whole sandbox and cannot be revoked. - Trips people up: Tier 1 and 2 cannot reach the open internet, so package installs fail. - Trips people up: Any organisation member can exec in any running sandbox. - Trips people up: 50 GiB disks exist only on Windows. ## Company - Legal entity: Daytona Platforms Inc., at a New York address. Delaware incorporation is unconfirmed by the company; its terms name Delaware law. [source](https://www.daytona.io/terms-of-service) - Founded and leadership: 2023, by Ivan Burazin (CEO), Vedran Jukić (CTO) and Goran Draganić (Chief Architect). [source](https://www.daytona.io/about) - Funding: $91M total after a $60M Series B at a $1B valuation in October 2026, led by FirstMark Growth. [source](https://www.daytona.io/dotfiles/daytona-raises-60m-series-b-to-build-the-agent-cloud) - Headcount: Twelve people are named on the about page; no total is published. - Status and SLA: Status page components showed 99.768% at the lowest. The SLA promises 99.95%, but credits go only to Tier 4 and above. [source](https://www.daytona.io/sla) - Certification: A SOC 2 Type II report covering December 2025 to March 2026 is available from the trust centre (checked 29 October 2026; earlier only a bridge letter was published). ISO 27001 is marked in progress while the badge is displayed. [source](https://trust.daytona.io/) - Price changes: No notice period: fees may change by posting the change on the service. [source](https://www.daytona.io/terms-of-service) ## Caveats - **Every sandbox is said to have a dedicated kernel, then said to be a container** (contradiction): The sandboxes page claims a dedicated kernel for every sandbox and two paragraphs later says sandboxes run as Linux containers by default. The isolation page is explicit that containers get namespaces and only VM classes get their own kernel. - **Startup is quoted as sub-90 ms and as sub-200 ms** (contradiction): The homepage claims sub-90 ms from code to execution; the careers page says sub-200 ms. Neither is a measured figure for a cold sandbox. - **The 10 GiB disk cap and the 50 GiB Windows presets cannot both be the maximum** (open): The sandboxes page states a 10 GB per-sandbox disk maximum and, on the same page, lists Windows presets with 30 and 50 GB. Treating 10 GiB as the real Linux cap is the profile's judgement call: a 50 GiB Linux sandbox needs a raised limit with no published price or approval path beyond support. - **Startup credits are $50k or $100k** (contradiction): The pricing page offers up to $50k in credits; the startups page offers up to $100k. Both are live. - **Audit logs are an Enterprise feature on one page and a permission on another** (contradiction): The pricing page lists SSO and audit logs under Enterprise; the audit-log page gates them by role instead, and says compliance export is coming soon. - **Roles do not protect running sandboxes** (open): Any member of an organisation, and any API key valid for it, can exec in every running sandbox whatever their role. A write:sandboxes key can also mount any secret in the organisation. - **The standard preview token is a sandbox-wide credential** (open): It is not restricted to the port requested, opens the web terminal and the toolbox, and cannot be revoked. Signed URLs are the shareable form: 60 seconds by default, 24 hours maximum. - **The open-source repository is archived** (open): The public repo says development moved to a private codebase in June 2026. The managed service is closed source, so the archived code is not what you are buying. - **Two documentation trees describe different products** (open): The default docs are v0.226; /docs/en/v2/ documents an alpha with different API hosts and a different macOS model, including Daytona-managed Mac reservations. ## Sources - [Docs](https://www.daytona.io/docs) - [Sandboxes](https://www.daytona.io/docs/en/sandboxes.md) - [Isolation](https://www.daytona.io/docs/en/isolation.md) - [Billing](https://www.daytona.io/docs/en/billing.md) - [Limits and tiers](https://www.daytona.io/docs/en/limits.md) - [Pricing](https://www.daytona.io/pricing) - [SLA](https://www.daytona.io/sla) - [Terms](https://www.daytona.io/terms-of-service) --- # E2B > Firecracker microVMs and templates for agent code, sold per running second. Website: https://e2b.dev Guide page: https://botperch.com/providers/e2b/ Checked: 2026-10-28 **Short answer:** One always-on personal agent (2 vCPU / 4 GiB / 20 GiB) costs about $270.89 a month here, with a catch: Sessions end after 24 hours, so an always-on machine has to be restarted by your own code. Fits well: A microVM with its own kernel, Docker, snapshots that keep memory, and up to 20 forks from a running sandbox. E2B sells isolated sandboxes for agents: a Linux VM created on demand from a template, driven through Python and JavaScript SDKs. It is infrastructure for a product rather than a finished assistant. Templates define what a sandbox starts with, including images built from Docker images, and the code-interpreter and desktop products run inside the sandbox. **Who it is for:** Developers integrating code execution, data analysis or computer use into an agent product. **Isolation:** Firecracker microVM with its own kernel, not a container. The default template user is user, not root; root can be set in a template. Docker is documented, but kernel features are not unlimited: the sandbox kernel does not ship xt_owner. **Sizes and regions:** Sized by vCPU and RAM: up to 8 vCPU, 8 GiB memory on Hobby and Pro, and 10 or 20 GiB of included disk. No GPU on any plan. Regions: US (GCP), US West (AWS), EU and APAC. ## How it charges - model: Per-second usage against a credit balance; Pro adds a monthly plan fee. - meter: $0.000014 per vCPU-second and $0.0000045 per GiB-second of allocated resources while running. Paused and killed sandboxes are not billed. - stopped: Nothing for compute. Volumes and snapshots are separate objects with their own storage. - planFee: Hobby has no fee; Pro is $150 a month plus usage; Enterprise has a $3,000 monthly minimum. - minimum: No published per-sandbox minimum. Hobby starts with a one-time $100 credit and no card. Per second on allocated vCPU and memory while running; paused sandboxes cost nothing. - Pausing keeps memory and files at no charge; volumes and snapshots are separate. - Sandbox storage is included at no extra cost, up to 10 GiB on Hobby and 20 GiB on Pro. ## Monthly cost for each preset workload - A personal agent that stays on (Hermes, OpenClaw): $270.89 (catch: Sessions end after 24 hours, so an always-on machine has to be restarted by your own code.) - A coding agent for one developer: $202.99 (catch: 40 GiB of disk is over the 20 GiB limit.) - A code interpreter inside your product: $55.20 - A browser agent for a small team: $828.00 - Self-hosted n8n for a small team: $270.89 (catch: Sessions end after 24 hours, so an always-on machine has to be restarted by your own code.) - A Discord or Slack bot for one server: $60.44 (catch: Sessions end after 1 hour, so an always-on machine has to be restarted by your own code.) - Claude Code for a team of five: $414.96 (catch: 40 GiB of disk is over the 20 GiB limit.) - A scraper that runs four times a day: $1.66 - Your own remote MCP server: $48.62 (catch: Sessions end after 1 hour, so an always-on machine has to be restarted by your own code.) - A: 1,000 short tasks: $27.60 - B: one always-on box: $241.78 (catch: 50 GiB of disk is over the 10 GiB limit. Sessions end after 1 hour, so an always-on machine has to be restarted by your own code.) - C: three hours a day: $164.90 ## Fits well - A microVM with its own kernel, Docker, snapshots that keep memory, and up to 20 forks from a running sandbox. - An agent that needs a real API and SDKs, plus templates built from any Docker image. - A team that needs a SOC 2 report and a HIPAA path without an enterprise contract. ## Fits badly - A long-running agent: the default timeout kills the sandbox after five minutes and commands do not reset it. - Memory above 8 GiB, or any GPU workload. - A client-facing link that must be private: public URLs have no authentication by default. ## Features - **Isolation** (yes): Firecracker; non-root user. A Firecracker microVM with its own kernel. Docker is documented, but the default template user is user, not root, and some kernel modules are missing. [source](https://docs.e2b.dev/security) [docs](https://docs.e2b.dev/faq/security-and-compliance#how-sandboxes-are-isolated) - **Sizes and regions** (partly): 8 vCPU / 8 GiB; no GPU. Up to 8 vCPU and 8 GiB, with 10 GiB of disk on Hobby and 20 GiB on Pro. Four regions, no GPU on any plan. [source](https://docs.e2b.dev/billing.md) [docs](https://docs.e2b.dev/billing) - **Lifecycle** (partly): RAM + disk. Pause saves the filesystem and RAM, so processes resume; a filesystem-only pause is opt-in. Kill is terminal, and the default timeout kills the sandbox after five minutes. [source](https://docs.e2b.dev/sandbox/persistence) [docs](https://docs.e2b.dev/sandbox) - **Snapshots and forks** (yes): RAM + disk; 20 forks. Snapshots capture filesystem and memory while the source keeps running, and filesystem-only snapshots are available. Up to 20 forks from a running VM, with a brief pause and dropped connections. [source](https://docs.e2b.dev/sandbox/fork.md) [docs](https://docs.e2b.dev/sandbox/snapshots) - **Storage** (partly): 10–20 GiB; volumes in beta. Snapshots keep the filesystem, and separate volumes persist across sandboxes, but volumes are in private beta and cannot be snapshotted. Included disk is 10 GiB on Hobby and 20 GiB on Pro. [source](https://docs.e2b.dev/faq/calculate-sandbox-price.md) [docs](https://docs.e2b.dev/volumes) - **Idle and waking** (partly): 5 min, then killed. A timeout defaults to five minutes and kills the sandbox; pausing instead is opt-in. Commands and URL requests do not reset it. Continuous runtime is capped at one hour on Hobby and 24 hours on Pro. [source](https://docs.e2b.dev/faq/sandbox-lifetime) [docs](https://docs.e2b.dev/faq/sandbox-lifetime) - **Reaching it** (partly): No auth. Public URLs are reachable by anyone who knows them, with no authentication by default. SSH runs through a WebSocket proxy rather than a native port. [source](https://docs.e2b.dev/network/public-url) [docs](https://docs.e2b.dev/network/public-url) - **Custom domains** (partly): Own proxy in front. No native custom domain. The documented path is a customer-operated GCP VM running Caddy and Cloudflare DNS in front of the sandbox. [source](https://docs.e2b.dev/network/custom-domain) [docs](https://docs.e2b.dev/network/custom-domain) - **Outbound network** (yes): No rate; no static IP. Outbound is open by default with documented domain and IP allow and deny rules. No dedicated or static egress IP on any plan, including Enterprise. [source](https://docs.e2b.dev/faq/egress-ip-ranges) [docs](https://docs.e2b.dev/network/internet-access) - **Keys and secrets** (yes): No, proxy. An egress proxy injects the real value into matching outbound HTTPS requests outside the sandbox. The destination receives the value and could expose it in its response. [source](https://docs.e2b.dev/secrets) [docs](https://docs.e2b.dev/secrets) - **Ways to drive it** (yes): No; SDK. Python and JavaScript SDKs, a CLI, SSH through a WebSocket proxy, a desktop SDK, an MCP gateway inside the sandbox and lifecycle webhooks. [source](https://docs.e2b.dev/sandbox/ssh-access) [docs](https://docs.e2b.dev/cli) - **Built-in agents** (partly): None preinstalled; guides. Guides show Claude Code, Codex and Amp running in a sandbox, but preinstallation is not claimed and there is no hosted agent-run API. [source](https://docs.e2b.dev/use-cases/coding-agents) [docs](https://docs.e2b.dev/agents/hermes) - **Teams and accounts** (partly): Per-project limit. A workspace shares payment, credits and invoice; each project has its own plan and spending limit. SOC 2 Type II and a HIPAA BAA path. SSO and audit coverage are not published. [source](https://docs.e2b.dev/workspaces) [docs](https://docs.e2b.dev/workspaces) - **Billing models** (partly): $0.000014/vCPU-s. Per second of allocated vCPU and RAM while running, against a credit balance. Paused and killed sandboxes are not billed. Pro adds a $150 monthly fee; Hobby has a one-time $100 credit. [source](https://e2b.dev/pricing.md) [docs](https://docs.e2b.dev/billing) - **Trials and free tiers** (yes): $100 one-off. A one-time $100 usage credit on Hobby, with no card to start. When it runs out without a payment method, every project in the workspace is blocked shortly afterwards. [source](https://e2b.dev/pricing.md) [docs](https://e2b.dev/pricing) - **The company** (partly): FoundryLabs, Inc.; SOC 2 II. FoundryLabs, Inc., Delaware. Founded 2023 by Vasek Mlejnsky (CEO) and Tomas Valenta (CTO); $21M Series A in July 2025, $32M total. Status page shows 99.78% for US-West-1 over Jul–Oct 2026, a regional aggregate rather than an SLA. Enterprise terms set uptime and support in the agreement; no public numeric SLA for Hobby or Pro. SOC 2 Type II report on request and a HIPAA BAA path. Fees can change with 30 days' notice, but general terms changes take effect immediately; deletion after cancellation has no published deadline. [source](https://docs.e2b.dev/security.md) ## Capabilities - Its own virtual machine: yes (Firecracker microVM) [source](https://docs.e2b.dev/security) - Root access: yes (root via template). The default template runs as an ordinary user called user, not root; root has to be set in the template. [source](https://docs.e2b.dev/template/user-and-workdir) - Docker inside: yes (Docker image documented) [source](https://docs.e2b.dev/template/examples/docker) - Nested virtualisation: not-published [source](https://docs.e2b.dev/faq) - Your own image: yes (any Docker image) [source](https://docs.e2b.dev/template/base-image) - Any size you like: partly (up to 8 cores / 8 GiB). You can choose cores and memory, but only up to 8 of each; more needs a conversation with support. [source](https://docs.e2b.dev/billing) - Large machines: no (8 cores / 8 GiB). The ceiling is 8 cores and 8 GB of memory, so a 32 GB machine cannot be bought. [source](https://docs.e2b.dev/billing) - Resize while running: no (fixed at creation). The machine keeps the size it was created with; there is no resize. [source](https://docs.e2b.dev/billing) - GPUs: no (CPU only). There is no graphics processor option in any plan, tool or template. [source](https://docs.e2b.dev/faq) - Choose the region: partly (4 regions, support needed). Four regions exist, but outside the United States you have to contact support to be switched on. [source](https://docs.e2b.dev/faq/eu-region) - Runs in the EU: yes (europe-west1) [source](https://docs.e2b.dev/faq/eu-region) - Pause keeps memory: yes [source](https://docs.e2b.dev/sandbox/persistence) - Pre-started pools: no [source](https://docs.e2b.dev/sandbox) - Starts in under a second: not-published [source](https://docs.e2b.dev/sandbox) - Snapshots of files: yes [source](https://docs.e2b.dev/sandbox/persistence) - Snapshots with memory: yes [source](https://docs.e2b.dev/sandbox/fork) - Copy a running machine: yes (Up to 20 at once). The source pauses while it is copied and its open connections drop. [source](https://docs.e2b.dev/sandbox/fork) - Pick an older snapshot: yes [source](https://docs.e2b.dev/sandbox/snapshots) - Reusable templates: yes [source](https://docs.e2b.dev/template/how-it-works.md) - Automatic backups: no [source](https://docs.e2b.dev/sandbox/snapshots) - Files survive a stop: no [source](https://docs.e2b.dev/sandbox/persistence) - Separate volumes: partly. Volumes exist but are in private beta and need access from support. [source](https://docs.e2b.dev/volumes) - One volume, several machines: partly. One volume can serve several sandboxes, but volumes are in private beta. [source](https://docs.e2b.dev/volumes) - Mount outside storage: partly. Mounting a bucket needs a custom template with the right filesystem tool installed; it is not built in. [source](https://docs.e2b.dev/storage/cloud-buckets) - Large disk: no (20 GiB max). The largest included disk is 20 GiB, short of 100 GB. [source](https://docs.e2b.dev/billing) - Can stay on indefinitely: partly (1 h Hobby, 24 h Pro). A sandbox cannot run longer than an hour on the free plan or 24 hours on Pro, whether or not it is busy. [source](https://docs.e2b.dev/billing) - Choose the idle timeout: partly (5 min, max 24 h). The clock counts down from creation and commands do not reset it, and the default action is to kill rather than pause. [source](https://docs.e2b.dev/faq/sandbox-lifetime) - Wakes on a request: yes [source](https://docs.e2b.dev/faq/sandbox-lifetime) - Scheduled runs: no [source](https://docs.e2b.dev/llms.txt) - Public link to a port: yes (Anyone with the link) [source](https://docs.e2b.dev/network/public-url.md) - Private link: no. There is no built-in lock: anyone who has the link can open it. [source](https://docs.e2b.dev/network/public-url.md) - Real SSH: partly (You build the image). SSH only works if you build a custom image with an SSH server and a relay inside it. [source](https://docs.e2b.dev/sandbox/ssh-access.md) - Terminal in the browser: not-published [source](https://docs.e2b.dev/sandbox/ssh-access.md) - Tunnel to your computer: not-published [source](https://docs.e2b.dev/sandbox/ssh-access.md) - Non-web ports: not-published [source](https://docs.e2b.dev/network/public-url.md) - Your own domain: partly (Own proxy). You have to run a server of your own in front of the machine to use your domain. [source](https://docs.e2b.dev/network/custom-domain.md) - Automatic HTTPS: no. The certificate is obtained by the server you run in front of the machine, not by the provider. [source](https://docs.e2b.dev/network/custom-domain.md) - Outbound data included: not-published [source](https://docs.e2b.dev/pricing.md) - Allow only some sites: yes (Domain or address list) [source](https://docs.e2b.dev/network/internet-access.md) - Turn the internet off: yes (On/off switch) [source](https://docs.e2b.dev/network/internet-access.md) - Fixed outgoing IP: no. There is no dedicated or fixed outbound address on any plan, including Enterprise. [source](https://docs.e2b.dev/faq/egress-ip-ranges.md) - Stored secrets: yes (Per project) [source](https://docs.e2b.dev/secrets.md) - Secrets the agent cannot read: yes (Outside the machine) [source](https://docs.e2b.dev/secrets.md) - Limited API keys: partly (One key per team). A key belongs to one team and there is no published read-only or per-machine scope. [source](https://docs.e2b.dev/api-key.md) - Create from the website: no [source](https://docs.e2b.dev/quickstart.md) - Command-line tool: yes [source](https://docs.e2b.dev/cli.md) - Python SDK: yes [source](https://docs.e2b.dev/quickstart.md) - TypeScript SDK: yes [source](https://docs.e2b.dev/llms.txt) - Documented HTTP API: yes [source](https://docs.e2b.dev/api-reference/sandboxes/create-sandbox-v2.md) - MCP server: partly. E2B's MCP support runs other companies' tools inside a sandbox; nothing of E2B's lets your assistant create sandboxes. [source](https://docs.e2b.dev/mcp-gateway.md) - Interactive terminal over the API: yes [source](https://docs.e2b.dev/sandbox/pty.md) - Files over the API: yes [source](https://docs.e2b.dev/filesystem.md) - Coding agents preinstalled: partly. A prebuilt Hermes template exists, but the default image has no agent and there is no Claude Code or Codex template. [source](https://docs.e2b.dev/agents/hermes.md) - Send it a prompt: no. Guides show agents running in a sandbox, but no API takes a prompt and runs one for you. [source](https://docs.e2b.dev/use-cases/coding-agents.md) - One-click Hermes: partly. A prebuilt template is ready, but you still create the sandbox with a command and pay by usage. [source](https://docs.e2b.dev/agents/hermes.md) - One-click OpenClaw: no. No OpenClaw template or guide is published. [source](https://docs.e2b.dev/use-cases/coding-agents.md) - Browser built in: partly. A browser comes with the desktop image or through Kernel cloud browsers, not in the default sandbox image. [source](https://docs.e2b.dev/use-cases/remote-browser.md) - Desktop for computer use: yes [source](https://docs.e2b.dev/use-cases/computer-use.md) - Runs other platforms' agents: yes [source](https://docs.e2b.dev/agents/claude-managed-agents.md) - Team workspace: yes [source](https://docs.e2b.dev/workspaces.md) - Roles and permissions: not-published [source](https://docs.e2b.dev/workspaces.md) - Single sign-on: not-published [source](https://docs.e2b.dev/workspaces.md) - Hard spending cap: yes [source](https://docs.e2b.dev/workspaces.md) - Usage alerts: not-published [source](https://docs.e2b.dev/workspaces.md) - Audit log: not-published [source](https://docs.e2b.dev/security.md) - Billed per second: yes (per second) [source](https://e2b.dev/pricing.md) - CPU billed only while working: no (allocated size). The bill follows the cores and memory you gave the machine, not what it used. [source](https://docs.e2b.dev/faq/calculate-sandbox-price) - Paused costs only storage: yes (nothing while paused) [source](https://docs.e2b.dev/faq/calculate-sandbox-price) - No monthly fee: yes (none on Hobby) [source](https://e2b.dev/pricing.md) - Flat monthly price: no (per second parts). The bill is cores plus memory per second. [source](https://e2b.dev/pricing.md) - Ongoing free tier: no (one-off $100). The $100 is a one-time credit, not a monthly allowance. [source](https://e2b.dev/pricing.md) - Free starting credit: yes ($100) [source](https://e2b.dev/pricing.md) - Try without a card: yes (no card) [source](https://e2b.dev/pricing.md) - Public status page: yes [source](https://e2b.dev/pricing) - Uptime promise (SLA): partly. Uptime and support terms are set in the Enterprise agreement; Hobby and Pro have no public numeric SLA. [source](https://e2b.dev/enterprise.md) - SOC 2 report: yes (Type II) [source](https://docs.e2b.dev/security.md) - Data processing agreement: yes [source](https://docs.e2b.dev/security.md) - Open source or self-hostable: yes (Embed, one machine) [source](https://docs.e2b.dev/byoc.md) ## Usability - Dashboard: A console exists for support and API keys, but the documented path is SDKs, a CLI and API keys. - Without code: No documented no-code path. Examples are SDK calls, terminals and templates; the desktop SDK still needs code to drive it. - Signup: No credit card to start, and a one-time $100 credit. When a workspace without a payment method runs out, every project in it is blocked shortly afterwards. - Docs: Extensive docs with per-page Markdown. Support is through the console. SOC 2 Type II is reported, and a HIPAA BAA can be requested. - Trips people up: The default timeout is 5 minutes and the default action is to kill the sandbox. - Trips people up: Public URLs are reachable by anyone who knows them. - Trips people up: The pricing page and billing docs disagree on the default sandbox size. - Trips people up: Volumes are in private beta and cannot be snapshotted. ## Company - Legal entity: FoundryLabs, Inc., a Delaware corporation. [source](https://docs.e2b.dev/security.md) - Founded: 2023, by Vasek Mlejnsky (CEO) and Tomas Valenta (CTO). [source](https://e2b.dev/about.md) - Funding: $21M Series A in July 2025, led by Insight Partners; $32M total at that announcement. [source](https://e2b.dev/resources/series-a.md) - Headcount: About 25, a third-party estimate from June 2026. No company-confirmed figure is published. [source](https://rywalker.com/research/e2b) - Status and SLA: 99.78% for US-West-1 over July–October 2026. Uptime and support terms are set in the enterprise agreement. [source](https://status.e2b.dev/) - Certification: SOC 2 Type II report and a HIPAA BAA path, both by request through the Trust Center. [source](https://docs.e2b.dev/security.md) ## Caveats - **The default timeout destroys the sandbox** (open): Every sandbox has a timeout defaulting to five minutes, and onTimeout: 'kill' is the default. Pausing instead is opt-in. - **The default sandbox size is stated two ways** (contradiction): The pricing page says the default is 2 vCPU / 4 GiB; the billing docs say 2 vCPU / 512 MiB. Both are current provider statements. - **Volumes are in private beta** (open): Volumes persist across sandboxes but file locking can hang, metadata caching is disabled and snapshots are not supported. - **No static egress IP on any plan** (open): There are no dedicated or static egress addresses, including Enterprise; a customer-operated proxy is the documented workaround. - **Public URLs have no authentication by default** (open): A sandbox's public URLs are reachable by anyone who knows them. ## Sources - [Docs](https://docs.e2b.dev/) - [Persistence](https://docs.e2b.dev/sandbox/persistence) - [Snapshots](https://docs.e2b.dev/sandbox/snapshots) - [Fork](https://docs.e2b.dev/sandbox/fork) - [Pricing](https://e2b.dev/pricing) - [Security](https://docs.e2b.dev/security) --- # InstaBox > Firecracker machines with a browser desktop, sold as a subscription that is also a monthly credit. Website: https://instabox.sh Guide page: https://botperch.com/providers/instabox/ Checked: 2026-10-28 **Short answer:** One always-on personal agent (2 vCPU / 4 GiB / 20 GiB) costs about $20.00 a month here, the 4th cheapest of the 11 providers that run it as described. Fits well: A real free plan: one 4 vCPU / 8 GiB machine that never converts and needs no card. InstaBox sells full Linux virtual machines, one per AI agent, that boot in about a second, keep their disk between sessions, and can be paused with memory and running processes intact. Each machine is a Firecracker microVM running Debian 13 with its own kernel, root, systemd and Docker. You drive it from a web dashboard, a CLI, a TypeScript SDK or plain HTTP, and you can watch or take over its graphical desktop. The intended buyer is a team running coding or computer-use agents that needs a real machine per task, not a single shared dev box. InstaBox is not InstaCloud, InsForge's separate managed-backend product. **Who it is for:** Teams and individuals running agents that need a persistent, general-purpose Linux box with a browser and desktop, who are comfortable with a CLI or API. **Isolation:** Firecracker microVM with its own kernel, root and passwordless sudo. Docker works. Templates are versioned images; you cannot bring your own OCI image. **Sizes and regions:** Fixed vCPU/RAM pairs by plan: Free is 4/8 only; Pro adds 2/4 and 8/16; Builder goes to 16/32; Team to 32/64. One disk at /data, 20 GiB by default, growable live to 200 GiB on Pro. ## How it charges - model: Monthly subscription that is also a credit: $20, $100 or $500, reset monthly. - meter: Per second while running, on the size you asked for: $0.004 per vCPU-hour, $0.00225 per GiB-hour, $0.00011 per GiB-hour of storage, $0.02 per GiB of egress. - stopped: Storage only. Paused and stopped machines pay GiB-hours for their disk and snapshots; paused memory is not billed and does not count as stored data. - planFee: The plan fee is the credit. Usage comes out of it first, then pay-as-you-go, and unused credit expires at month end. - minimum: $20 a month on Pro, or the free plan: one 4/8 machine, five snapshots, 100 GiB of egress a month. Per second on the size you asked for, out of a monthly plan that is also a credit; storage bills in every state. - The free plan is one 4 vCPU / 8 GiB machine that pauses after 30 idle minutes; it is not priced here. - Egress is $0.02 per GiB and is not included. ## Monthly cost for each preset workload - A personal agent that stays on (Hermes, OpenClaw): $20.00 - A coding agent for one developer: $20.00 - A code interpreter inside your product: $20.00 - A browser agent for a small team: $90.50 - Self-hosted n8n for a small team: $20.00 - A Discord or Slack bot for one server: $20.00 - Claude Code for a team of five: $43.26 - A scraper that runs four times a day: $20.00 - Your own remote MCP server: $20.00 - A: 1,000 short tasks: $20.00 - B: one always-on box: $28.84 - C: three hours a day: $20.00 ## Fits well - A real free plan: one 4 vCPU / 8 GiB machine that never converts and needs no card. - A browser desktop and a dashboard that creates the machine without a terminal. - Claude Code and Codex in the default image, with logins that persist in /data/home. ## Fits badly - An always-on agent on the free plan, which always pauses at 30 idle minutes. - A client-facing service on your own address: there is no custom domain, and only private ports carry a token. - A US-only data-residency requirement with a published region selector or status page. ## Features - **Isolation** (yes): Firecracker; root + Docker. A Firecracker microVM running Debian 13 with its own kernel, root, passwordless sudo and Docker. [source](https://instabox.sh/) [docs](https://instabox.sh/docs/limits) - **Sizes and regions** (partly): 32 vCPU / 64 GiB; US only. Fixed vCPU/RAM pairs by plan, from 2/4 to 32/64, one 20 GiB disk that grows live. No published region selector; the terms say the United States. [source](https://instabox.sh/docs/limits) [docs](https://instabox.sh/docs/limits) - **Lifecycle** (partly): RAM; 1 s resume. Pause keeps memory and running programs and resumes in about a second; stop loses them, and a paused machine cannot be stopped at all. A resume can cold-boot and report processesPreserved false. [source](https://instabox.sh/docs/integrate) [docs](https://instabox.sh/docs/machines) - **Snapshots