bochka vs GitHub Copilot cloud sandboxes
GitHub Copilot cloud sandboxes are a place for a Copilot session to run off your laptop, inside GitHub. bochka gives any coding agent a full VM you and your code can reach, with SSH, Docker, a desktop and hosting built in.
Where bochka stands out
Any agent, driven by your code
bochka ships Claude Code, Codex, OpenCode and other agents in every sandbox, and you prompt, steer and follow them from outside through one API. A Copilot cloud sandbox runs Copilot's own agent, started from an interactive CLI session or the Copilot app, and the CLI cloud mode cannot be combined with -p or -i.
A whole computer you can reach
A bochka sandbox is a full VM with root, systemd, Docker and /dev/kvm, and you can SSH into it. Apps the agent starts get HTTPS URLs on up to 50 ports, plus raw TCP and its own IP. GitHub documents none of SSH, Docker, nested virtualization or open ports for Copilot cloud sandboxes.
A screen and a browser for every agent
Every bochka sandbox has a Linux desktop streamed at 60fps, Chromium and computer-use tools ready for any agent. You can watch the agent work, embed the stream in your app, or take over the mouse yourself. Copilot cloud sandboxes are headless.
The companies and products
bochka
bochka.xyz runs sandboxes for AI agents: each one is a full Linux VM with its own kernel.
You start a machine with one command or one API call, then SSH in, run Docker, open a desktop, or let a built-in agent (Claude Code, Codex, OpenCode and others) work in it. The disk stays between sessions, and a stopped sandbox costs nothing.
- Isolation
- Full VM per sandbox, own kernel
- Regions
- EU: Germany, Finland, France
GitHub Copilot cloud sandboxes
GitHub Copilot cloud sandboxes are a feature of GitHub Copilot that runs a whole Copilot session in an isolated Linux environment hosted by GitHub.
It is not a sandbox you rent on its own: you start it from an interactive Copilot CLI session with copilot --cloud, or by picking the cloud sandbox option in the GitHub Copilot app, and Copilot's agent does the work inside. GitHub says it is built on Azure Container Apps Sandboxes, with GitHub adding identity, policy and billing. It is for teams already paying for Copilot who want sessions that keep going off their own machine and can be picked up on any device.
Which use cases each one fits
For each use case, Battleships prices every sandbox provider on the same workload and sorts them from the cheapest monthly bill up. “3rd cheapest of 367” means 2 of the other 366 providers run that workload, with every feature it needs, for less. “With limits” means the provider runs it but misses something, so it is listed after every full match. Open a use case for its whole ranking and what each provider misses.
| Use case and its workload | bochka: price rank | GitHub Copilot cloud sandboxes: price rank |
|---|---|---|
| Software factory 100 at once · 4 vCPU / 8 GB · 2,200 sessions of 8 h a month A software factory runs many agents with installs, Docker builds and preview servers; Copilot cloud sandboxes run one interactive Copilot session each and expose no ports, so they only partly fit. | 3rd cheapest of 367 $634 a month | 327th of 367, with limits $7,614 a month |
| Always-on AI employees 50 machines 24/7 · 2 vCPU / 4 GB An always-on assistant needs a machine your own code can talk to; a Copilot cloud sandbox is reached only through an interactive Copilot CLI session or the Copilot app. | 5th cheapest of 366 $657 a month | 317th of 366, with limits $7,894 a month |
| Code interpreter bursts 100 at once · 1 vCPU / 2 GB · 200,000 sessions of 1 min a month Neither is built for one-minute code runs, and Copilot cloud sandboxes have no exec API for running your own snippets at all. | 186th of 345, with limits $2,000 a month | 268th of 345, with limits $360 a month |
