bochka vs Fly.io Machines

Fly.io Machines are fast-starting microVMs for hosting your own apps close to users. bochka is built for agent sandboxes: every machine has a disk that keeps its files, a desktop with Chromium, nested virtualization and coding agents you drive from outside.

Where bochka stands out

A disk that keeps everything

On bochka the whole disk of a machine stays when it stops, with snapshots every minute and on stop, and a stopped machine costs nothing. A Fly Machine's root file system is ephemeral, so anything outside its one Volume can be lost on a restart or deploy. Forks on bochka copy the disk of a running machine; a Fly clone gets an empty Volume.

Built for agents, not app hosting

Every bochka machine has root, systemd, Docker, /dev/kvm and a 60fps desktop with Chromium and computer use. Claude Code, Codex and other coding agents are preinstalled, and you drive agents inside from outside with a prompt, steer and events API. A Fly Machine boots the image you build, with Fly's own init and none of this included.

Real keys never enter the sandbox

bochka's AI credentials proxy injects keys for model providers and any HTTPS API you register, so code inside the sandbox never sees them. When one account runs out of credits, bochka can switch the credential to another account of the same type. Fly passes secrets to Machines as environment variables; its tokenizer proxy is open source but you deploy and run it yourself.

The companies and products

bochka

bochka.xyz runs sandboxes for AI agents: each one is a full Linux VM with its own kernel.

You start a machine with one command or one API call, then SSH in, run Docker, open a desktop, or let a built-in agent (Claude Code, Codex, OpenCode and others) work in it. The disk stays between sessions, and a stopped sandbox costs nothing.

Isolation: Full VM per sandbox, own kernel
Hardware: Dedicated AMD Ryzen 9 9950X (Zen 5) hosts
Regions: EU: Germany, Finland, France
Plans: From $20 a month, all of it usage credit, 7-day trial

Fly.io Machines

Fly.io is an app hosting platform, and Machines are the microVMs underneath it that you can also start and stop through a REST API.

A Fly Machine boots your Docker image as a Firecracker microVM on Fly's own servers, in one of 17 regions. You pick a shared or performance CPU preset, attach at most one Volume for data that must last, and Fly Proxy can stop, suspend and wake Machines as traffic comes and goes. It is built for teams that host web apps and services worldwide; it is not a sandbox product, so this page compares the parts that overlap with agent work.

Kind of product: App hosting platform; Machines are its VM building block with a REST API
Isolation: Firecracker microVMs with hardware virtualization, on Fly's own servers
Regions: 17 regions in North America, Europe, Asia, Oceania, South America and Africa
CPU classes: Shared vCPUs guarantee 6.25% of each core with a burst balance; performance vCPUs get the full core
Storage: Root file system is ephemeral; one Volume of up to 500GB per Machine for lasting data
Free trial: 2 Machine hours or 7 days, up to 10 Machines of 2 vCPU / 4GB that stop after 5 minutes
Compliance: Lists SOC 2 Type II; a HIPAA package with a pre-signed BAA is sold as an add-on

Which use cases each one fits

For each use case, Battleships prices every sandbox provider on the same workload and sorts them from the cheapest monthly bill up. “3rd cheapest of 367” means 2 of the other 366 providers run that workload, with every feature it needs, for less. “With limits” means the provider runs it but misses something, so it is listed after every full match. Open a use case for its whole ranking and what each provider misses.