and forks** (partly): Disk only; may stop source. Snapshots are disk-only and may stop the machine to take them; a fork is snapshot-save plus create, not an instant clone; snapshots survive deleting the machine and include saved logins. [source](https://instabox.sh/docs/snapshots) [docs](https://instabox.sh/docs/snapshots) - **Storage** (partly): 20 GiB at /data. One disk at /data, 20 GiB by default and growable, with the root disk owned by the template. No volumes and no second disk; the free plan's disk is fixed. [source](https://instabox.sh/docs/limits) [docs](https://instabox.sh/docs/limits) - **Idle and waking** (partly): 30 min idle. Paid machines have no lifetime timeout, but idle auto-pause defaults to 30 minutes; paid plans can choose 5–30 minutes or off. Nothing deletes a paused or stopped machine: there is no forced TTL. [source](https://instabox.sh/docs/concepts) [docs](https://instabox.sh/docs/machines) - **Reaching it** (partly): Public or token-only links. An HTTPS link per port, up to 16, either public or private behind a replaceable token. SSH and mosh go through a gateway. Raw non-web ports are in an admin-only preview, later paid plans only with 5 per workspace. No custom domain. [source](https://instabox.sh/docs/ports.md) [docs](https://instabox.sh/docs/ports) - **Custom domains** (not-published): Not published. No custom-domain support is published. The public-port URL is a fixed vendor subdomain, and the OpenAPI PublicPort object has only port, name, url and machineId, with no customDomain or cname field. No roadmap entry exists. [source](https://instabox.sh/docs/ports) - **Outbound network** (partly): 100 GiB–50 TiB included. No general egress allowlist is published; host scoping applies to Secrets, not all sandbox traffic. Each plan includes egress every month (100 GiB Free, 1 TiB Pro, 5 TiB Builder, 50 TiB Team), then $0.02 per GiB. Outbound addresses are not published. [source](https://instabox.sh/pricing) [docs](https://instabox.sh/docs/limits) - **Keys and secrets** (yes): No, proxy on 443. Org Secrets in proxy mode: the sandbox sees an ibsec_ placeholder and the real value is added only to HTTPS headers on port 443 to named hosts. Env mode exposes the value. [source](https://instabox.sh/docs/secrets) [docs](https://instabox.sh/docs/secrets) - **Ways to drive it** (partly): Yes, dashboard. REST, a TypeScript SDK, a CLI, SSH and mosh through a gateway, a web terminal and a VNC desktop. No control-plane MCP is published. [source](https://instabox.sh/docs/start) [docs](https://instabox.sh/docs/keys-sdk) - **Built-in agents** (yes): Claude Code + Codex. Claude Code and Codex are in the default and agent templates, and sign-ins persist because home is /data/home. There is no hosted agent-run API. [source](https://instabox.sh/docs/limits) [docs](https://instabox.sh/docs/limits) - **Teams and accounts** (partly): Monthly cap stops machines. Organisations and workspaces with roles, scoped keys and a monthly spend cap that stops machines. SSO, SCIM and audit logs are Enterprise only. [source](https://api.instabox.sh/v1/openapi.json) [docs](https://instabox.sh/docs/api/account) - **Billing models** (yes): $20 plan, then usage. A subscription that is also credit: $20, $100 or $500 a month, then per-second vCPU and RAM, GiB-hour storage and $0.02 per GiB of egress. Paused and stopped machines pay storage only. [source](https://instabox.sh/pricing) [docs](https://instabox.sh/docs/pricing) - **Trials and free tiers** (yes): Free plan, 1 machine. A real free plan: one 4 vCPU / 8 GiB machine, 20 GiB fixed disk, five snapshots, 100 GiB egress, a fixed 30-minute idle pause and two templates. It never converts. [source](https://instabox.sh/pricing) [docs](https://instabox.sh/docs/pricing) - **The company** (partly): InsForge AI, Inc.; 99.9% Enterprise. InsForge AI, Inc., Delaware; InstaBox is its second product, launched 14 October 2026 and priced 19 October. Founded 2025 by Hang Huang (CEO) and Tony Chang (CTO), YC Spring 2026, six people, $8M seed in September 2026. The YC badge is on insforge.dev, not instabox.sh. No public status page; per-machine metrics only. 99.9% SLA on Enterprise only, with no credits or measurement published. HIPAA badge only; no SOC 2 report, ISO or public DPA. Fees non-refundable; terminate through support. [source](https://instabox.sh/pricing) ## Capabilities - Its own virtual machine: yes (Firecracker microVM) [source](https://instabox.sh/docs/limits.md) - Root access: yes (passwordless sudo) [source](https://instabox.sh/docs/limits.md) - Docker inside: yes (Docker on default image) [source](https://instabox.sh/docs/limits.md) - Nested virtualisation: not-published [source](https://instabox.sh/docs/limits.md) - Your own image: partly (operator-built templates). You pick from fixed images or a saved copy; a different starting image needs an operator to build one for you. [source](https://instabox.sh/docs/limits.md) - Any size you like: no (fixed pairs by plan). Each plan sells fixed pairs of cores and memory, and any other combination is refused. [source](https://instabox.sh/docs/limits.md) - Large machines: yes (32 cores / 64 GiB). Only on the $500-a-month plan or above. [source](https://instabox.sh/docs/limits.md) - Resize while running: partly (only while stopped). Cores and memory change only while the machine is stopped, and take effect at its next start; the free plan cannot resize at all. [source](https://instabox.sh/docs/machines.md) - GPUs: no (no GPU). No graphics processor is offered on any plan. [source](https://instabox.sh/docs/limits.md) - Choose the region: no (no region setting). There is no region setting anywhere in the tools or docs, so you cannot ask for a European machine. [source](https://instabox.sh/docs/limits.md) - Runs in the EU: no (US only). There is no European region and no way to ask for one. [source](https://instabox.sh/docs/limits.md) - Pause keeps memory: partly (RAM; 1 s resume). A resume can come back without the running programs, and the machine reports that it did. [source](https://instabox.sh/docs/machines.md) - Pre-started pools: no [source](https://instabox.sh/docs/pricing.md) - Starts in under a second: partly (About a second). A resume usually takes about a second, which is not under one. [source](https://instabox.sh/docs/integrate.md) - Snapshots of files: yes [source](https://instabox.sh/docs/snapshots.md) - Snapshots with memory: no [source](https://instabox.sh/docs/snapshots.md) - Copy a running machine: partly (A few seconds). A copy is made in a few seconds and carries the files but not the running programs. [source](https://instabox.sh/docs/snapshots.md) - Pick an older snapshot: yes [source](https://instabox.sh/docs/snapshots.md) - Reusable templates: yes [source](https://instabox.sh/docs/snapshots.md) - Automatic backups: no [source](https://instabox.sh/docs/snapshots.md) - Files survive a stop: yes [source](https://instabox.sh/docs/machines.md) - Separate volumes: no [source](https://instabox.sh/docs/limits.md) - One volume, several machines: no [source](https://instabox.sh/docs/limits.md) - Mount outside storage: no [source](https://instabox.sh/docs/limits.md) - Large disk: yes (Up to 1024 GiB) [source](https://instabox.sh/docs/limits.md) - Can stay on indefinitely: partly (Paid plans only). Only paid plans can switch off the idle pause; on the free plan a machine always pauses after 30 idle minutes, though nothing is deleted and it wakes when used. [source](https://instabox.sh/docs/machines.md) - Choose the idle timeout: partly (5–30 min or off). Only paid plans can choose; the free plan is fixed at 30 minutes and cannot turn it off. [source](https://instabox.sh/docs/concepts.md) - Wakes on a request: partly. Only a machine the platform paused for being idle wakes on a request; one you paused yourself has to be resumed. [source](https://instabox.sh/docs/machines.md) - Scheduled runs: no [source](https://instabox.sh/docs/concepts.md) - Public link to a port: yes (16 ports) [source](https://instabox.sh/docs/ports.md) - Private link: yes (Token in link) [source](https://instabox.sh/docs/ports.md) - Real SSH: yes (Gateway, short cert) [source](https://instabox.sh/docs/ssh.md) - Terminal in the browser: yes (Dashboard) [source](https://api.instabox.sh/v1/openapi.json) - Tunnel to your computer: yes (ssh -L, yours only) [source](https://instabox.sh/docs/ssh.md) - Non-web ports: partly (Preview, 5 per workspace). Raw non-web traffic is in a preview only administrators can use, and later will be paid-plan only with five ports per workspace. [source](https://instabox.sh/docs/ports.md) - Your own domain: not-published [source](https://instabox.sh/docs/ports.md) - Automatic HTTPS: not-published [source](https://instabox.sh/docs/ports.md) - Outbound data included: yes (100 GiB free) [source](https://instabox.sh/docs/pricing.md) - Allow only some sites: no. There is no setting that limits which sites a machine may reach. [source](https://api.instabox.sh/v1/openapi.json) - Turn the internet off: not-published [source](https://instabox.sh/docs/limits.md) - Fixed outgoing IP: not-published [source](https://instabox.sh/docs/limits.md) - Stored secrets: yes (Org secrets) [source](https://instabox.sh/docs/secrets.md) - Secrets the agent cannot read: yes (Web headers only) [source](https://instabox.sh/docs/secrets.md) - Limited API keys: yes (Per-resource scopes) [source](https://api.instabox.sh/v1/openapi.json) - Create from the website: yes [source](https://instabox.sh/docs/start.md) - Command-line tool: yes [source](https://instabox.sh/docs/start.md) - Python SDK: partly. A Python library is named in one place but has no page, package name or install command. [source](https://instabox.sh/docs/limits.md) - TypeScript SDK: yes [source](https://instabox.sh/docs/sdk.md) - Documented HTTP API: yes [source](https://instabox.sh/docs/api.md) - MCP server: no. No MCP server is published for the InstaBox API, so an assistant cannot create machines through one. [source](https://instabox.sh/docs/llms.txt) - Interactive terminal over the API: yes [source](https://api.instabox.sh/v1/openapi.json) - Files over the API: yes [source](https://instabox.sh/docs/api/commands.md) - Coding agents preinstalled: yes [source](https://instabox.sh/docs/limits.md) - Send it a prompt: no. There is no prompt endpoint; the API offers exec, files, desktop and snapshots. [source](https://instabox.sh/docs/api/commands.md) - One-click Hermes: no. No Hermes template, guide or one-click route is documented. [source](https://instabox.sh/docs/limits.md) - One-click OpenClaw: no. No OpenClaw template or guide is published. [source](https://instabox.sh/docs/limits.md) - Browser built in: yes [source](https://instabox.sh/docs/desktop.md) - Desktop for computer use: yes [source](https://instabox.sh/docs/desktop.md) - Runs other platforms' agents: no. No page documents another platform's cloud agents using InstaBox. [source](https://instabox.sh/docs/llms.txt) - Team workspace: yes [source](https://api.instabox.sh/v1/openapi.json) - Roles and permissions: yes [source](https://api.instabox.sh/v1/openapi.json) - Single sign-on: partly. Company sign-in, SAML and automatic user sync are listed only on the Enterprise plan. [source](https://instabox.sh/pricing) - Hard spending cap: yes [source](https://api.instabox.sh/v1/openapi.json) - Usage alerts: yes [source](https://api.instabox.sh/v1/openapi.json) - Audit log: partly. Audit logs are listed only on the Enterprise plan. [source](https://instabox.sh/pricing) - Billed per second: yes (per second) [source](https://instabox.sh/docs/pricing.md) - CPU billed only while working: no (size while running). A waiting machine costs the same as a busy one of the same size. [source](https://instabox.sh/docs/pricing.md) - Paused costs only storage: yes (storage only) [source](https://instabox.sh/docs/pricing.md) - No monthly fee: no ($20 minimum plan). The free plan is capped at one machine, and anything more needs a $20-a-month plan. [source](https://instabox.sh/docs/pricing.md) - Flat monthly price: no (metered parts). The bill is cores plus memory per second, plus storage. [source](https://instabox.sh/docs/pricing.md) - Ongoing free tier: yes (1 machine, 4 cores / 8 GiB) [source](https://instabox.sh/docs/pricing.md) - Free starting credit: no (none). There is no starting credit; the free plan is a machine, and paid plans include usage equal to their fee. [source](https://instabox.sh/docs/pricing.md) - Try without a card: yes (free plan) [source](https://instabox.sh/docs/pricing.md) - Public status page: not-published [source](https://instabox.sh/docs/start.md) - Uptime promise (SLA): partly (99.9%, Enterprise). A 99.9% promise is listed only on the Enterprise plan, with no published measurement or credits. [source](https://instabox.sh/pricing) - SOC 2 report: not-published [source](https://instabox.sh/pricing) - Data processing agreement: not-published [source](https://instabox.sh/terms) - Open source or self-hostable: no. InstaBox is a hosted service; no self-hosted or open-source edition is published. [source](https://instabox.sh/docs/start.md) ## Usability - Dashboard: Yes, a full console: create a machine from a template with a button, start/stop/pause, open the Computer tab to click the Linux desktop, publish ports, save snapshots from the Playground, read metrics and billing. - Without code: Partly. Creating a machine, opening its desktop, using Chromium, publishing a port and saving a snapshot are all click-driven. Claude Code and Codex are preinstalled, so you can type a plain-English request into the box's terminal. There is no hosted agent product and no prompt-in, result-out API. - Signup: GitHub or Google. Whether a brand-new free account needs a card is not published: the pricing page says $0, while the API has a cardMissingAt state that blocks free machines. Paid plans subscribe by card in the dashboard. - Docs: 26 pages, each available as Markdown, plus an llms-full.txt bundle; every page states limits and failure modes. Support is email on paid plans, priority on Team, and there is a Discord. No public status page was found. - Trips people up: The quick start is a terminal command, npx instabox@latest sh. - Trips people up: Two different off switches: pause keeps the session, stop does not, and you cannot stop a paused machine. - Trips people up: A snapshot does not save the session, only files and installs. - Trips people up: Fork is not instant, despite the homepage. - Trips people up: The free machine is not a server: it always pauses after 30 idle minutes. - Trips people up: Public port URLs have no password. ## Company - Legal entity: InsForge AI, Inc., a Delaware corporation. InstaBox is a product line, not a separate company. [source](https://instabox.sh/terms) - History: Public launch 14 October 2026; pricing went live 19 October 2026. The company was founded in 2025. [source](https://instabox.sh/blog/instabox-pricing) - Funding: $8M seed announced 29 September 2026; investors and valuation were not disclosed. [source](https://dealroom.co/news/158042-insforge-raises-8m-seed-to-build-cloud-infrastructure-for-ai-agents/) - Headcount: 6, per Y Combinator's directory and Dealroom. Founders are Hang Huang (CEO) and Tony Chang (CTO). [source](https://www.ycombinator.com/companies/insforge-instacloud) - Status and SLA: No status page. A 99.9% SLA is listed on Enterprise only, with no credits or measurement published. [source](https://instabox.sh/pricing) - Certification: The Trust Center lists HIPAA only and describes InsForge, not InstaBox. No SOC 2 badge. [source](https://app.vanta.com/insforge.dev/trust/9dxtxcntvvv5ow2tx7e4dm) - YC badge: Displayed on insforge.dev, not on instabox.sh. [source](https://insforge.dev/) ## Caveats - **The homepage says a fork copies running processes; the docs say otherwise** (contradiction): Marketing says fork a machine mid-run and copy a running machine in seconds, listing Running Processes. The docs say fork is snapshot save plus create, and a snapshot does not hold memory or running processes. - **An 8-hour free run cap has left the docs** (open): Earlier research found MaxRunMinutes defaulting to 480 for free machines in the API schema. On 29 October no docs or API page mentions it and the machines page says there is no forced TTL, so the guide no longer states a cap. - **Docs and API disagree on whether a preview visit wakes a paused machine** (contradiction): The ports page says a visit wakes an idle-paused machine; the OpenAPI says preview links remain offline until resumed. - **Whether the free plan needs a card** (open): The pricing page says $0 and Get started; the API has a card-missing state that makes free sandboxes answer 402. It may apply only to workspaces that once had a paid plan. - **Snapshots carry credentials** (open): Home is /data/home, so saved GitHub, Claude, Codex, git and SSH logins travel into every machine built from a snapshot. - **No published regions and no status page** (open): The Terms say the United States; there is no region selector. status.instabox.sh does not resolve. ## Sources - [Docs](https://instabox.sh/docs) - [Lifecycle](https://instabox.sh/docs/api/lifecycle) - [Machines](https://instabox.sh/docs/machines) - [Snapshots](https://instabox.sh/docs/snapshots) - [Secrets](https://instabox.sh/docs/secrets) - [Pricing](https://instabox.sh/pricing) - [OpenAPI document](https://api.instabox.sh/v1/openapi.json) --- # Lizard > Firecracker sandboxes at a flat hourly price per size, plus an app platform for whatever the agent builds. Website: https://lizard.build Guide page: https://botperch.com/providers/lizard/ Checked: 2026-10-28 **Short answer:** One always-on personal agent (2 vCPU / 4 GiB / 20 GiB) costs about $19.00 a month here, the 2nd cheapest of the 11 providers that run it as described. Fits well: A flat hourly price per size with a $19 plan, billed per second including idle time. Lizard is a cloud platform with two halves. Sandboxes are Firecracker microVMs for running agent code, sold in three fixed sizes at a flat hourly price. An app platform deploys a repository, with managed Postgres, Redis and S3-compatible storage. The docs describe the sandbox half first and treat app deployment as the second step, once the agent has built something. The two halves are billed on different meters, which is the most confusing thing about the product. The self-serve plans are Pro at $19 a month, Pro 5x at $99 and Pro 20x at $499; each includes its own fee back as usage across the whole platform, and the bigger two raise the sandbox limits. **Who it is for:** Agent builders who want cheap per-hour machines with generous pause and snapshot semantics, and who may want to deploy the result on the same platform. **Isolation:** Firecracker microVM with its own guest kernel, commands run as root by default, Linux only. Docker inside a sandbox, systemd and nested virtualisation are not documented. **Sizes and regions:** Three fixed sizes: Small 2 vCPU / 4 GB / 5 GB, Medium 4 vCPU / 8 GB / 20 GB, Large 8 vCPU / 16 GB / 50 GB. No custom size and no live resize. Volumes add up to 50 GB at /workspace. ## How it charges - model: Three plans, Pro at $19, Pro 5x at $99 and Pro 20x at $499 a month, each including its fee as usage; sandboxes are a flat hourly price per size. - meter: Per second while running, idle time included, at $0.0162 / $0.0324 / $0.0648 an hour for Small / Medium / Large. Volumes bill per GB-month on used space. - stopped: Paused compute is $0, and no storage charge for a paused sandbox's disk or memory is published. A stopped sandbox is deleted, so only volumes and snapshots remain. - planFee: $19 (Pro), $99 (Pro 5x) or $499 (Pro 20x) a month, each coming back as the same amount of usage. Unused usage does not carry over. - minimum: $19 a month is the floor. The 7-day trial includes $5 of usage and needs a card. A flat hourly price per size, idle time included, from a $19 plan that comes back as usage. - Between sessions the machine is paused, not stopped: a stopped sandbox is deleted. No storage charge for a paused sandbox is published. - Extra disk is a volume at $0.14 per GB-month of used space. - Sandbox egress is included up to 2 TB per rolling 30 days; the price beyond that is not published. - Pro 5x ($99) and Pro 20x ($499) include the same amount of usage as their fee and raise the sandbox limits; they never lower a bill, so the calculator lands on Pro unless you need the higher limits. ## Monthly cost for each preset workload - A personal agent that stays on (Hermes, OpenClaw): $19.00 - A coding agent for one developer: $19.00 - A code interpreter inside your product: $19.00 - A browser agent for a small team: $85.79 - Self-hosted n8n for a small team: $19.00 - A Discord or Slack bot for one server: $19.00 - Claude Code for a team of five: $39.92 - A scraper that runs four times a day: $19.00 - Your own remote MCP server: $19.00 - A: 1,000 short tasks: $19.00 - B: one always-on box: $27.85 - C: three hours a day: $19.00 ## Fits well - A flat hourly price per size with a $19 plan, billed per second including idle time. - Snapshots that keep memory and processes, and forks of 1–100 copies. - A dashboard-first first machine with a hosted MCP server for assistants. ## Fits badly - A long job from the SDK or CLI: the default lifetime is five minutes and there is no idle timer. - Anything outside /workspace that must survive a stop, which deletes the rest of the disk. - SSH-dependent tooling: there is no SSH protocol, so scp and port forwarding do not work. ## Features - **Isolation** (partly): Firecracker; root. A Firecracker microVM with its own kernel and root by default, but Docker inside a sandbox is not documented either way. [source](https://lizard.build/docs/sandboxes) [docs](https://lizard.build/docs/sandboxes#runtime-and-templates) - **Sizes and regions** (partly): 8 vCPU / 16 GB; two regions. Three fixed sizes: Small 2/4/5 GB, Medium 4/8/20 GB, Large 8/16/50 GB. Two regions, no GPU, no live resize. [source](https://lizard.build/docs/sandboxes) [docs](https://lizard.build/docs/platform/limits#sandbox-sizes) - **Lifecycle** (partly): Pause: RAM; fast pause: files. Pause keeps the whole disk, memory and processes; a fast pause keeps files only and resumes like a restart; stop or expiry deletes the sandbox disk, leaving only /workspace and snapshots. [source](https://lizard.build/docs/sandboxes) [docs](https://lizard.build/docs/sandboxes#lifecycle) - **Snapshots and forks** (yes): RAM + disk; 1–100 forks. A snapshot captures memory, processes and the whole disk and restores into a new sandbox at the source's size; a fork copies a running sandbox 1–100 times with memory, pausing the source briefly. [source](https://lizard.build/docs/sandboxes/sdk-reference.md) [docs](https://lizard.build/docs/sandboxes/quickstart#pause-and-resume) - **Storage** (partly): /workspace only; 1–50 GB. The local disk is lost on stop; only /workspace persists, through a named volume of 1–50 GB attached to one sandbox at a time and stored on one node. There is no trash. [source](https://lizard.build/docs/sandboxes/volumes.md) [docs](https://lizard.build/docs/sandboxes/volumes) - **Idle and waking** (partly): 5 min lifetime (SDK). There is no idle timer at all, but every sandbox has a hard lifetime deadline: five minutes by default from the SDK and CLI, and never by default from the dashboard and raw API. [source](https://lizard.build/docs/sandboxes) [docs](https://lizard.build/docs/platform/limits) - **Reaching it** (partly): One token per sandbox. A preview URL per exposed port, gated by one token per sandbox that opens every port on it. WebSockets pass through. No raw TCP, no SSH protocol, no custom domains for sandboxes. [source](https://lizard.build/docs/sandboxes/preview-urls) [docs](https://lizard.build/docs/sandboxes/preview-urls) - **Custom domains** (partly): App services only. Custom domains are documented for deployed app services, not for sandbox preview URLs. A sandbox preview stays on the provider's hostname. [source](https://lizard.build/docs/sandboxes/preview-urls) [docs](https://lizard.build/docs/networking) - **Outbound network** (partly): 2 TB per 30 days. Outbound is open with no documented allowlist. Sandbox egress has no per-GB charge, with 2 TB per account over a rolling 30 days included. [source](https://lizard.build/docs/platform/limits) [docs](https://lizard.build/docs/platform/limits#sandbox-egress) - **Keys and secrets** (partly): Yes, env vars. Secrets are create-time environment variables that reach every command, plus a scoped CLI key per sandbox that dies with it. No proxy and no host binding. [source](https://lizard.build/docs/sandboxes/sdk-reference) [docs](https://lizard.build/docs/variables) - **Ways to drive it** (partly): Yes, dashboard. REST, TypeScript and Python SDKs, a CLI, a hosted MCP server and a dashboard terminal. There is no SSH protocol and no public VNC port. [source](https://lizard.build/docs/sandboxes/sdk-reference) [docs](https://lizard.build/docs/sandboxes/dashboard) - **Built-in agents** (yes): Templates; CLI prompt. Five agent templates plus a base image and desktop variants. Agents are prompted from the CLI with streaming and interrupts; the SDK has no prompt method. [source](https://lizard.build/docs/sandboxes) [docs](https://lizard.build/docs/cli/agents) - **Teams and accounts** (partly): No cap at all. Workspaces, projects and scoped keys, with caps on sandboxes, CPU, memory and disk. No spending cap at all; SSO and audit logs are Enterprise only. [source](https://lizard.build/docs/cli/keys) [docs](https://lizard.build/docs/cli/workspace) - **Billing models** (partly): $19 plan; flat per size. One $19 plan including $19 of usage; sandboxes are a flat hourly price per size, billed per second including idle, and volumes bill on used space. Snapshot storage has no published price. [source](https://lizard.build/pricing) [docs](https://lizard.build/docs/platform/billing) - **Trials and free tiers** (partly): 7 days / $5. A seven-day trial with $5 of usage, a card required, Small machines only, US regions only and up to five at once. One trial per account and per card. [source](https://lizard.build/docs/platform/billing) [docs](https://lizard.build/docs/platform/billing#trial) - **The company** (partly): Dragon Labs LLC; no SLA. Dragon Labs LLC, Portland address, Delaware law. Founded 2026 by Yura Dubinin (co-founder and president) and Mikhail Erin; no funding announced. Infrastructure on OVHcloud in Germany and the US. Status page reports Platform 99.95% and both regions 99.85%, but has no sandbox component and covers only widespread incidents. No published SLA; Enterprise lists SLAs. SOC 2 coming soon, no BAA. Price rises get dashboard or email notice and apply from the next calendar month; deletion after termination is within a commercially reasonable timeframe, immediate on request including backups. [source](https://lizard.build/terms) ## Capabilities - Its own virtual machine: yes (Firecracker microVM) [source](https://lizard.build/docs/sandboxes) - Root access: yes (root by default) [source](https://lizard.build/docs/sandboxes/sdk-reference) - Docker inside: not-published [source](https://lizard.build/docs/sandboxes) - Nested virtualisation: not-published [source](https://lizard.build/docs/sandboxes) - Your own image: no (fixed template catalog). You choose from a fixed list of templates and cannot upload your own image. [source](https://lizard.build/docs/sandboxes) - Any size you like: no (3 fixed sizes). There are three fixed sizes and no custom option. [source](https://lizard.build/docs/sandboxes) - Large machines: no (8 cores / 16 GB). The largest machine is 8 cores and 16 GB, so a 32 GB machine is not offered. [source](https://lizard.build/docs/platform/limits) - Resize while running: no (fixed size). The size is chosen when the sandbox is created and cannot be changed. [source](https://lizard.build/docs/platform/limits) - GPUs: no (CPUs only). Sandboxes run on processors only; there is no graphics option. [source](https://lizard.build/sandboxes) - Choose the region: yes (2 regions) [source](https://lizard.build/docs/platform/limits) - Runs in the EU: yes (EU West (Limburg)) [source](https://lizard.build/docs/platform/limits) - Pause keeps memory: yes. A fast pause keeps only the files, so it is the option to avoid if work must survive. [source](https://lizard.build/docs/sandboxes/quickstart) - Pre-started pools: not-published [source](https://lizard.build/docs/sandboxes) - Starts in under a second: yes (228 ms median) [source](https://lizard.build/docs/sandboxes) - Snapshots of files: yes [source](https://lizard.build/docs/sandboxes/quickstart) - Snapshots with memory: yes [source](https://lizard.build/docs/sandboxes/quickstart) - Copy a running machine: yes (1–100 copies). A fork is refused when the source has a volume attached. [source](https://lizard.build/docs/sandboxes) - Pick an older snapshot: yes [source](https://lizard.build/docs/sandboxes/quickstart) - Reusable templates: yes [source](https://lizard.build/docs/sandboxes) - Automatic backups: no [source](https://lizard.build/docs/sandboxes) - Files survive a stop: no [source](https://lizard.build/docs/sandboxes) - Separate volumes: yes (1–50 GB). A volume attaches to one sandbox at a time and lives on one node. [source](https://lizard.build/docs/sandboxes/volumes) - One volume, several machines: no [source](https://lizard.build/docs/sandboxes/volumes) - Mount