bochka vs Amazon WorkSpaces
Amazon WorkSpaces gives a person a cloud desktop they log into. bochka gives an AI agent its own Linux VM that your code starts, forks and steers through an API.
Where bochka stands out
Agents you drive from outside
bochka ships Claude Code, Codex and five other coding agents in every sandbox, and you prompt, steer and follow them through one API. The 60fps desktop and Chromium come with a computer-use API, so an agent can see the screen and click without extra setup.
Many machines, made and forked by code
Your code can create a sandbox, fork a running one with its disk, and stop it with its disk kept, and the $20 plan already allows 100 at once. Every sandbox is a fresh Linux VM with Docker, root and /dev/kvm on by default.
Real keys never enter the machine
bochka's credentials proxy adds your real API keys to outgoing requests for model providers and any HTTPS API, so the sandbox only ever holds a placeholder. When one account runs out of credits, you can switch the credential to another account of the same kind.
The companies and products
bochka
bochka.xyz runs sandboxes for AI agents: each one is a full Linux VM with its own kernel.
You start a machine with one command or one API call, then SSH in, run Docker, open a desktop, or let a built-in agent (Claude Code, Codex, OpenCode and others) work in it. The disk stays between sessions, and a stopped sandbox costs nothing.
- Isolation
- Full VM per sandbox, own kernel
- Regions
- EU: Germany, Finland, France
Amazon WorkSpaces
Amazon WorkSpaces Personal is AWS's managed virtual desktop service: a persistent Windows or Linux desktop for each user.
Each WorkSpace is a full VM in your own AWS VPC, assigned to one user, who connects through the WorkSpaces client to a streamed desktop. You pick a bundle (CPU, RAM, disk, optional GPU), join it to a directory, and pay a flat monthly rate (AlwaysOn) or a monthly fee plus hours used (AutoStop). It is built for companies that hand desktops to staff, contractors and developers, not as an API sandbox for agents, so this page compares where the two overlap: a full machine an agent can work on.
Which use cases each one fits
For each use case, Battleships prices every sandbox provider on the same workload and sorts them from the cheapest monthly bill up. “3rd cheapest of 367” means 2 of the other 366 providers run that workload, with every feature it needs, for less. “With limits” means the provider runs it but misses something, so it is listed after every full match. Open a use case for its whole ranking and what each provider misses.
| Use case and its workload | bochka: price rank | Amazon WorkSpaces: price rank |
|---|---|---|
| Software factory 100 at once · 4 vCPU / 8 GB · 2,200 sessions of 8 h a month A WorkSpace can run Docker and builds, but each one is a desktop seat behind a quota of 1 per Region by default, so a factory of many agents needs quota raises first. | 3rd cheapest of 367 $634 a month | 41st of 367, with limits $6,818 a month |
| Always-on AI employees 50 machines 24/7 · 2 vCPU / 4 GB An AI employee that works all day fits a WorkSpace, but you still build the harness that drives it; bochka ships coding agents with a prompt and steer API. | 5th cheapest of 366 $657 a month | 67th of 366, with limits $1,550 a month |
| Code interpreter bursts 100 at once · 1 vCPU / 2 GB · 200,000 sessions of 1 min a month | 186th of 345, with limits $2,000 a month | 327th of 345, with limits $2,300 a month |
| Sandboxes for your users 300 at once · 2 vCPU / 4 GB · 30,000 sessions of 23 min a month WorkSpaces gives each person a desktop through a directory and a client app, not a sandbox your product creates per user in seconds. | Cheapest of 361 $209 a month | 339th of 361, with limits $8,628 a month |
| RL rollouts 1,000 at once · 2 vCPU / 4 GB · 1,000,000 sessions of 3 min a month | 34th of 360, with limits $2,000 a month | 321st of 360, with limits $31,000 a month |
| Agent evals 250 at once · 4 vCPU / 8 GB · 15,000 sessions of 20 min a month | 10th cheapest of 364 $200 a month | 337th of 364, with limits $10,148 a month |
