Cloudflare Sandbox vs Freestyle
Cloudflare Sandbox runs a container in its own microVM inside the Workers platform; it sleeps when idle and starts again from a fresh disk. Freestyle gives each sandbox a full KVM virtual machine that keeps its disk and can pause with its memory, then wake on the next request.
The companies and products
Cloudflare Sandbox
Cloudflare Sandbox SDK runs untrusted or AI-generated code in Linux containers on Cloudflare's network, driven from a Cloudflare Worker.
Each sandbox is a Cloudflare Container backed by a Durable Object, and each container runs in its own Firecracker microVM with its own kernel and network. You build a linux/amd64 image, pick an instance type of up to 4 vCPU and 12 GiB, and reach the sandbox through your own Worker. It suits teams already on Workers who want short-lived sandboxes that sleep when idle; for code that only calls known methods, Cloudflare also offers Dynamic Workers, which run JavaScript in V8 isolates.
- Largest instance
- 4 vCPU, 12 GiB memory, 20 GB disk (defaults, can be raised)
- Account limits
- 1,500 vCPU, 6 TiB memory and 30 TB disk running at once
- Compliance
- Cloudflare holds a SOC 2 Type II report
Freestyle
Freestyle sells full Linux virtual machines for AI agents, built for long running, complex tasks.
Each Freestyle VM is a KVM virtual machine with its own kernel, booted from an Ubuntu base snapshot with systemd, Docker and coding agent CLIs preinstalled. VMs can be paused with their memory, snapshotted while running, forked and woken by the next request, and every VM starts behind a default-deny firewall. It is built for teams that give each agent or each user its own machine, driven from a TypeScript SDK, a CLI or an API.
Which use cases each one fits
For each use case, Battleships prices every sandbox provider on the same workload and sorts them from the cheapest monthly bill up. “13th cheapest of 345” means 12 of the other 344 providers run that workload, with every feature it needs, for less. “With limits” means the provider runs it but misses something, so it is listed after every full match. Open a use case for its whole ranking and what each provider misses.
| Use case and its workload | Cloudflare Sandbox: price rank | Freestyle: price rank | bochka: price rank |
|---|---|---|---|
| Software factory 100 at once · 4 vCPU / 8 GB · 2,200 sessions of 8 h a month A software factory needs files that stay and full Docker; Freestyle has both, Cloudflare resets the disk after sleep, and bochka adds faster CPUs and a desktop. | 162nd of 367, with limits $1,543 a month | 241st of 367, with limits $3,311 a month | 3rd cheapest of 367 $634 a month |
| Always-on AI employees 50 machines 24/7 · 2 vCPU / 4 GB | 207th of 366, with limits $2,188 a month | 263rd of 366, with limits $4,195 a month | 5th cheapest of 366 $657 a month |
| Code interpreter bursts 100 at once · 1 vCPU / 2 GB · 200,000 sessions of 1 min a month Both fit short code runs; Cloudflare bills CPU only while it is busy, and Freestyle resumes a paused VM with its processes still running. | 13th cheapest of 345 $144 a month | 40th cheapest of 345 $482 a month | 186th of 345, with limits $2,000 a month |
| Sandboxes for your users 300 at once · 2 vCPU / 4 GB · 30,000 sessions of 23 min a month Both fit sandboxes for your users and both wake on the next request; bochka adds a desktop, hosting and per-sandbox spend limits on top. | 9th cheapest of 361 $731 a month | 16th cheapest of 361 $1,358 a month | Cheapest of 361 $209 a month |
| RL rollouts 1,000 at once · 2 vCPU / 4 GB · 1,000,000 sessions of 3 min a month Freestyle can snapshot a running VM with its memory and boot copies from it, which suits rollouts that branch from one state; Cloudflare has no fork. | 144th of 360, with limits $9,428 a month | 107th of 360, with limits $6,600 a month | 34th of 360, with limits $2,000 a month |