| Sandboxes for your users 300 at once · 2 vCPU / 4 GB · 30,000 sessions of 23 min a month Giving your users their own sandboxes needs an API to create and reach machines; Copilot cloud sandboxes are tied to Copilot seats and Copilot's own agent. | Cheapest of 361 $209 a month | 297th of 361, with limits $2,522 a month |
| RL rollouts 1,000 at once · 2 vCPU / 4 GB · 1,000,000 sessions of 3 min a month | 34th of 360, with limits $2,000 a month | 155th of 360, with limits $10,800 a month |
| Agent evals 250 at once · 4 vCPU / 8 GB · 15,000 sessions of 20 min a month | 10th cheapest of 364 $200 a month | 196th of 364, with limits $2,170 a month |
| CI runners 40 at once · 8 vCPU / 16 GB · 6,000 sessions of 12 min a month CI needs a runner your pipeline controls; GitHub's answer for that is GitHub Actions, not Copilot cloud sandboxes. | 4th cheapest of 377 $86 a month | 186th of 377, with limits $1,037 a month |
| 24/7 dev boxes 1 machine 24/7 · 4 vCPU / 8 GB A dev box wants SSH and editors that connect over it; Copilot cloud sandboxes document no SSH. | 18th cheapest of 368 $26 a month | 331st of 368, with limits $315 a month |
| Computer-use agents 50 at once · 4 vCPU / 8 GB · 20,000 sessions of 15 min a month Computer-use agents need a screen; bochka streams a Linux desktop at 60fps, and Copilot cloud sandboxes are headless. | 6th cheapest of 369 $200 a month | 307th of 369, with limits $2,170 a month |
| Browser-use agents 50 at once · 2 vCPU / 4 GB · 30,000 sessions of 10 min a month bochka ships Chromium on a desktop in every sandbox; GitHub documents no browser inside a Copilot cloud sandbox. | 7th cheapest of 367 $200 a month | 312th of 367, with limits $1,090 a month |
| Scraping & bots (startup scale) 50 at once · 1 vCPU / 2 GB · 100,000 sessions of 3 min a month | 6th cheapest of 346 $90 a month | 282nd of 346, with limits $540 a month |
| Mass scraping & bots (undetectable) 1,000 at once · 1 vCPU / 2 GB · 3,000,000 sessions of 2 min a month | 71st of 338, with limits $1,800 a month | 237th of 338, with limits $10,800 a month |
| Parallel red teaming 200 at once · 2 vCPU / 4 GB · 5,000 sessions of 30 min a month | 2nd cheapest of 360 $200 a month | 282nd of 360, with limits $550 a month |
| GPU eval jobs 10 at once · 8 vCPU / 32 GB · 500 sessions of 30 min a month | Can't run it | Can't run it |
| macOS agents 5 at once · 4 vCPU / 8 GB · 1,000 sessions of 20 min a month | Can't run it | Can't run it |
Key features
| Feature | bochka | GitHub Copilot cloud sandboxes |
|---|---|---|
| What it is | A sandbox API: full VMs you create, reach and drive from your code | A place for one Copilot session to run, started from Copilot CLI or the Copilot app |
| Isolation | Full VM with its own kernel on dedicated AMD Ryzen 9 9950X hosts | Isolated Linux environment on Azure Container Apps Sandboxes, which Microsoft describes as isolated lightweight VMs |
| Which agents run inside | Claude Code, Codex, OpenCode and more preinstalled, or any agent you install | Copilot's own agent session |
| Driving it from code | Prompt, steer and events API for the built-in agents, plus exec, files and SSH | Interactive sessions only: GitHub says you can't run the CLI programmatically in a cloud sandbox |
| Docker and nested virtualization | Docker, root, systemd and /dev/kvm on every sandbox | Not documented for cloud sandboxes |
| Getting a shell | SSH, plus CLI and API exec | Through the Copilot session only; no SSH documented |
| Desktop, browser and computer use | Linux desktop streamed at 60fps, Chromium and computer-use tools preinstalled | Headless; no desktop or browser documented |
| Reaching apps the agent runs | HTTPS URLs for up to 50 ports, token-protected by default; raw TCP; dedicated IPv4 or IPv6 | No ports or public URLs documented |
| State after a stop | Disk saved every minute and on stop; a stopped sandbox costs nothing | A snapshot is taken on stop and billed as storage until the session is deleted; resume restores files and environment variables |
| Fork | Fork a running sandbox with its disk | Not documented; sessions are active, stopped or deleted |
