AWS EC2 vs Azure Virtual Machines
AWS EC2 and Azure Virtual Machines are the same kind of product: plain cloud VMs with their own kernel that you set up yourself. They differ in the details: EC2 bills per second and rents Mac hosts, while Azure bills per minute, lists more regions and allows nested virtualization on more common sizes.
The companies and products
AWS EC2
AWS EC2 is Amazon's general-purpose cloud VM service, not a sandbox product: you rent virtual servers by the second and set them up yourself.
You pick an instance type (Intel, AMD, Graviton Arm, GPU or Mac), a machine image and a network, and EC2 boots a Nitro VM with its own kernel and root access. Disks are EBS volumes, inbound traffic goes through security groups, and anything agent-specific (agents, desktops, HTTPS URLs, key handling) is yours to build. It is built for every kind of server workload, from websites to GPU training, across AWS's worldwide regions.
Azure Virtual Machines
Azure Virtual Machines is Microsoft's general-purpose cloud VM service: you rent Linux or Windows machines by the minute in Azure regions worldwide.
It is a hyperscaler IaaS product, not a sandbox API. Each VM runs on Microsoft's Hyper-V hypervisor with its own kernel, root and SSH, and you pick from hundreds of sizes, including Arm, burstable and GPU families. Networking, disks, images, firewalls and any agent tooling are separate pieces you set up yourself, so it suits teams that already run on Azure and want full control.
Which use cases each one fits
For each use case, Battleships prices every sandbox provider on the same workload and sorts them from the cheapest monthly bill up. “5th cheapest of 364” means 4 of the other 363 providers run that workload, with every feature it needs, for less. “With limits” means the provider runs it but misses something, so it is listed after every full match. Open a use case for its whole ranking and what each provider misses.
| Use case and its workload | AWS EC2: price rank | Azure Virtual Machines: price rank | bochka: price rank |
|---|---|---|---|
| Software factory 100 at once · 4 vCPU / 8 GB · 2,200 sessions of 8 h a month | 87th of 367, with limits $775 a month | 83rd of 367, with limits $730 a month | 3rd cheapest of 367 $634 a month |
| Always-on AI employees 50 machines 24/7 · 2 vCPU / 4 GB | 114th of 366, with limits $646 a month | 113th of 366, with limits $644 a month | 5th cheapest of 366 $657 a month |
| Code interpreter bursts 100 at once · 1 vCPU / 2 GB · 200,000 sessions of 1 min a month Both clouds handle short code bursts better than bochka's start limits allow, though each VM takes tens of seconds to boot. | 102nd of 345, with limits $165 a month | 114th of 345, with limits $222 a month | 186th of 345, with limits $2,000 a month |
| Sandboxes for your users 300 at once · 2 vCPU / 4 GB · 30,000 sessions of 23 min a month Azure comes out a little ahead of EC2 for sandboxes for your users, but on both you build the URLs, auth and cleanup yourself; bochka ships that layer. | 70th of 361, with limits $607 a month | 63rd of 361, with limits $500 a month | Cheapest of 361 $209 a month |
| RL rollouts 1,000 at once · 2 vCPU / 4 GB · 1,000,000 sessions of 3 min a month EC2 ranks above Azure for RL rollouts once your vCPU quota is raised, and both beat bochka, whose daily start limits cap large bursts. | 13th of 360, with limits $830 a month | 19th of 360, with limits $1,039 a month | 34th of 360, with limits $2,000 a month |
| Agent evals 250 at once · 4 vCPU / 8 GB · 15,000 sessions of 20 min a month Both clouds fit agent evals fully and sit near the top, with Azure at $173 a month and EC2 at $177, and bochka close behind at $200. | 5th cheapest of 364 $177 a month | 3rd cheapest of 364 $173 a month | 10th cheapest of 364 $200 a month |