Use case and its workload	bochka: price rank	Fly.io Machines: price rank
Software factory 100 at once · 4 vCPU / 8 GB · 2,200 sessions of 8 h a month bochka fits fully, with Docker, /dev/kvm and a desktop on every machine; on Fly the root disk resets on restart, so each agent also needs its own Volume.	3rd cheapest of 367 $634 a month	92nd of 367, with limits $836 a month
Always-on AI employees 50 machines 24/7 · 2 vCPU / 4 GB An assistant that runs for weeks keeps its whole disk on bochka, while a Fly Machine keeps only what sits on its one attached Volume.	5th cheapest of 366 $657 a month	125th of 366, with limits $816 a month
Code interpreter bursts 100 at once · 1 vCPU / 2 GB · 200,000 sessions of 1 min a month Fly fits short bursts better on paper: per-second billing with no plan fee, and cheap shared CPU for code that mostly waits.	186th of 345, with limits $2,000 a month	75th of 345, with limits $94 a month
Sandboxes for your users 300 at once · 2 vCPU / 4 GB · 30,000 sessions of 23 min a month Both can host one VM per user, but Fly's API creates about one Machine per second per app, so big sign-up waves need pre-created Machines or several apps.	Cheapest of 361 $209 a month	69th of 361, with limits $600 a month
RL rollouts 1,000 at once · 2 vCPU / 4 GB · 1,000,000 sessions of 3 min a month	34th of 360, with limits $2,000 a month	48th of 360, with limits $2,838 a month
Agent evals 250 at once · 4 vCPU / 8 GB · 15,000 sessions of 20 min a month	10th cheapest of 364 $200 a month	117th of 364, with limits $457 a month
CI runners 40 at once · 8 vCPU / 16 GB · 6,000 sessions of 12 min a month CI jobs keep the CPU busy, which drains a shared Fly vCPU's burst balance; Fly's performance CPUs avoid that at a higher hourly rate.	4th cheapest of 377 $86 a month	152nd of 377, with limits $288 a month
24/7 dev boxes 1 machine 24/7 · 4 vCPU / 8 GB	18th cheapest of 368 $26 a month	118th of 368, with limits $53 a month
Computer-use agents 50 at once · 4 vCPU / 8 GB · 20,000 sessions of 15 min a month bochka ships a 60fps desktop with Chromium and computer use; on Fly Machines you build and stream a desktop yourself.	6th cheapest of 369 $200 a month	95th of 369, with limits $173 a month
Browser-use agents 50 at once · 2 vCPU / 4 GB · 30,000 sessions of 10 min a month bochka has Chromium and browser control ready in every machine; on Fly you package the browser into your own image.	7th cheapest of 367 $200 a month	160th of 367, with limits $90 a month
Scraping & bots (startup scale) 50 at once · 1 vCPU / 2 GB · 100,000 sessions of 3 min a month	6th cheapest of 346 $90 a month	161st of 346, with limits $67 a month
Mass scraping & bots (undetectable) 1,000 at once · 1 vCPU / 2 GB · 3,000,000 sessions of 2 min a month Fly ranks higher here: it can spread scrapers across 17 regions and pay only for the seconds they run.	71st of 338, with limits $1,800 a month	44th of 338, with limits $1,232 a month
Parallel red teaming 200 at once · 2 vCPU / 4 GB · 5,000 sessions of 30 min a month	2nd cheapest of 360 $200 a month	118th of 360, with limits $63 a month
GPU eval jobs 10 at once · 8 vCPU / 32 GB · 500 sessions of 30 min a month	Can't run it	Can't run it
macOS agents 5 at once · 4 vCPU / 8 GB · 1,000 sessions of 20 min a month	Can't run it	Can't run it

Key features

Feature	bochka	Fly.io Machines
Kind of product	Agent sandbox: a full VM per agent, ready to use	App hosting platform; you boot your own image as a microVM
Isolation	Full VM with its own kernel on dedicated AMD Ryzen 9 9950X (Zen 5) hosts	Firecracker microVM with its own kernel
Docker, systemd and nested virtualization	Docker, root, systemd and /dev/kvm on every machine	Root and Docker you install yourself; Fly's own init, no systemd; /dev/kvm not offered
Files after a stop	The whole disk is kept, with snapshots every minute and on stop; a stopped sandbox costs nothing	Root file system is ephemeral; lasting data goes on one Volume, billed for its full size around the clock
Pause and memory	Resume reboots from disk (no memory snapshots)	Suspend keeps memory for Machines up to 2GB; the snapshot is dropped on deploy or host move
Fork	Fork a running sandbox, disk included	Clone copies a Machine's config; a cloned Volume starts empty
Wake on request	You start and stop machines through the API	Fly Proxy stops or suspends idle Machines and wakes them when a request arrives
Desktop and computer use	60fps desktop and Chromium, computer use and browser control, embeddable stream	None built in; you add a desktop and browser to your own image
Coding agents	Claude Code, Codex, OpenCode and more preinstalled, with a prompt, steer and events API	None built in; you install and run agents yourself
Keeping keys out of the sandbox	AI credentials proxy for model providers and any HTTPS API; switch a credential to another account when credits run out	Secrets arrive as environment variables; Fly's open-source tokenizer proxy can be deployed yourself
Reaching the sandbox	HTTPS URLs for up to 50 ports, token-protected; raw TCP; dedicated IPv6 or IPv4	Public HTTPS and TCP services through Fly Proxy, Anycast IPs, custom domains, private network between Machines
Outbound rules	Open internet on every plan; no provider-side allowlist	Network policies allow chosen ports and protocols and deny the rest
CPU	One CPU class on every plan, with no baseline quota or burst balance	Shared vCPUs guarantee 6.25% of a core plus bursts; performance vCPUs get the full core at a higher rate
Regions	EU only: Germany, Finland, France	17 regions on six continents
Compliance and transparency	SOC 2 is in progress. We're open about where we stand: live status and data retention policy.	SOC 2