| CI runners 40 at once · 8 vCPU / 16 GB · 6,000 sessions of 12 min a month CI jobs need machines that appear and vanish by API; WorkSpaces are long-lived seats and its API allows two calls per second. | 4th cheapest of 377 $86 a month | 364th of 377, with limits $5,009 a month |
| 24/7 dev boxes 1 machine 24/7 · 4 vCPU / 8 GB A dev box is the closest fit for WorkSpaces, and it can run Windows; bochka adds hosting on HTTPS URLs and a disk saved every minute. | 18th cheapest of 368 $26 a month | 154th of 368, with limits $68 a month |
| Computer-use agents 50 at once · 4 vCPU / 8 GB · 20,000 sessions of 15 min a month Both have a full desktop, but WorkSpaces has no API to see the screen or move the mouse, so a computer-use agent needs your own tooling inside it. | 6th cheapest of 369 $200 a month | 40th cheapest of 369 $3,418 a month |
| Browser-use agents 50 at once · 2 vCPU / 4 GB · 30,000 sessions of 10 min a month bochka ships Chromium with computer use and a 60fps desktop stream; on WorkSpaces you install and wire up the browser automation yourself. | 7th cheapest of 367 $200 a month | 117th of 367, with limits $1,568 a month |
| Scraping & bots (startup scale) 50 at once · 1 vCPU / 2 GB · 100,000 sessions of 3 min a month WorkSpaces can give each desktop a static AWS IP, which helps for allowlisted targets, but there are no scraping or anti-bot features in either. | 6th cheapest of 346 $90 a month | 75th cheapest of 346 $1,183 a month |
| Mass scraping & bots (undetectable) 1,000 at once · 1 vCPU / 2 GB · 3,000,000 sessions of 2 min a month | 71st of 338, with limits $1,800 a month | 292nd of 338, with limits $23,384 a month |
| Parallel red teaming 200 at once · 2 vCPU / 4 GB · 5,000 sessions of 30 min a month | 2nd cheapest of 360 $200 a month | 88th of 360, with limits $1,435 a month |
| GPU eval jobs 10 at once · 8 vCPU / 32 GB · 500 sessions of 30 min a month | Can't run it | Can't run it |
| macOS agents 5 at once · 4 vCPU / 8 GB · 1,000 sessions of 20 min a month | Can't run it | Can't run it |
Key features
Every feature Battleships tracks (43)
| Feature | bochka | Amazon WorkSpaces |
|---|---|---|
| Full VM (own kernel) | Yes | Yes |
| Docker inside | Yes | Yes |
| Nested virtualization | Yes | Yes |
| Root | Yes | Yes |
| Systemd | Yes | No |
| Desktop GUI | Yes | Yes |
| Browser | Yes | Yes |
| Computer-use API | Yes | No |
| SSH | Yes | Yes |
| Persistent disk | Yes | Yes |
| Pause/resume | Yes | Yes |
| Automatic snapshots | Yes | Yes |
| Fork/clone | Yes | No |
| Live fork (no pause) | Yes | No |
| Memory fork | No | No |
| Custom image (Docker or snapshot) | Yes | Yes |
| ≥24 h sessions | Yes | Yes |
| Idle auto-stop | No | Yes |
| Wake on request | No | Yes |
| HTTPS preview URLs | Yes | No |
| Raw TCP inbound | Yes | No |
| Public IPv4 | No | Yes |
| Egress allowlist | No | Yes |
| Secret proxy | Yes | No |
| Secret proxy for any API | Yes | No |
| Preinstalled agents | Yes | No |
| Agent harness API | Yes | No |
| MCP server | No | No |
| GPU | No | Yes |
| Windows | No | Yes |
| Arm64 | No | No |
| Self-hosting | No | No |
| BYOC | No | No |
| Open source | No | No |
| Scoped API keys | Yes | Not published |
| Spend limits | Yes | No |
| Usage per sandbox (API) | Yes | Yes |
| Audit logs | No | Yes |
| SSO | No | Yes |
| SOC 2 | No | Yes |
| HIPAA | No | Yes |
| EU data residency | Yes | Yes |
| Zero data retention | Yes | Not published |
Performance
There is no comparable measurement for Amazon WorkSpaces: it was not part of the hpc-sandbox-benchmarks run. bochka did 26.69 runs per second on its Node.js build-and-test loop at 4 vCPU / 8 GB, on dedicated AMD Ryzen 9 9950X hosts. WorkSpaces bundles run on AWS EC2 hardware, and their speed depends on the bundle you pick.
Node.js build-and-test loop at 4 vCPU / 8 GB, higher is better. Measured with the open hpc-sandbox-benchmarks suite. Amazon WorkSpaces has no published run in this suite yet, so there is no like-for-like number to compare.