| Agent evals 250 at once · 4 vCPU / 8 GB · 15,000 sessions of 20 min a month | 45th cheapest of 364 $818 a month | 53rd cheapest of 364 $1,046 a month | 10th cheapest of 364 $200 a month |
| CI runners 40 at once · 8 vCPU / 16 GB · 6,000 sessions of 12 min a month Freestyle runs full Docker where Cloudflare turns off iptables and caps disk at 20 GB by default, but Freestyle's docs send heavy CPU work elsewhere, and bochka did 2.8 times its CPU work. | 301st of 377, with limits $704 a month | 168th of 377, with limits $625 a month | 4th cheapest of 377 $86 a month |
| 24/7 dev boxes 1 machine 24/7 · 4 vCPU / 8 GB A dev box must keep its files; Freestyle keeps the disk but bills it while paused, Cloudflare starts fresh after sleep, and a stopped bochka sandbox keeps its disk at no cost. | 70th cheapest of 368 $93 a month | 98th cheapest of 368 $151 a month | 18th cheapest of 368 $26 a month |
| Computer-use agents 50 at once · 4 vCPU / 8 GB · 20,000 sessions of 15 min a month Neither ships a desktop: Cloudflare removed its built-in one and Freestyle has install guides, while bochka has a 60fps desktop and computer use in every sandbox. | 166th of 369, with limits $460 a month | 234th of 369, with limits $940 a month | 6th cheapest of 369 $200 a month |
| Browser-use agents 50 at once · 2 vCPU / 4 GB · 30,000 sessions of 10 min a month | 210th of 367, with limits $233 a month | 257th of 367, with limits $482 a month | 7th cheapest of 367 $200 a month |
| Scraping & bots (startup scale) 50 at once · 1 vCPU / 2 GB · 100,000 sessions of 3 min a month | 250th of 346, with limits $286 a month | 278th of 346, with limits $482 a month | 6th cheapest of 346 $90 a month |
| Mass scraping & bots (undetectable) 1,000 at once · 1 vCPU / 2 GB · 3,000,000 sessions of 2 min a month | 169th of 338, with limits $5,741 a month | 183rd of 338, with limits $6,560 a month | 71st of 338, with limits $1,800 a month |
| Parallel red teaming 200 at once · 2 vCPU / 4 GB · 5,000 sessions of 30 min a month Red-team runs often need nested VMs and raw TCP; Freestyle and bochka have both, while Cloudflare cannot change iptables and takes no raw TCP from outside. | 239th of 360, with limits $325 a month | 272nd of 360, with limits $482 a month | 2nd cheapest of 360 $200 a month |
| GPU eval jobs 10 at once · 8 vCPU / 32 GB · 500 sessions of 30 min a month | Can't run it | Can't run it | Can't run it |
| macOS agents 5 at once · 4 vCPU / 8 GB · 1,000 sessions of 20 min a month | Can't run it | Can't run it | Can't run it |
Key features
| Feature | Cloudflare Sandbox | Freestyle | bochka |
|---|---|---|---|
| Isolation | Firecracker microVM per container, own kernel and network | Full KVM VM with its own kernel on bare metal servers | Full VM with its own kernel on dedicated AMD Ryzen 9 9950X hosts |
| CPU benchmark (4 vCPU / 8 GB) | No result on this benchmark | 9.64 runs/s | 26.69 runs/s |
| Largest machine | 4 vCPU / 12 GiB / 20 GB disk by default (can be raised) | Up to 32 vCPU / 64 GiB on Pro, 64 / 128 with custom limits | Up to 16 vCPU / 32 GB on the $100 plan and above |
| Files between sessions | Fresh disk after sleep; snapshots (public beta, kept 30 days) or R2 backups when your code saves them | Disk kept; billed for storage while paused or stopped | Disk saved every minute and on stop; a stopped sandbox costs nothing |
| Pause with memory | No paused state; a stop wipes disk and processes | Pause saves memory and disk; the same processes resume | No; resume boots the machine again with its disk |
| Fork | No fork; restore a saved snapshot or backup into a new sandbox | Clone a running VM without pausing it; snapshots capture memory and disk | Fork a running sandbox with its disk, without stopping it |
| Sleep and wake on request | Stops after inactivity and wakes on the next request | Optional idle timeout (none by default); a paused VM resumes on the next traffic | TTL based (1 h default, changeable); a stopped sandbox is started by API |
