Beam vs Docker Cloud Sandboxes
Beam is a serverless GPU platform whose sandboxes are fast gVisor containers that can run until you stop them. Docker Cloud Sandboxes puts the sbx coding-agent microVM from your laptop in the cloud, with agents ready to run but a 24-hour limit and 10 at a time by default.
The companies and products
Beam
Beam is a serverless cloud for GPU inference, sandboxes and background jobs, built on its open-source runtime Beta9.
Beam runs functions, REST endpoints, task queues, pods, sandboxes and VMs on CPUs and GPUs, all from a Python or TypeScript SDK. A sandbox is a container isolated with gVisor that starts in a second or two, lives until you terminate it or its time to live runs out, and can be saved as a filesystem image or a memory snapshot. Beam VMs are a separate CPU product: a microVM with its own kernel, systemd and a root disk that stays when it stops. Much of Beam is a GPU serverless platform for AI teams.
- Bring your own cloud
- Management fee per vCPU and GB of RAM, on top of your own cloud bill
Docker Cloud Sandboxes
Docker Cloud Sandboxes runs Docker's sbx coding-agent microVMs on Docker-managed compute instead of your laptop.
Each sandbox is a microVM with its own Linux kernel and its own Docker Engine, started from the same sbx CLI you use locally, with Claude Code, Codex and other agents ready to run. You can move a sandbox from your laptop to the cloud and back, publish HTTPS ports and SSH in. It launched on September 24, 2026, is billed pay-as-you-go on a personal Docker account, and is built for developers who want their local agent sandboxes to keep going off their machine.
- Launched
- September 24, 2026
- Session length
- 1 hour by default, extendable to 24 hours from creation
- Default quota
- 10 concurrent and 50 stored sandboxes per account
- Regions
- Not published
Which use cases each one fits
For each use case, Battleships prices every sandbox provider on the same workload and sorts them from the cheapest monthly bill up. “8th cheapest of 345” means 7 of the other 344 providers run that workload, with every feature it needs, for less. “With limits” means the provider runs it but misses something, so it is listed after every full match. Open a use case for its whole ranking and what each provider misses.
| Use case and its workload | Beam: price rank | Docker Cloud Sandboxes: price rank | bochka: price rank |
|---|---|---|---|
| Software factory 100 at once · 4 vCPU / 8 GB · 2,200 sessions of 8 h a month A software factory runs many agents for days; Docker stops each sandbox at 24 hours and allows 10 at once, Beam sandboxes lack systemd and /dev/kvm, and bochka gives each one a full VM. | 69th of 367, with limits $551 a month | 280th of 367, with limits $4,928 a month | 3rd cheapest of 367 $634 a month |
| Always-on AI employees 50 machines 24/7 · 2 vCPU / 4 GB An assistant that lives on its machine all month fits a Beam VM or a bochka sandbox, but not one Docker session, which ends 24 hours after creation. | 115th of 366, with limits $651 a month | 276th of 366, with limits $5,110 a month | 5th cheapest of 366 $657 a month |
| Code interpreter bursts 100 at once · 1 vCPU / 2 GB · 200,000 sessions of 1 min a month Beam fits short code runs best of the three: sandboxes start in a second or two, bill per second and go away when their timer ends. | 8th cheapest of 345 $117 a month | 119th of 345, with limits $233 a month | 186th of 345, with limits $2,000 a month |
| Sandboxes for your users 300 at once · 2 vCPU / 4 GB · 30,000 sessions of 23 min a month Serving your own users needs many sandboxes at once; Beam's Team plan allows 1,000 and bochka's plans up to 2,000, while Docker allows 10 by default. | 3rd cheapest of 361 $290 a month | 136th of 361, with limits $1,628 a month | Cheapest of 361 $209 a month |
| RL rollouts 1,000 at once · 2 vCPU / 4 GB · 1,000,000 sessions of 3 min a month | 341st of 360, with limits $939 a month | 114th of 360, with limits $7,000 a month | 34th of 360, with limits $2,000 a month |
| Agent evals 250 at once · 4 vCPU / 8 GB · 15,000 sessions of 20 min a month | 13th cheapest of 364 $251 a month | 167th of 364, with limits $1,400 a month | 10th cheapest of 364 $200 a month |