| Keeping keys out of the sandbox | Credentials proxy for model keys and any HTTPS API; switch a credential to another account when credits run out | Model calls go through Copilot, so no model key is needed; Copilot agent secrets are passed in as environment variables |
| Admin controls | Scoped API keys and spend limits | Org and enterprise policies shared with Copilot cloud agent, GitHub sign-in, product and SKU budgets that can stop usage |
| Regions | EU only (Germany, Finland, France), with EU data residency | Not published |
| Compliance and transparency | SOC 2 is in progress. We're open about where we stand: live status and data retention policy. | SOC 2 |
Every feature Battleships tracks (43)
| Feature | bochka | GitHub Copilot cloud sandboxes |
|---|---|---|
| Full VM (own kernel) | Yes | Yes |
| Docker inside | Yes | Not published |
| Nested virtualization | Yes | Not published |
| Root | Yes | Yes |
| Systemd | Yes | No |
| Desktop GUI | Yes | No |
| Browser | Yes | No |
| Computer-use API | Yes | No |
| SSH | Yes | No |
| Persistent disk | Yes | Yes |
| Pause/resume | Yes | Yes |
| Automatic snapshots | Yes | Yes |
| Fork/clone | Yes | No |
| Live fork (no pause) | Yes | No |
| Memory fork | No | No |
| Custom image (Docker or snapshot) | Yes | Yes |
| ≥24 h sessions | Yes | Yes |
| Idle auto-stop | No | Not published |
| Wake on request | No | No |
| HTTPS preview URLs | Yes | No |
| Raw TCP inbound | Yes | No |
| Public IPv4 | No | No |
| Egress allowlist | No | Not published |
| Secret proxy | Yes | No |
| Secret proxy for any API | Yes | No |
| Preinstalled agents | Yes | Yes |
| Agent harness API | Yes | Not published |
| MCP server | No | Not published |
| GPU | No | No |
| Windows | No | No |
| Arm64 | No | Not published |
| Self-hosting | No | No |
| BYOC | No | No |
| Open source | No | No |
| Scoped API keys | Yes | Not published |
| Spend limits | Yes | Yes |
| Usage per sandbox (API) | Yes | No |
| Audit logs | No | Not published |
| SSO | No | Yes |
| SOC 2 | No | Yes |
| HIPAA | No | Not published |
| EU data residency | Yes | No |
| Zero data retention | Yes | Not published |
Performance
There is no comparable measurement for GitHub Copilot cloud sandboxes, and GitHub does not publish their CPU or memory sizes. bochka did 26.69 runs per second on the StarSling hpc-sandbox-benchmarks Node.js build-and-test loop at 4 vCPU / 8 GB, on dedicated AMD Ryzen 9 9950X hosts. Until Copilot cloud sandboxes are measured on the same test, this page makes no speed claim either way.
Node.js build-and-test loop at 4 vCPU / 8 GB, higher is better. Measured with the open hpc-sandbox-benchmarks suite. GitHub Copilot cloud sandboxes has no published run in this suite yet, so there is no like-for-like number to compare.
Pricing in five scenarios
Each bill is priced from the providers' public price lists by the open Battleships engine, with the cheapest plan that runs the scenario.
| Scenario | bochka, a month | GitHub Copilot cloud sandboxes, a month |
|---|---|---|
| One coding agent, workdays 4 vCPU / 8 GB, 50 GB disk, 8 hours a day, 22 days a month, files kept between days | $20 · $20/mo | $76 · Copilot Business · with limits |
| One agent that never stops 4 vCPU / 8 GB, 50 GB disk, running 24/7 all month | $26 · $20/mo | $315 · Copilot Business · with limits |
| 50 agents in parallel 50 machines of 4 vCPU / 8 GB at once, 8-hour sessions, 1,100 sessions a month, Docker inside | $317 · $20/mo × 3 seats | $3,812 · Copilot Pro · with limits |
| Sandboxes for your users 2 vCPU / 4 GB, 30,000 sessions of 10 minutes a month, up to 300 at once | $200 · $100/mo × 2 seats | $1,090 · Copilot Pro · with limits |
| 1,000 short jobs at once 2 vCPU / 4 GB, 1,000 at once, 3 minutes each, 200,000 jobs a month | $2,000 · $2000/mo · with limits | $2,160 · Copilot Business · with limits |
bochka: Plans start at $20 a month, and the whole fee is usage credit. You pay per second while a sandbox runs, and a stopped sandbox costs nothing and keeps its disk.