| Root, Docker, nested virtualization | docker:dind with iptables and IP forwarding turned off; nested virtualization not documented | systemd as pid 1, Docker from boot, full KVM support | Root, systemd, full Docker and /dev/kvm for Android emulators and VMs |
| Desktop, browser and computer use | Built-in desktop removed in SDK 0.10.2; bring your own | Guides to install GNOME or Xvfb, VNC and Chromium yourself | Linux desktop streamed at 60fps, Chromium and computer use built in |
| Coding agents | Run Claude Code, Codex, OpenCode or Pi in your image; OpenCode has an SDK helper | claude, codex, opencode and openclaw preinstalled, driven through exec or a terminal | Claude Code, Codex, pi, OpenCode and more preinstalled, with a prompt, steer and events API |
| Keeping keys out of the sandbox | Your outbound handler adds the token for any HTTP or HTTPS host; you write the code | Credentials injected at the edge for HTTPS headers, Postgres and S3; the VM must trust the Freestyle CA | Managed proxy for model providers and any HTTPS API; switch a credential to another account when credits run out |
| Inbound traffic | HTTP and WebSocket previews routed through your Worker; no raw TCP or public IP | HTTPS on free style.dev names or your own domain, forward auth, other public protocols | HTTPS URLs for up to 50 ports, token-protected by default; raw TCP |
| Outbound rules | allowedHosts deny-by-default list plus outbound handlers you write in Worker code | Default-deny firewall with allow rules by IP, VM, VPC or exact domain | Open internet, no provider-side allowlist |
| Regions | Several regions across Cloudflare's network, nearest free instance picked | Not listed; the docs name a San Jose, US data center | EU only: Germany, Finland, France |
Every feature Battleships tracks (43)
| Feature | Cloudflare Sandbox | Freestyle | bochka |
|---|---|---|---|
| Full VM (own kernel) | Yes | Yes | Yes |
| Docker inside | Yes | Yes | Yes |
| Nested virtualization | No | Yes | Yes |
| Root | Yes | Yes | Yes |
| Systemd | Not published | Yes | Yes |
| Desktop GUI | No | No | Yes |
| Browser | No | No | Yes |
| Computer-use API | No | No | Yes |
| SSH | Yes | Yes | Yes |
| Persistent disk | No | Yes | Yes |
| Pause/resume | No | Yes | Yes |
| Automatic snapshots | No | Yes | Yes |
| Fork/clone | No | Yes | Yes |
| Live fork (no pause) | No | Yes | Yes |
| Memory fork | No | Yes | No |
| Custom image (Docker or snapshot) | Yes | Yes | Yes |
| ≥24 h sessions | Yes | Yes | Yes |
| Idle auto-stop | Yes | Yes | No |
| Wake on request | Yes | Yes | No |
| HTTPS preview URLs | Yes | Yes | Yes |
| Raw TCP inbound | No | Yes | Yes |
| Public IPv4 | No | No | No |
| Egress allowlist | Yes | Yes | No |
| Secret proxy | Yes | Yes | Yes |
| Secret proxy for any API | Yes | Yes | Yes |
| Preinstalled agents | Yes | Yes | Yes |
| Agent harness API | Yes | No | Yes |
| MCP server | No | No | No |
| GPU | No | Yes | No |
| Windows | No | No | No |
| Arm64 | No | No | No |
| Self-hosting | No | No | No |
| BYOC | No | No | No |
| Open source | Yes | No | No |
| Scoped API keys | Not published | Yes | Yes |
| Spend limits | No | Not published | Yes |
| Usage per sandbox (API) | Not published | No | Yes |
| Audit logs | Yes | Yes | No |
| SSO | Yes | Yes | No |
| SOC 2 | Yes | Not published | No |
| HIPAA | Yes | Not published | No |
| EU data residency | Yes | No | Yes |
| Zero data retention | Not published | Not published | Yes |
Performance
On the hpc-sandbox-benchmarks Node.js build-and-test loop at 4 vCPU / 8 GB, bochka did 26.69 runs per second and Freestyle did 9.64, about 2.8 times the CPU work in the same time. Cloudflare Sandbox has no result on that benchmark, so there is no comparable CPU number for it. This test measures CPU speed only, not start time.