| CI runners 40 at once · 8 vCPU / 16 GB · 6,000 sessions of 12 min a month Both run CI fully, EC2 at $255 a month and Azure at $335; bochka comes to $86 with Docker and /dev/kvm on every machine. | 21st cheapest of 377 $255 a month | 35th cheapest of 377 $335 a month | 4th cheapest of 377 $86 a month |
| 24/7 dev boxes 1 machine 24/7 · 4 vCPU / 8 GB A 24/7 dev box is $76 a month on EC2 and $94 on Azure, both with disks billed while stopped; bochka is $26. | 59th cheapest of 368 $76 a month | 72nd cheapest of 368 $94 a month | 18th cheapest of 368 $26 a month |
| Computer-use agents 50 at once · 4 vCPU / 8 GB · 20,000 sessions of 15 min a month Neither cloud has a desktop stream or computer-use API on Linux, so both are a compromise; bochka streams a 60fps desktop on every machine. | 103rd of 369, with limits $195 a month | 100th of 369, with limits $192 a month | 6th cheapest of 369 $200 a month |
| Browser-use agents 50 at once · 2 vCPU / 4 GB · 30,000 sessions of 10 min a month | 165th of 367, with limits $101 a month | 168th of 367, with limits $107 a month | 7th cheapest of 367 $200 a month |
| Scraping & bots (startup scale) 50 at once · 1 vCPU / 2 GB · 100,000 sessions of 3 min a month | 195th of 346, with limits $116 a month | 194th of 346, with limits $116 a month | 6th cheapest of 346 $90 a month |
| Mass scraping & bots (undetectable) 1,000 at once · 1 vCPU / 2 GB · 3,000,000 sessions of 2 min a month | 82nd of 338, with limits $2,046 a month | 81st of 338, with limits $2,044 a month | 71st of 338, with limits $1,800 a month |
| Parallel red teaming 200 at once · 2 vCPU / 4 GB · 5,000 sessions of 30 min a month | 108th of 360, with limits $45 a month | 110th of 360, with limits $46 a month | 2nd cheapest of 360 $200 a month |
| GPU eval jobs 10 at once · 8 vCPU / 32 GB · 500 sessions of 30 min a month Only AWS EC2 fits GPU eval jobs in our table, with single-GPU instances from L4 up to H100; Azure and bochka have no fitting option here. | 25th cheapest of 98 $1,723 a month | Can't run it | Can't run it |
| macOS agents 5 at once · 4 vCPU / 8 GB · 1,000 sessions of 20 min a month | Can't run it | Can't run it | Can't run it |
Key features
| Feature | AWS EC2 | Azure Virtual Machines | bochka |
|---|---|---|---|
| What you get | A general cloud VM; you install and wire everything else | A general cloud VM; images, networking and tooling are yours to set up | An agent sandbox: a full VM with agents, desktop, URLs and snapshots set up |
| Isolation | Nitro VM with its own kernel | Hyper-V VM with its own kernel | Full VM with its own kernel |
| Billing | Per second for Linux and Windows, 60 second minimum | Per full minute; a VM shut down from inside the OS keeps billing until deallocated | Per second from a monthly plan credit; a stopped sandbox costs nothing |
| Nested virtualization | /dev/kvm only on C8i, M8i, R8i and metal instances | On Intel and AMD D and F sizes such as Dsv5 and Fsv2; not on Arm or B-series | /dev/kvm, Docker, root and systemd on every machine |
| Operating systems and CPUs | Linux and Windows on Intel, AMD and Graviton Arm; macOS on Mac Dedicated Hosts | Linux and Windows on Intel, AMD and Arm (Cobalt 100, Ampere Altra); no macOS | Linux on dedicated AMD Ryzen 9 9950X (Zen 5) hosts; Wine for Windows apps |
| GPUs | Nvidia L4, A10, L40S, H100 and H200 instances | GPU families such as NC with Nvidia H100 and A100 | None |
| Coding agents | None preinstalled; install and drive them over SSH or Systems Manager | None built in; install and run them with Run Command, scripts or SSH | Claude Code, Codex, OpenCode and more preinstalled, with a prompt, steer and events API |
