bochka vs Tencent Cloud Agent Runtime
Both give an agent its own isolated machine with its own kernel. bochka gives it a whole Linux VM that runs Docker and emulators for as long as you want, while Tencent is built for huge numbers of short, prebuilt sandboxes that start in about 100 ms inside Tencent Cloud.
Where bochka stands out
A whole Linux machine, not a single image
A bochka sandbox is a full VM with root, systemd and Docker, plus /dev/kvm for Android emulators and VMs. Tencent runs one container image per sandbox on a light guest kernel, and its docs never describe Docker or KVM inside it.
Runs as long as the work does
bochka has no session cap on paid plans, and the disk is saved every minute and on stop, with free stops. Tencent's standard instances default to 5 minutes and are destroyed after at most 24 hours, and pausing is capped at 20 instances per region.
Agents and keys built in
Claude Code, Codex and five other agents come preinstalled, and you prompt, steer and follow them from outside through one API. Real API keys stay outside the sandbox in a credentials proxy, and a credential can switch to another account when one runs out of credits.
The companies and products
bochka
bochka.xyz runs sandboxes for AI agents: each one is a full Linux VM with its own kernel.
You start a machine with one command or one API call, then SSH in, run Docker, open a desktop, or let a built-in agent (Claude Code, Codex, OpenCode and others) work in it. The disk stays between sessions, and a stopped sandbox costs nothing.
- Isolation
- Full VM per sandbox, own kernel
- Regions
- EU: Germany, Finland, France
Tencent Cloud Agent Runtime
Tencent Cloud Agent Runtime is Tencent's serverless sandbox service for AI agents, sold inside Tencent Cloud.
Its Agent Sandbox gives each agent a small isolated guest with its own kernel, built on Tencent's Cube secure sandbox, and offers ready-made types for code, browser, Ubuntu desktop, Android phones and custom images. It speaks the E2B protocol, so E2B SDKs work against it, and it adds an MCP server, network policies and storage mounts. It is built for agent platforms and reinforcement learning teams that start and throw away many sandboxes on Tencent Cloud.
Which use cases each one fits
For each use case, Battleships prices every sandbox provider on the same workload and sorts them from the cheapest monthly bill up. “3rd cheapest of 367” means 2 of the other 366 providers run that workload, with every feature it needs, for less. “With limits” means the provider runs it but misses something, so it is listed after every full match. Open a use case for its whole ranking and what each provider misses.
| Use case and its workload | bochka: price rank | Tencent Cloud Agent Runtime: price rank |
|---|---|---|
| Software factory 100 at once · 4 vCPU / 8 GB · 2,200 sessions of 8 h a month A software factory needs Docker, long builds and machines that keep their state for days, which a full bochka VM gives and Tencent's sandboxes do not document. | 3rd cheapest of 367 $634 a month | 247th of 367, with limits $3,560 a month |
| Always-on AI employees 50 machines 24/7 · 2 vCPU / 4 GB An assistant that lives on one machine all month runs past Tencent's 24-hour instance lifetime on standard sandboxes, while bochka has no session cap on paid plans. | 5th cheapest of 366 $657 a month | 46th of 366, with limits $4,469 a month |
| Code interpreter bursts 100 at once · 1 vCPU / 2 GB · 200,000 sessions of 1 min a month Tencent fits short code runs better: sandboxes start in about 100 ms, bill per second and are destroyed when the job is done. | 186th of 345, with limits $2,000 a month | 116th of 345, with limits $230 a month |
| Sandboxes for your users 300 at once · 2 vCPU / 4 GB · 30,000 sessions of 23 min a month | Cheapest of 361 $209 a month | 131st of 361, with limits $1,469 a month |
