bochka vs Hetzner Cloud
A Hetzner Cloud server is a plain Linux VM that you install, secure and look after yourself, and it bills until you delete it. bochka also gives each agent a full VM, but with nested virtualization, snapshots every minute, stops that cost nothing, fork of a running machine, a desktop and coding agents already built in.
Where bochka stands out
Nested virtualization on every machine
bochka documents Docker, systemd and /dev/kvm on every machine, so an agent can run Android emulators, Firecracker or its own VMs. Hetzner's server FAQ answers the same question with "No, this is not possible on cloud server."
Free stops, snapshots every minute, fork while running
bochka saves a sandbox's disk every minute and when it stops, and a stopped sandbox costs nothing. You can fork a running sandbox in one call. On Hetzner a powered-off server bills at the full rate until you delete it, snapshots are taken by hand, and a copy means a snapshot plus a new server.
Coding agents and a desktop built in
Every bochka sandbox has Claude Code, Codex, OpenCode and other agents ready, and you drive agents inside from outside with a prompt, steer and events API. It also streams a 60fps desktop with Chromium for computer use. The credentials proxy keeps real AI keys out of the machine and can switch to another account when one runs out of credits.
The companies and products
bochka
bochka.xyz runs sandboxes for AI agents: each one is a full Linux VM with its own kernel.
You start a machine with one command or one API call, then SSH in, run Docker, open a desktop, or let a built-in agent (Claude Code, Codex, OpenCode and others) work in it. The disk stays between sessions, and a stopped sandbox costs nothing.
- Isolation
- Full VM per sandbox, own kernel
- Regions
- EU: Germany, Finland, France
Hetzner Cloud
Hetzner is a German hosting company founded in 1997; Hetzner Cloud rents virtual servers, storage and networking by the hour.
A Hetzner Cloud server is a Linux VM picked from shared vCPU lines (cost-optimized CX and CAX, regular CPX) or dedicated vCPU (CCX), with local NVMe disk, a public IP and up to 20 TB of traffic in the EU. You add volumes, private networks, firewalls and load balancers, and run everything yourself through the Console, the Cloud API, the hcloud CLI or Terraform. It is general infrastructure, not an agent sandbox, so this page compares the two where they overlap: giving an agent its own Linux machine.
Which use cases each one fits
For each use case, Battleships prices every sandbox provider on the same workload and sorts them from the cheapest monthly bill up. “3rd cheapest of 367” means 2 of the other 366 providers run that workload, with every feature it needs, for less. “With limits” means the provider runs it but misses something, so it is listed after every full match. Open a use case for its whole ranking and what each provider misses.
| Use case and its workload | bochka: price rank | Hetzner Cloud: price rank |
|---|---|---|
| Software factory 100 at once · 4 vCPU / 8 GB · 2,200 sessions of 8 h a month Both give a full Linux VM with root and Docker, but Hetzner has no nested virtualization, so emulators and VMs inside the agent's machine do not run there. | 3rd cheapest of 367 $634 a month | 46th of 367, with limits $287 a month |
| Always-on AI employees 50 machines 24/7 · 2 vCPU / 4 GB A Hetzner server can run an assistant around the clock, but you build the agent setup, HTTPS and backups yourself; bochka has them built in. | 5th cheapest of 366 $657 a month | 94th of 366, with limits $325 a month |
| Code interpreter bursts 100 at once · 1 vCPU / 2 GB · 200,000 sessions of 1 min a month Neither fits one-minute runs well: Hetzner bills every started hour in full, and bochka's start limits make big bursts a compromise. | 186th of 345, with limits $2,000 a month | 156th of 345, with limits $649 a month |
| Sandboxes for your users 300 at once · 2 vCPU / 4 GB · 30,000 sessions of 23 min a month Hetzner's server limits are not published and are raised by a support request reviewed by hand, so 300 user sandboxes need that request first; bochka allows 100 to 2,000 sandboxes by plan. | Cheapest of 361 $209 a month | 46th of 361, with limits $314 a month |