| Keeping keys out of the machine | IAM role credentials and secrets are read from inside the instance | Key Vault secrets are fetched into the VM, where its code can read them | AI credentials proxy for model providers and any HTTPS API; switch to another account when credits run out |
| Desktop and computer use | Linux images have no desktop; Windows instances have Remote Desktop; no computer-use API | None built in; you install your own VNC or RDP server | 60fps desktop and Chromium, computer use and browser control, embeddable stream |
| Reaching the machine | Public IPv4 ($0.005 an hour) and any port through security groups; HTTPS needs your own domain, certificate and load balancer | Public IPv4 ($0.005 an hour) and any port through security groups; HTTPS is yours to run, or you add a load balancer or gateway | HTTPS URLs for up to 50 ports, token-protected; raw TCP; dedicated IP |
| Files after a stop | EBS disks kept and billed while stopped; snapshots manual or scheduled with Data Lifecycle Manager | Disks kept and billed while deallocated; scheduled snapshots need Azure Backup | Snapshots every minute and on stop; a stopped sandbox costs nothing |
| Fork and pause | Clone by making an image and booting a new instance; hibernation keeps memory | Clone from an image or disk snapshot (image capture needs the VM stopped); hibernation up to 64 GB of RAM | Fork a running sandbox in one call; resume reboots from disk (no memory snapshots) |
| Outbound network rules | Security groups; domain allowlists with AWS Network Firewall or DNS Firewall (paid) | Security groups; domain allowlists with the paid Azure Firewall | Open internet on every plan; no provider-side allowlist |
| Regions | 39 regions and 124 availability zones | 77 regions listed as available or coming soon | EU only: Germany, Finland, France |
Every feature Battleships tracks (43)
| Feature | AWS EC2 | Azure Virtual Machines | bochka |
|---|---|---|---|
| Full VM (own kernel) | Yes | Yes | Yes |
| Docker inside | Yes | Yes | Yes |
| Nested virtualization | Yes | Yes | Yes |
| Root | Yes | Yes | Yes |
| Systemd | Yes | Yes | Yes |
| Desktop GUI | No | No | Yes |
| Browser | No | No | Yes |
| Computer-use API | No | No | Yes |
| SSH | Yes | Yes | Yes |
| Persistent disk | Yes | Yes | Yes |
| Pause/resume | Yes | Yes | Yes |
| Automatic snapshots | Yes | No | Yes |
| Fork/clone | No | Yes | Yes |
| Live fork (no pause) | No | No | Yes |
| Memory fork | No | No | No |
| Custom image (Docker or snapshot) | Yes | Yes | Yes |
| ≥24 h sessions | Yes | Yes | Yes |
| Idle auto-stop | No | No | No |
| Wake on request | No | No | No |
| HTTPS preview URLs | No | No | Yes |
| Raw TCP inbound | Yes | Yes | Yes |
| Public IPv4 | Yes | Yes | No |
| Egress allowlist | Yes | Yes | No |
| Secret proxy | No | No | Yes |
| Secret proxy for any API | No | No | Yes |
| Preinstalled agents | No | No | Yes |
| Agent harness API | No | No | Yes |
| MCP server | No | Yes | No |
| GPU | Yes | Yes | No |
| Windows | Yes | Yes | No |
| Arm64 | Yes | Yes | No |
| Self-hosting | No | No | No |
| BYOC | No | No | No |
| Open source | No | No | No |
| Scoped API keys | Not published | Not published | Yes |
| Spend limits | Not published | No | Yes |
| Usage per sandbox (API) | Yes | Yes | Yes |
| Audit logs | Not published | Yes | No |
| SSO | Yes | Yes | No |
| SOC 2 | Yes | Yes | No |
| HIPAA | Yes | Yes | No |
| EU data residency | Yes | Yes | Yes |
| Zero data retention | Not published | Not published | Yes |
Performance
There is no comparable measurement for AWS EC2 or Azure Virtual Machines: neither was part of the public benchmark run we use. In that run, StarSling's Node.js build-and-test test on 2026-09-29, bochka did 26.69 runs per second at 4 vCPU / 8 GB. On both clouds, speed depends on the CPU family you pick.