Every feature Battleships tracks (43)

Feature	bochka	Fly.io Machines
Full VM (own kernel)	Yes	Yes
Docker inside	Yes	Yes
Nested virtualization	Yes	No
Root	Yes	Yes
Systemd	Yes	No
Desktop GUI	Yes	No
Browser	Yes	No
Computer-use API	Yes	No
SSH	Yes	Yes
Persistent disk	Yes	Yes
Pause/resume	Yes	Yes
Automatic snapshots	Yes	Yes
Fork/clone	Yes	Yes
Live fork (no pause)	Yes	Yes
Memory fork	No	No
Custom image (Docker or snapshot)	Yes	Yes
≥24 h sessions	Yes	Yes
Idle auto-stop	No	Yes
Wake on request	No	Yes
HTTPS preview URLs	Yes	Yes
Raw TCP inbound	Yes	Yes
Public IPv4	No	Yes
Egress allowlist	No	Yes
Secret proxy	Yes	No
Secret proxy for any API	Yes	No
Preinstalled agents	Yes	No
Agent harness API	Yes	No
MCP server	No	Yes
GPU	No	No
Windows	No	No
Arm64	No	No
Self-hosting	No	No
BYOC	No	No
Open source	No	Yes
Scoped API keys	Yes	Not published
Spend limits	Yes	No
Usage per sandbox (API)	Yes	No
Audit logs	No	Not published
SSO	No	No
SOC 2	No	Yes
HIPAA	No	Yes
EU data residency	Yes	Yes
Zero data retention	Yes	Not published

Performance

bochka26.69 runs/s

Fly.io MachinesNot measured

There is no comparable measurement: Fly.io Machines were not part of the public StarSling run where bochka did 26.69 Node.js build-and-test runs per second at 4 vCPU / 8 GB. Fly sells two CPU classes, shared vCPUs that guarantee 6.25% of a core with a burst balance and performance vCPUs that get the full core, so results would depend on which class you choose.

Node.js build-and-test loop at 4 vCPU / 8 GB, higher is better. Measured with the open hpc-sandbox-benchmarks suite. Fly.io Machines has no published run in this suite yet, so there is no like-for-like number to compare.

Pricing in five scenarios

Each bill is priced from the providers' public price lists by the open Battleships engine, with the cheapest plan that runs the scenario.

Scenario	bochka, a month	Fly.io Machines, a month
One coding agent, workdays 4 vCPU / 8 GB, 50 GB disk, 8 hours a day, 22 days a month, files kept between days	$20 · $20/mo	$15 · Pay As You Go · with limits
One agent that never stops 4 vCPU / 8 GB, 50 GB disk, running 24/7 all month	$26 · $20/mo	$36 · Pay As You Go · with limits
50 agents in parallel 50 machines of 4 vCPU / 8 GB at once, 8-hour sessions, 1,100 sessions a month, Docker inside	$317 · $20/mo × 3 seats	$487 · Pay As You Go · with limits
Sandboxes for your users 2 vCPU / 4 GB, 30,000 sessions of 10 minutes a month, up to 300 at once	$200 · $100/mo × 2 seats	$110 · Pay As You Go · with limits
1,000 short jobs at once 2 vCPU / 4 GB, 1,000 at once, 3 minutes each, 200,000 jobs a month	$2,000 · $2000/mo · with limits	$232 · Pay As You Go · with limits

bochka: You pick a monthly plan from $20, and all of it becomes usage credit spent per second on running sandboxes. A stopped sandbox costs nothing and keeps its disk.

Fly.io Machines: Fly bills each Machine per second while it runs, by CPU preset and memory, with no plan fee; stopped Machines pay for their root file system and Volumes are billed for their full size all month. The figures below use the lowest rate Fly sells: shared vCPUs bought in 1-year reservation blocks for 40% off. Performance vCPUs at the full core cost several times more.