GitHub Copilot cloud sandboxes: GitHub bills compute per second and memory per GiB second while a session runs, and snapshot storage per GiB month while it is stopped. That comes on top of a Copilot seat, and the sandbox meters are separate from the AI credits the seat uses for model calls. The table assumes compute is billed per vCPU second, which GitHub's docs do not spell out.
Limits in those scenarios
Every Copilot scenario is marked as not fitting because the product is in preview with pricing that may change, and GitHub publishes no disk size, egress price, machine sizes or limit on how many sessions run at once. For 300 sandboxes for your users or 1,000 short jobs at once, nobody can say if it scales that far. The bigger limit is shape: each sandbox is one Copilot session, with no ports or exec API, so serving users or running other agents does not map onto it. On bochka, the 1,000-job burst gets queued, because starts per minute and per day are capped even on the $2,000 plan.
| Scenario | bochka | GitHub Copilot cloud sandboxes |
|---|---|---|
| One coding agent, workdays | None that bite |
|
| One agent that never stops | None that bite |
|
| 50 agents in parallel | None that bite |
|
| Sandboxes for your users | None that bite |
|
| 1,000 short jobs at once |
|
|
Which one should you use?
Use GitHub Copilot cloud sandboxes when
your team already uses Copilot and just wants its Copilot sessions to run off their laptops, under the GitHub policies and budgets you already have.
- Nothing to set up for Copilot users. Useful if your team already lives in Copilot: add --cloud to a session and it runs off your laptop, then resume it anywhere.
- Governed with the rest of GitHub. Org owners control who can use cloud sandboxes with the same policies as Copilot cloud agent, and cap spend with GitHub budgets.
Use bochka when
you want a sandbox your own code controls: any coding agent on a full VM with SSH, Docker, a desktop, hosting on open ports, and an API to prompt and steer it.
- Any agent, driven by your code. If your pipeline runs Claude Code or Codex, or a script must start and watch many agents, Copilot cloud sandboxes give you Copilot's agent in an interactive session only, tied to Copilot seats and policies.
- A whole computer you can reach. An agent that builds a web app needs someone to open it, and tests often need Docker or an emulator. Without ports or SSH you only see what the Copilot session reports back.
- A screen and a browser for every agent. An agent checking its own UI change, or filling a web form, needs a real browser on a real screen. In a headless Copilot session you would install a browser and a virtual display yourself each time.
Questions people ask
Is bochka cheaper than GitHub Copilot cloud sandboxes?
In the scenarios on this page, yes: one coding agent on workdays comes to $20 a month on bochka and $76 on Copilot, and one agent running all month comes to $26 versus $315. 50 agents in parallel come to $317 versus $3,812, and Copilot also needs a seat per user. The Copilot numbers are preview prices and may change.
Can I run Claude Code or Codex in a Copilot cloud sandbox?
A Copilot cloud sandbox runs a Copilot session, started from Copilot CLI or the Copilot app. GitHub does let some plans hand work to Claude and Codex as third-party agents on its cloud agent, but that is a separate feature. On bochka, Claude Code, Codex and other agents come preinstalled in every sandbox, with an API to prompt and steer them.
Can I SSH into a Copilot cloud sandbox or open a port?
GitHub documents neither. You reach the session through Copilot CLI or the Copilot app. Every bochka sandbox has SSH, HTTPS URLs on up to 50 ports and raw TCP.
What happens when I stop a Copilot cloud sandbox?
GitHub takes a snapshot so you can resume later with your files, environment variables and work in progress, and bills that snapshot as storage until you delete the session. bochka saves the disk every minute and on stop, and a stopped sandbox costs nothing.
Do I need a Copilot subscription to use it?
Yes. Cloud sandboxes are a Copilot feature, and for organizations an owner must turn on the Cloud Sandbox access policy, which is off by default. bochka signs you in with GitHub, Google or an emailed code and does not need any other subscription.
Is bochka SOC 2 compliant?
SOC 2 is in progress. We're open about where we stand: live status at status.bochka.xyz and our data retention policy at docs.bochka.xyz/data-retention.
Start a sandbox
Install the CLI, then run bochka new.
Product preview