| CI runners 40 at once · 8 vCPU / 16 GB · 6,000 sessions of 12 min a month Beam and bochka both fit CI jobs; builds of Android apps or VM images need /dev/kvm, which only bochka exposes. | 12th cheapest of 377 $171 a month | 172nd of 377, with limits $672 a month | 4th cheapest of 377 $86 a month |
| 24/7 dev boxes 1 machine 24/7 · 4 vCPU / 8 GB A dev box that stays on all month works on a Beam VM or bochka, while Docker's sandboxes end 24 hours after creation. | 13th cheapest of 368 $21 a month | 127th of 368, with limits $204 a month | 18th cheapest of 368 $26 a month |
| Computer-use agents 50 at once · 4 vCPU / 8 GB · 20,000 sessions of 15 min a month Computer-use agents need a screen; bochka has a 60fps Linux desktop with Chromium, and neither Beam nor Docker has a desktop product. | 111th of 369, with limits $237 a month | 268th of 369, with limits $1,400 a month | 6th cheapest of 369 $200 a month |
| Browser-use agents 50 at once · 2 vCPU / 4 GB · 30,000 sessions of 10 min a month | 195th of 367, with limits $176 a month | 277th of 367, with limits $700 a month | 7th cheapest of 367 $200 a month |
| Scraping & bots (startup scale) 50 at once · 1 vCPU / 2 GB · 100,000 sessions of 3 min a month | 200th of 346, with limits $131 a month | 262nd of 346, with limits $350 a month | 6th cheapest of 346 $90 a month |
| Mass scraping & bots (undetectable) 1,000 at once · 1 vCPU / 2 GB · 3,000,000 sessions of 2 min a month | 42nd of 338, with limits $923 a month | 190th of 338, with limits $7,000 a month | 71st of 338, with limits $1,800 a month |
| Parallel red teaming 200 at once · 2 vCPU / 4 GB · 5,000 sessions of 30 min a month | 175th of 360, with limits $155 a month | 248th of 360, with limits $350 a month | 2nd cheapest of 360 $200 a month |
| GPU eval jobs 10 at once · 8 vCPU / 32 GB · 500 sessions of 30 min a month Only Beam has GPUs, from RTX 4090 to H100 and B200; Docker Cloud Sandboxes and bochka are CPU only. | Cheapest of 98 $458 a month | Can't run it | Can't run it |
| macOS agents 5 at once · 4 vCPU / 8 GB · 1,000 sessions of 20 min a month | Can't run it | Can't run it | Can't run it |
Key features
| Feature | Beam | Docker Cloud Sandboxes | bochka |
|---|---|---|---|
| Isolation | gVisor container by default for sandboxes; separate Beam VMs are CPU microVMs | MicroVM with its own Linux kernel and its own Docker Engine | Full VM with its own kernel on dedicated AMD Ryzen 9 9950X hosts |
| Session length | Default 10 minutes; set -1 to run until you terminate it | 1 hour by default, at most 24 hours from creation | No cap on paid plans; you set the time to live |
| Sandboxes at once | 30 CPU containers on Developer, 1,000 on Team | 10 by default; no published way to raise it | 100 on the $20 plan, up to 2,000 on higher plans |
| Stop, snapshot and fork | Memory snapshot of a running sandbox, restored into new sandboxes | Stop keeps memory and files; snapshot with memory and restore as a new sandbox | Disk saved every minute and on stop; fork a running sandbox with its disk |
| Docker and systemd | Docker with docker_enabled; systemd only in Beam VMs | Its own Docker Engine; agent runs as a non-root user with sudo | Docker, systemd and root, like a normal Ubuntu server |
| Nested virtualization | Not documented | Not documented | Yes, /dev/kvm for Android emulators and VMs |
| GPUs | GPU sandboxes and serverless GPUs up to H100, H200 and B200 | No, CPU only | No, CPU only |
| Desktop and browser | No desktop or browser product | Terminal sessions only | 60fps Linux desktop with Chromium and computer use |
| Coding agents | None preinstalled; you install and run them yourself | Claude Code, Codex, Copilot, OpenCode and more, attached to from the sbx CLI | Seven agents preinstalled, with a prompt, steer and events API to drive them from outside |
| Keeping API keys out of the sandbox | Secrets are environment variables inside the sandbox | Cloud proxy sets the auth header; the sandbox sees a placeholder | Credentials proxy for model providers and any HTTPS API, with account switching when credits run out |
| Inbound access | Public HTTPS URL per exposed port with no built-in auth; no raw TCP | Public HTTPS URL per published port; not a TCP tunnel; SSH | HTTPS URLs for up to 50 ports, token-protected by default; raw TCP; dedicated IPv4 or IPv6 |
| Outbound rules | Block all, or allow up to 10 CIDR ranges | Allow and deny rules by host, with presets | Open internet, no provider-side allowlist |