outside storage: no [source](https://lizard.build/docs/addons/storage.md) - Large disk: no (50 GB max). The largest size offers 50 GB of disk, short of 100 GB. [source](https://lizard.build/docs/platform/limits.md) - Can stay on indefinitely: yes [source](https://lizard.build/docs/sandboxes) - Choose the idle timeout: no [source](https://lizard.build/docs/sandboxes) - Wakes on a request: no [source](https://lizard.build/docs/sandboxes) - Scheduled runs: no [source](https://lizard.build/docs/sandboxes) - Public link to a port: no. Every preview link needs the machine's access token, so there is no open address to share. [source](https://lizard.build/docs/sandboxes/preview-urls.md) - Private link: yes (One token per machine) [source](https://lizard.build/docs/sandboxes/preview-urls.md) - Real SSH: partly (Own client only). Its shell command works, but it is the provider's own client rather than a standard SSH connection, so ordinary SSH tools cannot connect. [source](https://lizard.build/docs/cli/ssh.md) - Terminal in the browser: yes (Terminal tab) [source](https://lizard.build/docs/sandboxes/dashboard.md) - Tunnel to your computer: not-published [source](https://lizard.build/docs/sandboxes/preview-urls.md) - Non-web ports: no. Preview links carry web traffic only, so a database or game port cannot be published. [source](https://lizard.build/docs/sandboxes/preview-urls.md) - Your own domain: partly (Apps only). Custom domains work for deployed apps, not for a sandbox's preview link. [source](https://lizard.build/docs/sandboxes/preview-urls.md) - Automatic HTTPS: partly (Apps only). Certificates are handled for deployed apps, but a sandbox preview has no domain to certify. [source](https://lizard.build/docs/sandboxes/preview-urls.md) - Outbound data included: yes (2 TB per 30 days) [source](https://lizard.build/docs/platform/limits.md) - Allow only some sites: not-published [source](https://lizard.build/docs/platform/limits.md) - Turn the internet off: not-published [source](https://lizard.build/docs/platform/limits.md) - Fixed outgoing IP: not-published [source](https://lizard.build/docs/platform/limits.md) - Stored secrets: yes (At create time) [source](https://lizard.build/docs/sandboxes/sdk-reference.md) - Secrets the agent cannot read: no. There is no service that adds keys for you; keys are variables the agent can read. [source](https://lizard.build/docs/sandboxes/sdk-reference.md) - Limited API keys: yes (Project or workspace) [source](https://lizard.build/docs/cli/keys.md) - Create from the website: yes [source](https://lizard.build/docs/sandboxes/dashboard.md) - Command-line tool: yes [source](https://lizard.build/docs/cli/sandbox.md) - Python SDK: yes [source](https://lizard.build/docs/sandboxes/sdk-reference.md) - TypeScript SDK: yes [source](https://lizard.build/docs/sandboxes.md) - Documented HTTP API: yes [source](https://lizard.build/docs/sandboxes/sdk-reference.md) - MCP server: yes [source](https://lizard.build/docs/agents.md) - Interactive terminal over the API: yes [source](https://lizard.build/docs/sandboxes/sdk-reference.md) - Files over the API: yes [source](https://lizard.build/docs/sandboxes/sdk-reference.md) - Coding agents preinstalled: yes (5 agents) [source](https://lizard.build/docs/sandboxes.md) - Send it a prompt: partly. You can send a prompt from the command line, but the SDK and API have no prompt call, so a program cannot start an agent. [source](https://lizard.build/docs/cli/sandbox.md) - One-click Hermes: no. The deploy catalog has no Hermes template; only a manual install in a sandbox. [source](https://lizard.build/deploy/openclaw--openclaw) - One-click OpenClaw: yes [source](https://lizard.build/deploy/openclaw--openclaw) - Browser built in: yes [source](https://lizard.build/docs/sandboxes.md) - Desktop for computer use: yes [source](https://lizard.build/docs/sandboxes.md) - Runs other platforms' agents: no. No page documents another platform's cloud agents using Lizard. [source](https://lizard.build/docs/sandboxes.md) - Team workspace: yes [source](https://lizard.build/docs/concepts/architecture.md) - Roles and permissions: partly. Role-based access is listed only on the Enterprise plan; the Pro plan marks it not included. [source](https://lizard.build/pricing) - Single sign-on: partly. SSO and SAML are Enterprise-only; the Pro plan marks them not included. [source](https://lizard.build/pricing) - Hard spending cap: no. There is no spending cap at all; only sandbox, CPU, memory and disk caps. [source](https://lizard.build/docs/platform/billing.md) - Usage alerts: not-published [source](https://lizard.build/docs/platform/billing.md) - Audit log: partly. Audit logs are Enterprise-only; the Pro plan marks them not included. [source](https://lizard.build/pricing) - Billed per second: yes (per second) [source](https://lizard.build/pricing) - CPU billed only while working: no (idle is billed). Waiting time is charged at the same rate as working time. [source](https://lizard.build/pricing) - Paused costs only storage: yes (compute stops) [source](https://lizard.build/pricing) - No monthly fee: no ($19 plan). There is one plan at $19 a month, which includes $19 of usage. [source](https://lizard.build/pricing) - Flat monthly price: yes ($0.0324/h medium) [source](https://lizard.build/pricing) - Ongoing free tier: no (7-day trial). There is no free tier, only a seven-day trial that needs a card. [source](https://lizard.build/docs/platform/billing) - Free starting credit: partly ($5 inside a trial). The $5 comes only as part of a seven-day trial and needs a card. [source](https://lizard.build/docs/platform/billing) - Try without a card: no (card for the trial). You add a card to start the trial, though nothing is charged at that point. [source](https://lizard.build/docs/platform/billing) - Public status page: yes [source](https://status.lizard.build) - Uptime promise (SLA): partly. SLAs come with Enterprise support; no public numeric uptime promise exists. [source](https://lizard.build/pricing) - SOC 2 report: no. The SOC 2 report is listed as coming soon. [source](https://lizard.build/pricing) - Data processing agreement: yes [source](https://lizard.build/pricing) - Open source or self-hostable: no. Lizard is hosted only; the docs describe its own infrastructure and no self-hosted edition. [source](https://lizard.build/docs/sandboxes.md) ## Usability - Dashboard: Yes, and it creates sandboxes without code: pick a template, region, size and lifetime, then pause, resume, open a terminal or browse volumes. - Without code: Partly. Creating a sandbox is click-driven, and the terminal tab gives you a shell. Running an agent, taking a snapshot, forking and attaching a volume are CLI or SDK only, and a card is needed to start the trial. - Signup: GitHub or Google, then a card through Stripe Checkout for the 7-day trial. Nothing is charged during the trial. There is no free tier to use without a plan. - Docs: Unusually candid: per-page updated dates, test-status notes saying what was and was not verified, raw Markdown twins. Support is email and Discord. The status page covers the platform but not sandbox capacity. - Trips people up: The default lifetime is 5 minutes from the SDK and CLI, and never from the dashboard or raw API. - Trips people up: Stop means delete, including everything outside /workspace. - Trips people up: Everything interesting beyond creating a sandbox needs a terminal. - Trips people up: The card comes before the product. - Trips people up: Two bills in one number: apps are metered per vCPU-second, sandboxes are flat per hour, a 6.2× gap for the same capacity. - Trips people up: Overage charges arrive automatically with no spending cap. ## Company - Legal entity: Dragon Labs LLC, doing business as Lizard. Delaware law, with a Portland, Oregon mailing address. [source](https://lizard.build/terms) - History: First public SDK release 24 June 2026 and first blog post 31 July 2026. No founding date is published. [source](https://registry.npmjs.org/@lizard-build/sdk) - Funding: No announced round, amount or investor list. A directory labels the stage Seed. - Headcount: Two, per LinkedIn. Yura Dubinin is named as co-founder and president; Mikhail Erin co-authors the blog. [source](https://www.linkedin.com/company/lizard-build) - Status and SLA: 99.95% platform uptime. No sandbox component is monitored, and no SLA exists outside Enterprise. [source](https://status.lizard.build/) - Certification: No SOC 2 report yet; no ISO 27001 or HIPAA claim is published. ## Caveats - **Snapshot storage has no published price** (open): Restores are priced at the source's hourly rate, but stored snapshots have no rate anywhere on the pricing or billing pages. - **Stop deletes the sandbox and its disk** (open): There is no stopped-but-restartable state. Only /workspace volumes and snapshots survive, and there is no trash or recycle bin. - **Two default lifetimes that contradict each other** (contradiction): Five minutes from the SDK and CLI, no expiry from the raw API and dashboard. A beginner following the CLI docs can lose work without warning. - **Docker inside a sandbox is not documented** (open): Neither is systemd, nested virtualisation, kernel feature support or CPU architecture. Treat all of them as unverified. - **No spending cap** (open): Overage is charged automatically in steps from $20 up to $1,000, with no ceiling. The docs say so explicitly. - **The runtime and billing model changed without notice** (open): On 30 September the docs described one fixed 4 vCPU / 4096 MiB sandbox in shared-kernel Kubernetes pods, billed on measured usage. By 13 October the pricing page listed Firecracker microVMs at flat per-size rates, from $0.0162 an hour. The changelog and blog do not mention the switch. Whether anyone's bill rose cannot be told, because the old usage rates were never published. Older sandboxes keep usage-based billing. ## Sources - [Docs: sandboxes](https://lizard.build/docs/sandboxes) - [Docs: quickstart](https://lizard.build/docs/sandboxes/quickstart) - [Docs: limits and sizes](https://lizard.build/docs/platform/limits) - [Docs: billing](https://lizard.build/docs/platform/billing) - [Docs: dashboard](https://lizard.build/docs/sandboxes/dashboard) - [Pricing](https://lizard.build/pricing) --- # Modal > gVisor containers by default with a five-minute lifetime, no pause at all, and a CPU unit that may be one or two vCPUs depending on which reading you trust. Website: https://modal.com Guide page: https://botperch.com/providers/modal/ Checked: 2026-10-28 **Short answer:** One always-on personal agent (2 vCPU / 4 GiB / 20 GiB) costs about $143.71 a month here, with a catch: Sessions end after 24 hours, so an always-on machine has to be restarted by your own code. Modal sandboxes have no stopped state; keeping files needs a Volume or a snapshot. Fits well: High-volume, short-lived code execution: Sandboxes start in about a second and the platform claims over 10,000 creates a second. Modal Sandboxes are short-lived Linux containers for running untrusted code inside Modal's serverless platform. You create one from Python, JavaScript or Go, run commands over an API, and either let it expire or terminate it. There is no paused or stopped state. A sandbox runs, then it is finished; local state survives only through a filesystem snapshot, a memory snapshot or a Volume, and every restore produces a new sandbox. It sits beside Modal's Functions, Inference and Training products on one workspace and one bill. **Who it is for:** Teams already on Modal, or building high-volume code execution and RL rollouts, who want sandboxes next to their Functions and GPUs. **Isolation:** gVisor by default, with a KVM-backed VM runtime opt-in for Docker, FUSE or nested cgroups. Every container runs as root. GPU sandboxes are gVisor only. Up to 250 sidecar containers per sandbox give a second boundary for credentials or a proxy. **Sizes and regions:** No fixed sizes: fractional physical cores (1 core = 2 vCPUs, as documented) and MiB of memory, with a default of 0.125 core and 128 MiB. Sandboxes can burst above the request and are billed on the higher of request and actual use. Disk is a fixed 512 GiB quota, not resizable. The maximum shape is not published. Container regions are selectable at 1.15× (broad) or 1.75× (narrow); GPU sandboxes are preemptible. ## How it charges - model: Per-second usage on one workspace bill, with no Sandbox-specific plan or fee. - meter: CPU $0.141912 per core-hour and memory $0.024012 per GiB-hour, billed on the higher of request and actual use. Sandboxes pay the non-preemptible rate, 3× list. Disk is billed as memory at a 20:1 ratio. - stopped: Nothing, because there is no stopped state. A running sandbox bills its request even when idle; a terminated one bills nothing. - planFee: Starter is $0 plus compute with $30 a month of credits; Team is $250 plus compute with $100 of credits; Enterprise is custom. - minimum: A payment method is required to use Modal. Minimum request is 0.125 core and 128 MiB. Per second on the higher of requested and used CPU and memory, at 3× list for sandboxes; there is no stopped state. - Modal bills per physical core and documents one core as 2 vCPUs, so a vCPU here is half a core. Battleships prices a whole core as one vCPU, twice this figure. How many CPUs the machine itself reports per core was not tested. - A payment method is required. - Egress beyond the plan's included amount is $0.04 per GiB and is not included. ## Monthly cost for each preset workload - A personal agent that stays on (Hermes, OpenClaw): $143.71 (catch: Sessions end after 24 hours, so an always-on machine has to be restarted by your own code. Modal sandboxes have no stopped state; keeping files needs a Volume or a snapshot.) - A coding agent for one developer: $46.15 (catch: Modal sandboxes have no stopped state; keeping files needs a Volume or a snapshot.) - A code interpreter inside your product: $49.32 - A browser agent for a small team: $1,159.80 - Self-hosted n8n for a small team: $143.71 (catch: Sessions end after 24 hours, so an always-on machine has to be restarted by your own code. Modal sandboxes have no stopped state; keeping files needs a Volume or a snapshot.) - A Discord or Slack bot for one server: $56.86 (catch: Sessions end after 24 hours, so an always-on machine has to be restarted by your own code. Modal sandboxes have no stopped state; keeping files needs a Volume or a snapshot.) - Claude Code for a team of five: $350.74 (catch: Modal sandboxes have no stopped state; keeping files needs a Volume or a snapshot.) - A scraper that runs four times a day: $0.00 - Your own remote MCP server: $39.33 (catch: Sessions end after 24 hours, so an always-on machine has to be restarted by your own code. Modal sandboxes have no stopped state; keeping files needs a Volume or a snapshot.) - A: 1,000 short tasks: $9.66 - B: one always-on box: $317.42 (catch: Sessions end after 24 hours, so an always-on machine has to be restarted by your own code. Modal sandboxes have no stopped state; keeping files needs a Volume or a snapshot.) - C: three hours a day: $0.00 (catch: Modal sandboxes have no stopped state; keeping files needs a Volume or a snapshot.) ## Fits well - High-volume, short-lived code execution: Sandboxes start in about a second and the platform claims over 10,000 creates a second. - A GPU sandbox for inference or training-adjacent work: up to 8 GPUs per container, priced per GPU-second. - A team already on Modal: sandboxes share the workspace, Images, Volumes and billing with Functions. - Splitting trust with sidecars: up to 250 extra containers per sandbox for a proxy or credentials. ## Fits badly - An agent that needs to pause and resume: there is no paused state, and a memory snapshot terminates the source. - An always-on box: the lifetime cap is 24 hours and a running idle sandbox bills its full request. - A cheap always-on dev box: $347 a month documented, $555 on the measured CPU reading. - A client-facing URL: inbound is closed by default and there is no built-in desktop or browser. ## Features - **Isolation** (partly): gVisor; VM on request. gVisor by default, with a KVM VM runtime opt-in for Docker, FUSE or nested cgroups. Every container runs as root, and GPU sandboxes are gVisor only. Up to 250 sidecars per sandbox give a second boundary. [source](https://modal.com/docs/guide/sandboxes) [docs](https://modal.com/docs/guide/sandboxes#runtimes) - **Sizes and regions** (partly): No fixed sizes; 1 core = 2 vCPU. Fractional physical cores (1 core = 2 vCPUs as documented) and MiB of memory, default 0.125 core / 128 MiB. Disk is a fixed 512 GiB. The maximum shape is unpublished. Regions are selectable at 1.15× broad and 1.75× narrow. [source](https://modal.com/docs/guide/sandbox-resources) [docs](https://modal.com/docs/guide/sandbox-resources) - **Lifecycle** (no): No pause; terminate. No paused or stopped state. Terminate sends SIGKILL; a memory snapshot terminates the source and restores a new sandbox within seven days. The nearest thing to a resume is an automatic exit snapshot, which is filesystem only. [source](https://modal.com/docs/guide/sandbox-snapshots) [docs](https://modal.com/docs/guide/sandboxes#timeouts) - **Snapshots and forks** (partly): Filesystem 30 d; memory 7 d. Filesystem, directory and memory snapshots, plus automatic exit snapshots. Filesystem and exit snapshots last 30 days by default; memory snapshots 7 days and cannot be extended. Fork means several sandboxes from one filesystem image, not a live clone. [source](https://modal.com/docs/guide/sandbox-snapshots) [docs](https://modal.com/docs/guide/sandbox-snapshots) - **Storage** (partly): 512 GiB; billed as memory. A fixed 512 GiB root filesystem, not resizable, billed by raising the memory request at a 20:1 ratio. Volumes are separate, survive the sandbox, are excluded from snapshots, and cost $0.09/GiB-month after 1 TiB. [source](https://modal.com/docs/guide/sandbox-resources) [docs](https://modal.com/docs/guide/sandbox-files) - **Idle and waking** (partly): 5 min lifetime; no idle. Default maximum lifetime 5 minutes, up to 24 hours. Idle timeout is off by default and terminates rather than pauses. There is no lifetime-free option; longer work needs snapshots. [source](https://modal.com/docs/guide/sandboxes) [docs](https://modal.com/docs/guide/sandboxes#idle-timeouts) - **Reaching it** (yes): Connect token. No inbound by default. Expose encrypted, h2 or unencrypted ports; connect tokens are the recommended path for HTTP and WebSockets, and raw TCP is possible. inbound_cidr_allowlist is not enforced on unencrypted tunnels. [source](https://modal.com/docs/guide/sandbox-networking) [docs](https://modal.com/docs/guide/sandbox-networking#forwarding-ports) - **Custom domains** (yes): Team+, manual. Custom domains for sandbox tunnels are on Team and Enterprise, with a manual setup step: NS records plus a Slack request. [source](https://modal.com/docs/guide/sandbox-networking) [docs](https://modal.com/docs/guide/sandbox-networking#custom-domains) - **Outbound network** (yes): $0.04/GiB. Open by default, with block-all, CIDR and domain allowlists; DNS leaks past the allowlists. Static IPs come from Proxies on Team and Enterprise. Egress is $0.04/GiB over 1, 10 or 100 TiB by plan. [source](https://modal.com/docs/guide/sandbox-networking) [docs](https://modal.com/docs/guide/sandbox-networking#outbound-access-control) - **Keys and secrets** (partly): Env vars, or beta proxy. Secrets arrive as environment variables by default. A beta Outbound Policy injects credentials into outbound HTTPS outside the sandbox and is immutable per configuration. OIDC identity tokens are available. [source](https://modal.com/docs/guide/sandbox-secret-injection) [docs](https://modal.com/docs/guide/sandbox-secret-injection) - **Ways to drive it** (partly): No; SDK. Python, JavaScript and Go SDKs, a CLI, modal shell and a dashboard with per-App metrics. No REST API separate from the SDK surface, no SSH daemon and no control-plane MCP server. [source](https://modal.com/docs/guide/sandboxes) [docs](https://modal.com/docs/guide/sandboxes) - **Built-in agents** (no): None; SDK. No hosted agent, desktop, browser or computer-use API. The documented use cases are RL rollouts and coding agents, both as SDK code you write. [source](https://modal.com/docs/guide/sandboxes) - **Teams and accounts** (partly): Environment budgets. Environment budgets on Team and Enterprise stop workloads at the limit. RBAC is Team+, SSO and audit logs are Enterprise. Starter has 3 seats and 100 containers. [source](https://modal.com/docs/guide/budgets) [docs](https://modal.com/docs/guide/workspaces) - **Billing models** (partly): $0.141912/core-hour. Per second on the higher of request and actual use: CPU $0.141912/core-hour and memory $0.024012/GiB-hour at the non-preemptible sandbox rate, 3× list. Disk is billed as memory at 20:1. [source](https://modal.com/docs/guide/sandbox-resources) [docs](https://modal.com/docs/guide/billing) - **Trials and free tiers** (partly): $30/month credits. Starter is $0 plus compute with $30 a month of credits; Team is $250 plus compute with $100. A payment method is required to use Modal. [source](https://modal.com/pricing) [docs](https://modal.com/pricing#pricing-plans) - **The company** (partly): Modal Labs, Inc.; no public SLA. Modal Labs, Inc., Delaware, founded 2021; $750M Series D at $15.75B, over $1.2B raised, 200+ staff. No public SLA; SOC 2 Type II with a 2025 report period; HIPAA Enterprise only. [source](https://modal.com/legal/terms) ## Capabilities - Its own virtual machine: partly (gVisor by default). The default is a gVisor container, which is not a computer of its own; a true virtual machine with its own kernel is a separate runtime you have to ask for. [source](https://modal.com/docs/guide/sandboxes) - Root access: yes (always root) [source](https://modal.com/docs/guide/existing-images) - Docker inside: partly (VM runtime only). Docker needs the VM runtime; the default gVisor sandbox cannot run it. [source](https://modal.com/docs/guide/sandboxes) - Nested virtualisation: partly (Enterprise plan only). Nested virtual machines are an Enterprise-plan option that must be switched on when the sandbox is created. [source](https://modal.com/docs/guide/sandboxes) - Your own image: yes (any registry image) [source](https://modal.com/docs/guide/existing-images) - Any size you like: yes (any cores and MiB) [source](https://modal.com/docs/guide/sandbox-resources) - Large machines: yes (no published ceiling) [source](https://modal.com/docs/guide/resources) - Resize while running: no (fixed at creation). Resources are fixed when the sandbox is created; changing them means starting a new one. [source](https://modal.com/docs/guide/sandbox-resources) - GPUs: yes (up to 8 GPUs) [source](https://modal.com/docs/guide/gpu) - Choose the region: yes (broad or narrow regions) [source](https://modal.com/docs/guide/region-selection) - Runs in the EU: yes (eu regions) [source](https://modal.com/docs/guide/data-residency) - Pause keeps memory: no [source](https://modal.com/docs/guide/sandbox-snapshots) - Pre-started pools: partly. You have to build and run the pool yourself; there is no setting that keeps machines waiting. [source](https://modal.com/docs/guide/sandboxes) - Starts in under a second: yes (Sub-second) [source](https://modal.com/) - Snapshots of files: yes (30 days default) [source](https://modal.com/docs/guide/sandbox-snapshots) - Snapshots with memory: partly (Experimental; 7 days). Memory snapshots are still labelled experimental and are deleted after seven days, which cannot be extended. [source](https://modal.com/docs/guide/sandbox-snapshots) - Copy a running machine: no [source](https://modal.com/docs/guide/sandbox-snapshots) - Pick an older snapshot: yes [source](https://modal.com/docs/guide/sandbox-snapshots) - Reusable templates: yes [source](https://modal.com/docs/guide/sandbox-snapshots) - Automatic backups: no [source](https://modal.com/docs/guide/sandbox-snapshots) - Files survive a stop: no [source](https://modal.com/docs/guide/sandboxes) - Separate volumes: yes (Up to 1 TiB free) [source](https://modal.com/docs/guide/volumes) - One volume, several machines: yes (Hundreds of writers). Two machines writing the same file means the last write wins. [source](https://modal.com/docs/guide/volumes) - Mount outside storage: yes [source](https://modal.com/docs/guide/cloud-bucket-mounts) - Large disk: yes (512 GiB) [source](https://modal.com/docs/guide/sandbox-resources) - Can stay on indefinitely: partly (24 h maximum). No sandbox can run longer than 24 hours, however busy it is. [source](https://modal.com/docs/guide/sandboxes) - Choose the idle timeout: partly. You can set an idle timeout, but reaching it ends the machine rather than pausing it. [source](https://modal.com/docs/guide/sandboxes) - Wakes on a request: no [source](https://modal.com/docs/guide/sandboxes) - Scheduled runs: yes [source](https://modal.com/docs/guide/cron) - Public link to a port: partly (Open raw port only). A normal web port needs a connect token; only a port exposed as raw traffic is open to anyone. [source](https://modal.com/docs/guide/sandbox-networking) - Private link: yes (Connect token) [source](https://modal.com/docs/guide/sandbox-networking) - Real SSH: partly (Install it yourself). The machine has no SSH server; you have to install one and open a port for it. [source](https://modal.com/docs/guide/sandbox-networking) - Terminal in the browser: not-published [source](https://modal.com/docs/guide/sandbox-networking) - Tunnel to your computer: not-published [source](https://modal.com/docs/guide/sandbox-networking) - Non-web ports: yes (Raw tunnels) [source](https://modal.com/docs/guide/sandbox-networking) - Your own domain: partly (Team+, manual). Only Team and Enterprise plans get it, and you must move the domain's name servers and ask support to finish setup. [source](https://modal.com/docs/guide/sandbox-networking) - Automatic HTTPS: partly (Team+, manual). Certificates come with the domain, but only on Team and Enterprise plans and after a manual setup step. [source](https://modal.com/docs/guide/sandbox-networking) - Outbound data included: yes (1 TiB, then $0.04) [source](https://modal.com/docs/guide/network-egress-billing) - Allow only some sites: yes (Domain or address list) [source](https://modal.com/docs/guide/sandbox-networking) - Turn the internet off: yes (block_network) [source](https://modal.com/docs/guide/sandbox-networking) - Fixed outgoing IP: partly (Team+, 5 addresses). Only Team and Enterprise plans get it, and each account can create one or three gateways holding up to five addresses each. [source](https://modal.com/docs/guide/proxy-ips) - Stored secrets: yes (Inline secrets) [source](https://modal.com/docs/guide/sandboxes) - Secrets the agent cannot read: partly (Beta). The feature that hides keys is in beta and cannot be changed once set up. [source](https://modal.com/docs/guide/sandbox-secret-injection) - Limited API keys: partly (Workspace role). Permissions come from a person's workspace role, not from a key that can only do one thing. [source](https://modal.com/docs/guide/rbac) - Create from the website: no [source](https://modal.com/docs/guide/sandboxes) - Command-line tool: yes [source](https://modal.com/docs/cli/latest/shell) - Python SDK: yes [source](https://modal.com/docs/guide/sandboxes) - TypeScript SDK: yes [source](https://modal.com/docs/guide/sandboxes) - Documented HTTP API: no. The documented interface is the SDK and its gRPC connection; there is no separate HTTP API to call. [source](https://modal.com/docs/guide/sandboxes) - MCP server: no. The only MCP guidance is how to deploy someone else's MCP server inside Modal. [source](https://modal.com/docs/examples/mcp_server_stateless.md) - Interactive terminal over the API: yes [source](https://modal.com/docs/cli/latest/shell) - Files over the API: yes [source](https://modal.com/docs/guide/sandbox-files) - Coding agents preinstalled: no. Nothing is preinstalled and there is no agent API; the agent is code you run. [source](https://modal.com/docs/guide/sandboxes) - Send it a prompt: no. Modal sells the computer, not an agent loop; the docs show SDK code you write. [source](https://modal.com/docs/guide/sandboxes) - One-click Hermes: no. Hermes lists Modal as a terminal backend, not as a one-click host. [source](https://modal.com/docs/guide/sandboxes) - One-click OpenClaw: no. No OpenClaw template or guide is published. [source](https://modal.com/docs/guide/sandboxes) - Browser built in: no. No browser, desktop or computer-use API is documented; the sandbox is a headless container. [source](https://modal.com/docs/guide/sandboxes) - Desktop for computer use: no. No desktop, VNC or computer-use API is documented. [source](https://modal.com/docs/guide/sandboxes) - Runs other platforms' agents: yes [source](https://modal.com/docs/examples/cursor.md) - Team workspace: yes [source](https://modal.com/docs/guide/rbac) - Roles and permissions: partly (Team plan and above). Role-based access starts on the Team plan; the free-to-start Starter plan has no roles. [source](https://modal.com/docs/guide/rbac) - Single sign-on: partly. Okta SSO is listed with audit logs and HIPAA on the Enterprise plan. [source](https://modal.com/pricing) - Hard spending cap: yes [source](https://modal.com/docs/guide/budgets) - Usage alerts: not-published [source](https://modal.com/docs/guide/budgets) - Audit log: partly. Audit logs are listed with SSO and HIPAA on the Enterprise plan. [source](https://modal.com/pricing) - Billed per second: yes (per second) [source](https://modal.com/docs/guide/sandbox-resources) - CPU billed only while working: no (request or use, whichever is higher). A machine that reserves more than it uses pays for the reservation. [source](https://modal.com/docs/guide/sandbox-resources) - Paused costs only storage: no (no pause). There is no pause: a sandbox bills until it is shut down, and its saved copy is stored separately. [source](https://modal.com/docs/guide/sandbox-resources) - No monthly fee: yes (Starter $0) [source](https://modal.com/pricing) - Flat monthly price: no (request or use). The bill follows the higher of what you asked for and what you used. [source](https://modal.com/docs/guide/sandbox-resources) - Ongoing free tier: partly ($30 a month, card needed). Thirty dollars of free compute returns each month, but a payment method must be on file before anything runs. [source](https://modal.com/pricing) - Free starting credit: yes ($30 a month) [source](https://modal.com/pricing) - Try without a card: no (card required). A payment method must be on file before you can use Modal at all. [source](https://modal.com/docs/guide/billing) - Public status page: yes [source](https://modal.com/docs/cli/latest/shell) - Uptime promise (SLA): no. There is no public SLA; one is attached to the order only if you bought a plan that includes it. [source](https://modal.com/legal/terms) - SOC 2 report: yes (Type II) [source](https://modal.com/legal/terms) - Data processing agreement: yes [source](https://modal.com/legal/terms) - Open source or self-hostable: no. The client libraries are open source; the platform is not. [source](https://modal.com/legal/terms) ## Usability - Dashboard: An operator console: a Sandboxes tab per App with CPU, memory, pressure and exit-reason charts, plus billing and invoices. - Without code: No. Every creation path is SDK code; modal shell attaches to a sandbox that already exists. - Signup: A payment method is required to use Modal. Starter is $0 plus compute with 3 seats and $30 a month of credits. - Docs: Extensive docs with llms.txt, Python, JavaScript and Go SDKs, and a CLI. Support is community Slack on all plans, a private Slack and embedded engineers on Enterprise; no response times published. - Trips people up: The default lifetime is five minutes. - Trips people up: An idle sandbox is not free: it bills max(request, actual). - Trips people up: Snapshot means three different things; only the memory one keeps processes, and it kills the source. - Trips people up: Disk is billed as memory at 20:1. - Trips people up: Region pinning adds 15–75%. ## Company - Legal entity: Modal Labs, Inc., a Delaware corporation. [source](https://modal.com/legal/terms) - Founded and leadership: 2021, by Erik Bernhardsson (CEO) and Akshat Bubna (CTO). [source](https://modal.com/blog/1-billion-annualized-run-rate-series-d) - Funding: $750M Series D at a $15.75B post-money valuation in October 2026, led by Accel; over $1.2B raised in total. [source](https://modal.com/blog/1-billion-annualized-run-rate-series-d) - Headcount: 200+, company-stated in October 2026. TechCrunch estimated about 150 three weeks earlier. [source](https://modal.com/blog/1-billion-annualized-run-rate-series-d) - Status and SLA: Sandboxes showed 100% over 30 days, 99.983% over 60 and 99.989% over 90. No public SLA document; the SLA is attached to a Service Order. [source](https://modal.com/legal/terms) - Certification: SOC 2 Type II, with the current report covering September–December 2025. HIPAA is Enterprise only. [source](https://modal.com/legal/terms) - Price changes: No rate-change clause and no published notice period for list prices. [source](https://modal.com/legal/terms) ## Caveats - **The pricing page says you never pay for idle, and the sandbox meter says you do** (contradiction): The headline describes scale-to-zero Functions. A sandbox with no active command bills its full request until it is terminated. - **Sandbox disk cannot be increased, except where a 3 TiB maximum is published** (contradiction): The sandbox resources page says disk cannot be increased; the resources guide documents an ephemeral_disk parameter with a 3.0 TiB maximum. The most likely reading is that the parameter belongs to Functions, so 512 GiB is the sandbox ceiling. - **An EU region does not keep snapshots in the EU** (contradiction): Sandboxes can be pinned to eu at 1.15×, but application logs and snapshots you create are stored in the United States whatever region the container runs in. - **One core is two vCPUs in the docs and one guest CPU in a third-party measurement** (contradiction): Modal prices CPU per physical core and equates a core to two vCPUs. A third-party benchmark reports that cpu=N gives a guest that sees N CPUs. The two readings differ by 1.6× on every cost estimate. - **There is no pause** (open): A sandbox runs or it is finished. The nearest equivalent is a memory snapshot, which terminates the source, restores into a new sandbox and expires after seven days. - **Memory snapshots are alpha and picky** (open): They cannot run with GPUs, restore only on the same instance type, cannot be taken while a command runs, and cannot have their seven-day expiry extended. - **Snapshot storage has no published price** (open): Filesystem, directory, memory and exit snapshots all bill as storage, and none of the pricing page, the snapshots guide or the billing guide gives a rate. - **No SSH and no control-plane MCP server** (open): modal shell is a CLI session, not an SSH daemon, and the only MCP material in the docs is an example of running an MCP server inside a sandbox. ## Sources - [Sandboxes guide](https://modal.com/docs/guide/sandboxes) - [Sandbox resources](https://modal.com/docs/guide/sandbox-resources) - [Snapshots](https://modal.com/docs/guide/sandbox-snapshots) - [Sandbox networking](https://modal.com/docs/guide/sandbox-networking) - [Pricing](https://modal.com/pricing) - [Billing](https://modal.com/docs/guide/billing) - [Data residency](https://modal.com/docs/guide/data-residency) - [Terms](https://modal.com/legal/terms) --- # Morph > Full VMs with memory-and-disk snapshots, branched into parallel copies, billed in MCUs. Website: https://cloud.morph.so Guide page: https://botperch.com/providers/morph/ Checked: 2026-10-28 **Short answer:** One always-on personal agent (2 vCPU / 4 GiB / 20 GiB) costs about $63.00 a month here, the 7th cheapest of the 11 providers that run it as described. Fits well: Full VMs with Docker-in-Docker, systemd, root and FUSE, for a workload that needs a normal server. Morph Cloud sells devboxes and lower-level instances: full virtual machines that can run Docker-in-Docker, a local Kubernetes cluster or a self-hosted database. Its distinctive primitive is the snapshot: an immutable copy of memory and disk that can boot a new instance with running processes, or branch into many copies for fan-out. **Who it is for:** Teams running parallel agent environments, RL rollouts or test fan-out, and developers who want a cloud devbox with a dashboard. **Isolation:** Full virtual machine, with Docker-in-Docker, systemd and root documented. FUSE is available; nested virtualisation and other guest operating systems are experimental. **Sizes and regions:** Resources are chosen at creation: vCPU, memory and disk size. No complete size catalogue, GPU statement, region list or data-residency commitment is published. ## How it charges - model: Prepaid MCUs with optional monthly plans that include an allocation. - meter: One MCU covers 1 vCPU-hour, 4 GB RAM-hours, 16 GB disk-hours or 5 TB snapshot-hours. The rate is the maximum of those dimensions, at $0.05 per MCU-hour. - stopped: A paused instance bills only for the snapshot taken. A stopped instance is deleted, so its own disk is not a cheap parked state. - planFee: Developer $0, Team $40 and Scale $250 a month, including 0, 1,000 and 7,500 MCUs. - minimum: No published minimum duration. The signup docs promise 300 free compute hours a month; the pricing page shows 0 MCUs and asks you to buy. Compute units per hour: the largest of vCPU, RAM ÷ 4 and disk ÷ 16, at $0.05 each. - Between sessions the instance is paused: it bills only for its snapshot. A stopped instance is deleted. - Live pages disagree on the free tier: 0 units on the pricing page, 300 units in the plans doc, 300 compute hours on the sign-up page. None is subtracted. ## Monthly cost for each preset workload - A personal agent that stays on (Hermes, OpenClaw): $63.00 - A coding agent for one developer: $32.27 - A code interpreter inside your product: $33.33 - A browser agent for a small team: $375.00 - Self-hosted n8n for a small team: $63.00 - A Discord or Slack bot for one server: $36.50 - Claude Code for a team of five: $151.37 - A scraper that runs four times a day: $1.00 - Your own remote MCP server: $36.50 - A: 1,000 short tasks: $16.67 - B: one always-on box: $136.00 - C: three hours a day: $9.15 ## Fits well - Full VMs with Docker-in-Docker, systemd, root and FUSE, for a workload that needs a normal server. - Snapshots of memory and disk that branch into several running instances. - A configurable machine: vCPU, memory and disk are chosen at creation rather than picked from a menu. ## Fits badly - A buyer who needs published regions, GPU options, maximum sizes or an SLA. - An attached block volume: Morph Volumes is S3-compatible object storage behind a gateway. - A compliance review that expects a SOC 2 naming Morph Labs, Inc. ## Features - **Isolation** (yes): Full VM; Docker-in-Docker. Full VMs with Docker-in-Docker, systemd, root and FUSE. Nested virtualisation and other guest operating systems are experimental. [source](https://cloud.morph.so/docs/devboxes/getting-started) [docs](https://cloud.morph.so/docs/devboxes/getting-started) - **Sizes and regions** (partly): Not published. vCPU, memory and disk are chosen at creation, with no fixed catalogue. Maximum CPU, RAM and disk per VM, GPU availability, architecture, host locations and selectable regions are not published. [source](https://cloud.morph.so/docs/documentation/instances/creating-snapshot) [docs](https://cloud.morph.so/docs/documentation/instances/creating-snapshot) - **Lifecycle** (partly): Pause: RAM + disk. Pause snapshots memory and disk and suspends the VM; stop releases the instance and deletes it. Booting a snapshot is a cold boot, while starting one restores memory. [source](https://cloud.morph.so/docs/documentation/instances/pause-resume) [docs](https://cloud.morph.so/docs/documentation/instances/basic-lifecycle) - **Snapshots and forks** (yes): RAM + disk; branches. Snapshots are immutable copies of memory and disk; a branch creates several running instances from one snapshot. Starting a snapshot restores memory, while booting it is a cold boot. [source](https://cloud.morph.so/docs/documentation/instances/creating-snapshot) [docs](https://cloud.morph.so/docs/documentation/instances/branch) - **Storage** (partly): S3 volumes, not a disk. The instance disk holds the machine, and Morph Volumes is separate S3-compatible object storage reached through a gateway and CLI, not an attached block disk. EFS is a third option. [source](https://cloud.morph.so/docs/volumes/getting-started) [docs](https://cloud.morph.so/docs/volumes/getting-started) - **Idle and waking** (partly): Not published. Devboxes scale to zero after inactivity, preserving memory and application state, and wake on an HTTP or SSH request. Instance TTL is a duration after which an instance stops or pauses. [source](https://cloud.morph.so/docs/devboxes/getting-started) [docs](https://cloud.morph.so/docs/examples/auto-scale-agent-workspaces) - **Reaching it** (partly): Not published. An instance can expose an HTTP service through the API. Default authentication and raw TCP support are not published. [source](https://cloud.morph.so/docs/api-reference/expose-http-service-instance-instance-id-http-post) [docs](https://cloud.morph.so/docs/documentation/instances/http-services) - **Custom domains** (not-published): Not published. No custom-domain feature appears in the documentation, API or terms. An HTTP service can be exposed, but it is served on a provider hostname. [source](https://cloud.morph.so/docs/documentation/instances/http-services) - **Outbound network** (not-published): Charged, no rate. Egress is a chargeable component in the terms, but no per-GB rate, allowlist, static IP or filtering is published. Do not assume egress is free. [source](https://cloud.morph.so/web/legal/terms-of-service) - **Keys and secrets** (partly): Not published. Devbox templates integrate a secrets manager, and agent tokens carry scoped secret permissions. Whether a proxy keeps values out of the VM is not published. [source](https://cloud.morph.so/docs/devboxes/getting-started) [docs](https://cloud.morph.so/docs/devboxes/agent-tokens) - **Ways to drive it** (partly): Yes, dashboard. SDKs and a CLI, SSH, a devbox API, a configurable remote desktop, and a tmux API for agents. No first-party MCP server or webhooks are documented. [source](https://cloud.morph.so/docs/devboxes/getting-started) [docs](https://cloud.morph.so/docs/documentation/cli) - **Built-in agents** (partly): None; tmux API. A full tmux API lets you drive Claude Code or Codex programmatically, but no agent is preinstalled and no agent-run API exists. [source](https://cloud.morph.so/docs/devboxes/getting-started) - **Teams and accounts** (partly): Not published. Devboxes are shareable to anyone in the organisation, and an SSH-key audit endpoint exists. SSO, hard spend caps and comprehensive audit coverage are not published. [source](https://cloud.morph.so/docs/devboxes/getting-started) [docs](https://cloud.morph.so/docs/devboxes/sharing-and-collaboration) - **Billing models** (partly): $0.05/MCU-hour. MCUs where the rate is the largest resource dimension: 1 vCPU-hour, 4 GB RAM-hours, 16 GB disk-hours or 5 TB snapshot-hours, at $0.05 per MCU-hour. Plans include MCU allocations. [source](https://cloud.morph.so/web/subscribe) [docs](https://cloud.morph.so/docs/documentation/setup/plans) - **Trials and free tiers** (partly): 300 h/month claimed. Signup docs promise 300 free compute hours a month on the $0 Developer plan; the pricing page lists 0 MCUs and says to purchase MCUs. An invite is mentioned. [source](https://cloud.morph.so/docs/documentation/setup/signing-up) [docs](https://cloud.morph.so/docs/documentation/setup/plans) - **The company** (partly): Morph Labs, Inc.; no SOC 2. Morph Labs, Inc., San Francisco; founded 2023 by Jesse Han. Funding is contradictory: one third-party source reports a $5.75M Khosla-led seed, another says no funding was raised. Status page reports 100% for Morph Cloud API over 90 days, provider-reported. No numeric SLA; a separate order SLA would control. No verified SOC 2 for Morph Labs; the Delve portal belongs to AutoInfra, a different company. Prices change with 30 days' notice, or 60 days if cumulative increases exceed 15% in 12 months; month-to-month termination is effective next billing cycle; deletion after cancellation not published. [source](https://trust.delve.co/morph) ## Capabilities - Its own virtual machine: yes (full VM) [source](https://cloud.morph.so/docs/devboxes/getting-started) - Root access: yes (root shell) [source](https://cloud.morph.so/docs/documentation/instances/fuse) - Docker inside: yes (Docker-in-Docker) [source](https://cloud.morph.so/docs/devboxes/getting-started) - Nested virtualisation: partly (experimental). Running another operating system or a virtual machine inside is described as experimental. [source](https://cloud.morph.so/docs/devboxes/getting-started) - Your own image: partly (templates and snapshots). There is no documented way to import your own image; you start from a template or from a snapshot you saved. [source](https://cloud.morph.so/docs/devboxes/getting-started) - Any size you like: yes (cores, memory, disk) [source](https://cloud.morph.so/docs/documentation/instances/creating-snapshot) - Large machines: partly (ceiling not published). The plan allows up to 1024 cores across the account, but the largest single machine is not published. [source](https://cloud.morph.so/web/subscribe) - Resize while running: partly (disk live; cores need reboot). Disk space can grow while the machine runs, but changing cores or memory means restarting it. [source](https://cloud.morph.so/docs/examples/resizing-instances) - GPUs: not-published [source](https://cloud.morph.so/docs/devboxes/getting-started) - Choose the region: not-published [source](https://cloud.morph.so/docs/devboxes/getting-started) - Runs in the EU: not-published [source](https://cloud.morph.so/docs/devboxes/getting-started) - Pause keeps memory: yes [source](https://cloud.morph.so/docs/documentation/instances/pause-resume) - Pre-started pools: no [source](https://cloud.morph.so/docs/documentation/instances/basic-lifecycle) - Starts in under a second: not-published [source](https://cloud.morph.so/docs/documentation/instances/basic-lifecycle) - Snapshots of files: yes [source](https://cloud.morph.so/docs/documentation/instances/creating-snapshot) - Snapshots with memory: yes [source](https://cloud.morph.so/docs/documentation/instances/creating-snapshot) - Copy a running machine: yes [source](https://cloud.morph.so/docs/documentation/instances/branch) - Pick an older snapshot: yes [source](https://cloud.morph.so/docs/documentation/instances/creating-snapshot) - Reusable templates: yes [source](https://cloud.morph.so/docs/documentation/instances/creating-snapshot) - Automatic backups: no [source](https://cloud.morph.so/docs/documentation/instances/creating-snapshot) - Files survive a stop: no [source](https://cloud.morph.so/docs/documentation/instances/pause-resume) - Separate volumes: partly. The volume is object storage reached over S3, not a disk attached to the machine. [source](https://cloud.morph.so/docs/volumes/getting-started) - One volume, several machines: partly. Sharing happens through an S3 bucket, not a disk several machines mount. [source](https://cloud.morph.so/docs/volumes/getting-started) - Mount outside storage: no [source](https://cloud.morph.so/docs/volumes/getting-started) - Large disk: not-published [source](https://cloud.morph.so/docs/documentation/instances/creating-snapshot) - Can stay on indefinitely: yes [source](https://cloud.morph.so/docs/devboxes/getting-started) - Choose the idle timeout: partly. You can switch the idle pause off, but the docs never say how long it waits or what values you can set. [source](https://cloud.morph.so/docs/devboxes/getting-started) - Wakes on a request: yes [source](https://cloud.morph.so/docs/devboxes/getting-started) - Scheduled runs: no [source](https://cloud.morph.so/docs/documentation/instances/basic-lifecycle) - Public link to a port: not-published [source](https://cloud.morph.so/docs/api-reference/expose-http-service-instance-instance-id-http-post) - Private link: not-published [source](https://cloud.morph.so/docs/api-reference/expose-http-service-instance-instance-id-http-post) - Real SSH: yes (Built in) [source](https://cloud.morph.so/docs/devboxes/getting-started) - Terminal in the browser: not-published [source](https://cloud.morph.so/docs/devboxes/development) - Tunnel to your computer: yes (ssh -L) [source](https://cloud.morph.so/docs/devboxes/getting-started) - Non-web ports: not-published [source](https://cloud.morph.so/docs/documentation/instances/http-services) - Your own domain: not-published [source](https://cloud.morph.so/docs/api-reference/expose-http-service-instance-instance-id-http-post) - Automatic HTTPS: not-published [source](https://cloud.morph.so/docs/api-reference/expose-http-service-instance-instance-id-http-post) - Outbound data included: not-published (Charged, no rate) [source](https://cloud.morph.so/web/legal/terms-of-service) - Allow only some sites: not-published [source](https://cloud.morph.so/web/legal/terms-of-service) - Turn the internet off: not-published [source](https://cloud.morph.so/docs/devboxes/getting-started) - Fixed outgoing IP: not-published [source](https://cloud.morph.so/web/legal/terms-of-service) - Stored secrets: yes (Template manager) [source](https://cloud.morph.so/docs/devboxes/getting-started) - Secrets the agent cannot read: not-published [source](https://cloud.morph.so/docs/devboxes/getting-started) - Limited API keys: yes (Token scopes) [source](https://cloud.morph.so/docs/devboxes/agent-tokens) - Create from the website: yes [source](https://cloud.morph.so/docs/devboxes/getting-started) - Command-line tool: yes [source](https://cloud.morph.so/docs/documentation/setup/installation-guide) - Python SDK: yes [source](https://cloud.morph.so/docs/documentation/setup/installation-guide) - TypeScript SDK: yes [source](https://cloud.morph.so/docs/documentation/setup/installation-guide) - Documented HTTP API: yes [source](https://cloud.morph.so/docs/api-reference/start-instance-instance-post) - MCP server: no [source](https://cloud.morph.so/docs/devboxes/getting-started) - Interactive terminal over the API: yes [source](https://cloud.morph.so/docs/devboxes/getting-started) - Files over the API: yes [source](https://cloud.morph.so/docs/documentation/file-management) - Coding agents preinstalled: no. Devboxes boot from templates you build; no agent is in the default image. [source](https://cloud.morph.so/docs/devboxes/getting-started) - Send it a prompt: no. The tmux API lets your program type into an agent, but Morph runs no agent loop of its own. [source](https://cloud.morph.so/docs/devboxes/getting-started) - One-click Hermes: no. No Hermes template or guide is published. [source](https://cloud.morph.so/docs/devboxes/getting-started) - One-click OpenClaw: no. No OpenClaw template or guide is published. [source](https://cloud.morph.so/docs/devboxes/getting-started) - Browser built in: partly. A documented example runs headless Chrome in a container, but no browser is installed for you. [source](https://cloud.morph.so/docs/documentation/instances/snapshot-setup) - Desktop for computer use: yes [source](https://cloud.morph.so/docs/devboxes/getting-started) - Runs other platforms' agents: no. No page documents another platform's cloud agents using Morph. [source](https://cloud.morph.so/docs/devboxes/getting-started) - Team workspace: yes [source](https://cloud.morph.so/docs/devboxes/getting-started) - Roles and permissions: not-published [source](https://cloud.morph.so/docs/devboxes/getting-started) - Single sign-on: not-published [source](https://cloud.morph.so/web/subscribe) - Hard spending cap: not-published [source](https://cloud.morph.so/web/subscribe) - Usage alerts: not-published [source](https://cloud.morph.so/web/subscribe) - Audit log: not-published [source](https://cloud.morph.so/web/legal/terms-of-service) - Billed per second: yes (per second) [source](https://cloud.morph.so/web/legal/terms-of-service) - CPU billed only while working: no (largest resource counts). The rate follows the largest of cores, memory and disk, so spare capacity is paid for. [source](https://cloud.morph.so/web/subscribe) - Paused costs only storage: yes (snapshot only) [source](https://cloud.morph.so/docs/documentation/instances/pause-resume) - No monthly fee: yes (Developer $0) [source](https://cloud.morph.so/web/subscribe) - Flat monthly price: no (one rate per unit). The price is a single rate per unit hour, not a fixed monthly price per machine. [source](https://cloud.morph.so/web/subscribe) - Ongoing free tier: partly (300 hours claimed). The signup page promises 300 free hours a month, but the pricing page shows no free compute and asks you to buy units. [source](https://cloud.morph.so/docs/documentation/setup/signing-up) - Free starting credit: partly (300 hours claimed). One page promises 300 free hours a month, while the pricing page lists no free units. [source](https://cloud.morph.so/docs/documentation/setup/signing-up) - Try without a card: not-published [source](https://cloud.morph.so/docs/documentation/setup/signing-up) - Public status page: yes [source](https://status.cloud.morph.so) - Uptime promise (SLA): no. No public uptime target or credit schedule is published; a separately signed SLA would control. [source](https://cloud.morph.so/web/legal/terms-of-service) - SOC 2 report: not-published [source](https://cloud.morph.so/web/legal/terms-of-service) - Data processing agreement: not-published [source](https://cloud.morph.so/web/legal/terms-of-service) - Open source or self-hostable: no. Morph Cloud is hosted; no self-hosted or open-source edition is published. [source](https://cloud.morph.so/docs/devboxes/getting-started) ## Usability - Dashboard: A devbox dashboard can create a machine from a template or snapshot and open it in VS Code. - Without code: A devbox can be created without API code, but setup asks for an SDK or CLI and an API key. - Signup: An invite is mentioned in the signup docs; card requirement and waitlist status are not published. - Docs: Documentation covers devboxes, instances, snapshots, volumes and agent tokens. No independent status page was verified. - Trips people up: Stop deletes the instance; pause is the state-preserving action. - Trips people up: Booting a snapshot is a cold boot; starting it restores memory. - Trips people up: Volumes are S3-compatible object storage, not an attached block disk. - Trips people up: The free-credit promise contradicts the pricing page. ## Company - Legal entity: Morph Labs, Inc., at a San Francisco address. The state of incorporation is not published. [source](https://cloud.morph.so/web/legal/terms-of-service) - Founded: 2023, by Jesse Han, per Tracxn. Christian Szegedy is reported as chief scientist and a seed investor. [source](https://tracxn.com/d/companies/morph-labs/__8ZZWlPNWnRct4CJf-JJjU940HzzVxh1CEZxBQBG6tXg) - Funding: Disputed: one source reports a $5.75M Khosla-led seed, another says no funding has been raised. [source](https://tracxn.com/d/companies/morph-labs/__8ZZWlPNWnRct4CJf-JJjU940HzzVxh1CEZxBQBG6tXg) - Headcount: About 9–11, an aggregator estimate for 2026. No company-confirmed figure. [source](https://www.rl-list.com/vendors/morph) - Status and SLA: Status page reports 100% for the Cloud API over its 90-day chart. No numeric SLA is published. [source](https://status.cloud.morph.so/) - Certification: No verified SOC 2 for Morph Labs, Inc. The Delve trust portal sometimes cited for it belongs to AutoInfra. [source](https://trust.delve.co/morph) ## Caveats - **Free credit is described two ways** (contradiction): Signup docs promise 300 free compute hours a month on the $0 Developer plan; the pricing page lists 0 MCUs and says to purchase MCUs to use compute. - **Stop deletes the instance** (open): The stop API releases the instance and its resources; only a separately retained snapshot survives. - **Snapshot billing basis is unpublished** (open): Whether snapshots bill allocated or stored bytes, and how compression and deduplication count, is not stated. - **Volumes are object storage** (open): Morph Volumes is an S3-compatible product accessed through a gateway and CLI, distinct from an attached disk or EFS mount. - **No published region, GPU or architecture list** (open): Host locations, data residency and GPU availability were not confirmed in primary material. ## Sources - [Devboxes](https://cloud.morph.so/docs/devboxes/getting-started) - [Pause and resume](https://cloud.morph.so/docs/documentation/instances/pause-resume) - [Snapshots](https://cloud.morph.so/docs/documentation/instances/creating-snapshot) - [Branch](https://cloud.morph.so/docs/documentation/instances/branch) - [Pricing](https://cloud.morph.so/web/subscribe) --- # Runtime > Firecracker microVMs billed on measured CPU, with the strongest secret handling in this set. Website: https://withruntime.com Guide page: https://botperch.com/providers/runtime/ Checked: 2026-10-28 **Short answer:** One always-on personal agent (2 vCPU / 4 GiB / 20 GiB) costs about $24.95 a month here, the 5th cheapest of the 11 providers that run it as described. Fits well: An agent that mostly waits: measured CPU with a 50-millicore floor makes an idle hour about $0.03. Runtime Cloud is a hosted fleet of Firecracker microVMs that an agent, or the program driving it, creates, runs commands in, pauses, forks and deletes over an API. It is sold as compute for AI-agent workloads rather than websites or long-lived servers. The commercial pitch is that CPU is billed on measured use with a very low idle floor, so a sandbox waiting on a language model costs almost nothing. Twenty products sit behind one API, CLI, MCP server and SDK set: sandboxes, secrets, images, volumes, snapshots, previews, desktop, metrics, webhooks, OpenTelemetry, TCP ports, private networks and more. **Who it is for:** Teams building agent products that execute model-written code, and teams migrating off a rival sandbox SDK: drop-in shims exist for E2B, Daytona, Vercel and Blaxel. **Isolation:** Firecracker microVM on servers Runtime operates, with its own kernel; not a container and not gVisor. New sandboxes expose /dev/kvm, so nested virtualisation works. No GPU and no ARM: x86-64 only. **Sizes and regions:** No fixed size menu: any vCPU / memory / disk combination inside the bounds, which are 16 vCPU, 64 GiB of memory and 400 GiB of disk on a paid account. CPU