Node.js build-and-test loop at 4 vCPU / 8 GB, higher is better. Measured with the open hpc-sandbox-benchmarks suite. Cloudflare Sandbox has no published run in this suite yet, so there is no like-for-like number to compare.
Pricing in five scenarios
Each bill is priced from the providers' public price lists by the open Battleships engine, with the cheapest plan that runs the scenario.
| Scenario | Cloudflare Sandbox, a month | Freestyle, a month | bochka, a month |
|---|---|---|---|
| One coding agent, workdays 4 vCPU / 8 GB, 50 GB disk, 8 hours a day, 22 days a month, files kept between days | $39 · Workers Paid · with limits | $27 · Free | $20 · $20/mo |
| One agent that never stops 4 vCPU / 8 GB, 50 GB disk, running 24/7 all month | $148 · Workers Paid · with limits | $159 · Free | $26 · $20/mo |
| 50 agents in parallel 50 machines of 4 vCPU / 8 GB at once, 8-hour sessions, 1,100 sessions a month, Docker inside | $1,660 · Workers Paid · with limits | $2,139 · Pro | $317 · $20/mo × 3 seats |
| Sandboxes for your users 2 vCPU / 4 GB, 30,000 sessions of 10 minutes a month, up to 300 at once | $476 · Workers Paid | $581 · Pro | $200 · $100/mo × 2 seats |
| 1,000 short jobs at once 2 vCPU / 4 GB, 1,000 at once, 3 minutes each, 200,000 jobs a month | $1,889 · Workers Paid · with limits | $1,305 · Pro · with limits | $2,000 · $2000/mo · with limits |
Cloudflare Sandbox: You need Workers Paid, with a $5 a month account minimum. CPU is billed only while busy; memory and disk are billed on the instance size until the container sleeps, and 4 vCPU always comes with 12 GiB.
Freestyle: Freestyle bills per second for the vCPU, RAM and disk allocated to a VM, busy or idle, after monthly allowances. On Free the allowances are hard stops; Hobby and Pro set a $50 or $500 monthly minimum that counts as usage, and a paused VM bills only for storage.
Freestyle: Plans start at $20 a month, and the whole fee is usage credit, billed per second while a sandbox runs. A stopped sandbox costs nothing and keeps its disk.
Limits in those scenarios
Cloudflare's disk resets after sleep and is 20 GB by default, so the scenarios that keep 50 GB of files between days do not fit without your own snapshot or backup code. Its account limit of 1,500 vCPU at once is short of the 2,000 the 1,000-job burst needs, and Freestyle Pro caps out at 400 concurrent VMs, so neither fits that burst. Freestyle has no idle timeout by default, so a VM bills until you pause it. bochka fits the burst on concurrency but queues starts above 90 a minute on the $2,000 plan.
| Scenario | Cloudflare Sandbox | Freestyle | bochka |
|---|---|---|---|
| One coding agent, workdays |
| None that bite | None that bite |
| One agent that never stops |
| None that bite | None that bite |
| 50 agents in parallel |
| None that bite | None that bite |
| Sandboxes for your users | None that bite | None that bite | None that bite |
| 1,000 short jobs at once |
|
|
|
Which one should you use?
Use Cloudflare Sandbox when
your app already runs on Workers and you want short sandboxes that sleep when idle, wake on the next request, and bill CPU only while busy.
- Sleeps when idle, wakes on request. For many short, spiky sessions: a sandbox sleeps when idle, wakes on the next request, and bills CPU only while busy.
- Egress rules you can program. allowedHosts blocks every host you did not list, and outbound handlers run your own Worker code on each request.