| Where it runs | US only; Beta9 runtime free to self-host, or your own cloud for a fee | Regions not published; same microVM runs on your laptop | EU only (Germany, Finland, France) |
Every feature Battleships tracks (43)
| Feature | Beam | Docker Cloud Sandboxes | bochka |
|---|---|---|---|
| Full VM (own kernel) | No | Yes | Yes |
| Docker inside | Yes | Yes | Yes |
| Nested virtualization | No | No | Yes |
| Root | Yes | Yes | Yes |
| Systemd | No | Not published | Yes |
| Desktop GUI | No | No | Yes |
| Browser | No | No | Yes |
| Computer-use API | No | No | Yes |
| SSH | Yes | Yes | Yes |
| Persistent disk | Yes | Yes | Yes |
| Pause/resume | No | Yes | Yes |
| Automatic snapshots | No | Yes | Yes |
| Fork/clone | Yes | Yes | Yes |
| Live fork (no pause) | Yes | Yes | Yes |
| Memory fork | Yes | Yes | No |
| Custom image (Docker or snapshot) | Yes | Yes | Yes |
| ≥24 h sessions | Yes | Yes | Yes |
| Idle auto-stop | No | No | No |
| Wake on request | No | Not published | No |
| HTTPS preview URLs | Yes | Yes | Yes |
| Raw TCP inbound | No | Not published | Yes |
| Public IPv4 | No | No | No |
| Egress allowlist | Yes | Yes | No |
| Secret proxy | No | Yes | Yes |
| Secret proxy for any API | No | Yes | Yes |
| Preinstalled agents | No | Yes | Yes |
| Agent harness API | No | No | Yes |
| MCP server | Yes | Yes | No |
| GPU | Yes | No | No |
| Windows | No | No | No |
| Arm64 | No | Yes | No |
| Self-hosting | Yes | No | No |
| BYOC | Yes | No | No |
| Open source | Yes | No | No |
| Scoped API keys | Not published | Not published | Yes |
| Spend limits | Not published | Not published | Yes |
| Usage per sandbox (API) | No | No | Yes |
| Audit logs | Not published | Not published | No |
| SSO | No | Yes | No |
| SOC 2 | Yes | No | No |
| HIPAA | Yes | No | No |
| EU data residency | Not published | No | Yes |
| Zero data retention | Not published | Not published | Yes |
Performance
There is no comparable CPU measurement for Beam or Docker Cloud Sandboxes: neither is in the StarSling hpc-sandbox-benchmarks runs, so we cannot say which of the two is faster. bochka did 26.69 runs per second on that Node.js test at 4 vCPU / 8 GB, on dedicated AMD Ryzen 9 9950X hosts. Beam says its sandboxes cold-boot in 1 to 3 seconds.
Node.js build-and-test loop at 4 vCPU / 8 GB, higher is better. Measured with the open hpc-sandbox-benchmarks suite. Beam and Docker Cloud Sandboxes have no published run in this suite yet, so there is no like-for-like number to compare.
Pricing in five scenarios
Each bill is priced from the providers' public price lists by the open Battleships engine, with the cheapest plan that runs the scenario.
| Scenario | Beam, a month | Docker Cloud Sandboxes, a month | bochka, a month |
|---|---|---|---|
| One coding agent, workdays 4 vCPU / 8 GB, 50 GB disk, 8 hours a day, 22 days a month, files kept between days | $5 · Developer | $49 · Docker Agentic Platform (pay-as-you-go) | $20 · $20/mo |
| One agent that never stops 4 vCPU / 8 GB, 50 GB disk, running 24/7 all month | $22 · Developer | $204 · Docker Agentic Platform (pay-as-you-go) · with limits | $26 · $20/mo |
| 50 agents in parallel 50 machines of 4 vCPU / 8 GB at once, 8-hour sessions, 1,100 sessions a month, Docker inside | $410 · Team | $2,464 · Docker Agentic Platform (pay-as-you-go) · with limits | $317 · $20/mo × 3 seats |
| Sandboxes for your users 2 vCPU / 4 GB, 30,000 sessions of 10 minutes a month, up to 300 at once | $191 · Team | $700 · Docker Agentic Platform (pay-as-you-go) · with limits | $200 · $100/mo × 2 seats |
| 1,000 short jobs at once 2 vCPU / 4 GB, 1,000 at once, 3 minutes each, 200,000 jobs a month | $259 · Team | $1,400 · Docker Agentic Platform (pay-as-you-go) · with limits | $2,000 · $2000/mo · with limits |
Beam: Beam sandboxes bill per second for each CPU core (two vCPU) and GiB of RAM you request, until you terminate them or their time to live ends, so an idle tail is billed too. Developer has no fee; Team costs $89 a month plus usage, and egress is free.
Docker Cloud Sandboxes: Docker bills per second for the size you pick, from $0.07 an hour for 1 vCPU / 2 GiB to $1.12 an hour for 16 vCPU / 32 GiB, with no monthly fee. A stopped sandbox costs nothing, and volumes and egress are free.