is shared by default; reserved guarantees every vCPU at full price. ## How it charges - model: Prepaid credit, no plan fee, no seats and no commitment. - meter: Per second: $0.025 per active vCPU-hour measured, with a 50-millicore floor per sandbox, plus $0.0075 per reserved GiB-hour of memory. Storage while paused or stopped is $0.08 per decimal GB per 30-day month. - stopped: Disk and saved memory blocks keep billing at the storage rate. Only delete ends the charge. - planFee: None publicly. Plans exist in a private beta with no published prices. - minimum: No minimum billing period. Top-ups are $10 to $10,000, and an automatic top-up earns 5% extra credit. Per second on measured CPU with a 50-millicore floor, reserved memory, and stored disk in decimal GB. - A stopped box keeps billing storage, including saved memory; only delete ends the charge. - Automatic top-ups earn 5% extra credit, not subtracted here. ## Monthly cost for each preset workload - A personal agent that stays on (Hermes, OpenClaw): $24.95 - A coding agent for one developer: $13.49 - A code interpreter inside your product: $12.83 - A browser agent for a small team: $157.50 - Self-hosted n8n for a small team: $24.88 - A Discord or Slack bot for one server: $11.86 - Claude Code for a team of five: $66.96 - A scraper that runs four times a day: $0.50 - Your own remote MCP server: $6.39 - A: 1,000 short tasks: $9.17 - B: one always-on box: $54.54 - C: three hours a day: $4.76 ## Fits well - An agent that mostly waits: measured CPU with a 50-millicore floor makes an idle hour about $0.03. - A small team that needs SSO, SCIM, a 400-day audit log and per-key spend limits without an enterprise plan. - Secrets that must not enter the machine, plus OIDC tokens for AWS or GCP. ## Fits badly - A buyer who needs a named founder, a funding history or a company older than a few months. - Multi-region or EU data residency: there is one region, in Virginia. - A workload that needs a Runtime-owned SOC 2 report. ## Features - **Isolation** (yes): Firecracker; /dev/kvm. A Firecracker microVM with its own kernel, and new sandboxes expose /dev/kvm, so nested virtualisation works. [source](https://withruntime.com/llms.txt) [docs](https://withruntime.com/docs/security) - **Sizes and regions** (partly): 64 GiB; 1 region. Any vCPU, memory and disk combination inside 16 vCPU, 64 GiB and 400 GiB. One region in Virginia; shared CPU by default, reserved on request. [source](https://withruntime.com/docs/api) [docs](https://withruntime.com/docs/sandbox-environment) - **Lifecycle** (yes): Pause: RAM frozen. Pause freezes the VM with memory and programs intact; stop keeps files and drops memory. Both keep billing storage, and only delete ends the charge. [source](https://withruntime.com/docs/sandbox-environment) [docs](https://withruntime.com/docs/sandbox-environment#time-and-lifetime) - **Snapshots and forks** (yes): RAM + disk. Snapshots default to memory plus disk, with disk-only opt-in; forks copy files, memory and processes but freeze the source while capturing; a sandbox with a volume cannot be snapshotted. [source](https://withruntime.com/docs/javascript) [docs](https://withruntime.com/docs/javascript#snapshots-and-forks) - **Storage** (yes): Up to 4 volumes. Up to four volumes per sandbox, each mounted at a path, with a read-only snapshot mode for sharing. Buckets from S3, R2 or GCS can appear as a directory without the key entering the sandbox. [source](https://withruntime.com/docs/storage) [docs](https://withruntime.com/docs/storage) - **Idle and waking** (yes): 300 s idle. No clock unless you set one, and persistent: true disables the idle pause. Otherwise it pauses after five idle minutes and wakes on the next request, usually within a second. [source](https://withruntime.com/docs/pricing) [docs](https://withruntime.com/docs/pricing) - **Reaching it** (yes): Closed until opened. Nothing is reachable until you open a door: token-gated previews, custom domains, raw TCP ports, a WireGuard or Tailscale private network, or SSH over the API. [source](https://withruntime.com/docs/sandbox-environment) [docs](https://withruntime.com/docs/networking#private-preview-links) - **Custom domains** (yes): Native, Let's Encrypt. A sandbox's web port can run at your own hostname with HTTPS, verified by DNS records and a certificate from Let's Encrypt. [source](https://withruntime.com/docs/networking) [docs](https://withruntime.com/docs/networking#custom-domains) - **Outbound network** (yes): $5/mo static IP. internet: false refuses everything, an allow list is allow-list only, and deny always wins. A dedicated outbound address costs $5 a month, and sandboxes reach each other over a private name. [source](https://withruntime.com/pricing) [docs](https://withruntime.com/docs/egress) - **Keys and secrets** (yes): No, placeholder + OIDC. The machine sees a placeholder, and the value is added only to HTTPS requests to the hosts you name. OIDC tokens let AWS or GCP trust a sandbox without a stored key. [source](https://withruntime.com/docs/security) [docs](https://withruntime.com/docs/security#secrets-sandboxes-never-see) - **Ways to drive it** (yes): Yes, dashboard. REST, JavaScript, Python, Go, Ruby and Java SDKs, a CLI, a hosted MCP server, SSH over the API, a desktop, webhooks and OpenTelemetry. [source](https://withruntime.com/docs/mcp) [docs](https://withruntime.com/docs/cli) - **Built-in agents** (no): None preinstalled. No preinstalled coding agents: the default image ships Python, Node, Bun, git, compilers and sudo, and agents are installed by you. The vendor says no bridge harness has run on Runtime yet. [source](https://withruntime.com/docs/vercel-ai-sdk) - **Teams and accounts** (yes): Per-key daily + lifetime. Roles, compartments that wall off key groups, per-key daily spend limits and a per-sandbox lifetime cap. SSO, SCIM and a 400-day audit log are free. [source](https://withruntime.com/docs/pricing) [docs](https://withruntime.com/docs/teams) - **Billing models** (partly): 50-millicore CPU floor. Prepaid credit, per second: measured active CPU above a 50-millicore floor, plus reserved memory, plus storage while paused or stopped. No plan fee; plans are in a private beta. [source](https://withruntime.com/docs/pricing) [docs](https://withruntime.com/docs/pricing) - **Trials and free tiers** (yes): 100 h free, no card. Recurring free usage with no card: 100 hours of a 1 GB machine, memory and CPU allowances, and hard caps on size and concurrency. Accounts that never pay get it once across 30 days. [source](https://withruntime.com/docs/pricing) [docs](https://withruntime.com/docs/included-usage) - **The company** (partly): Runtime LLC; 99% API credit. Runtime LLC, Denver; state of formation not published. No founder or executive named; launched September 2026; funding not published. Status checks the API every 2 minutes and a real sandbox every 10; the API passed 96.37% over 7 days and 98.87% over 30. The 99% promise is credit-based: 10% of the month's charges for any account that has bought credit, not tied to a plan. SOC 2 and ISO certificates belong to its data centre in Virginia, not Runtime. New usage can be repriced as soon as posted; cancellation deletes content without a notice promise. [source](https://withruntime.com/docs/pricing) ## Capabilities - Its own virtual machine: yes (Firecracker microVM) [source](https://withruntime.com/docs/sandbox-environment) - Root access: yes (sudo, then root) [source](https://withruntime.com/docs/sandbox-environment) - Docker inside: yes (enable-docker) [source](https://withruntime.com/docs/sandbox-environment) - Nested virtualisation: yes (/dev/kvm) [source](https://withruntime.com/docs/changelog) - Your own image: yes (custom images) [source](https://withruntime.com/docs/images) - Any size you like: yes (any combination in bounds) [source](https://withruntime.com/docs/api) - Large machines: yes (16 cores / 64 GiB) [source](https://withruntime.com/docs/api) - Resize while running: partly (memory, while paused). You can change the memory only while the machine is paused, not while it is working. [source](https://withruntime.com/docs/sandbox-environment) - GPUs: no (no GPU). Runtime lists a GPU request as an example of something it cannot do. [source](https://withruntime.com/docs/feedback-and-support) - Choose the region: no (one region). Everything runs in one place, in Virginia in the United States. [source](https://withruntime.com/docs/trust) - Runs in the EU: no (US only). Everything runs in Virginia in the United States. [source](https://withruntime.com/docs/trust) - Pause keeps memory: yes [source](https://withruntime.com/docs/sandbox-environment) - Pre-started pools: partly. There is no pool to size or refill; you keep spare paused machines yourself and wake one for each task. [source](https://withruntime.com/docs/javascript) - Starts in under a second: yes (About 0.1 s) [source](https://withruntime.com/docs/javascript) - Snapshots of files: yes [source](https://withruntime.com/docs/api) - Snapshots with memory: yes [source](https://withruntime.com/docs/javascript) - Copy a running machine: yes. The source is frozen while the copy is captured, so it pauses for a moment. [source](https://withruntime.com/docs/javascript) - Pick an older snapshot: yes [source](https://withruntime.com/docs/javascript) - Reusable templates: yes [source](https://withruntime.com/llms.txt) - Automatic backups: yes (Daily, or your cron). Backups cover volumes only; a sandbox's own disk has no copy. [source](https://withruntime.com/docs/storage) - Files survive a stop: yes. A stopped disk is billed and kept until you delete the sandbox. [source](https://withruntime.com/docs/sandbox-environment) - Separate volumes: yes (Up to 4) [source](https://withruntime.com/docs/storage) - One volume, several machines: partly. Only one machine can write a volume at a time; others can hold a read-only copy taken when they start. [source](https://withruntime.com/docs/storage) - Mount outside storage: yes [source](https://withruntime.com/docs/storage) - Large disk: yes (400 GiB) [source](https://withruntime.com/docs/jobs) - Can stay on indefinitely: yes [source](https://withruntime.com/docs/pricing) - Choose the idle timeout: yes (300 s, or never) [source](https://withruntime.com/docs/javascript) - Wakes on a request: yes [source](https://withruntime.com/docs/javascript) - Scheduled runs: yes [source](https://withruntime.com/docs/jobs) - Public link to a port: yes (Paid top-up) [source](https://withruntime.com/docs/included-usage) - Private link: yes (Token by default) [source](https://withruntime.com/docs/sandbox-environment) - Real SSH: partly (Through the CLI). The connection goes through the provider's own command rather than a plain SSH address. [source](https://withruntime.com/docs/editors) - Terminal in the browser: yes (Console) [source](https://withruntime.com/docs/products) - Tunnel to your computer: yes (Through the API) [source](https://withruntime.com/docs/editors) - Non-web ports: yes (5 per machine) [source](https://withruntime.com/docs/networking) - Your own domain: yes (Your hostname) [source](https://withruntime.com/docs/networking) - Automatic HTTPS: yes (Let's Encrypt) [source](https://withruntime.com/docs/networking) - Outbound data included: yes (100 GiB a month) [source](https://withruntime.com/pricing) - Allow only some sites: yes (Allow list) [source](https://withruntime.com/docs/sandbox-environment) - Turn the internet off: yes (internet: false) [source](https://withruntime.com/docs/sandbox-environment) - Fixed outgoing IP: yes ($5 a month) [source](https://withruntime.com/pricing) - Stored secrets: yes (Stored once) [source](https://withruntime.com/docs/security) - Secrets the agent cannot read: yes (Placeholder) [source](https://withruntime.com/docs/security) - Limited API keys: yes (Read-only keys) [source](https://withruntime.com/docs/pricing) - Create from the website: yes [source](https://withruntime.com/docs/products) - Command-line tool: yes [source](https://withruntime.com/docs/cli) - Python SDK: yes [source](https://withruntime.com/docs/start) - TypeScript SDK: yes [source](https://withruntime.com/docs/start) - Documented HTTP API: yes [source](https://withruntime.com/about) - MCP server: yes [source](https://withruntime.com/docs/mcp) - Interactive terminal over the API: yes [source](https://withruntime.com/docs/cli) - Files over the API: yes [source](https://withruntime.com/docs/javascript) - Coding agents preinstalled: no. The default image ships languages and tools but no coding agent; you install the agent yourself. [source](https://withruntime.com/docs/vercel-ai-sdk) - Send it a prompt: no. Runtime has no agent-run API; its own docs say no bridge harness has run on it yet. [source](https://withruntime.com/docs/vercel-ai-sdk) - One-click Hermes: no. No Hermes template or guide is published. [source](https://withruntime.com/docs/start) - One-click OpenClaw: no. No OpenClaw template or guide is published. [source](https://withruntime.com/docs/start) - Browser built in: yes [source](https://withruntime.com/docs/javascript) - Desktop for computer use: yes [source](https://withruntime.com/docs/javascript) - Runs other platforms' agents: yes [source](https://withruntime.com/docs/frameworks) - Team workspace: yes [source](https://withruntime.com/docs/teams) - Roles and permissions: yes (4 roles) [source](https://withruntime.com/docs/products) - Single sign-on: yes [source](https://withruntime.com/pricing) - Hard spending cap: yes [source](https://withruntime.com/docs/pricing) - Usage alerts: partly. The console warns when credit or free usage is about to run out, but you cannot set your own threshold. [source](https://withruntime.com/docs/products) - Audit log: yes (400 days) [source](https://withruntime.com/docs/teams) - Billed per second: yes (per second) [source](https://withruntime.com/docs/reservations) - CPU billed only while working: yes (measured, 50 mcore floor) [source](https://withruntime.com/docs/pricing) - Paused costs only storage: yes (storage only) [source](https://withruntime.com/docs/pricing) - No monthly fee: yes (none) [source](https://withruntime.com/docs/pricing) - Flat monthly price: no (measured parts). The bill is measured processor time plus reserved memory plus storage. [source](https://withruntime.com/docs/pricing) - Ongoing free tier: yes (100 hours a month) [source](https://withruntime.com/docs/pricing) - Free starting credit: partly (matched credit). There is no plain signup credit; whatever you add in your first 30 days is doubled, up to $1,000. [source](https://withruntime.com/docs/pricing) - Try without a card: yes (no card) [source](https://withruntime.com/docs/pricing) - Public status page: yes [source](https://withruntime.com/docs/trust) - Uptime promise (SLA): yes (99% API) [source](https://withruntime.com/docs/pricing) - SOC 2 report: partly. The SOC 2 and ISO certificates belong to its Virginia data centre, not to Runtime, so there is no Runtime-owned report. [source](https://withruntime.com/docs/trust) - Data processing agreement: yes [source](https://withruntime.com/docs/pricing) - Open source or self-hostable: no. Runtime runs everything in its own Virginia region and publishes no self-hosted edition. [source](https://withruntime.com/docs/trust) ## Usability - Dashboard: Yes, a detailed console: a Home report with a Needs you section, sandboxes with Overview, Terminal, Files, Activity and Settings tabs, a limits page, and usage and billing with daily spend by product. - Without code: Partly, and only for the first step: one click starts a sandbox with a shell in the page on free hours. There are no app templates and no hosted agent, and the documented no-code path is pasting its llms.txt link into Claude Code, Codex or Cursor. - Signup: A Google sign-in, no card and no waitlist. Free usage needs a verified sign-in and is withheld from data-centre or VPN addresses until credit is added. - Docs: Extensive, every page dated, with llms.txt bundles. Support is an AI agent in the same call, with humans for billing, security and data loss. The status page is public and specific. - Trips people up: A sandbox is not a website host: nothing is reachable until you open a preview, domain or TCP port. - Trips people up: The bill moves while nothing happens, because memory is charged for every running second. - Trips people up: Pause, stop and delete are three different things with three different bills. - Trips people up: The first useful step still needs a command or an agent. - Trips people up: Memory is measured in GiB and disk in decimal GB, a 7.4% difference that shows up in quotes. - Trips people up: There is no EU region, and uptime was below the promised 99% during research. ## Company - Legal entity: Runtime LLC, at a Denver, Colorado address. The state of formation is not published. [source](https://withruntime.com/legal/terms) - Leadership: No founder, executive or board member is named anywhere Runtime publishes. - History: Public since 18 September 2026, the first changelog entry. Nothing earlier than September 2026 is published. [source](https://withruntime.com/docs/changelog) - Funding: Not published. No round, investor, accelerator or valuation appears on the site. - Status and SLA: API checks passed 96.37% over 7 days and 98.87% over 30, against a 99% monthly promise with a 10% credit for paid accounts. [source](https://withruntime.com/status.json) - Certification: The certificates on its trust page belong to suppliers, including its Virginia data centre. No Runtime-owned SOC 2 is claimed. [source](https://withruntime.com/docs/trust) ## Caveats - **A stopped sandbox keeps billing** (open): Only delete ends the storage charge. A stopped box is a bill, not a cleanup, and persistent: true bills memory around the clock. - **Uptime was below the published promise** (open): The status page showed 96.37% over 7 days and 98.87% over 30 days against a 99% monthly promise at the time of research. - **Free hours: every month or once?** (contradiction): The start page says 100 free hours every month; the pricing and included-usage pages say an account that has never paid gets them once, across its first 30 days. - **The canonical state list is not published** (open): The docs name transitions and mention starting, running, pausing, paused, resuming, stopping and stopped, but there is no quotable list of state strings. - **One region, in Virginia** (open): Everything runs in us-east. There is no EU option, and no per-tenant residency control. - **Very young** (open): A one-month-old repository, near-zero community discussion, and daily changelog entries including breaking changes. No preinstalled coding agents, and the vendor says no bridge harness has run on Runtime yet. ## Sources - [Docs: sandbox environment](https://withruntime.com/docs/sandbox-environment) - [Docs: pricing](https://withruntime.com/docs/pricing) - [Docs: security and secrets](https://withruntime.com/docs/security) - [Docs: networking](https://withruntime.com/docs/networking) - [Docs: API](https://withruntime.com/docs/api) - [Pricing](https://withruntime.com/pricing) --- # Sandboxer > Whole Ubuntu microVMs billed per second, sold through monthly plans whose dollars come back as machine time. Website: https://sandboxer.com Guide page: https://botperch.com/providers/sandboxer/ Checked: 2026-10-28 **Short answer:** One always-on personal agent (2 vCPU / 4 GiB / 20 GiB) costs about $40.00 a month here, the 6th cheapest of the 11 providers that run it as described. Fits well: A microVM with systemd, Docker with BuildKit and Compose, and /dev/kvm. Sandboxer rents whole Linux virtual machines to agents and to the people running them. Each sandbox is an Ubuntu 24.04 microVM on Cloud Hypervisor with its own kernel, root, systemd, Docker and /dev/kvm, reachable over an HTTP API, a CLI, two SDKs and an MCP server. Its selling point is that state outlives the session: a stop writes RAM as well as disk, so a resume can bring running processes back, and a fork is a copy-on-write clone. It launched publicly on 2026-10-18. There are two regions, no GPUs, no SLA, and no independent reviews yet. **Who it is for:** Solo builders and small agent fleets, products giving every user their own computer, eval farms and teams running coding or computer-use agents in parallel. **Isolation:** Cloud Hypervisor microVM with its own kernel and a separate copy-on-write root disk. Docker, systemd, /dev/kvm and root all work. The control channel is vsock, not TCP, so code inside cannot reach the host API. **Sizes and regions:** Four fixed sizes: small 2 vCPU / 4 GB / 12 GB, default 4 vCPU / 8 GB / 50 GB, large 8 vCPU / 16 GB / 125 GB, xlarge 16 vCPU / 32 GB / 251 GB. vCPUs are shared; RAM is reserved. Disk is space for your files, on top of a 6–7 GB OS image. ## How it charges - model: Monthly plan whose dollars return as machine time, plus optional time packs. - meter: Per second while running, at a fixed multiplier per size: small 0.5×, default 1×, large 2×, xlarge about 5.56×. One dollar buys 100,000 default-seconds. - stopped: Nothing for compute. Storage is counted against an included quota but not billed, and going over the quota blocks new sandboxes rather than charging. - planFee: $20, $100, $500 or $2,000 a month, per seat in an organisation. The plan price comes back as machine time, and unused plan time expires monthly. - minimum: The $20 plan is the floor: there is no free tier, and the 7-day trial converts into it automatically. A fixed multiplier per size, per second while running, out of a plan whose dollars come back as machine time. - Storage counts against an included quota and is not billed; going over blocks new sandboxes. - Plans are per seat in an organisation. ## Monthly cost for each preset workload - A personal agent that stays on (Hermes, OpenClaw): $40.00 - A coding agent for one developer: $20.00 - A code interpreter inside your product: $20.00 - A browser agent for a small team: $100.00 - Self-hosted n8n for a small team: $40.00 - A Discord or Slack bot for one server: $20.00 - Claude Code for a team of five: $40.00 - A scraper that runs four times a day: $20.00 - Your own remote MCP server: $20.00 - A: 1,000 short tasks: $20.00 - B: one always-on box: $40.00 - C: three hours a day: $20.00 ## Fits well - A microVM with systemd, Docker with BuildKit and Compose, and /dev/kvm. - Six agent harnesses in every sandbox and a prompt API that returns an id. - Stopped time that is free, with the whole disk kept while the sandbox is stopped. ## Fits badly - A procurement review: no SLA, no SSO, no audit log and no certification. - A heavy network workload with a third party that rate-limits by IP: outbound shares the node's address. - A team that wants per-seat pricing to stay flat: plans are per seat. ## Features - **Isolation** (yes): Cloud Hypervisor; /dev/kvm. A Cloud Hypervisor microVM with its own kernel, systemd, Docker with BuildKit and Compose, and /dev/kvm. [source](https://sandboxer.com/docs/security) [docs](https://sandboxer.com/docs/security) - **Sizes and regions** (partly): 16 vCPU / 32 GB; 2 regions. Four fixed sizes from 2/4/12 GB to 16/32/251 GB, shared vCPU with reserved RAM. Two regions, no GPU, no ARM. [source](https://sandboxer.com/pricing) [docs](https://sandboxer.com/docs/machines) - **Lifecycle** (partly): RAM to disk; 2 min window. A stop writes memory and device state to disk, so a resume can restore running processes — but only on a machine of the same CPU type within two minutes, otherwise it cold-boots. [source](https://sandboxer.com/docs/snapshots) [docs](https://sandboxer.com/docs/snapshots) - **Snapshots and forks** (yes): Disk + RAM on stop. Three snapshot kinds: a stop snapshot with disk and memory, continuous disk snapshots every ten minutes, and named disk snapshots used as templates with share codes. Forks are disk-only. [source](https://sandboxer.com/docs/snapshots) [docs](https://sandboxer.com/docs/snapshots) - **Storage** (partly): Whole disk; quota, not bill. The whole disk persists while stopped, free within a storage quota, and there is no separate volume or image registry. Going over quota blocks new sandboxes rather than charging. [source](https://sandboxer.com/docs/machines) [docs](https://sandboxer.com/docs/billing) - **Idle and waking** (partly): 1 s – 30 days, or off. No maximum lifetime, but a hard auto-stop defaults to one hour and idle pause to 15–120 minutes by plan. An always-on box needs ttlSeconds: null and idleStopMinutes: 0. [source](https://sandboxer.com/docs/limits) [docs](https://sandboxer.com/docs/long-running) - **Reaching it** (yes): Token in URL. A stable HTTPS address per port, private by default with a token in the URL; --public removes it. A public IPv6 with the firewall closed except SSH. No raw-TCP endpoint. [source](https://sandboxer.com/docs/hosting) [docs](https://sandboxer.com/docs/hosting) - **Custom domains** (partly): CNAME plus your TLS. First-class custom domains are on the roadmap; the documented workaround is a CNAME to the hosted hostname with your own TLS termination. [source](https://sandboxer.com/docs/hosting) [docs](https://sandboxer.com/docs/hosting) - **Outbound network** (partly): Not billed. Outbound is open by default with no allowlist product. Traffic shares the node's IPv4 and IPv6 with other sandboxes, so external rate limits are shared. [source](https://sandboxer.com/docs/security) [docs](https://sandboxer.com/docs/security) - **Keys and secrets** (partly): Yes, env + files. An environment injects variables, secret files and repositories into the VM, and removing a secret deletes it from disk. There is no broker or short-lived credential exchange. [source](https://sandboxer.com/docs/security) [docs](https://sandboxer.com/docs/environments) - **Ways to drive it** (yes): Yes, dashboard. REST, TypeScript and Python SDKs, a static CLI binary, a hosted MCP server, SSH and SCP, a VNC desktop and a browser terminal. [source](https://sandboxer.com/docs/cli) [docs](https://sandboxer.com/docs/api) - **Built-in agents** (yes): Six harnesses; prompt API. Six harnesses installed in every sandbox, a prompt API that returns a prompt id, steering for Claude Code, Codex and Pi, and a live model catalogue. [source](https://sandboxer.com/docs/agents) [docs](https://sandboxer.com/docs/agents) - **Teams and accounts** (partly): Per-member caps. An organisation is a shared wallet with owner and member roles, scoped keys and per-member usage caps. Plans are per seat, and no audit log or SSO is published. [source](https://sandboxer.com/docs/organizations) [docs](https://sandboxer.com/docs/organizations) - **Billing models** (partly): $0.036/h default. A monthly plan whose dollars return as machine time, metered per second at a fixed multiplier per size. Stopped time is free, but the $20 plan is a floor and plan time expires monthly. [source](https://sandboxer.com/pricing) [docs](https://sandboxer.com/docs/billing) - **Trials and free tiers** (partly): 7 days / 25 h, then a plan. A seven-day trial with 25 hours of machine time, two sandboxes, small and default sizes, and a card up front. It becomes $20 a month on day eight. [source](https://sandboxer.com/pricing) [docs](https://sandboxer.com/pricing) - **The company** (partly): North Bay Opco I, Inc.; no SLA. North Bay Opco I, Inc., Delaware, Miami mailbox; part of North Bay Ventures, Jon Oringer's studio. Entity incorporated November 2022; product launched 18 October 2026; funding not published. Status reports API 100%, sandboxes 99.45% and website 99.79% over 30 days, but the product is ten days old, so the 90-day columns cannot all be production traffic. No SLA during early access. No SOC 2, ISO or HIPAA. Price changes need 30 days' notice; cancellation runs to month end; closing forfeits remaining credit; data is deleted after termination with no export window. [source](https://sandboxer.com/terms) ## Capabilities - Its own virtual machine: yes (Cloud Hypervisor microVM) [source](https://sandboxer.com/docs/security) - Root access: yes (sudo inside) [source](https://sandboxer.com/docs/machines) - Docker inside: yes (Docker preinstalled) [source](https://sandboxer.com/docs/machines) - Nested virtualisation: yes (/dev/kvm) [source](https://sandboxer.com/docs/machines) - Your own image: partly (snapshot templates). You cannot start from your own image; you set a machine up and save its disk as a template. [source](https://sandboxer.com/docs/llms.txt) - Any size you like: no (4 fixed sizes). There are four fixed sizes and no custom size. [source](https://sandboxer.com/docs/machines) - Large machines: yes (16 cores / 32 GB). Only on the $100-a-month plan or above. [source](https://sandboxer.com/docs/machines) - Resize while running: no (stop and recreate). There is no way to change a running machine's size; you create a new one and copy your files across. [source](https://sandboxer.com/docs/machines) - GPUs: no (no GPU). There are no graphics processors. [source](https://sandboxer.com/docs/llms.txt) - Choose the region: yes (US East or EU Central) [source](https://sandboxer.com/docs/regions) - Runs in the EU: yes (Helsinki) [source](https://sandboxer.com/docs/regions) - Pause keeps memory: partly (2 min window). Memory comes back only if a machine of the same processor type is free within two minutes; otherwise it boots fresh with the files. [source](https://sandboxer.com/docs/snapshots) - Pre-started pools: partly. The provider keeps machines