| RL rollouts 1,000 at once · 2 vCPU / 4 GB · 1,000,000 sessions of 3 min a month Tencent targets agentic RL with prebuilt SWE-bench and Android World sandboxes, but its default quota of 50 instances per region must be raised before a big run. | 34th of 360, with limits $2,000 a month | 112th of 360, with limits $6,989 a month |
| Agent evals 250 at once · 4 vCPU / 8 GB · 15,000 sessions of 20 min a month | 10th cheapest of 364 $200 a month | 156th of 364, with limits $1,131 a month |
| CI runners 40 at once · 8 vCPU / 16 GB · 6,000 sessions of 12 min a month Both fit; bochka runs Docker and /dev/kvm inside the job, so container builds and Android emulators work without extra setup. | 4th cheapest of 377 $86 a month | 77th cheapest of 377 $699 a month |
| 24/7 dev boxes 1 machine 24/7 · 4 vCPU / 8 GB A dev box needs SSH and Docker, which bochka has and Tencent's sandboxes do not; only Tencent's persistent custom sandboxes skip the 24-hour limit. | 18th cheapest of 368 $26 a month | 286th of 368, with limits $184 a month |
| Computer-use agents 50 at once · 4 vCPU / 8 GB · 20,000 sessions of 15 min a month Both have a Linux desktop for computer use; bochka streams it at 60fps, and Tencent adds ready-made Android phone sandboxes. | 6th cheapest of 369 $200 a month | 23rd cheapest of 369 $1,018 a month |
| Browser-use agents 50 at once · 2 vCPU / 4 GB · 30,000 sessions of 10 min a month | 7th cheapest of 367 $200 a month | 86th of 367, with limits $506 a month |
| Scraping & bots (startup scale) 50 at once · 1 vCPU / 2 GB · 100,000 sessions of 3 min a month | 6th cheapest of 346 $90 a month | 31st cheapest of 346 $343 a month |
| Mass scraping & bots (undetectable) 1,000 at once · 1 vCPU / 2 GB · 3,000,000 sessions of 2 min a month | 71st of 338, with limits $1,800 a month | 189th of 338, with limits $6,852 a month |
| Parallel red teaming 200 at once · 2 vCPU / 4 GB · 5,000 sessions of 30 min a month Parallel red teaming needs root, Docker and raw network tools on a full machine, which bochka gives every sandbox. | 2nd cheapest of 360 $200 a month | 32nd of 360, with limits $342 a month |
| GPU eval jobs 10 at once · 8 vCPU / 32 GB · 500 sessions of 30 min a month | Can't run it | Can't run it |
| macOS agents 5 at once · 4 vCPU / 8 GB · 1,000 sessions of 20 min a month | Can't run it | Can't run it |
Key features
| Feature | bochka | Tencent Cloud Agent Runtime |
|---|---|---|
| Isolation | Full VM with its own kernel on dedicated AMD Ryzen 9 9950X hosts | Cube secure sandbox with its own kernel and a lightweight guest OS |
| Docker inside | Yes, Docker and systemd run as in any Linux VM | Not documented; Docker is used to build the image before upload |
| Nested virtualization | Yes, /dev/kvm for Android emulators and VMs | Not documented; Android comes as prebuilt Mobile and Android World sandboxes |
| Session length | No cap on paid plans; you set the time to live | Default 5 minutes, up to 24 hours, then the instance is destroyed; Mobile sandboxes up to 15 days, persistent custom sandboxes exempt |
| Pause and resume | Disk is saved every minute and on stop; resume boots the machine again | Pause keeps process memory and files; idle auto-pause and wake on the next request in public beta |
| Fork | Fork a running sandbox with its disk | Console clone copies a sandbox's settings, not its state |
| Biggest machine | Up to 16 vCPU / 32 GB on the $100 plan and above | Up to 32 vCPU on custom sandboxes, larger on request |
| Shell access | SSH, plus a command and file API | No SSH; web terminal, VS Code in the browser and an E2B-style command API |
| Inbound access | HTTPS URLs for up to 50 ports, token-protected by default; raw TCP; dedicated IPv4 or IPv6 | HTTPS URL per port on a Tencent domain, with token or anonymous access; no public IP |
| Outbound rules | Open internet, no provider-side allowlist | No-internet mode, your own VPC with security groups, and host and port policies (gray release) |