Pricing in five scenarios
Each bill is priced from the providers' public price lists by the open Battleships engine, with the cheapest plan that runs the scenario.
| Scenario | bochka, a month | Amazon WorkSpaces, a month |
|---|---|---|
| One coding agent, workdays 4 vCPU / 8 GB, 50 GB disk, 8 hours a day, 22 days a month, files kept between days | $20 · $20/mo | $117 · AWS account (no plan fee) · with limits |
| One agent that never stops 4 vCPU / 8 GB, 50 GB disk, running 24/7 all month | $26 · $20/mo | $68 · AWS account (no plan fee) · with limits |
| 50 agents in parallel 50 machines of 4 vCPU / 8 GB at once, 8-hour sessions, 1,100 sessions a month, Docker inside | $317 · $20/mo × 3 seats | $5,826 · AWS account (no plan fee) · with limits |
| Sandboxes for your users 2 vCPU / 4 GB, 30,000 sessions of 10 minutes a month, up to 300 at once | $200 · $100/mo × 2 seats | $8,628 · AWS account (no plan fee) · with limits |
| 1,000 short jobs at once 2 vCPU / 4 GB, 1,000 at once, 3 minutes each, 200,000 jobs a month | $2,000 · $2000/mo · with limits | $57,400 · AWS account (no plan fee) · with limits |
bochka: Plans start at $20 a month, and the whole fee is usage credit. You pay per second while a sandbox runs, and a stopped sandbox costs nothing and keeps its disk.
Amazon WorkSpaces: AlwaysOn bills a flat monthly rate per desktop, whether it runs or not. AutoStop bills a monthly infrastructure fee plus each hour used, with partial hours billed as full hours, and the monthly part keeps billing while the desktop is stopped.
Limits in those scenarios
The table marks WorkSpaces as not fitting any scenario because it is a desktop service, not an API sandbox: there is no agent API, and a new account can run 1 WorkSpace per Region until a quota increase is approved. AutoStop desktops stop only after they are disconnected, an hour later by default, so a desktop left connected keeps billing. On bochka, the limit that bites is starts: at 1,000 short jobs at once, even the $2,000 plan queues starts above 90 a minute.
| Scenario | bochka | Amazon WorkSpaces |
|---|---|---|
| One coding agent, workdays | None that bite |
|
| One agent that never stops | None that bite |
|
| 50 agents in parallel | None that bite |
|
| Sandboxes for your users | None that bite |
|
| 1,000 short jobs at once |
|
|
Which one should you use?
Use Amazon WorkSpaces when
people, or an agent that needs Windows apps or a GPU, need a managed desktop inside your own AWS account and directory.
- Windows desktops, and GPUs. For agents or people who need Windows apps, or a GPU desktop with T4, L4 or RTX PRO 4500 graphics.
- Inside your own AWS network. For teams that want desktops inside their own VPC, joined to their directory, with their own firewall rules.
- Regions around the world. Useful when desktops must run in the US, Asia Pacific, South America, Africa or GovCloud.
Use bochka when
your code needs many Linux machines for agents: made, forked and stopped by API, with coding agents, computer use, hosting and a key proxy built in.
- Agents you drive from outside. A WorkSpace is built for a person at a keyboard: its API starts and stops desktops but cannot send a task, read the screen or move the mouse. You would build and run that whole layer inside every desktop yourself.
- Many machines, made and forked by code. WorkSpaces starts at 1 desktop per Region, its API takes two calls per second, and the only copy is a disk image that new desktops boot from. Fanning one task out to 50 agents means quota tickets and slow launches first.
- Real keys never enter the machine. On a WorkSpace the keys sit inside a desktop the agent fully controls, so one prompt injection can read and leak them. AWS has no proxy for this; you would run and maintain your own.
Questions people ask
Can I use Amazon WorkSpaces as a sandbox for AI agents?
You can install an agent on a WorkSpace and let it work there, but WorkSpaces is built for people. Its API starts, stops and images desktops, with no way to send a task, read the screen or drive input, so you build that part yourself.
Is bochka cheaper than Amazon WorkSpaces?
Yes, bochka costs less in all five scenarios on this page, though in the burst of 1,000 short jobs neither one fits as is. For one agent that never stops, bochka costs $26 a month against $68 for an Ubuntu WorkSpace, and for one agent on workdays $20 against $117.
Can bochka run Windows like WorkSpaces?
No. bochka sandboxes run Linux only. If your agent needs Windows apps, WorkSpaces gives you Windows desktops with the licence included.
Do both support Docker and nested virtualization?
Yes. bochka has Docker and /dev/kvm on every sandbox. WorkSpaces supports Docker Desktop, WSL2 and KVM once an admin turns on nested virtualization, on most non-GPU bundles except Value.
How many WorkSpaces can I run at once?
A new account starts with 1 WorkSpace per Region and 0 GPU WorkSpaces, and you ask for more through Service Quotas. bochka's $20 plan allows 100 sandboxes at once, and higher plans go to 2,000 without a ticket.
Is bochka SOC 2 compliant?
SOC 2 is in progress. We're open about where we stand: live status at status.bochka.xyz and our data retention policy at docs.bochka.xyz/data-retention.
Start a sandbox
Install the CLI, then run bochka new.
Product preview