ready, but you cannot say how many or which setup; a size the region does not keep boots instead. [source](https://sandboxer.com/docs/machines) - Starts in under a second: yes (0.18 s median) [source](https://sandboxer.com/docs/machines) - Snapshots of files: yes [source](https://sandboxer.com/docs/snapshots) - Snapshots with memory: yes [source](https://sandboxer.com/docs/snapshots) - Copy a running machine: partly. A fork copies the files and boots fresh; the running programs are not copied. [source](https://sandboxer.com/docs/snapshots) - Pick an older snapshot: partly. The automatic copies keep only the latest two; anything older you have to save yourself under a name. [source](https://sandboxer.com/docs/snapshots) - Reusable templates: yes [source](https://sandboxer.com/docs/snapshots) - Automatic backups: partly (Every 10 minutes). These are automatic snapshots kept on the same host as the machine, not an off-site backup, so they do not survive losing that host. [source](https://sandboxer.com/docs/snapshots) - Files survive a stop: yes [source](https://sandboxer.com/docs/snapshots) - Separate volumes: no [source](https://sandboxer.com/docs/machines) - One volume, several machines: no [source](https://sandboxer.com/docs/machines) - Mount outside storage: no [source](https://sandboxer.com/docs/machines) - Large disk: yes (251 GB) [source](https://sandboxer.com/docs/machines) - Can stay on indefinitely: yes [source](https://sandboxer.com/docs/limits) - Choose the idle timeout: yes (15–120 min, or 0) [source](https://sandboxer.com/docs/long-running) - Wakes on a request: yes [source](https://sandboxer.com/docs/long-running) - Scheduled runs: partly. A cron or timer runs inside the machine, so it never fires while the machine is stopped or paused. [source](https://sandboxer.com/guides/run-scheduled-jobs-in-a-sandbox-with-systemd-timers.md) - Public link to a port: yes (--public) [source](https://sandboxer.com/docs/hosting.md) - Private link: yes (Token in link) [source](https://sandboxer.com/docs/hosting.md) - Real SSH: yes (sshEndpoint) [source](https://sandboxer.com/docs/ssh.md) - Terminal in the browser: yes (Dashboard tab) [source](https://sandboxer.com/docs/ssh.md) - Tunnel to your computer: yes (sbx forward) [source](https://sandboxer.com/docs/ssh.md) - Non-web ports: partly (Through SSH only). There is no public non-web port; you reach one by opening a tunnel from your own computer. [source](https://sandboxer.com/docs/security.md) - Your own domain: partly (CNAME and your certificate). You point a name at the provider's address and supply the security certificate yourself; a native feature is only planned. [source](https://sandboxer.com/docs/hosting.md) - Automatic HTTPS: no. You point the name and terminate the certificate yourself. [source](https://sandboxer.com/docs/hosting.md) - Outbound data included: yes (Not billed) [source](https://sandboxer.com/pricing) - Allow only some sites: no. There is no allowlist or outbound firewall setting; every machine can reach the whole internet. [source](https://sandboxer.com/guides/what-can-reach-a-sandbox-and-what-it-can-reach) - Turn the internet off: partly (Firewall inside). There is no provider setting; you block traffic with the machine's own firewall, which the agent can undo. [source](https://sandboxer.com/guides/what-can-reach-a-sandbox-and-what-it-can-reach) - Fixed outgoing IP: no (Shared host address). Outbound traffic shares the host machine's address with every other sandbox on it, so other services see one shared address. [source](https://sandboxer.com/docs/security.md) - Stored secrets: yes (Variables and files) [source](https://sandboxer.com/docs/environments.md) - Secrets the agent cannot read: no. Keys are written into the machine as variables and files, so the agent can read them. [source](https://sandboxer.com/docs/environments.md) - Limited API keys: yes (Action and machine sets) [source](https://sandboxer.com/docs/api-keys.md) - Create from the website: no [source](https://sandboxer.com/docs/quickstart) - Command-line tool: yes [source](https://sandboxer.com/docs/cli) - Python SDK: yes [source](https://sandboxer.com/docs/llms.txt) - TypeScript SDK: yes [source](https://sandboxer.com/docs/llms.txt) - Documented HTTP API: yes [source](https://sandboxer.com/docs/api) - MCP server: yes [source](https://sandboxer.com/docs/mcp) - Interactive terminal over the API: yes [source](https://sandboxer.com/docs/api) - Files over the API: yes [source](https://sandboxer.com/docs/mcp) - Coding agents preinstalled: yes (6 harnesses) [source](https://sandboxer.com/docs/llms.txt) - Send it a prompt: yes [source](https://sandboxer.com/docs/agents) - One-click Hermes: no. Its six harnesses do not include Hermes, and there is no template. [source](https://sandboxer.com/docs/llms.txt) - One-click OpenClaw: no. Its harness list does not include OpenClaw, and there is no template. [source](https://sandboxer.com/docs/llms.txt) - Browser built in: yes [source](https://sandboxer.com/docs/llms.txt) - Desktop for computer use: yes [source](https://sandboxer.com/docs/desktop) - Runs other platforms' agents: no. Its agent pages cover SDKs and frameworks, not another platform's hosted cloud agents. [source](https://sandboxer.com/docs/llms.txt) - Team workspace: yes [source](https://sandboxer.com/docs/organizations) - Roles and permissions: partly. Only two roles exist; there is no read-only role or finer permission. [source](https://sandboxer.com/docs/organizations) - Single sign-on: not-published [source](https://sandboxer.com/docs/organizations) - Hard spending cap: partly. A member's machine time can be capped, and a zero balance stops new sandboxes, but there is no account-wide dollar cap. [source](https://sandboxer.com/docs/organizations) - Usage alerts: yes [source](https://sandboxer.com/docs/billing) - Audit log: not-published [source](https://sandboxer.com/docs/security) - Billed per second: yes (per second) [source](https://sandboxer.com/docs/billing) - CPU billed only while working: no (flat rate per size). The price depends on the size you picked, not on how hard it works. [source](https://sandboxer.com/docs/billing) - Paused costs only storage: yes (nothing while stopped) [source](https://sandboxer.com/docs/billing) - No monthly fee: no ($20 minimum plan). The smallest plan is $20 a month, and included time does not carry over. [source](https://sandboxer.com/docs/billing) - Flat monthly price: yes ($26.28 a month default) [source](https://sandboxer.com/pricing.md) - Ongoing free tier: no (trial only). There is no free tier, only a seven-day trial that becomes a $20 plan. [source](https://sandboxer.com/docs/billing) - Free starting credit: no (none). There is no credit; the trial is 25 hours of machine time that becomes a paid plan. [source](https://sandboxer.com/pricing.md) - Try without a card: no (card for the trial). The trial needs a card up front and becomes a paid plan after seven days. [source](https://sandboxer.com/pricing.md) - Public status page: yes [source](https://sandboxer.com/docs/llms.txt) - Uptime promise (SLA): no. There is no SLA during early access. [source](https://sandboxer.com/docs/llms.txt) - SOC 2 report: not-published [source](https://sandboxer.com/docs/security) - Data processing agreement: partly. You have to write to privacy@ to get a data processing addendum. [source](https://sandboxer.com/terms) - Open source or self-hostable: no. Sandboxer runs on dedicated servers it operates; no self-hosted edition is published. [source](https://sandboxer.com/docs/llms.txt) ## Usability - Dashboard: Yes, at sandboxer.com/app: a sandbox list with a stop countdown and an Extend button, an Open desktop button, a browser terminal, billing, environments, agents, API keys, webhooks and alerts. - Without code: Not really. Every documented workflow is a sbx command, and templates are created from the CLI or API. The one genuinely no-code route is adding its hosted MCP server as a connector in Claude or ChatGPT and asking in chat. - Signup: GitHub, Google, email code or email and password, plus a card before the first sandbox. The card starts a 7-day trial with 25 hours of machine time, which becomes the $20 plan on day 8. - Docs: About 30 pages with a Markdown mirror, an OpenAPI file, a 50-term glossary and published benchmark method. Support is email only. The status page is public with 90-day uptime. - Trips people up: The card comes first: you cannot see a sandbox without payment details. - Trips people up: The trial becomes a subscription on day 8 unless cancelled. - Trips people up: Nothing is one-click: hosting a port is a CLI step. - Trips people up: The default 1-hour auto-stop stops a sandbox you forgot about, and a running job does not hold it off. - Trips people up: A private preview URL is a password, and anyone with the link is in. - Trips people up: Resume may not restore your session, which is the promise you will remember. ## Company - Legal entity: North Bay Opco I, Inc., a Delaware corporation with a Miami mailing address. [source](https://sandboxer.com/terms) - Ownership: One product of North Bay Ventures, Jon Oringer's venture studio. The same entity contracts for sibling products. [source](https://www.northbayventures.com/) - History: The product went live on 18 October 2026. [source](https://x.com/jonoringer/status/2111826193578070439) - Incorporated: The contracting entity was incorporated on 9 November 2022, almost four years before the product launched. [source](https://netstate.co/agents/us-de/corporation-service-company/p/14030) - Funding: Not published. No round, investor, valuation or accelerator appears anywhere. - Status and SLA: API 100% and sandboxes 99.45% over 30 days. No SLA during early access, on any plan. [source](https://sandboxer.com/docs/llms.txt) - Certification: No SOC 2, ISO 27001 or HIPAA claim and no trust centre. A vulnerability policy with a three-day acknowledgement. ## Caveats - **Its sizes and prices exactly match Boat's** (open): small, default, large and xlarge at $0.018 / $0.036 / $0.072 / $0.20 an hour, and the same $20 / $100 / $500 / $2,000 plan tiers. But the disk sizes differ (12/50/125/251 GB here against 51/51/111/251 GB at Boat), the regions differ (US East and Helsinki here, EU-only at Boat), Boat deletes a stopped sandbox's disk after 14 days while Sandboxer keeps it, and the legal entities are unrelated. No public source explains the relationship. This is an open question, not evidence of a reseller or a copy. - **Ten days old at the time of research** (open): Launch post 2026-10-18, oldest changelog entry 2026-10-17, no independent reviews or benchmarks, and no company page: the legal entity is a Delaware company at a Miami private mailbox shared with unrelated products. - **Resume keeps running processes only conditionally** (open): It needs a machine of the same CPU type within two minutes; otherwise the sandbox cold-boots from disk. requireMemory: true makes it strict but cannot be combined with a resize. - **No SLA, no SSO, no audit log, no compliance certification published** (open): There is a vulnerability policy and a security.txt, but no SOC 2, ISO 27001 or HIPAA statement, and no DPA or sub-processor list. - **Two regions disagree on where us-east is** (contradiction): The regions page says Ashburn, Virginia; a performance note on the machines page says Leesburg, VA. Same metro, different answer. ## Sources - [Docs](https://sandboxer.com/docs) - [Snapshots](https://sandboxer.com/docs/snapshots) - [Machines and sizes](https://sandboxer.com/docs/machines) - [Billing](https://sandboxer.com/docs/billing) - [Hosting and preview URLs](https://sandboxer.com/docs/hosting) - [Pricing](https://sandboxer.com/pricing) - [Security](https://sandboxer.com/docs/security) --- # Sprites > Persistent Fly.io microVMs that suspend after about 30 seconds idle and bill measured CPU and memory. Website: https://fly.io/sprites Guide page: https://botperch.com/providers/sprites/ Checked: 2026-10-28 **Short answer:** One always-on personal agent (2 vCPU / 4 GiB / 20 GiB) costs about $77.61 a month here, the 8th cheapest of the 11 providers that run it as described. Fits well: An agent that pauses constantly: a warm pause after about 30 seconds resumes in 100–500 ms. Sprites are persistent Linux environments on Fly.io for agents, development and user-submitted code. Each is a dedicated microVM with a whole filesystem that survives between sessions. The design assumes a computer that sleeps: a short idle window suspends it with memory frozen, and a longer idle period stops it and drops memory, keeping the disk. **Who it is for:** Developers who want a long-lived Linux computer for an agent, with automatic sleep and usage-based billing rather than a reserved size. **Isolation:** Dedicated microVM with hardware-level isolation. Root is available and Docker is reported to work, but Sprites do not run systemd: a built-in service manager starts services on wake. **Sizes and regions:** One fixed shape: 8 vCPUs and 100 GB of storage, with memory assigned and autoscaled per Sprite. No published region selection, GPU or ARM option. ## How it charges - model: Measured usage, with optional monthly plans that bundle allowances. - meter: Actual CPU at $0.0385 per CPU-hour and actual memory at $0.021875 per GB-hour while awake; hot storage at $0.000683 per GB-hour and cold storage at $0.000027 per GB-hour. - stopped: No compute charge in warm or cold state, but cold storage is billed for as long as data is kept. - planFee: The pricing page says there are no plans; the product FAQ describes plans including Hero at $100 a month. Both are current. - minimum: No published minimum. A one-time $30 trial credit per user and per organisation, which cannot pay a subscription fee. Measured CPU and memory while awake, hot storage while awake and cold storage for as long as data is kept. - Memory is billed on actual use; the calculator uses the memory you entered. - A one-time $30 trial credit is not subtracted. - The pricing page says there are no plans; the FAQ sells Hero ($100) and Mythic ($2,000). Pay as you go is used here. ## Monthly cost for each preset workload - A personal agent that stays on (Hermes, OpenClaw): $77.61 - A coding agent for one developer: $34.15 - A code interpreter inside your product: $35.90 - A browser agent for a small team: $485.03 - Self-hosted n8n for a small team: $77.50 - A Discord or Slack bot for one server: $38.88 - Claude Code for a team of five: $169.99 - A scraper that runs four times a day: $1.33 - Your own remote MCP server: $22.91 - A: 1,000 short tasks: $22.18 - B: one always-on box: $164.91 - C: three hours a day: $10.19 ## Fits well - An agent that pauses constantly: a warm pause after about 30 seconds resumes in 100–500 ms. - A long-lived filesystem with no volume to manage, capped at 100 GB and billed on bytes written. - Secrets that never reach the Sprite, through connectors and a gateway. ## Fits badly - systemd: Sprites do not run it, and services start through a built-in manager on wake. - A live fork or create-from-checkpoint: neither is documented. - A client-facing link: the URL is private to the organisation and needs an org token. ## Features - **Isolation** (partly): microVM; no systemd. A hardware-isolated microVM with root and Docker reported, but it does not run systemd: a built-in service manager starts services on wake. [source](https://docs.fly.io/sprites/concepts/services) [docs](https://docs.fly.io/sprites/index.md) - **Sizes and regions** (partly): 8 vCPU; no choice. One shape: 8 vCPUs and 100 GB of storage, with memory assigned and autoscaled. GPU is explicitly not offered; region selection is unavailable and placement is automatic; CPU architecture is not published. [source](https://docs.fly.io/sprites/concepts/lifecycle.md) [docs](https://docs.fly.io/sprites/concepts/lifecycle.md) - **Lifecycle** (yes): Warm pause; 100–500 ms. A warm pause freezes memory and processes and resumes in 100–500 ms; a longer idle period stops the VM, drops memory and starts processes fresh. Open TCP connections do not survive either. [source](https://docs.fly.io/sprites/concepts/lifecycle) [docs](https://docs.fly.io/sprites/concepts/lifecycle.md) - **Snapshots and forks** (partly): Filesystem only. Checkpoints snapshot the writable filesystem, copy-on-write and without interrupting work; they restore in place and overwrite current files. A live fork or create-from-checkpoint is not documented. [source](https://docs.fly.io/sprites/concepts/checkpoints) [docs](https://docs.fly.io/sprites/concepts/checkpoints.md) - **Storage** (yes): 100 GB cap; bytes written. The whole filesystem persists on durable local storage, capped at 100 GB, and checkpoints keep filesystem blocks that bill while retained. No attachable or shared volumes are documented. [source](https://docs.fly.io/sprites/concepts/lifecycle.md) [docs](https://docs.fly.io/sprites/concepts/lifecycle.md) - **Idle and waking** (yes): 30 s warm pause. A warm pause after about 30 seconds idle, a cold stop after a longer unpublished period, and wake on request. Four things reset the timer, including an open TCP connection. [source](https://docs.fly.io/sprites/concepts/lifecycle) [docs](https://docs.fly.io/sprites/working-with-sprites.md) - **Reaching it** (partly): Org token. Every Sprite has an HTTPS URL that is private to the organisation by default, reachable with an org token. SSH requires installing a server and proxying it. [source](https://docs.fly.io/sprites/concepts/networking) [docs](https://docs.fly.io/sprites/concepts/networking.md) - **Custom domains** (not-published): Not published. No native custom-domain support is documented. A community report from April 2026 says Sprites lack custom domains and certificates the way regular Fly VMs do; current support was not confirmed, so treat a proxy as the only known path. [source](https://community.fly.io/t/cloudflare-to-sprite-ssl-tls-is-broken-preventing-custom-domains-therefore-prod-use-cases/27512) - **Outbound network** (yes): Not metered. Outbound is unrestricted by default, with an opt-in DNS allowlist applied from outside the Sprite. Bandwidth is not metered. [source](https://docs.fly.io/sprites/concepts/networking) [docs](https://docs.fly.io/sprites/concepts/networking.md) - **Keys and secrets** (yes): No, gateway. Connectors store the credential in the organisation and route API calls through the Sprites gateway, so the Sprite never sees the token. A connector with no policy refuses every Sprite. [source](https://docs.fly.io/sprites/concepts/connectors) [docs](https://docs.fly.io/sprites/concepts/connectors.md) - **Ways to drive it** (partly): No; CLI. A CLI and interactive console, SDKs and agent integrations, and SSH only after installing a server and proxying it. No managed desktop or browser-control product. [source](https://docs.fly.io/sprites/quickstart) [docs](https://docs.fly.io/sprites/cli/commands.md) - **Built-in agents** (no): None; plugins only. Plugins for coding agents and SDK integrations, but no preinstalled agent or provider-managed agent API is documented. [source](https://fly.io/sprites/) - **Teams and accounts** (partly): Not published. Fly.io organisations and connector management in a dashboard. SSO is claimed by a third party; spend caps, key scopes, audit retention and residency are not published. [source](https://docs.fly.io/sprites/quickstart) [docs](https://docs.fly.io/sprites/cli/authentication.md) - **Billing models** (partly): $0.0385/CPU-hour. Actual CPU at $0.0385 per CPU-hour and actual memory at $0.021875 per GB-hour, plus hot and cold storage. The pricing page says there are no plans; the product FAQ describes plans. [source](https://fly.io/pricing/) [docs](https://fly.io/pricing/) - **Trials and free tiers** (partly): $30 one-off. A one-time $30 trial credit per user and per organisation. Credits cannot pay a subscription fee. Card requirement and expiry are not published. [source](https://fly.io/sprites/) [docs](https://fly.io/sprites/) - **The company** (partly): Fly.io, Inc.; 99.9% Enterprise. Fly.io, Inc., Delaware; CEO Scott Johnston, founder Kurt Mackey advisory; platform since 2017, Sprites launched January 2026; $25M Series D in July 2026. Status page lists Sprites as a component but shows no numeric uptime; it covers global incidents only and recorded a certificate outage on 11–12 October. The 99.9% SLA is Enterprise-only and credits must be claimed; Sprites coverage is not confirmed. SOC 2 is platform-level and does not name Sprites; the BAA is a $99/month add-on. The customer is responsible for backups; data deleted within 30 days, backups within 90. [source](https://fly.io/legal/sla-uptime/) ## Capabilities - Its own virtual machine: yes (microVM) [source](https://docs.fly.io/sprites/index) - Root access: yes (sudo) [source](https://docs.fly.io/sprites/working-with-sprites) - Docker inside: partly (Docker, with limits). Docker runs, but some containers fail and the usual service manager is missing, so services need the provider's own manager instead. [source](https://community.fly.io/t/27956) - Nested virtualisation: not-published [source](https://docs.fly.io/sprites/) - Your own image: no (fixed base image). There is no documented way to start a Sprite from your own image. [source](https://docs.fly.io/sprites/concepts/checkpoints) - Any size you like: no (one shape). There is one shape: 8 cores, memory assigned automatically, and no choice. [source](https://docs.fly.io/sprites/concepts/lifecycle) - Large machines: no (8 cores / 16 GB). The machine is fixed at 8 cores and up to 16 GB of memory, below the 32 GB mark. [source](https://fly.io/sprites/checkpoint-restore/) - Resize while running: no (one fixed shape). The shape is fixed, so there is nothing to resize. [source](https://docs.fly.io/sprites/concepts/lifecycle) - GPUs: no (no GPU). Sprites are not a graphics environment; Fly sells graphics machines as a separate product. [source](https://fly.io/learn/fly-vs-modal/) - Choose the region: no (placement automatic). You cannot choose where a Sprite runs; placement is decided for you. [source](https://community.fly.io/t/where-do-sprites-dev-sprites-live-as-in-which-fly-io-region-is-it/26775) - Runs in the EU: partly (EU possible, not chosen). A Sprite may run in Europe because placement follows you, but you cannot require it to. [source](https://community.fly.io/t/where-do-sprites-dev-sprites-live-as-in-which-fly-io-region-is-it/26775) - Pause keeps memory: yes (100–500 ms). After a longer idle spell it is stopped and memory is dropped, and you are not told which happened. [source](https://docs.fly.io/sprites/concepts/lifecycle.md) - Pre-started pools: no [source](https://docs.fly.io/sprites/concepts/lifecycle.md) - Starts in under a second: yes (100–500 ms) [source](https://docs.fly.io/sprites/concepts/lifecycle.md) - Snapshots of files: yes [source](https://docs.fly.io/sprites/concepts/checkpoints.md) - Snapshots with memory: no [source](https://docs.fly.io/sprites/concepts/checkpoints.md) - Copy a running machine: no [source](https://docs.fly.io/sprites/concepts/checkpoints.md) - Pick an older snapshot: yes (v0, v1, v2…) [source](https://docs.fly.io/sprites/concepts/checkpoints.md) - Reusable templates: no [source](https://docs.fly.io/sprites/concepts/checkpoints.md) - Automatic backups: no [source](https://docs.fly.io/sprites/concepts/checkpoints.md) - Files survive a stop: yes (100 GB) [source](https://docs.fly.io/sprites/concepts/lifecycle.md) - Separate volumes: no [source](https://docs.fly.io/sprites/concepts/lifecycle.md) - One volume, several machines: no [source](https://docs.fly.io/sprites/concepts/lifecycle.md) - Mount outside storage: no [source](https://docs.fly.io/sprites/concepts/lifecycle.md) - Large disk: yes (100 GB) [source](https://docs.fly.io/sprites/concepts/lifecycle.md) - Can stay on indefinitely: partly (30 s idle). A Sprite pauses about 30 seconds after its last activity; a task can hold it awake, but you cannot switch the pause off. [source](https://docs.fly.io/sprites/concepts/lifecycle.md) - Choose the idle timeout: no [source](https://docs.fly.io/sprites/concepts/lifecycle.md) - Wakes on a request: yes [source](https://docs.fly.io/sprites/concepts/lifecycle.md) - Scheduled runs: no [source](https://docs.fly.io/sprites/concepts/lifecycle.md) - Public link to a port: yes (public or org-only) [source](https://docs.fly.io/sprites/concepts/networking) - Private link: yes (Org token) [source](https://docs.fly.io/sprites/concepts/networking) - Real SSH: partly (Install a server). You must install an SSH server inside the machine and reach it through the provider's proxy. [source](https://docs.fly.io/sprites/working-with-sprites.md) - Terminal in the browser: not-published [source](https://docs.fly.io/sprites/quickstart.md) - Tunnel to your computer: yes (sprite proxy) [source](https://docs.fly.io/sprites/concepts/networking) - Non-web ports: partly (Through your computer). You can map a database port onto your own computer, but there is no public address for non-web traffic. [source](https://docs.fly.io/sprites/concepts/networking) - Your own domain: not-published [source](https://docs.fly.io/sprites/concepts/networking) - Automatic HTTPS: not-published [source](https://docs.fly.io/sprites/concepts/networking) - Outbound data included: yes (Not metered) [source](https://fly.io/sprites/) - Allow only some sites: yes (Domain list) [source](https://docs.fly.io/sprites/concepts/networking) - Turn the internet off: partly (Deny every domain). You can deny every domain by policy, but the machine keeps its network and the rule works by refusing name lookups. [source](https://docs.fly.io/sprites/concepts/networking) - Fixed outgoing IP: not-published [source](https://docs.fly.io/sprites/concepts/networking) - Stored secrets: not-published [source](https://docs.fly.io/sprites/concepts/connectors) - Secrets the agent cannot read: partly (Catalogue only). Only the services in its catalogue are covered; any other key has to go into the machine. [source](https://docs.fly.io/sprites/concepts/connectors) - Limited API keys: not-published [source](https://docs.fly.io/sprites/cli/authentication.md) - Create from the website: no [source](https://docs.fly.io/sprites/cli/commands.md) - Command-line tool: yes [source](https://docs.fly.io/sprites/cli/commands.md) - Python SDK: no [source](https://docs.fly.io/sprites/quickstart.md) - TypeScript SDK: yes [source](https://docs.fly.io/sprites/quickstart.md) - Documented HTTP API: yes [source](https://fly.io/sprites/) - MCP server: no [source](https://fly.io/sprites/) - Interactive terminal over the API: yes [source](https://docs.fly.io/sprites/cli/commands.md) - Files over the API: yes [source](https://docs.fly.io/sprites/cli/commands.md) - Coding agents preinstalled: no. Sprites provide plugins and integrations for agents, but no agent is in the image. [source](https://fly.io/sprites/) - Send it a prompt: no. Sprites host an agent you install; there is no prompt endpoint. [source](https://fly.io/sprites/) - One-click Hermes: no. Hermes is named on the marketing page, but there is no template or guided route. [source](https://fly.io/sprites/) - One-click OpenClaw: no. OpenClaw is named on the marketing page, but there is no template or guided route. [source](https://fly.io/sprites/) - Browser built in: no. No browser is installed or offered; a browser is something you run and reach through a proxy. [source](https://docs.fly.io/sprites/cli/commands.md) - Desktop for computer use: no. No desktop is documented; interactive access is a terminal console. [source](https://docs.fly.io/sprites/cli/commands.md) - Runs other platforms' agents: no. Its ecosystem lists coding tools, not another platform's cloud agents. [source](https://fly.io/sprites/) - Team workspace: yes [source](https://docs.fly.io/sprites/cli/authentication.md) - Roles and permissions: yes [source](https://docs.fly.io/sprites/cli/authentication.md) - Single sign-on: not-published [source](https://docs.fly.io/sprites/cli/authentication.md) - Hard spending cap: not-published [source](https://fly.io/sprites/) - Usage alerts: not-published [source](https://fly.io/sprites/) - Audit log: no. Fly states plainly that there is no customer-facing audit log of organisation activity or staff access. [source](https://fly.io/legal/security-questionnaire/) - Billed per second: yes (per second) [source](https://fly.io/pricing/) - CPU billed only while working: yes (actual CPU) [source](https://fly.io/pricing/) - Paused costs only storage: yes (compute stops) [source](https://fly.io/sprites/) - No monthly fee: yes (none) [source](https://fly.io/pricing/) - Flat monthly price: no (actual use). The bill follows the processor and memory actually used, so it varies with the work. [source](https://fly.io/pricing/) - Ongoing free tier: no (one-off $30). Free usage is a one-time $30 credit, not a monthly allowance. [source](https://fly.io/sprites/) - Free starting credit: yes ($30) [source](https://fly.io/sprites/) - Try without a card: not-published [source](https://fly.io/sprites/) - Public status page: yes [source](https://fly.io/sprites/) - Uptime promise (SLA): partly. Fly's 99.9% promise is for Enterprise plans and credits must be claimed; Sprites coverage is not named. [source](https://fly.io/legal/sla-uptime/) - SOC 2 report: partly. Fly's SOC 2 report describes the platform and does not name Sprites. [source](https://fly.io/legal/security-questionnaire/) - Data