| Coding agents | Seven agents preinstalled, with a prompt, steer and events API | Claude Code, Codex and Gemini CLI preinstalled in All-In-One, run through the command API |
| Keeping API keys out of the sandbox | Credentials proxy for model providers and any HTTPS API; switch a credential to another account when credits run out | Secrets passed in as environment variables |
| Desktop and browser | Linux desktop streamed at 60fps with Chromium and computer use | Ubuntu desktop (OSWorld), Chromium over VNC, and Android phone sandboxes |
| Regions | EU only (Germany, Finland, France) | Mainland China and Hong Kong |
| Compliance and transparency | SOC 2 is in progress. We're open about where we stand: live status and data retention policy. | SOC 2 |
Every feature Battleships tracks (43)
| Feature | bochka | Tencent Cloud Agent Runtime |
|---|---|---|
| Full VM (own kernel) | Yes | Yes |
| Docker inside | Yes | No |
| Nested virtualization | Yes | No |
| Root | Yes | Not published |
| Systemd | Yes | Not published |
| Desktop GUI | Yes | Yes |
| Browser | Yes | Yes |
| Computer-use API | Yes | Yes |
| SSH | Yes | No |
| Persistent disk | Yes | Yes |
| Pause/resume | Yes | Yes |
| Automatic snapshots | Yes | Yes |
| Fork/clone | Yes | No |
| Live fork (no pause) | Yes | No |
| Memory fork | No | No |
| Custom image (Docker or snapshot) | Yes | Yes |
| ≥24 h sessions | Yes | Yes |
| Idle auto-stop | No | Yes |
| Wake on request | No | Yes |
| HTTPS preview URLs | Yes | Yes |
| Raw TCP inbound | Yes | Not published |
| Public IPv4 | No | No |
| Egress allowlist | No | Yes |
| Secret proxy | Yes | No |
| Secret proxy for any API | Yes | No |
| Preinstalled agents | Yes | Yes |
| Agent harness API | Yes | No |
| MCP server | No | Yes |
| GPU | No | No |
| Windows | No | No |
| Arm64 | No | No |
| Self-hosting | No | No |
| BYOC | No | No |
| Open source | No | No |
| Scoped API keys | Yes | Not published |
| Spend limits | Yes | Not published |
| Usage per sandbox (API) | Yes | No |
| Audit logs | No | Not published |
| SSO | No | Yes |
| SOC 2 | No | Yes |
| HIPAA | No | Yes |
| EU data residency | Yes | No |
| Zero data retention | Yes | Not published |
Performance
There is no comparable measurement for Tencent Cloud Agent Runtime: it has not been run on the hpc-sandbox-benchmarks CPU test. bochka did 26.69 runs per second on that test at 4 vCPU / 8 GB, on dedicated AMD Ryzen 9 9950X hosts. Tencent publishes a start time of about 100 ms but no CPU score.
Node.js build-and-test loop at 4 vCPU / 8 GB, higher is better. Measured with the open hpc-sandbox-benchmarks suite. Tencent Cloud Agent Runtime has no published run in this suite yet, so there is no like-for-like number to compare.
Pricing in five scenarios
Each bill is priced from the providers' public price lists by the open Battleships engine, with the cheapest plan that runs the scenario.
| Scenario | bochka, a month | Tencent Cloud Agent Runtime, a month |
|---|---|---|
| One coding agent, workdays 4 vCPU / 8 GB, 50 GB disk, 8 hours a day, 22 days a month, files kept between days | $20 · $20/mo | $53 · Pay as you go |
| One agent that never stops 4 vCPU / 8 GB, 50 GB disk, running 24/7 all month | $26 · $20/mo | $193 · Pay as you go · with limits |
| 50 agents in parallel 50 machines of 4 vCPU / 8 GB at once, 8-hour sessions, 1,100 sessions a month, Docker inside | $317 · $20/mo × 3 seats | $2,284 · Pay as you go · with limits |
| Sandboxes for your users 2 vCPU / 4 GB, 30,000 sessions of 10 minutes a month, up to 300 at once | $200 · $100/mo × 2 seats | $633 · Pay as you go · with limits |
| 1,000 short jobs at once 2 vCPU / 4 GB, 1,000 at once, 3 minutes each, 200,000 jobs a month | $2,000 · $2000/mo · with limits | $1,398 · Pay as you go · with limits |
bochka: Plans start at $20 a month, and the whole fee is usage credit. You pay per second while a sandbox runs, and a stopped sandbox costs nothing and keeps its disk.