Node.js build-and-test loop at 4 vCPU / 8 GB, higher is better. Measured with the open hpc-sandbox-benchmarks suite. AWS EC2 and Azure Virtual Machines have no published run in this suite yet, so there is no like-for-like number to compare.
Pricing in five scenarios
Each bill is priced from the providers' public price lists by the open Battleships engine, with the cheapest plan that runs the scenario.
| Scenario | AWS EC2, a month | Azure Virtual Machines, a month | bochka, a month |
|---|---|---|---|
| One coding agent, workdays 4 vCPU / 8 GB, 50 GB disk, 8 hours a day, 22 days a month, files kept between days | $21 · Pay-as-you-go (no platform fee) | $26 · Pay-as-you-go subscription (no plan fee) | $20 · $20/mo |
| One agent that never stops 4 vCPU / 8 GB, 50 GB disk, running 24/7 all month | $51 · Pay-as-you-go (no platform fee) · with limits | $48 · Pay-as-you-go subscription (no plan fee) · with limits | $26 · $20/mo |
| 50 agents in parallel 50 machines of 4 vCPU / 8 GB at once, 8-hour sessions, 1,100 sessions a month, Docker inside | $944 · Pay-as-you-go (no platform fee) | $1,168 · Pay-as-you-go subscription (no plan fee) | $317 · $20/mo × 3 seats |
| Sandboxes for your users 2 vCPU / 4 GB, 30,000 sessions of 10 minutes a month, up to 300 at once | $269 · Pay-as-you-go (no platform fee) | $225 · Pay-as-you-go subscription (no plan fee) | $200 · $100/mo × 2 seats |
| 1,000 short jobs at once 2 vCPU / 4 GB, 1,000 at once, 3 minutes each, 200,000 jobs a month | $502 · Pay-as-you-go (no platform fee) | $483 · Pay-as-you-go subscription (no plan fee) · with limits | $2,000 · $2000/mo · with limits |
AWS EC2: EC2 bills each instance per second (60 second minimum) at its list rate, here the Graviton c7g sizes on demand, with no platform fee. EBS disks and public IPv4 bill on top, also while stopped, and lower rates need a 1-year or 3-year commitment.
Azure Virtual Machines: Azure bills each VM per full minute while it runs, with no plan fee; disks, public IPv4 and egress bill on top, and disks keep billing while deallocated. The cheapest fits here use Arm Cobalt sizes, B-series burstable sizes, or a 3-year reservation for a machine that never stops.
Azure Virtual Machines: You pick a monthly plan from $20, and all of it becomes usage credit spent per second on running sandboxes. A stopped sandbox costs nothing and keeps its disk.
Limits in those scenarios
A new AWS account can run only 5 vCPUs of standard On-Demand instances per region, and Azure caps vCPUs per region and per VM family, with stopped VMs still counting, so 50 agents in parallel need a quota raise on both. One agent that never stops reaches the prices shown ($51 a month on EC2, $48 on Azure) only with a 3-year commitment. For 1,000 short jobs at once, Azure's B-series VMs guarantee 30% of each vCPU and throttle above that, while EC2 fits. On bochka that burst is held back by starts per minute and per day.
| Scenario | AWS EC2 | Azure Virtual Machines | bochka |
|---|---|---|---|
| One coding agent, workdays | None that bite | None that bite | None that bite |
| One agent that never stops |
|
| None that bite |
| 50 agents in parallel | None that bite | None that bite | None that bite |
| Sandboxes for your users | None that bite | None that bite | None that bite |
| 1,000 short jobs at once | None that bite |
|
|
Which one should you use?
Use AWS EC2 when
you need macOS, a wide range of GPU instances, per-second billing for short jobs, or your company already runs on AWS.
- macOS on Mac hosts. Useful if agents build for Apple platforms: EC2 rents Mac instances on Dedicated Hosts, and Azure has no macOS.