Docker Cloud Sandboxes: Plans start at $20 a month, and the whole fee is usage credit. You pay per second while a sandbox runs, and a stopped sandbox costs nothing and keeps its disk.
Limits in those scenarios
Docker's 24-hour cap rules it out for one agent that never stops, and its default of 10 sandboxes at once rules it out for 50 agents in parallel, sandboxes for your users and 1,000 short jobs at once. Beam fits all five scenarios, but 50 agents need its Team plan, since Developer allows 30 CPU containers, and Beam publishes no price for extra disk, so none is counted. bochka fits four; its start limits queue a 1,000-job burst even on the $2,000 plan.
| Scenario | Beam | Docker Cloud Sandboxes | bochka |
|---|---|---|---|
| One coding agent, workdays |
| None that bite | None that bite |
| One agent that never stops |
|
| None that bite |
| 50 agents in parallel |
|
| None that bite |
| Sandboxes for your users |
|
| None that bite |
| 1,000 short jobs at once |
|
|
|
Which one should you use?
Use Beam when
your work needs GPUs, when you run many short sandboxes or code runs, when you need hundreds at once, or when you want to self-host the runtime.
- GPUs in the same platform. For work that needs a GPU, Beam offers GPU sandboxes and serverless GPUs from RTX 4090 to H100 and B200.
- No time cap and room to scale. A Beam sandbox can run until you stop it, and the Team plan allows 1,000 CPU containers at once.
- Open source runtime. Beam's Beta9 runtime is AGPL-3.0 and free to self-host, or it can run in your own cloud for a fee.
Use Docker Cloud Sandboxes when
you already run agents in sbx on your laptop and want a few to keep going in the cloud for up to a day, with memory kept across stops and strict outbound rules.
- The same sandbox on your laptop. If you already run sbx locally, the cloud is the same microVM and CLI, and you can move a sandbox either way.
- Agents and keys handled for you. Claude Code, Codex and other agents are ready to run, and a proxy adds API keys so the sandbox sees a placeholder.
- Stop with memory kept. For agents that pause between steps, a stopped sandbox comes back with its memory and running processes.
Where bochka fits
If your agents do real work for hours or days, look at bochka. Each sandbox is a full VM with Docker, systemd and /dev/kvm, a desktop, and agents you drive from your own code, with no session cap on paid plans. Pick Beam instead if you need GPUs.
A whole machine for the agent
Beam sandboxes are gVisor containers without systemd, and neither Beam nor Docker documents /dev/kvm, so Android emulators and nested VMs have nowhere to run. bochka gives every sandbox its own kernel, systemd and /dev/kvm.
Long runs and many at once
Docker ends each sandbox 24 hours after creation and runs 10 at a time, so your code must stop and resume long jobs. bochka has no session cap on paid plans and runs 100 at once on its $20 plan.
Screen, agents and keys built in
Neither Beam nor Docker has a desktop, so computer-use agents need a separate browser service. Beam has no agents preinstalled and keeps secrets in env vars; bochka ships seven agents with an API, a 60fps desktop and a credentials proxy.
Use bochka when your agents run for days or by the dozen on a full VM, need Docker, systemd, Android emulators, a desktop or a browser, or have to be driven from your own app through an API. Compare it one to one: bochka vs Beam and bochka vs Docker Cloud Sandboxes.
Questions people ask
Is Beam cheaper than Docker Cloud Sandboxes?
In these scenarios, yes. One coding agent on workdays costs $5 a month on Beam against $49 on Docker, and in the other four scenarios Docker does not fit because of its 24-hour cap or its default of 10 sandboxes at once. bochka costs $20 a month for the workday agent.
Which is faster, Beam or Docker Cloud Sandboxes?
We cannot say: neither has a result on the hpc-sandbox-benchmarks CPU test. bochka did 26.69 runs per second on it at 4 vCPU / 8 GB.
Can Beam and Docker Cloud Sandboxes run Docker?
Yes. Beam supports Docker inside a sandbox with docker_enabled, and each Docker cloud sandbox has its own Docker Engine. bochka runs Docker in a full VM with systemd and /dev/kvm.
Can a sandbox run longer than 24 hours?
On Beam, yes: set the time to live to -1 and it runs until you terminate it. On Docker, no: a sandbox cannot go past 24 hours from creation. bochka has no session cap on paid plans.
Which one has GPUs?
Only Beam, with GPU sandboxes and serverless GPUs from RTX 4090 to H100, H200 and B200. Docker Cloud Sandboxes and bochka are CPU only.
Is bochka SOC 2 compliant?
SOC 2 is in progress. We're open about where we stand: live status at status.bochka.xyz and our data retention policy at docs.bochka.xyz/data-retention.
Try bochka
Install the CLI, then run bochka new.
Product preview