| RL rollouts 1,000 at once · 2 vCPU / 4 GB · 1,000,000 sessions of 3 min a month | 34th of 360, with limits $2,000 a month | 104th of 360, with limits $6,490 a month |
| Agent evals 250 at once · 4 vCPU / 8 GB · 15,000 sessions of 20 min a month | 10th cheapest of 364 $200 a month | 51st cheapest of 364 $1,010 a month |
| CI runners 40 at once · 8 vCPU / 16 GB · 6,000 sessions of 12 min a month Both run Docker builds on a full VM, but a ten-minute CI job on Hetzner is billed as a full hour and you run the runner software yourself. | 4th cheapest of 377 $86 a month | 83rd cheapest of 377 $788 a month |
| 24/7 dev boxes 1 machine 24/7 · 4 vCPU / 8 GB Both fit a 24/7 dev box: a Hetzner server is a classic always-on machine with a monthly price cap, and a bochka machine keeps its disk with snapshots every minute. | 18th cheapest of 368 $26 a month | 32nd cheapest of 368 $42 a month |
| Computer-use agents 50 at once · 4 vCPU / 8 GB · 20,000 sessions of 15 min a month bochka streams a 60fps desktop with Chromium and computer use; on Hetzner you install the desktop, the browser and the control loop yourself. | 6th cheapest of 369 $200 a month | 134th of 369, with limits $320 a month |
| Browser-use agents 50 at once · 2 vCPU / 4 GB · 30,000 sessions of 10 min a month bochka ships Chromium and browser control in every sandbox; on Hetzner you install and run the browser stack yourself. | 7th cheapest of 367 $200 a month | 227th of 367, with limits $312 a month |
| Scraping & bots (startup scale) 50 at once · 1 vCPU / 2 GB · 100,000 sessions of 3 min a month | 6th cheapest of 346 $90 a month | 157th of 346, with limits $62 a month |
| Mass scraping & bots (undetectable) 1,000 at once · 1 vCPU / 2 GB · 3,000,000 sessions of 2 min a month | 71st of 338, with limits $1,800 a month | 45th of 338, with limits $1,248 a month |
| Parallel red teaming 200 at once · 2 vCPU / 4 GB · 5,000 sessions of 30 min a month | 2nd cheapest of 360 $200 a month | 114th of 360, with limits $52 a month |
| GPU eval jobs 10 at once · 8 vCPU / 32 GB · 500 sessions of 30 min a month | Can't run it | Can't run it |
| macOS agents 5 at once · 4 vCPU / 8 GB · 1,000 sessions of 20 min a month | Can't run it | Can't run it |
Key features
| Feature | bochka | Hetzner Cloud |
|---|---|---|
| What you get | A sandbox API for agents, on full VMs | A general Linux VM you set up and run yourself |
| Isolation | Every sandbox is a full VM with its own kernel | Every server is a full VM with its own kernel |
| CPU speed (Node.js build-and-test, 4 vCPU / 8 GB) | 26.69 runs/s on dedicated AMD Ryzen 9 9950X (Zen 5) hosts | 8.88 runs/s on a shared CX33; CPX and CCX were not measured |
| Docker and nested virtualization | Docker, root, systemd and /dev/kvm on every machine | Root and Docker; nested virtualization is "not possible on cloud server" |
| Stopping | A stopped sandbox costs nothing and keeps its disk | A powered-off server bills at the full rate until you delete it |
| Snapshots | Automatic snapshots every minute and on stop | Snapshots you take yourself, or daily backups in 7 slots for 20% of the server price |
| Fork | Fork a running sandbox in one call (disk, no memory) | Take a snapshot, then create a new server from it (disk, no memory; shutting down first is recommended) |
| Reaching the machine | HTTPS URLs for up to 50 ports, token-protected; raw TCP; own IP | Public IPv4 and IPv6 on any port; HTTPS needs your own certificates or a paid load balancer |
| Desktop and computer use | 60fps desktop and Chromium, computer use and browser control, embeddable stream | None built in; a VNC console for admin, and you install a desktop yourself |
| Coding agents | Claude Code, Codex, OpenCode and more preinstalled, with a prompt, steer and events API | None; you install and drive agents yourself, for example over SSH |
| Keeping keys out of the machine | AI credentials proxy for model providers and any HTTPS API you register; switch a credential to another account when credits run out | No credentials proxy; secrets go on the server through cloud-init, files or env vars |