- Per-second billing. Useful for many short jobs: EC2 bills Linux and Windows per second after a 60 second minimum, while Azure bills per full minute.
- GPU eval jobs. Useful if you run evals on GPUs: EC2 is the one of the two that fits that use case in our table.
Use Azure Virtual Machines when
you need nested virtualization on common sizes, a region in a country EC2 does not cover, Spot capacity for large batches, or your company already runs on Azure.
- Nested virtualization on common sizes. Useful if agents start VMs or emulators: Azure allows it on Intel and AMD D and F sizes, while EC2 limits it to C8i, M8i, R8i and metal.
- More regions. Useful if data must stay in a given country: Azure lists 77 regions available or coming soon, against 39 for EC2.
- Spot VMs for large batches. Useful for big batches that can survive eviction: Azure Spot VMs sell spare capacity at a deep discount, with 30 seconds of notice.
Where bochka fits
bochka is not a hyperscaler: it has no GPUs, no Windows or macOS guests and runs only in the EU. If what you are really running is agents, though, both clouds leave you to build the agent layer on top of a raw VM. bochka gives each agent a full VM that already has that layer.
Agents driven from outside, keys kept outside
On EC2 and Azure you install every agent over SSH, Systems Manager or Run Command, and IAM or Key Vault secrets land inside the VM where agent code can read them. bochka ships the agents, a prompt and events API and a credentials proxy.
Fork a running machine, stop for free
Copying a machine on either cloud means capturing an image and booting a new VM cold, and Azure needs the VM stopped first. Parked machines keep billing disks and public IPv4. bochka forks a running sandbox and snapshots every minute.
Desktop, HTTPS URLs and /dev/kvm on every machine
Neither cloud streams a Linux desktop or offers a computer-use API, HTTPS needs your own certificate and load balancer, and nested virtualization works only on some sizes. bochka has a 60fps desktop, HTTPS on 50 ports and /dev/kvm everywhere.
Use bochka when what you run is agents and you want each one on a ready full VM: coding agents with an API, keys kept outside, a desktop, HTTPS URLs, /dev/kvm, minute-by-minute snapshots and forks, with no infrastructure to build. Compare it one to one: bochka vs AWS EC2 and bochka vs Azure Virtual Machines.
Questions people ask
Is AWS EC2 cheaper than Azure Virtual Machines?
It depends on the job. In our scenarios one coding agent on workdays is $21 a month on EC2 and $26 on Azure, and 50 agents in parallel come to $944 versus $1,168. Azure is lower for sandboxes for your users, $225 against $269, and for one agent that never stops, $48 against $51 with a 3-year commitment on both.
Which is faster, EC2 or Azure?
We have no comparable measurement for either: neither was in the public benchmark run we use, and speed depends on the instance family you pick. bochka did 26.69 Node.js build-and-test runs per second at 4 vCPU / 8 GB in that run.
Can EC2 and Azure VMs run Docker and nested virtualization?
Both give you root, so Docker and systemd run on any instance. Nested virtualization is narrower: on EC2 only C8i, M8i, R8i and metal instances, on Azure Intel and AMD D and F sizes but not Arm or B-series. bochka has /dev/kvm on every machine.
Do EC2 and Azure VMs bill while stopped?
A stopped EC2 instance stops compute billing but still bills its EBS disk and any public IPv4. On Azure only a deallocate from the portal, CLI or API ends compute billing, a shutdown from inside the OS does not, and disks and static IPs keep billing. A stopped bochka sandbox costs nothing.
Which has more regions?
Azure lists 77 regions as available or coming soon, and EC2 runs in 39 regions with 124 availability zones. Both have several regions in the EU. bochka runs only in the EU, in Germany, Finland and France.
Can I run coding agents on EC2 or Azure?
Yes, on either you launch a VM, install the agent, give it a key and drive it over SSH, Systems Manager or Run Command. bochka does that work for you: agents come preinstalled, you drive them by API, and the real keys stay outside the machine.
Try bochka
Install the CLI, then run bochka new.
Product preview