processing agreement: yes [source](https://fly.io/legal/security-questionnaire/) - Open source or self-hostable: no. Sprites is a hosted Fly product; no self-hosted edition is published. [source](https://docs.fly.io/sprites/cli/authentication.md) ## Usability - Dashboard: A dashboard exists for connector setup and a Gateway Playground that can fire a request without code. - Without code: Limited. The documented start path installs a CLI and opens a console; the no-code surface is connector testing, not running an agent. - Signup: Uses a Fly.io account. Card requirement, waitlist and trial duration are not published. - Docs: Fly documentation covers lifecycle, checkpoints, networking and connectors. Support is community on lower plans and varies by plan. - Trips people up: Warm and cold are different states, and the transition is not user-selected. - Trips people up: Open TCP connections do not survive a pause, warm or cold. - Trips people up: Checkpoints are filesystem snapshots, not memory snapshots. - Trips people up: Cold storage bills while the Sprite is kept. ## Company - Legal entity: Fly.io, Inc., a Delaware corporation. Sprites is a product on Fly's platform, not a separate company. [source](https://fly.io/legal/security-questionnaire/) - Leadership: Scott Johnston is CEO; founder Kurt Mackey moved to an advisory role and remains on the board. [source](https://fly.io/news/fly-io-launches-computers-for-agents/) - History and funding: Fly has run the platform since 2017 and launched Sprites on 9 January 2026. A $25M Series D in July 2026, co-led by Dell Technologies Capital and Intel Capital. [source](https://fly.io/news/fly-io-launches-computers-for-agents/) - Status and SLA: Sprites is a component on Fly's status page with no numeric uptime figure. Fly's 99.9% SLA is Enterprise-only and credits must be claimed. [source](https://fly.io/legal/sla-uptime/) - Certification: SOC 2 Type 2 covers the Fly platform and does not name Sprites; the report and BAA sit behind a $99-a-month compliance package. [source](https://fly.io/legal/security-questionnaire/) - Headcount: Not published. Fly lists team members but no headcount figure. ## Caveats - **The pricing page and product FAQ disagree on plans** (contradiction): Pricing says there are no plans and nothing charged per Sprite; the FAQ describes plans including Hero at $100 a month with CPU, RAM and storage allowances. - **Warm-to-cold timing is not published** (open): The idle window before warm suspension is about 30 seconds; how long before a Sprite drops to cold is not stated. - **Storage charges while idle are ambiguous** (contradiction): The FAQ says warm and cold are not billed, while the pricing page bills cold storage for as long as data is kept. - **No fork or create-from-checkpoint is documented** (open): Checkpoints restore in place and overwrite current files; a live fork or clone is not established. - **Region selection and architecture are unpublished** (open): No provider-confirmed region list, GPU option or CPU architecture statement was found. ## Sources - [Overview](https://docs.fly.io/sprites/index) - [Lifecycle](https://docs.fly.io/sprites/concepts/lifecycle) - [Checkpoints](https://docs.fly.io/sprites/concepts/checkpoints) - [Networking](https://docs.fly.io/sprites/concepts/networking) - [Connectors](https://docs.fly.io/sprites/concepts/connectors) - [Pricing](https://fly.io/pricing/) --- # Tensorlake > Firecracker microVMs that keep their memory across a pause, sold as prepaid credits or a $250 Pro plan. Website: https://www.tensorlake.ai Guide page: https://botperch.com/providers/tensorlake/ Checked: 2026-10-29 **Short answer:** One always-on personal agent (2 vCPU / 4 GiB / 20 GiB) costs about $250.00 a month here, the 11th cheapest of the 11 providers that run it as described. Fits well: An agent that must pause mid-task: suspend and memory snapshots both keep the process tree, and resume takes about a second. Tensorlake sells isolated Linux microVMs for agents, one per task or one per session, that boot in a few hundred milliseconds and can be frozen with their memory, processes and files intact and resumed later under the same name. Each machine is a Firecracker microVM with its own kernel and a root disk you size from 10 to 100 GB. You drive it from a Python or TypeScript SDK, a tl CLI, plain HTTP, SSH or a WebSocket terminal, and you can mount a durable versioned volume or a Tensorlake-hosted Git repository into it. The same company also sells durable workflow orchestration, a versioned filesystem, hosted Git and GitHub Actions runners, so a team can put an agent's code, its working files and its long-running jobs in one place. The sandbox is the part this page compares. **Who it is for:** Engineering teams running agents that must survive a pause — long coding sessions, evaluation sweeps, RL rollouts — who are comfortable installing a CLI or SDK and want a real VM rather than a container. **Isolation:** Firecracker microVM with its own kernel, root and /dev/kvm, so nested QEMU/KVM virtual machines run inside. Docker needs the tensorlake/ubuntu-systemd image plus an install step. GPU sandboxes are gVisor instead of a VM. **Sizes and regions:** Per-sandbox ceilings by plan: Free 1 vCPU / 1 GB / 10 GB; Usage Credits 4 vCPU / 16 GB / 100 GB; Pro 16 vCPU / 64 GB / 100 GB; Enterprise custom. RAM must be 1–8 GB per vCPU. Disk is 10–100 GB, growth-only. ## How it charges - model: Prepaid Usage Credits in $5, $10 or $20 packs (1 CU = $0.01), or Pro at $250 a billing cycle including 25,000 CU. - meter: Per second: $0.07 per active CPU core-hour, $0.015 per GB-hour of RAM, $0.0002 per GB-hour of root disk on credits; $0.042, $0.009 and $0.0001 on Pro. Egress is free. - stopped: A suspended sandbox bills no CPU, RAM or disk; its preserved state bills as snapshot storage at $0.07 per GB-month. - planFee: $250 a billing cycle on Pro, which includes 25,000 CU ($250 of usage). Usage Credits have no fee: you buy packs and spend them down. - minimum: Nothing on Free, which needs no card. Usage Credits start at a $5 pack; Pro is $250 a month. Per second on active CPU, allocated RAM and disk, drawn from prepaid credits or a $250 Pro plan; a suspended sandbox bills snapshot storage only. - Rates are the Usage Credits rates. Pro's rates are lower — $0.042 per active core-hour, $0.009 per GB-hour of RAM (both 40% less) and $0.0001 per GB-hour of disk (50% less) — and its $250 fee includes 25,000 CU. The calculator prices every plan at the higher Usage Credits rates, so a Pro bill above $250 of monthly usage is overstated. - Tensorlake's own pages word Pro differently: the pricing page says the fee includes 25,000 CU ($250 of usage); the billing docs and FAQ say "$250 per month plus metered usage". This guide reads them together as $250 that includes $250 of usage, with usage beyond it billed. Get it in writing before relying on it. - CPU bills only while it executes, so the engine applies the workload's busy share. When Tensorlake cannot sample active CPU it falls back to allocated vCPU time, which costs more. - Snapshot storage is $0.07 per GB-month while a sandbox is suspended, modelled here as a per-GB-hour stopped rate (0.07 ÷ 730) on the sandbox's disk size. Tensorlake says only unique bytes are billed, so the real figure can be lower. - Billing is by the second in whole compute units, pooled per organization. Egress is free. - Memory must be 1–8 GB per vCPU, so a 1 vCPU sandbox cannot exceed 8 GB of RAM. ## Monthly cost for each preset workload - A personal agent that stays on (Hermes, OpenClaw): $250.00 - A coding agent for one developer: $24.46 - A code interpreter inside your product: $28.60 - A browser agent for a small team: $331.00 - Self-hosted n8n for a small team: $250.00 - A Discord or Slack bot for one server: $250.00 - Claude Code for a team of five: $120.95 - A scraper that runs four times a day: $1.20 - Your own remote MCP server: $250.00 - A: 1,000 short tasks: $22.00 - B: one always-on box: $250.00 - C: three hours a day: $8.25 ## Fits well - An agent that must pause mid-task: suspend and memory snapshots both keep the process tree, and resume takes about a second. - Evaluation sweeps and RL rollouts: pre-warmed pools, non-blocking creates and copy-by-N fan one warmed sandbox out to a fleet. - A coding agent that needs a real machine: /dev/kvm, Docker on the systemd image, SSH with port forwarding and VS Code Remote-SSH. - Work that must outlive the sandbox: versioned volumes mounted as ordinary directories, or a Tensorlake-hosted Git repository. ## Fits badly - Someone who will not use a terminal: there is no documented console button for a first sandbox, and every guide starts with a CLI install. - Keeping credentials away from the agent: keys arrive as environment variables the agent's own processes can read. - An always-on personal assistant on a small budget: Pro is $250 a month, and cheaper plans end a session after 24 hours. - A custom hostname on the hosted product: only a self-hosted BYOC ingress lets you own the domain. ## Features - **Isolation** (yes): Firecracker; /dev/kvm. A Firecracker microVM with its own kernel, root and /dev/kvm, so KVM-based hypervisors run inside and snapshots still work. Docker needs tensorlake/ubuntu-systemd plus an install step; the default image has no Docker. GPU sandboxes are gVisor instead, without live resize or volume mounts. [source](https://docs.tensorlake.ai/sandboxes/introduction) [docs](https://docs.tensorlake.ai/sandboxes/introduction) - **Sizes and regions** (partly): 16 vCPU / 64 GiB; no region picker. Ceilings by plan: Free 1 vCPU / 1 GB / 10 GB, Usage Credits 4 / 16 / 100, Pro 16 / 64 / 100, Enterprise custom. Memory is 1–8 GB per vCPU and disk is 10–100 GB, growth-only. No region selector is published: the docs claim EU data residency, and BYOC puts sandboxes in your own AWS region. [source](https://www.tensorlake.ai/pricing) [docs](https://docs.tensorlake.ai/platform/billing) - **Lifecycle** (yes): RAM + processes; ~1 s resume. Named sandboxes suspend on idle or on request and resume under the same ID with the process tree alive. Ephemeral sandboxes cannot suspend and are deleted at their timeout. Terminated sandboxes stay restartable for 48 hours, restoring from the latest snapshot when one exists. [source](https://docs.tensorlake.ai/sandboxes/quickstart) [docs](https://docs.tensorlake.ai/sandboxes/lifecycle) - **Snapshots and forks** (yes): Memory or disk; copy ×N. Two snapshot types: filesystem restores with a cold boot, memory captures filesystem, memory and running processes and restores warm. Snapshots outlive the source sandbox and are deduplicated. copy boots one or many sandboxes from a running or suspended source, inheriting image, resources, network policy and exposed ports. [source](https://docs.tensorlake.ai/sandboxes/snapshots) [docs](https://docs.tensorlake.ai/sandboxes/snapshots) - **Storage** (yes): 10–100 GB root; 8 volumes. Root disk 10–100 GB, ephemeral and growth-only. Cloud Volumes mount as ordinary POSIX directories, are durable and versioned with snapshots and time travel, and up to 8 can be mounted per sandbox, read-only, prefetched or pinned to a snapshot. Hosted Git repositories mount without a clone. [source](https://docs.tensorlake.ai/sandboxes/mount-filesystems) [docs](https://docs.tensorlake.ai/sandboxes/mount-filesystems) - **Idle and waking** (yes): 10 min idle; 2 h to unlimited. timeout_secs is an idle threshold measured on proxy traffic — SSH, a PTY WebSocket, an exposed port, an SDK call — not a wall-clock lifetime. Default 600 s; maximum 2 h on Free, 24 h with Usage Credits, unlimited on Pro. Setting 0 requests the plan maximum. [source](https://docs.tensorlake.ai/sandboxes/lifecycle) [docs](https://docs.tensorlake.ai/sandboxes/lifecycle#timeout) - **Reaching it** (yes): HTTPS per port; auth on by default. The proxy carries HTTP, WebSocket and gRPC, and preserves path and query. Auth is the default: requests need a project API key, or a signed-in session cookie from a browser. allow_unauthenticated_access makes exposed user ports public, but the management API on port 9501 always requires auth. [source](https://docs.tensorlake.ai/sandboxes/networking) [docs](https://docs.tensorlake.ai/sandboxes/networking) - **Custom domains** (partly): BYOC ingress only. No custom-domain setting exists on Tensorlake Cloud: sandboxes live under sandbox.tensorlake.ai. In the BYOC mode where you run the ingress, you supply the NLB, an ACM certificate and a public DNS zone, and each sandbox gets a subdomain of your base domain. [source](https://docs.tensorlake.ai/platform/self-hosted-compute/aws) [docs](https://docs.tensorlake.ai/platform/self-hosted-compute/aws) - **Outbound network** (yes): Allow/deny lists; free egress. allow_out takes domains, leading-wildcard domains, IPv4 addresses and CIDRs; deny_out wins on a conflict. The policy can be swapped on a running sandbox as one atomic change that closes existing connections, and a hostname that will not resolve rejects the update. allow_internet_access=false with an empty allowlist blocks DNS too. Egress is free. [source](https://docs.tensorlake.ai/sandboxes/networking) [docs](https://docs.tensorlake.ai/sandboxes/networking) - **Keys and secrets** (partly): Env vars only. Environment variables are scoped to one command or one PTY session and merged into that process's environment. No secrets manager, placeholder substitution or egress-proxy injection is documented for sandboxes, so a key the agent needs is a key the agent can print. The orchestration product has its own Secrets page, which does not cover sandboxes. [source](https://docs.tensorlake.ai/sandboxes/environment-variables) [docs](https://docs.tensorlake.ai/sandboxes/environment-variables) - **Ways to drive it** (partly): SDK, CLI, SSH; no MCP. Python and TypeScript SDKs, an async Python client, a tl CLI, REST, standard SSH with scp/rsync/port forwarding, a WebSocket PTY API, local TCP tunnels and an SDK desktop client. No control-plane MCP server is published; the console covers keys, spend, sandbox lists and process logs. [source](https://docs.tensorlake.ai/sandboxes/quickstart) [docs](https://docs.tensorlake.ai/sandboxes/quickstart) - **Built-in agents** (partly): None; five integrations. Nothing is preinstalled: the images are Ubuntu, Debian and a VNC desktop. The routes are a tensorlake-opencode plugin that intercepts bash, read, write and edit, self-hosted environments for Claude Managed Agents and Cursor Cloud Agents, Devin Outposts, Crabbox for test suites, and a page on preloading skill files into images. [source](https://docs.tensorlake.ai/sandboxes/opencode) [docs](https://docs.tensorlake.ai/sandboxes/opencode) - **Teams and accounts** (partly): Roles + SSO; no spend cap. Org admin and member roles, project admin and member roles, and API keys limited to project-member permissions. SSO over OIDC or SAML is available to org admins but has to be enabled for the organisation. No spend cap, budget alert or audit-log product is published; prepaid credits are the stop, and Pro adds a 1,000-sandbox concurrency ceiling. [source](https://docs.tensorlake.ai/platform/billing) [docs](https://docs.tensorlake.ai/platform/access-control) - **Billing models** (yes): Active CPU; $250 Pro. Prepaid Usage Credits in $5–$20 packs (1 CU = $0.01) or Pro at $250 including 25,000 CU. CPU bills only while it executes, falling back to allocated vCPU time when sampling fails; RAM and disk bill on allocation while running; a suspended sandbox bills snapshot storage at $0.07 per GB-month; egress is free. [source](https://www.tensorlake.ai/pricing) [docs](https://docs.tensorlake.ai/platform/billing) - **Trials and free tiers** (yes): Free forever, 1 sandbox. Free is $0 forever with no credit card: 1 concurrent sandbox, 1 vCPU / 1 GB / 10 GB, 2-hour sessions, unmetered sessions and SOC 2. Usage Credits begin with a $5 pack you choose; unused credits are kept rather than refunded and come back if you return to the plan. [source](https://www.tensorlake.ai/pricing) [docs](https://www.tensorlake.ai/pricing) - **The company** (partly): Tensorlake, Inc.; 99.9% SLA. Tensorlake, Inc., San Francisco, founded 2023, 11–50 people, $8M seed from Artisanal Ventures, Plug and Play and Hawk Hill per third-party records with conflicting dates. SOC 2 Type 2 everywhere; HIPAA with a BAA on Pro and above but no HIPAA badge in the Trust Center. 99.9% control-plane availability, service credits capped at 50% of the month's fees and no cash refund, paid plans only. Public Datadog status page. California law, San Francisco courts. [source](https://www.tensorlake.ai/terms) [docs](https://docs.tensorlake.ai/platform/security) ## Capabilities - Its own virtual machine: partly (VM, except GPU). The ordinary machines are real virtual machines, but the graphics-card machines you have to ask for are containers instead. [source](https://docs.tensorlake.ai/sandboxes/introduction) - Root access: yes (sudo or --user root) [source](https://docs.tensorlake.ai/sandboxes/tensorlake-images) - Docker inside: yes (needs ubuntu-systemd image) [source](https://docs.tensorlake.ai/sandboxes/tensorlake-images) - Nested virtualisation: yes (/dev/kvm) [source](https://docs.tensorlake.ai/sandboxes/nested-virt) - Your own image: yes (Dockerfile builds) [source](https://docs.tensorlake.ai/faqs/sandbox-images-faq) - Any size you like: yes (any cores and memory) [source](https://docs.tensorlake.ai/platform/billing) - Large machines: yes (16 cores / 64 GB). Only on the $250-a-month plan or above. [source](https://docs.tensorlake.ai/platform/billing) - Resize while running: yes (cores, memory, disk live) [source](https://docs.tensorlake.ai/sandboxes/live-resize) - GPUs: partly (by request). Graphics machines exist but you have to ask on Slack to be given access, and they cannot be resized or run virtual machines inside. [source](https://docs.tensorlake.ai/sandboxes/gpu) - Choose the region: yes (US or EU) [source](https://docs.tensorlake.ai/platform/eu-data-residency) - Runs in the EU: yes (EU endpoint) [source](https://docs.tensorlake.ai/platform/eu-data-residency) - Pause keeps memory: yes. Only named sandboxes can be suspended; an unnamed one runs until it ends. [source](https://docs.tensorlake.ai/sandboxes/lifecycle.md) - Pre-started pools: yes [source](https://docs.tensorlake.ai/sandboxes/pools.md) - Starts in under a second: yes (Hundreds of ms) [source](https://docs.tensorlake.ai/sandboxes/introduction.md) - Snapshots of files: yes [source](https://docs.tensorlake.ai/sandboxes/snapshots.md) - Snapshots with memory: yes [source](https://docs.tensorlake.ai/sandboxes/snapshots.md) - Copy a running machine: yes [source](https://docs.tensorlake.ai/sandboxes/snapshots.md) - Pick an older snapshot: yes [source](https://docs.tensorlake.ai/sandboxes/snapshots.md) - Reusable templates: yes [source](https://docs.tensorlake.ai/sandboxes/snapshots.md) - Automatic backups: partly. Only the storage you mount is saved automatically; a machine's own disk has no copy. [source](https://docs.tensorlake.ai/filesystems/core-concepts.md) - Files survive a stop: partly (48 h after terminate). A terminated machine can be brought back for 48 hours; after that its files are gone. [source](https://docs.tensorlake.ai/sandboxes/lifecycle.md) - Separate volumes: yes [source](https://docs.tensorlake.ai/sandboxes/mount-filesystems.md) - One volume, several machines: yes. Same-path writes are last-writer-wins, so two machines editing one file can clash. [source](https://docs.tensorlake.ai/filesystems/concurrent-writes.md) - Mount outside storage: no [source](https://docs.tensorlake.ai/sandboxes/mount-filesystems.md) - Large disk: yes (100 GB root) [source](https://docs.tensorlake.ai/platform/billing.md) - Can stay on indefinitely: partly (2 h free, 24 h credits). A free sandbox stops after 2 idle hours and a credit-plan sandbox after 24; only Pro and Enterprise are unlimited. [source](https://docs.tensorlake.ai/sandboxes/lifecycle.md) - Choose the idle timeout: yes [source](https://docs.tensorlake.ai/sandboxes/lifecycle.md) - Wakes on a request: yes [source](https://docs.tensorlake.ai/sandboxes/lifecycle.md) - Scheduled runs: no [source](https://docs.tensorlake.ai/applications/concepts.md) - Public link to a port: yes (Per-port switch) [source](https://docs.tensorlake.ai/sandboxes/networking.md) - Private link: yes (Project key) [source](https://docs.tensorlake.ai/sandboxes/networking.md) - Real SSH: yes (Standard ssh) [source](https://docs.tensorlake.ai/sandboxes/pty-sessions.md) - Terminal in the browser: not-published [source](https://docs.tensorlake.ai/sandboxes/process-logs.md) - Tunnel to your computer: yes (Local tunnel) [source](https://docs.tensorlake.ai/sandboxes/tunnels.md) - Non-web ports: partly (Through a tunnel). The public address carries web traffic and SSH only; a database needs a tunnel from your own computer. [source](https://docs.tensorlake.ai/sandboxes/tunnels.md) - Your own domain: not-published [source](https://docs.tensorlake.ai/sandboxes/networking.md) - Automatic HTTPS: not-published [source](https://docs.tensorlake.ai/sandboxes/networking.md) - Outbound data included: not-published [source](https://docs.tensorlake.ai/platform/billing.md) - Allow only some sites: yes (Domains or addresses) [source](https://docs.tensorlake.ai/sandboxes/networking.md) - Turn the internet off: yes (--no-internet) [source](https://docs.tensorlake.ai/sandboxes/networking.md) - Fixed outgoing IP: not-published [source](https://docs.tensorlake.ai/sandboxes/networking.md) - Stored secrets: no. There is no saved secret: you pass the value with each command or session. [source](https://docs.tensorlake.ai/sandboxes/environment-variables.md) - Secrets the agent cannot read: no. There is no service that adds keys to requests; the machine holds whatever you pass it. [source](https://docs.tensorlake.ai/sandboxes/environment-variables.md) - Limited API keys: yes (Project-scoped) [source](https://docs.tensorlake.ai/platform/authentication.md) - Create from the website: no [source](https://docs.tensorlake.ai/faqs/sandboxes-faq.md) - Command-line tool: yes [source](https://docs.tensorlake.ai/sandboxes/quickstart.md) - Python SDK: yes [source](https://docs.tensorlake.ai/sandboxes/quickstart.md) - TypeScript SDK: yes [source](https://docs.tensorlake.ai/sandboxes/quickstart.md) - Documented HTTP API: yes [source](https://docs.tensorlake.ai/llms.txt) - MCP server: no [source](https://docs.tensorlake.ai/sandboxes/chrome-cdp.md) - Interactive terminal over the API: yes [source](https://docs.tensorlake.ai/sandboxes/pty-sessions.md) - Files over the API: yes [source](https://docs.tensorlake.ai/sandboxes/file-operations.md) - Coding agents preinstalled: no. The managed images ship an OS, a desktop and tooling; no coding agent is installed. [source](https://docs.tensorlake.ai/sandboxes/tensorlake-images.md) - Send it a prompt: no. Tensorlake exposes a sandbox as a tool for your own agent; it does not run an agent from a prompt. [source](https://docs.tensorlake.ai/sandboxes/tool-calls.md) - One-click Hermes: no. No Hermes template or guide is published. [source](https://docs.tensorlake.ai/sandboxes/tensorlake-images.md) - One-click OpenClaw: no. No OpenClaw template or guide is published. [source](https://docs.tensorlake.ai/sandboxes/tensorlake-images.md) - Browser built in: yes [source](https://docs.tensorlake.ai/sandboxes/chrome-cdp.md) - Desktop for computer use: yes [source](https://docs.tensorlake.ai/sandboxes/computer-use.md) - Runs other platforms' agents: yes [source](https://docs.tensorlake.ai/sandboxes/cursor-cloud-agents.md) - Team workspace: yes [source](https://docs.tensorlake.ai/platform/access-control.md) - Roles and permissions: partly (Admin and member only). Every plan gets two fixed roles, admin and member, at organization and project level; fuller role-based access is listed under the Enterprise plan. [source](https://docs.tensorlake.ai/platform/access-control) - Single sign-on: partly. SSO is listed on the Enterprise plan, and the docs say access must be enabled for your organisation. [source](https://docs.tensorlake.ai/platform/sso.md) - Hard spending cap: partly. Prepaid credit packs cannot be overspent, but the Pro plan bills overage beyond its included usage. [source](https://www.tensorlake.ai/pricing) - Usage alerts: not-published [source](https://docs.tensorlake.ai/platform/billing.md) - Audit log: partly. Audit logs are not self-serve: you ask support for them. [source](https://docs.tensorlake.ai/platform/security.md) - Billed per second: yes (per second) [source](https://docs.tensorlake.ai/platform/billing) - CPU billed only while working: yes (active CPU only) [source](https://docs.tensorlake.ai/platform/billing) - Paused costs only storage: yes (storage only) [source](https://docs.tensorlake.ai/sandboxes/lifecycle) - No monthly fee: yes (prepaid credit) [source](https://docs.tensorlake.ai/platform/billing) - Flat monthly price: no (metered parts). The bill is processor time plus memory plus disk plus storage. [source](https://docs.tensorlake.ai/platform/billing) - Ongoing free tier: yes (1 machine, 1 core / 1 GB) [source](https://docs.tensorlake.ai/platform/billing) - Free starting credit: no (none). There is no starting credit; the free plan is a small machine and credit is bought in packs. [source](https://docs.tensorlake.ai/platform/billing) - Try without a card: yes (free plan, no card) [source](https://docs.tensorlake.ai/platform/billing) - Public status page: yes [source](https://status.tensorlake.ai) - Uptime promise (SLA): no. The only published SLA is a 24-hour response to a P1 support ticket, not an uptime promise. [source](https://www.tensorlake.ai/pricing) - SOC 2 report: yes (Type 2) [source](https://docs.tensorlake.ai/platform/security.md) - Data processing agreement: yes [source](https://www.tensorlake.ai/dpa) - Open source or self-hostable: partly (BYOC, Enterprise). Self-hosting is offered only on the Enterprise plan and only in your own AWS account; the software is not open source. [source](https://docs.tensorlake.ai/platform/self-hosted-compute/aws.md) ## Usability - Dashboard: A cloud console at cloud.tensorlake.ai: projects, API keys, a usage tab with cost tiles and vCPU-hours, invoices and credit packs, and a Sandboxes list with a per-sandbox Logs tab you can filter and search. - Without code: No. The first step is pip install tensorlake, npm i @tensorlakeai/tensorlake or the curl | sh CLI installer, then a create call. The console covers keys, spend and logs, not making a machine. - Signup: Email or a social login at cloud.tensorlake.ai; the free tier needs no card. API keys are per project, start with tl_apiKey_, and carry project-member permissions only. - Docs: 108 pages in the llms.txt index, each available as Markdown plus an llms-full.txt bundle, and unusually deep on edge cases: pending reasons, resize generations, mount fail-closed rules, PTY frame bytes. Support is Slack and email, with a founder replying on smaller plans. - Trips people up: The stock images run as tl-user, who cannot write to /workspace; guides that assume /workspace fail until you use /home/tl-user. - Trips people up: timeout_secs is an idle timer on proxy traffic, not a lifetime: a sandbox with no proxied traffic suspends even mid-task. - Trips people up: Only named sandboxes can suspend; an ephemeral sandbox is deleted when its timeout fires. - Trips people up: pip install needs --break-system-packages on the stock images, which are PEP 668 managed. - Trips people up: Pro is the only plan without a session cap, so anything that must stay up costs $250 a month. - Trips people up: A custom domain exists only in the self-hosted BYOC ingress mode, not on Tensorlake Cloud. ## Company - Legal entity: Tensorlake, Inc. (written TensorLake in the Terms). Governed by California law, with exclusive venue in San Francisco. [source](https://www.tensorlake.ai/terms) - History and base: Founded 2023, headquartered in San Francisco, California. Third-party records disagree on the year (one says 2022). [source](https://indexed.vc/companies/tensorlake) - Funding: $8M seed, investors Artisanal Ventures, Plug and Play and Hawk Hill Ventures. Third-party records date the round 2024 or 2025; Tensorlake publishes no announcement. [source](https://indexed.vc/companies/tensorlake) - Headcount: Small: one third-party record gives a band of 11–50 employees; Tensorlake publishes no team page that would confirm a number. [source](https://indexed.vc/companies/tensorlake) - Certification: SOC 2 Type 2 on every tier, report gated behind the Trust Center. HIPAA is claimed with a BAA from Pro up, but the Trust Center shows only a SOC 2 badge. [source](https://docs.tensorlake.ai/platform/security) - Data residency: EU data residency and zero data retention are claimed; there is no region selector in the sandbox API, and BYOC defaults to us-east-1. [source](https://docs.tensorlake.ai/sandboxes/introduction) - SLA: 99.9% monthly availability for the control plane, with service credits capped at 50% of the month's fees and no cash refund. Paid plans only. [source](https://www.tensorlake.ai/terms) - Support: Slack community and email on every tier, 24×7 Slack and email on Pro with a 24-hour P1, and a 1-hour P1 plus a resident SA on Enterprise. [source](https://www.tensorlake.ai/pricing) - Status page: A public Datadog status page covers Applications and Sandboxes; sandboxes