| Outbound rules | Open internet on every plan; no provider-side allowlist | Free Cloud Firewalls with inbound and outbound rules by IP, port and protocol |
| Machine sizes | Up to 16 vCPU / 32 GB per sandbox | Up to 48 dedicated vCPU / 192 GB (CCX63) |
| Regions | EU only: Germany, Finland, France | Germany and Finland, plus Ashburn, Hillsboro and Singapore |
| Compliance and transparency | SOC 2 is in progress. We're open about where we stand: live status and data retention policy. | No SOC 2 report published |
Every feature Battleships tracks (43)
| Feature | bochka | Hetzner Cloud |
|---|---|---|
| Full VM (own kernel) | Yes | Yes |
| Docker inside | Yes | Yes |
| Nested virtualization | Yes | No |
| Root | Yes | Yes |
| Systemd | Yes | Yes |
| Desktop GUI | Yes | No |
| Browser | Yes | No |
| Computer-use API | Yes | No |
| SSH | Yes | Yes |
| Persistent disk | Yes | Yes |
| Pause/resume | Yes | Yes |
| Automatic snapshots | Yes | No |
| Fork/clone | Yes | Yes |
| Live fork (no pause) | Yes | Yes |
| Memory fork | No | No |
| Custom image (Docker or snapshot) | Yes | Yes |
| ≥24 h sessions | Yes | Yes |
| Idle auto-stop | No | No |
| Wake on request | No | No |
| HTTPS preview URLs | Yes | No |
| Raw TCP inbound | Yes | Yes |
| Public IPv4 | No | Yes |
| Egress allowlist | No | Yes |
| Secret proxy | Yes | No |
| Secret proxy for any API | Yes | No |
| Preinstalled agents | Yes | No |
| Agent harness API | Yes | No |
| MCP server | No | No |
| GPU | No | No |
| Windows | No | No |
| Arm64 | No | Yes |
| Self-hosting | No | No |
| BYOC | No | No |
| Open source | No | No |
| Scoped API keys | Yes | Not published |
| Spend limits | Yes | No |
| Usage per sandbox (API) | Yes | No |
| Audit logs | No | Not published |
| SSO | No | No |
| SOC 2 | No | No |
| HIPAA | No | No |
| EU data residency | Yes | Yes |
| Zero data retention | Yes | Not published |
Performance
In StarSling's public benchmark at 4 vCPU / 8 GB, bochka did 26.69 Node.js build-and-test runs per second on its own hosts. The only Hetzner number comes from the 2026-08-24 run, where bochka's temporary fallback capacity ran on a shared Hetzner CX33 and did 8.88 runs per second, about a third of bochka's speed. Hetzner's CPX and dedicated CCX servers were not measured, and the CX line is currently out of stock.
Node.js build-and-test loop at 4 vCPU / 8 GB, higher is better. Measured with the open hpc-sandbox-benchmarks suite. Hetzner Cloud measured on: Shared vCPU, Cost-Optimized (CX, Intel/AMD), EU.
Pricing in five scenarios
Each bill is priced from the providers' public price lists by the open Battleships engine, with the cheapest plan that runs the scenario.
| Scenario | bochka, a month | Hetzner Cloud, a month |
|---|---|---|
| One coding agent, workdays 4 vCPU / 8 GB, 50 GB disk, 8 hours a day, 22 days a month, files kept between days | $20 · $20/mo | $3 · Pay-as-you-go (postpaid) · with limits |
| One agent that never stops 4 vCPU / 8 GB, 50 GB disk, running 24/7 all month | $26 · $20/mo | $10 · Pay-as-you-go (postpaid) · with limits |
| 50 agents in parallel 50 machines of 4 vCPU / 8 GB at once, 8-hour sessions, 1,100 sessions a month, Docker inside | $317 · $20/mo × 3 seats | $141 · Pay-as-you-go (postpaid) · with limits |
| Sandboxes for your users 2 vCPU / 4 GB, 30,000 sessions of 10 minutes a month, up to 300 at once | $200 · $100/mo × 2 seats | $312 · Pay-as-you-go (postpaid) · with limits |
| 1,000 short jobs at once 2 vCPU / 4 GB, 1,000 at once, 3 minutes each, 200,000 jobs a month | $2,000 · $2000/mo · with limits | $2,080 · Pay-as-you-go (postpaid) · with limits |
bochka: You pick a monthly plan from $20, and all of it becomes usage credit spent per second on running sandboxes. A stopped sandbox costs nothing and keeps its disk.
Hetzner Cloud: Hetzner bills each server by the hour, rounding every started hour up, with a monthly cap, and keeps billing until you delete it, even when it is off. The prices here use the cheapest shared CX servers, which are currently out of stock, plus the public IPv4; the CPX and CCX servers you can actually order today cost more per hour.