- Next to the rest of Workers. If your app already runs on Workers, sandboxes sit next to Durable Objects and R2, in several regions.
Use Freestyle when
each agent or user needs a full VM that keeps its disk, pauses with its memory, forks while running, or needs more than 4 vCPU.
- A full VM that keeps its disk. Each sandbox is a KVM VM with systemd, full Docker and nested virtualization, and its disk stays between sessions.
- Memory pause and live fork. A VM pauses with its memory, resumes the same processes, and can be cloned while it keeps running.
- Bigger machines. Pro VMs go up to 32 vCPU / 64 GiB, well past Cloudflare's 4 vCPU / 12 GiB default size.
Where bochka fits
If your agents work for hours on builds, tests, Docker and web pages, look at bochka. It gives each agent a full VM like Freestyle, on faster CPUs, with a desktop, a browser and an API to drive the agents inside from outside. Its disk is saved every minute, and a stopped sandbox costs nothing.
Faster CPUs for builds and tests
On the same Node.js build-and-test benchmark, bochka did 26.69 runs/s and Freestyle 9.64, so every install and test waits almost three times as long there. Cloudflare has no result, and tops out at 4 vCPU by default.
A desktop and browser, ready
Cloudflare removed its built-in desktop and Freestyle offers guides to install GNOME or Xvfb, VNC and Chromium. On both you build and maintain the display stack, plus the screenshot and click layer, before an agent can use a page.
Agents driven from outside
On Cloudflare you bake each agent into your image and write the handler that adds every token; on Freestyle you start the CLI through exec and parse its output. bochka has a prompt, steer and events API, and switches a credential when credits run out.
Use bochka when your agents do real work for hours: builds, tests, full Docker, emulators, a desktop and a browser, on fast CPUs that keep their files between sessions. Compare it one to one: bochka vs Cloudflare Sandbox and bochka vs Freestyle.
Questions people ask
Is Cloudflare Sandbox cheaper than Freestyle?
It depends on the job. For sandboxes for your users it is $476 a month on Cloudflare against $581 on Freestyle, but for one coding agent on workdays Freestyle is $27 and Cloudflare $39 and does not keep the disk. bochka costs less than both in four of the five scenarios.
Which is faster, Cloudflare Sandbox or Freestyle?
Freestyle did 9.64 runs per second on the hpc-sandbox-benchmarks CPU test at 4 vCPU / 8 GB, and Cloudflare has no result on it. bochka did 26.69 on the same test.
Can Cloudflare Sandbox run Docker?
Yes, as docker:dind with the daemon's iptables and IP forwarding turned off, because containers cannot change iptables. Freestyle and bochka both run full Docker with systemd and nested virtualization.
Do they keep my files between sessions?
Freestyle keeps the disk, and can keep memory too when a VM pauses. Cloudflare starts from a fresh disk after sleep, unless your code saved a snapshot (public beta, kept 30 days) or a backup to R2. bochka saves the disk every minute and on stop.
Can I limit where a sandbox connects to?
On both, yes. Cloudflare has an allowedHosts list and outbound handlers in Worker code; Freestyle starts every VM behind a default-deny firewall with allow rules by IP, VM, VPC or domain. bochka does not offer a provider-side egress allowlist today.
Where does each one run?
Cloudflare places containers in several regions of its network. Freestyle does not list regions; its docs name a San Jose, US data center. bochka runs in the EU only, in Germany, Finland and France.
Try bochka
Install the CLI, then run bochka new.
Product preview
More comparisons
- bochka vs Cloudflare Sandbox
- bochka vs Freestyle
- E2B vs Cloudflare Sandbox
- Daytona vs Cloudflare Sandbox
- Modal vs Cloudflare Sandbox
- Vercel Sandbox vs Cloudflare Sandbox
- Cloudflare Sandbox vs Blaxel
- Cloudflare Sandbox vs Runloop
- Cloudflare Sandbox vs Tensorlake
- Cloudflare Sandbox vs Morph Cloud
- Cloudflare Sandbox vs CodeSandbox SDK
- Cloudflare Sandbox vs Northflank