Tencent Cloud Agent Runtime: Tencent bills in yuan, per second, for the vCPU and memory you allocate while a sandbox runs, with 15 GiB of disk free while running. A paused sandbox stops paying for CPU and memory but pays storage for its disk, plus its saved memory if it paused with memory, with no free disk while paused. No egress price is published.
Limits in those scenarios
Tencent's standard instances end after 24 hours, which is why it does not fit the always-on scenario. Its default quota is 50 instances, 50 vCPU and 100 GiB of RAM per region, so fifty 4 vCPU agents or a large user fleet need a quota increase first, and Docker inside is not documented for the fleet scenario. At 1,000 short jobs at once neither fits as listed: bochka's $2,000 plan queues starts, and Tencent stops at 50 concurrent sandboxes until support raises it.
| Scenario | bochka | Tencent Cloud Agent Runtime |
|---|---|---|
| One coding agent, workdays | None that bite |
|
| One agent that never stops | None that bite |
|
| 50 agents in parallel | None that bite |
|
| Sandboxes for your users | None that bite |
|
| 1,000 short jobs at once |
|
|
Which one should you use?
Use Tencent Cloud Agent Runtime when
you already run on Tencent Cloud in China or Hong Kong and need many short sandboxes, prebuilt RL or Android environments, or a sandbox with no internet at all.
- Fast starts and memory pause. Good for huge numbers of short jobs: sandboxes start in about 100 ms and pause with their running processes.
- Ready-made sandboxes for RL and phones. RL and mobile agent teams get prebuilt SWE-bench, OSWorld, Android World and Mobile sandboxes, and machines up to 32 vCPU.
- Network control and China regions. Teams already on Tencent Cloud can cut off internet, attach their own VPC and run in mainland China or Hong Kong.
Use bochka when
your agents do real work for hours or days: Docker, builds, emulators, a desktop and hosting on a full VM that keeps its disk and never times out.
- A whole Linux machine, not a single image. Agents that build and run containers, start databases with docker compose or boot an emulator need these. On Tencent you bake every tool into the image ahead of time, or pick one of its prebuilt sandbox types.
- Runs as long as the work does. A coding agent or an always-on assistant that runs past 24 hours loses its machine on Tencent unless your code pauses it, mounts outside storage for its files, or uses a persistent custom sandbox.
- Agents and keys built in. Tencent preinstalls three agent CLIs but you drive them through raw commands, and keys go in as environment variables, where one prompt injection inside the sandbox can read and leak them.
Questions people ask
Is bochka cheaper than Tencent Cloud Agent Runtime?
In four of the five scenarios on this page, yes. For 1,000 short jobs at once, Tencent's estimate is lower, but neither fits as listed: bochka queues the starts and Tencent's default quota stops at 50 sandboxes. Tencent also publishes no egress price.
Can I run Docker inside a Tencent Agent Sandbox?
Tencent's docs only use Docker to build the sandbox image before you upload it, and do not describe Docker inside a running sandbox. bochka runs Docker, systemd and /dev/kvm inside every sandbox.
How long can a Tencent Agent Sandbox run?
Standard instances default to 5 minutes and are destroyed after at most 24 hours. Mobile sandboxes can run for up to 15 days, and custom sandboxes have a persistent mode. bochka has no session cap on paid plans.
Does Tencent Cloud Agent Runtime work with the E2B SDK?
Yes. Tencent says it is compatible with the E2B protocol and accepts E2B-format API keys, so E2B SDK code can point at it. bochka has its own API and CLI, with coding agents you drive from outside through prompt, steer and events calls.
Can I use Tencent Cloud Agent Runtime from Europe?
Its documented regions are in mainland China and Hong Kong, such as Shanghai, Beijing and Hong Kong. bochka runs only in the EU, in Germany, Finland and France, with zero data retention.
Is bochka SOC 2 compliant?
SOC 2 is in progress. We're open about where we stand: live status at status.bochka.xyz and our data retention policy at docs.bochka.xyz/data-retention.
Start a sandbox
Install the CLI, then run bochka new.
Product preview