showed 99.89% uptime over the 90 days to 29 October 2026. [source](https://status.tensorlake.ai/) - Subprocessors: Google Cloud and AWS for infrastructure, Cloudflare and Datadog for monitoring, listed in the Trust Center as Annex III of the DPA. [source](https://trust.tensorlake.ai/) ## Caveats - **Whether Pro's $250 includes $250 of usage** (contradiction): The pricing page says the fee includes 25,000 CU worth $250. The billing docs and the pricing FAQ both describe Pro as '$250 / month + usage' and say Pro deducts usage, with no allowance mentioned. - **Resources are called fixed at create on one page and resizable on another** (contradiction): The lifecycle page says CPU, memory and disk are fixed when the sandbox is created and cannot be changed afterwards. The live-resize page documents changing all three on a running sandbox, and the SDK update call does it. - **The prepaid tier has two names** (open): The docs and dashboard call it Usage Credits; the Terms call the same plan On-Demand. Nothing says whether they are the same product. - **Free credits are promised in one place and absent in another** (open): The Harbor guide says new accounts include free credits. The pricing page describes a $0 free tier with no card and prepaid packs starting at $5, with no signup credit mentioned. - **EU data residency without a region selector** (open): The introduction claims EU data residency, but no sandbox API parameter, console control or region list is published, and the BYOC example defaults to us-east-1. Which plan gets EU placement is unclear. - **Snapshot storage is billed per GB-month of 'unique bytes'** (open): Rates say $0.07 per GB-month; the snapshot page says users are billed only for unique bytes, so the stored size of a suspended sandbox is not simply its disk size. The calculator models it as the disk size and will overstate. - **A malicious npm release shipped in October 2026** (open): The Trust Center records a malicious tensorlake@0.5.144 published to npm on 8 October 2026 with a GitHub advisory. Pin a version and check the advisory before installing the JavaScript SDK. - **HIPAA is claimed but not badged** (open): Pricing says HIPAA with a BAA on Pro and above, and the docs call the platform HIPAA compliant; the Trust Center lists a SOC 2 badge and no HIPAA badge, and the Terms forbid storing protected health information without a written agreement. ## Sources - [Docs](https://docs.tensorlake.ai/sandboxes/introduction) - [Lifecycle](https://docs.tensorlake.ai/sandboxes/lifecycle) - [Snapshots and clone](https://docs.tensorlake.ai/sandboxes/snapshots) - [Networking](https://docs.tensorlake.ai/sandboxes/networking) - [Pricing and billing](https://docs.tensorlake.ai/platform/billing) - [Pricing](https://www.tensorlake.ai/pricing) - [Terms](https://www.tensorlake.ai/terms) - [Trust Center](https://trust.tensorlake.ai/) - [Status](https://status.tensorlake.ai/) --- # Vercel Sandbox > Firecracker microVMs inside Vercel, billed on active CPU and provisioned memory. Website: https://vercel.com/docs/sandbox Guide page: https://botperch.com/providers/vercel-sandbox/ Checked: 2026-10-28 **Short answer:** One always-on personal agent (2 vCPU / 4 GiB / 20 GiB) costs about $73.12 a month here, with a catch: Sessions end after 24 hours, so an always-on machine has to be restarted by your own code. Fits well: A Firecracker microVM with root, Docker and FUSE, up to 32 vCPU and 64 GB of NVMe. Vercel Sandbox runs untrusted or agent-generated code in Firecracker microVMs, managed through a CLI, JavaScript SDK or Python SDK. It is part of the Vercel platform rather than a separate product: usage sits on the Vercel plan, and the Hobby plan is restricted to non-commercial use. **Who it is for:** Teams already on Vercel who want agent code execution with many regions and familiar account controls. **Isolation:** Firecracker microVM with a dedicated kernel. Root access, Docker and FUSE are documented; systemd and nested virtualisation are not. **Sizes and regions:** 1 or even numbers of vCPUs from 2 to 32 depending on plan, 2 GB of memory per vCPU, and 64 GB of ephemeral NVMe. Hobby caps at 4 vCPU / 8 GB, Pro at 8 / 16, Enterprise at 32 / 64. Nineteen regions; no GPU published. ## How it charges - model: Metered usage against the Vercel plan, with a monthly credit on Pro. - meter: Active CPU at $0.128 per CPU-hour, excluding time waiting on I/O; provisioned memory at $0.0212 per GB-hour with a one-minute minimum; creations, data transfer, snapshots and drives separately. - stopped: No CPU or memory charge, but snapshots and drives keep billing. Persistent sandboxes create a billable snapshot when they stop. - planFee: Vercel Pro is $20 a month and includes $20 of usage credit, which expires monthly. - minimum: Memory bills in one-minute increments. Hobby has included quotas and pauses creation when they are exhausted. Active CPU, excluding time spent waiting, plus provisioned memory for the whole session; persistent sandboxes keep their files as a snapshot between sessions. - A persistent sandbox restores its files from a snapshot when it starts again, not its memory or running processes. Snapshot storage is $0.08 per GB-month; the calculator charges it on the full disk size, which overstates it if little is written. - Each sandbox gets 64 GB of fast disk at no separate charge while it runs. - Creations, data transfer and drives are billed separately and are not included. - Sandboxes that cannot resume from a snapshot are removed after 14 days of inactivity. ## Monthly cost for each preset workload - A personal agent that stays on (Hermes, OpenClaw): $73.12 (catch: Sessions end after 24 hours, so an always-on machine has to be restarted by your own code.) - A coding agent for one developer: $32.91 - A code interpreter inside your product: $42.77 - A browser agent for a small team: $462.40 - Self-hosted n8n for a small team: $72.74 (catch: Sessions end after 24 hours, so an always-on machine has to be restarted by your own code.) - A Discord or Slack bot for one server: $33.76 (catch: Sessions end after 24 hours, so an always-on machine has to be restarted by your own code.) - Claude Code for a team of five: $162.10 - A scraper that runs four times a day: $20.00 - Your own remote MCP server: $20.00 (catch: Sessions end after 24 hours, so an always-on machine has to be restarted by your own code.) - A: 1,000 short tasks: $35.47 - B: one always-on box: $161.18 (catch: Sessions end after 24 hours, so an always-on machine has to be restarted by your own code.) - C: three hours a day: $20.00 ## Fits well - A Firecracker microVM with root, Docker and FUSE, up to 32 vCPU and 64 GB of NVMe. - A workload that needs to run close to users: 19 regions, and the most of any provider here. - A Vercel-hosted app that wants a sandbox next to its deployments, with credentials brokered out of the machine. ## Fits badly - An always-on agent: the default session timeout is five minutes and the Hobby cap is 45 minutes. - A confidential Hobby workload: Hobby content may be used for model training, and the plan is non-commercial. - Anything needing SSH, a desktop or a raw TCP inbound port. ## Features - **Isolation** (partly): Firecracker; root + Docker. A Firecracker microVM with a dedicated kernel, root, Docker and FUSE. systemd and nested virtualisation are not published. [source](https://vercel.com/docs/sandbox/concepts) [docs](https://vercel.com/docs/sandbox/concepts#isolation-architecture) - **Sizes and regions** (yes): 19 regions. 1 or even numbers of vCPUs from 2 to 32 by plan, 2 GB of memory per vCPU, 64 GB of ephemeral NVMe, and 19 regions. No GPU published. [source](https://vercel.com/docs/sandbox/concepts) [docs](https://vercel.com/docs/sandbox/pricing#resource-limits) - **Lifecycle** (partly): Filesystem only. Stopping ends the session. Persistent sandboxes save their filesystem and restore it into a new session, not RAM; restart background services with the onResume hook. [source](https://vercel.com/docs/sandbox/concepts/persistent-sandboxes) [docs](https://vercel.com/docs/sandbox/concepts/persistent-sandboxes) - **Snapshots and forks** (partly): Filesystem only. Snapshots capture the filesystem and outlive the sandbox; taking one manually stops the session. Fork uses the current snapshot or falls back to a fresh create from the image. [source](https://vercel.com/docs/sandbox/concepts/snapshots) [docs](https://vercel.com/docs/sandbox/concepts/snapshots) - **Storage** (partly): 64 GB ephemeral; drives. 64 GB of ephemeral NVMe per sandbox, plus drives billed on logical used size. Only one sandbox at a time can mount a drive read-write; snapshots are the sharing mechanism. [source](https://vercel.com/docs/sandbox/pricing#resource-limits) [docs](https://vercel.com/docs/sandbox/concepts/drives) - **Idle and waking** (partly): 5 min session. A session timeout of five minutes by default, with a maximum session of 45 minutes on Hobby and 24 hours on Pro. No idle-activity timer is published. [source](https://vercel.com/docs/sandbox/concepts) [docs](https://vercel.com/docs/sandbox/pricing#runtime-limits) - **Reaching it** (partly): Web ports only. Web ports can be exposed, up to 15 per sandbox, and traffic to them is billable. The dashboard's Connect tab gives a terminal in the browser. A general raw TCP inbound, standard SSH or public IPv4 is not published. [source](https://vercel.com/docs/sandbox/pricing#network) [docs](https://vercel.com/docs/sandbox/concepts#network-access) - **Custom domains** (not-published): Not published. Attaching a customer's own domain to a Sandbox port was not confirmed. Vercel domains apply to deployments, a different product; ask whether a separately managed proxy is supported. [source](https://vercel.com/docs/sandbox) - **Outbound network** (yes): $0.15/GB. Firewall rules default to allow-all and can be set per sandbox. Matchers transform requests but never block them, so an allowlist needs an explicit rule. [source](https://vercel.com/docs/sandbox/pricing#pricing) [docs](https://vercel.com/docs/sandbox/concepts/firewall) - **Keys and secrets** (yes): No, proxy. Credentials brokering injects credentials into egressing traffic, so secrets never enter the sandbox and code inside cannot exfiltrate them. [source](https://vercel.com/docs/sandbox/concepts/firewall#credentials-brokering) [docs](https://vercel.com/docs/sandbox/concepts/firewall#credentials-brokering) - **Ways to drive it** (partly): No; CLI or SDK. CLI, JavaScript and Python SDKs, and a dashboard that can stop or delete a sandbox and shows a lifecycle activity log. No SSH or desktop is published. [source](https://vercel.com/docs/sandbox) [docs](https://vercel.com/docs/sandbox/sdk-reference) - **Built-in agents** (partly): Agents in image; no API. The default universal image includes coding agents and common utilities, but there is no agent-run API; you drive them yourself. [source](https://vercel.com/docs/sandbox) [docs](https://vercel.com/docs/sandbox/ecosystem) - **Teams and accounts** (partly): Spend management. Team seats, spend management that can pause projects, and a lifecycle activity log. SAML costs $300 a month; fine-grained Sandbox key scopes and contractual residency are not published. [source](https://vercel.com/docs/plans/pro-plan#paid-add-ons) [docs](https://vercel.com/docs/plans/pro-plan#team-seats) - **Billing models** (partly): $0.128/CPU-hour. Active CPU at $0.128 per CPU-hour excluding I/O wait, provisioned memory at $0.0212 per GB-hour with a one-minute minimum, plus creations, transfer, snapshots and drives. [source](https://vercel.com/docs/sandbox/pricing#pricing) [docs](https://vercel.com/docs/sandbox/pricing) - **Trials and free tiers** (partly): Hobby quotas; 14-day Pro. Hobby has included quotas but is restricted to non-commercial use, and pauses sandbox creation when quotas run out. Pro has a 14-day trial with $20 in credits. [source](https://vercel.com/docs/plans/hobby) [docs](https://vercel.com/docs/plans/hobby) - **The company** (yes): Vercel Inc.; 99.99% platform. Vercel Inc., Delaware; founded 2015 by Guillermo Rauch. Sandbox announced June 2025, generally available January 2026; $300M Series F at a $9.3B valuation in September 2025. Status page shows Sandbox Operational but no Sandbox-specific uptime figure. The 99.99% Enterprise SLA covers the platform and does not name Sandbox; Pro and Hobby have no SLA. SOC 2 Type 2 and ISO 27001 are platform-level; Sandbox scope is not established. Fee changes need written notice and apply from the next payment period; content may be deleted on termination. [source](https://vercel.com/legal/sla#services-availability) ## Capabilities - Its own virtual machine: yes (Firecracker microVM) [source](https://vercel.com/docs/sandbox/concepts) - Root access: yes (full root) [source](https://vercel.com/docs/sandbox/concepts) - Docker inside: yes (Docker inside) [source](https://vercel.com/docs/sandbox/concepts) - Nested virtualisation: not-published [source](https://vercel.com/docs/sandbox/concepts) - Your own image: yes (custom image or snapshot) [source](https://vercel.com/docs/sandbox/concepts) - Any size you like: partly (even cores only, 2 GB each). You choose cores in steps of two and each core comes with exactly 2 GB of memory, so memory cannot be set on its own. [source](https://vercel.com/docs/sandbox/pricing) - Large machines: partly (32 cores on Enterprise only). Machines above 8 cores and 16 GB need the Enterprise plan; the self-serve plans stop there. [source](https://vercel.com/docs/sandbox/pricing) - Resize while running: no (fixed for the session). The size is set when the sandbox is created and cannot be changed during its life. [source](https://vercel.com/docs/sandbox/pricing) - GPUs: no (no GPU). No graphics processor option is published for sandboxes. [source](https://vercel.com/docs/sandbox/pricing) - Choose the region: yes (19 regions) [source](https://vercel.com/docs/sandbox/pricing) - Runs in the EU: yes (European regions) [source](https://vercel.com/docs/sandbox/concepts/snapshots) - Pause keeps memory: no [source](https://vercel.com/docs/sandbox/concepts/persistent-sandboxes) - Pre-started pools: no [source](https://vercel.com/docs/sandbox/concepts/persistent-sandboxes) - Starts in under a second: yes (Sub-second) [source](https://vercel.com/docs/sandbox/concepts) - Snapshots of files: yes (30-day default) [source](https://vercel.com/docs/sandbox/concepts/snapshots) - Snapshots with memory: no [source](https://vercel.com/docs/sandbox/concepts/persistent-sandboxes) - Copy a running machine: partly. A fork starts from a snapshot of the current state, and taking one stops the session it copies. [source](https://vercel.com/docs/sandbox/concepts/snapshots) - Pick an older snapshot: yes (Keep last 1–10) [source](https://vercel.com/docs/sandbox/concepts/persistent-sandboxes) - Reusable templates: yes [source](https://vercel.com/docs/sandbox/concepts) - Automatic backups: partly (On every stop). A copy is saved each time the machine stops, but there is no schedule and only the last few are kept. [source](https://vercel.com/docs/sandbox/concepts/snapshots) - Files survive a stop: yes [source](https://vercel.com/docs/sandbox/concepts/persistent-sandboxes) - Separate volumes: yes [source](https://vercel.com/docs/sandbox/concepts/drives) - One volume, several machines: partly. Only one machine can write a drive; others get a read-only copy taken when they mount it. [source](https://vercel.com/docs/sandbox/concepts/drives) - Mount outside storage: no [source](https://vercel.com/docs/sandbox/concepts/drives) - Large disk: yes (1 TiB drive) [source](https://vercel.com/docs/sandbox/concepts/drives) - Can stay on indefinitely: partly (45 min Hobby, 24 h Pro). A single session cannot last beyond 45 minutes on the free plan or 24 hours on paid plans. [source](https://vercel.com/docs/sandbox/pricing) - Choose the idle timeout: no [source](https://vercel.com/docs/sandbox/pricing) - Wakes on a request: yes [source](https://vercel.com/docs/sandbox/concepts/persistent-sandboxes) - Scheduled runs: yes [source](https://vercel.com/docs/cron-jobs) - Public link to a port: yes (Exposed ports) [source](https://vercel.com/docs/sandbox/concepts) - Private link: no. An exposed port is open to anyone with the link; there is no token or login in front of it. [source](https://vercel.com/docs/sandbox/concepts) - Real SSH: partly (SSH-like shell). The command line is the provider's own tool that feels like SSH; a standard SSH client cannot connect. [source](https://vercel.com/docs/sandbox/working-with-sandbox) - Terminal in the browser: yes (Dashboard tab) [source](https://vercel.com/changelog/connect-to-and-manage-sandboxes-from-the-dashboard) - Tunnel to your computer: no. Exposed ports are reachable on the internet, but there is no documented way to map one onto your own computer. [source](https://vercel.com/docs/sandbox/concepts) - Non-web ports: no. Only web ports can be exposed, so a database or game server cannot be reached from outside. [source](https://vercel.com/docs/sandbox/concepts) - Your own domain: not-published [source](https://vercel.com/docs/sandbox) - Automatic HTTPS: not-published [source](https://vercel.com/docs/sandbox) - Outbound data included: partly (20 GB a month). Only 20 GB a month is included; beyond that, traffic costs $0.15 a gigabyte. [source](https://vercel.com/docs/sandbox/pricing) - Allow only some sites: yes (Domain or address list) [source](https://vercel.com/docs/sandbox/concepts/firewall) - Turn the internet off: yes (deny-all) [source](https://vercel.com/docs/sandbox/concepts/firewall) - Fixed outgoing IP: not-published [source](https://vercel.com/docs/sandbox/concepts) - Stored secrets: partly (Passed each time). There is no saved list of secrets for a sandbox; you pass the values each time you create or run one. [source](https://vercel.com/docs/sandbox/concepts) - Secrets the agent cannot read: yes (Outside the machine) [source](https://vercel.com/docs/sandbox/concepts/firewall) - Limited API keys: partly (Team tokens). Tokens are limited to a team, but no read-only or sandbox-only scope is published. [source](https://vercel.com/docs/sandbox) - Create from the website: no [source](https://vercel.com/docs/sandbox/concepts/persistent-sandboxes) - Command-line tool: yes [source](https://vercel.com/docs/sandbox/cli-reference) - Python SDK: yes [source](https://vercel.com/docs/sandbox) - TypeScript SDK: yes [source](https://vercel.com/docs/sandbox) - Documented HTTP API: no. Sandbox is driven through the SDKs and the CLI; no HTTP API is documented. [source](https://vercel.com/docs/sandbox) - MCP server: no. No MCP server manages sandboxes; Vercel's MCP material is about building MCP servers on Vercel. [source](https://vercel.com/docs/sandbox) - Interactive terminal over the API: yes [source](https://vercel.com/docs/sandbox/cli-reference) - Files over the API: yes [source](https://vercel.com/docs/sandbox/sdk-reference) - Coding agents preinstalled: yes [source](https://vercel.com/docs/sandbox) - Send it a prompt: no. Agents are in the image but there is no API that runs one; you open a terminal or use the CLI. [source](https://vercel.com/docs/sandbox) - One-click Hermes: no. A Hermes guide exists, but you follow terminal steps; nothing is one click. [source](https://vercel.com/docs/sandbox/ecosystem/hermes) - One-click OpenClaw: no. No OpenClaw template or one-click route is documented. [source](https://vercel.com/docs/sandbox/ecosystem) - Browser built in: no. No browser is documented in the image or as an API; agents in the image are terminal tools. [source](https://vercel.com/docs/sandbox) - Desktop for computer use: no. No desktop, VNC or computer-use API is published for Sandbox. [source](https://vercel.com/docs/sandbox) - Runs other platforms' agents: yes [source](https://vercel.com/docs/sandbox/ecosystem) - Team workspace: yes [source](https://vercel.com/docs/plans/pro-plan) - Roles and permissions: yes [source](https://vercel.com/docs/plans/pro-plan) - Single sign-on: partly ($300/month). SAML single sign-on is a paid add-on at $300 a month. [source](https://vercel.com/docs/plans/pro-plan) - Hard spending cap: partly. Spend Management can pause projects at an amount you set, but it is a project pause rather than a sandbox stop. [source](https://vercel.com/docs/sandbox/pricing) - Usage alerts: yes [source](https://vercel.com/docs/sandbox/pricing) - Audit log: partly. Audit Logs are a Vercel Enterprise feature; Sandbox-specific coverage is not established. [source](https://vercel.com/docs/audit-log) - Billed per second: partly (memory rounds to a minute). Memory is counted in whole minutes, so a 20-second task is charged for a full minute of memory. [source](https://vercel.com/docs/sandbox/pricing) - CPU billed only while working: yes (active CPU only) [source](https://vercel.com/docs/sandbox/pricing) - Paused costs only storage: yes (compute stops) [source](https://vercel.com/docs/sandbox) - No monthly fee: partly (Hobby free; Pro $20). The free Hobby plan is for personal projects only; commercial use needs the $20-a-month Pro plan. [source](https://vercel.com/docs/plans/pro-plan) - Flat monthly price: no (active CPU plus memory). The bill is active processor time plus memory for as long as the sandbox runs. [source](https://vercel.com/docs/sandbox/pricing) - Ongoing free tier: partly (Hobby, personal use only). The free Hobby plan is limited to personal projects and stops creating sandboxes when its allowance runs out. [source](https://vercel.com/docs/plans/hobby) - Free starting credit: partly ($20 in a 14-day trial). The credit is part of a 14-day Pro trial, not a standing signup credit. [source](https://vercel.com/docs/plans/hobby) - Try without a card: not-published [source](https://vercel.com/docs/plans/hobby) - Public status page: yes [source](https://www.vercel-status.com) - Uptime promise (SLA): partly (99.99%, Enterprise). The 99.99% Enterprise SLA covers the platform and does not name Sandbox. [source](https://vercel.com/legal/sla) - SOC 2 report: partly. Vercel holds SOC 2 Type 2, but Sandbox's place in the audit scope is not published. [source](https://vercel.com/docs/security/compliance) - Data processing agreement: yes [source](https://vercel.com/legal/dpa) - Open source or self-hostable: no. Vercel Sandbox is hosted on Vercel; no self-hosted edition is published. [source](https://vercel.com/docs/sandbox) ## Usability - Dashboard: The Vercel dashboard can stop or delete a sandbox and shows a lifecycle activity log. - Without code: No documented no-code path; the workflows are CLI and SDK. - Signup: A Vercel account. Card requirement depends on the plan and trial path; Hobby is non-commercial only. - Docs: Vercel's docs cover sandbox concepts, SDK, pricing and limits. Support follows the Vercel plan. - Trips people up: The default timeout is 5 minutes, and the maximum session is 45 minutes on Hobby, 24 hours on Pro. - Trips people up: Persistent sandboxes bill snapshot storage automatically. - Trips people up: Active CPU excludes I/O wait, so the meter is not wall-clock time. - Trips people up: Hobby pauses sandbox creation when quotas run out. ## Company - Legal entity: Vercel Inc., a Delaware corporation. [source](https://vercel.com/legal/dpa) - Founded: 2015, by Guillermo Rauch, who is CEO. Sandbox was announced in June 2025 and went GA in January 2026. [source](https://vercel.com/blog/series-f) - Funding: $300M Series F at a $9.3B valuation in September 2025, co-led by Accel and GIC. [source](https://vercel.com/blog/series-f) - Headcount: 600, per Forbes in September 2025. No current company-confirmed figure. [source](https://www.forbes.com/companies/vercel/) - Status and SLA: Sandbox is listed as operational with no Sandbox-specific percentage. The 99.99% Enterprise SLA does not name Sandbox. [source](https://vercel.com/legal/sla#services-availability) - Certification: SOC 2 Type 2 and ISO 27001:2022 at platform level; Sandbox's place in that scope is not published. [source](https://vercel.com/docs/security/compliance#soc-2-type-2) ## Caveats - **Persistence is billed by default** (open): Persistent sandboxes save their filesystem when stopped, and each automatic snapshot consumes snapshot storage billed separately from compute. - **The session limit is not a lifetime limit** (open): The maximum duration applies to a single session: 45 minutes on Hobby, 24 hours on Pro and Enterprise. Persistent sandboxes can be resumed into a new session. - **Hobby is non-commercial** (open): The Hobby plan restricts users to non-commercial, personal use only. - **Hobby quota reset wording differs** (contradiction): One page says creation pauses until 30 days after first use; another says until the next billing cycle. - **Fork is not a live memory copy** (open): Fork uses the current saved snapshot or falls back to a fresh create from the image; manual snapshotting stops the source. ## Sources - [Overview](https://vercel.com/docs/sandbox) - [Concepts](https://vercel.com/docs/sandbox/concepts) - [Persistence](https://vercel.com/docs/sandbox/concepts/persistent-sandboxes) - [Snapshots](https://vercel.com/docs/sandbox/concepts/snapshots) - [Pricing](https://vercel.com/docs/sandbox/pricing) --- # Glossary - **Sandbox:** A computer you rent in the cloud, sealed off from everything else, that a program can create, use and throw away. Agents use one so the code they run cannot reach your own machine or other customers. - **vCPU:** One share of a processor. More vCPUs let a machine do more things at once; an agent waiting for messages uses a small fraction of one. - **GiB / GB:** Units of memory or disk. A GiB is about 7% larger than a GB; for choosing a provider the difference rarely matters. - **Memory (RAM):** The machine's working space while it runs. Lost when the machine stops unless the provider saves it. A browser or a large program needs more of it. - **Disk:** Where files are kept. On some providers the disk survives a stop, on others it is wiped, which is why the guide asks whether files must be kept. - **Egress:** Data the machine sends out to the internet, such as downloads to a user or uploads to another service. Some providers charge per GB; most agents send very little. - **Snapshot:** A saved copy of a machine at one moment, so it can be restored or copied later. Some providers save memory and running programs too, others only files. - **Fork:** Starting one or more new machines from a snapshot, each continuing from the same point. Useful for trying several things in parallel. - **Idle timeout:** How long a machine can sit unused before the provider pauses, stops or deletes it. Short timeouts save money but can break an agent that must answer at any time. - **Sleep and wake:** The provider pauses an idle machine and starts it again when a request arrives. You pay little while it sleeps, but the first reply after a pause is slower. - **Cold start:** The wait while a machine is created or woken before it can do anything. From under a second to a minute, depending on the provider. - **Active-CPU billing:** The processor is charged only while it is working, not while it waits. Cheap for agents that spend most of their time idle. - **Per-second billing:** Usage is counted to the second, so a two-minute task costs two minutes. Some providers round up to a minimum first. - **Included usage:** A monthly plan fee that comes with the same amount, or a set amount, of usage. You pay the fee even if you use less, and pay extra only above it. - **Isolation:** How firmly one machine is kept apart from others on the same hardware. A microVM is a small full computer and is the stronger wall; a container shares more with its neighbours. - **Region:** The part of the world where the machine runs. It matters for speed if your users are far away, and for law if data must stay in a country or the EU. - **VPS:** A virtual private server: a machine you rent by the month that runs all the time. Cheaper for one always-on agent, but you set it up and look after it yourself. - **Terminal:** A text window where you type commands instead of clicking. Many providers can be set up only this way; the guide says when one cannot. - **API and SDK:** Ways for a program, rather than a person, to control the provider: create a machine, run a command, delete it. An SDK is a ready-made library for one programming language. - **SSH:** A standard way to open a terminal on a remote machine from your own computer. - **Custom domain:** Serving what the machine runs at your own web address, such as agent.example.com, instead of the provider's. - **Token:** The unit an AI model is billed in, roughly three-quarters of a word. An agent re-reads its instructions and history on every message, so one message can use tens of thousands. - **Cache read:** Tokens the model has already seen in this conversation and can reread cheaply. Agents reread a lot, so this is most of their tokens and much cheaper than new input. - **Zero data retention:** The model provider promises not to store your prompts or replies after answering. This guide prices only model offerings that make this promise. - **MCP:** Model Context Protocol: a common way to give an AI agent tools, such as reading a calendar or searching a database, served by a small program called an MCP server. - **Webhook:** A web address that another service calls when something happens, such as a new chat message. It lets a sleeping machine be woken only when needed.