Limits in those scenarios
Every Hetzner scenario here is priced on the CX line, and Hetzner's site marks all CX servers as currently unavailable, so none of them fit as priced today. Hetzner also does not publish its per-project server limits: you request a raise and it is reviewed by hand, which matters for 50 agents, 300 user sandboxes or 1,000 jobs at once. Short jobs are billed a full hour each. On bochka the limit is a sandbox count (100 to 2,000 by plan) plus starts per minute, so the 1,000-job burst gets queued and needs more starts per day than the $2,000 plan allows.
| Scenario | bochka | Hetzner Cloud |
|---|---|---|
| One coding agent, workdays | None that bite |
|
| One agent that never stops | None that bite |
|
| 50 agents in parallel | None that bite |
|
| Sandboxes for your users | None that bite |
|
| 1,000 short jobs at once |
|
|
Which one should you use?
Use Hetzner Cloud when
you want plain long-lived Linux servers you run yourself, need regions in the US or Singapore, big dedicated machines, or outbound firewall rules.
- Servers in the US and Singapore. Useful if your users are outside Europe: Hetzner Cloud also runs servers in Ashburn, Hillsboro and Singapore.
- Big dedicated machines and a cloud around them. Useful for heavy single machines: dedicated vCPU servers go up to 48 vCPU and 192 GB, next to volumes and private networks.
- Firewall rules for outbound traffic. Useful if an agent's machine must only reach a few addresses: free Cloud Firewalls can block all other outbound traffic.
Use bochka when
you want each agent on its own full VM that is ready to work: /dev/kvm, coding agents, a desktop, HTTPS ports and minute-by-minute snapshots built in, fork while running, and stops that cost nothing.
- Nested virtualization on every machine. Agents that test mobile apps, build VM images or run sandboxes of their own need KVM inside their machine. On Hetzner Cloud that work does not run at all, so it has to move to a dedicated root server you manage.
- Free stops, snapshots every minute, fork while running. Agents sit idle between tasks. On Hetzner you either pay for an idle server or script snapshot, delete and recreate yourself, and daily backups mean a broken machine can lose a day of work.
- Coding agents and a desktop built in. A Hetzner server starts as an empty OS image, so you install, update and supervise each agent, desktop and key yourself, and the agent can read any key you put on it.
Questions people ask
Is bochka cheaper than Hetzner Cloud?
Not on paper for one or a few machines: one agent on workdays comes to $3 a month on Hetzner's CX servers, if you delete the server every night, against $20 on bochka, and 50 agents in parallel come to $141 against $317. For 300 user sandboxes bochka comes to $200 against $312. All the Hetzner prices use the CX line, which is currently out of stock, so the servers you can order today cost more.
Do I pay for a Hetzner server that is turned off?
Yes. Hetzner bills a server for as long as it exists, whether it is on or off, until you delete it. To stop paying you take a snapshot, delete the server and create it again later. On bochka, a stopped sandbox costs nothing and keeps its disk.
Does Hetzner Cloud support nested virtualization?
No. Hetzner's server FAQ says running virtual machines inside a cloud server is not possible. Docker works, since a server is a full VM with root. On bochka, Docker, systemd and /dev/kvm are documented on every machine.
Does Hetzner have an agent sandbox product?
No. Hetzner Cloud sells general servers, volumes, networks, firewalls and load balancers through a Console, an API, a CLI and Terraform, and you install agents yourself and drive them over SSH. bochka is built for agents, with coding agents, a desktop and a credentials proxy in every sandbox.
Where does my data run?
bochka runs only in the EU (Germany, Finland and France), with EU data residency and a zero data retention option. Hetzner Cloud runs in Germany and Finland, and also in the US (Ashburn and Hillsboro) and Singapore, which are outside the EU.
Is bochka SOC 2 compliant?
SOC 2 is in progress. We're open about where we stand: live status at status.bochka.xyz and our data retention policy at docs.bochka.xyz/data-retention.
Start a sandbox
Install the CLI, then run bochka new.
Product preview
More comparisons
- bochka vs Oracle Cloud
- bochka vs IONOS Cloud
- bochka vs AWS AgentCore
- bochka vs Contabo
- bochka vs Azure Virtual Machines
- bochka vs AWS Fargate
- bochka vs netcup
- bochka vs AWS EC2
- bochka vs E2B
- bochka vs Daytona
- bochka vs Modal
- bochka vs Vercel Sandbox
- AWS EC2 vs Hetzner Cloud
- Google Compute Engine vs Hetzner Cloud
- Azure Virtual Machines vs Hetzner Cloud
- Oracle Cloud vs Hetzner Cloud
- DigitalOcean vs Hetzner Cloud
- Hetzner Cloud vs Vultr
- Hetzner Cloud vs Linode
- Hetzner Cloud vs Scaleway