Limits in those scenarios

The table marks Fly as a compromise in all five scenarios, for two reasons. The lowest Fly figures need a 1-year reservation, and they use shared vCPUs that guarantee only 6.25% of each core, so an agent that builds and tests for long stretches drains its burst balance and gets throttled. Fly's API also creates and starts about one Machine per second per app, so 1,000 jobs at once need pre-created Machines or several apps. On bochka the 1,000-job burst is limited by starts per minute and per day, so it gets queued even on the $2,000 plan.

Scenario	bochka	Fly.io Machines
One coding agent, workdays	None that bite	different kind of product: app platform 1-year commitment burstable CPU: 6.25% of each vCPU guaranteed, throttled above that
One agent that never stops	None that bite	different kind of product: app platform 1-year commitment burstable CPU: 6.25% of each vCPU guaranteed, throttled above that
50 agents in parallel	None that bite	different kind of product: app platform 1-year commitment burstable CPU: 6.25% of each vCPU guaranteed, throttled above that
Sandboxes for your users	None that bite	different kind of product: app platform 1-year commitment burstable CPU: 6.25% of each vCPU guaranteed, throttled above that
1,000 short jobs at once	max 2,400 starts/day (needs ~6,667) max 600 starts/hour (needs ~1,000) bursts above 90 starts/min are queued (a burst of 333 takes ~4 min to start)	different kind of product: app platform 1-year commitment burstable CPU: 6.25% of each vCPU guaranteed, throttled above that

Which one should you use?

Use Fly.io Machines when

you host web apps or light services that must run near users outside Europe, sleep between requests and wake on traffic.

17 regions worldwide. Useful if your agents or users are outside Europe: Fly runs Machines in 17 regions, from the US to Sydney and Johannesburg.
Wake on request and memory suspend. Useful for services that sleep between requests: Fly Proxy wakes a Machine when traffic arrives, and small Machines resume with memory kept.
Network policies and a full app platform. Useful if you host whole apps: Fly adds port-level egress rules, private networking, Anycast IPs and custom domains around each Machine.

Use bochka when

your agents do real work for hours: installs, builds, tests, Docker and emulators on a full VM whose disk survives every stop, with a desktop, coding agents and a keys proxy built in.

A disk that keeps everything. An agent installs tools, clones repos and leaves caches all over the disk. On Fly you either put all of it on a Volume, billed for its full size even while stopped, or rebuild it after each restart.
Built for agents, not app hosting. On Fly you build and maintain the image with the desktop, browser and agents, then write the code that starts, prompts and watches each agent. Emulators and nested VMs have no /dev/kvm to use.
Real keys never enter the sandbox. Code an agent writes can read any environment variable and send it anywhere. On Fly, keeping keys out means running and securing your own tokenizer app next to your Machines.

Questions people ask

Can I use Fly.io Machines as an AI agent sandbox?

Yes, many teams do, but you build the sandbox yourself. You package the tools, browser and agents into an image, add a Volume for files that must last, and write the code that drives the agents. bochka ships all of that in every machine.

Is bochka cheaper than Fly.io Machines?

It depends on how busy the CPU is. Using Fly's cheapest rate, shared vCPUs on a 1-year reservation, one agent on workdays is $15 a month on Fly and $20 on bochka, and 300 user sandboxes are $110 versus $200. One agent running all month is $36 on Fly and $26 on bochka, and 50 agents in parallel are $487 versus $317. Fly's figures assume work that stays within a shared vCPU's 6.25% baseline.

Do Fly Machines keep my files when they stop?

Only what is on a Volume. Fly's docs say the root file system of a Machine is ephemeral and should only be used for temporary data, and each Machine can mount one Volume. On bochka the whole disk is kept, with snapshots every minute and on stop.

Can I run Docker or nested VMs on Fly Machines?

You can install and run Docker inside a Fly Machine yourself, since it is a microVM with root. Fly does not offer /dev/kvm, so nested VMs and Android emulators are not available. bochka has Docker, systemd and /dev/kvm ready on every machine.

Where does my data run?

bochka runs only in the EU (Germany, Finland and France), with EU data residency and a zero data retention option. Fly runs Machines in 17 regions worldwide, including several in Europe.

Is bochka SOC 2 compliant?

SOC 2 is in progress. We're open about where we stand: live status at status.bochka.xyz and our data retention policy at docs.bochka.xyz/data-retention. Fly lists SOC 2 Type II on its pricing page.

Start a sandbox

Install the CLI, then run bochka new.

Product preview