Cloudflare Sandbox vs Google Agent Runtime
Cloudflare Sandbox runs each container in its own Firecracker microVM with root and Docker, but the disk starts fresh after it sleeps. Google Agent Runtime hosts your agent code and runs sandboxes as an unprivileged user with no sudo, but it can pause them with their files and snapshot their memory.
The companies and products
Cloudflare Sandbox
Cloudflare Sandbox SDK runs untrusted or AI-generated code in Linux containers on Cloudflare's network, driven from a Cloudflare Worker.
Each sandbox is a Cloudflare Container backed by a Durable Object, and each container runs in its own Firecracker microVM with its own kernel and network. You build a linux/amd64 image, pick an instance type of up to 4 vCPU and 12 GiB, and reach the sandbox through your own Worker. It suits teams already on Workers who want short-lived sandboxes that sleep when idle; for code that only calls known methods, Cloudflare also offers Dynamic Workers, which run JavaScript in V8 isolates.
- Largest instance
- 4 vCPU, 12 GiB memory, 20 GB disk (defaults, can be raised)
- Account limits
- 1,500 vCPU, 6 TiB memory and 30 TB disk running at once
- Compliance
- Cloudflare holds a SOC 2 Type II report
Google Agent Runtime
Google Agent Runtime is the agent hosting part of Gemini Enterprise Agent Platform on Google Cloud, renamed from Vertex AI Agent Engine in April 2026.
It is a hyperscaler service, not a sandbox company. Agent Runtime deploys agents you build with ADK, LangGraph, LangChain, AG2 or LlamaIndex and bills them only while they work on a turn. Next to it, Agent Sandbox gives those agents a place to run code: a Code Execution sandbox, a shell or custom container sandbox, and a Computer Use browser. All of them run as secure containers inside your Google Cloud project.
Which use cases each one fits
For each use case, Battleships prices every sandbox provider on the same workload and sorts them from the cheapest monthly bill up. “13th cheapest of 345” means 12 of the other 344 providers run that workload, with every feature it needs, for less. “With limits” means the provider runs it but misses something, so it is listed after every full match. Open a use case for its whole ranking and what each provider misses.
| Use case and its workload | Cloudflare Sandbox: price rank | Google Agent Runtime: price rank | bochka: price rank |
|---|---|---|---|
| Software factory 100 at once · 4 vCPU / 8 GB · 2,200 sessions of 8 h a month Long builds need root, Docker and files that stay: Cloudflare has root and Docker but resets the disk on sleep, Google keeps files but runs without root or Docker, and bochka has all of it on one VM. | 162nd of 367, with limits $1,543 a month | 295th of 367, with limits $5,801 a month | 3rd cheapest of 367 $634 a month |
| Always-on AI employees 50 machines 24/7 · 2 vCPU / 4 GB Google Agent Runtime ranks 28th here because a paused sandbox keeps its files, though it is deleted after 7 days at most; Cloudflare wipes the disk on sleep, and bochka keeps the disk with no session cap on paid plans. | 207th of 366, with limits $2,188 a month | 28th cheapest of 366 $7,519 a month | 5th cheapest of 366 $657 a month |
| Code interpreter bursts 100 at once · 1 vCPU / 2 GB · 200,000 sessions of 1 min a month Cloudflare Sandbox ranks 13th here because CPU is billed only while busy and a container wakes on the next request; Google's Code Execution sandbox is a ready Python interpreter with no network. | 13th cheapest of 345 $144 a month | 254th of 345, with limits $275 a month | 186th of 345, with limits $2,000 a month |
| Sandboxes for your users 300 at once · 2 vCPU / 4 GB · 30,000 sessions of 23 min a month Cloudflare Sandbox ranks 9th and fits well; Google gives your users a shell through its API but no public URL, and bochka ranks 1st with HTTPS on up to 50 ports per sandbox. | 9th cheapest of 361 $731 a month | 280th of 361, with limits $1,916 a month | Cheapest of 361 $209 a month |
| RL rollouts 1,000 at once · 2 vCPU / 4 GB · 1,000,000 sessions of 3 min a month | 144th of 360, with limits $9,428 a month | 128th of 360, with limits $8,240 a month | 34th of 360, with limits $2,000 a month |
| Agent evals 250 at once · 4 vCPU / 8 GB · 15,000 sessions of 20 min a month | 45th cheapest of 364 $818 a month | 79th cheapest of 364 $2,060 a month | 10th cheapest of 364 $200 a month |
| CI runners 40 at once · 8 vCPU / 16 GB · 6,000 sessions of 12 min a month Docker-heavy CI is hard on both: Cloudflare runs Docker with iptables turned off and 20 GB of disk by default, Google has no Docker at all, and bochka runs full Docker and systemd on every VM. | 301st of 377, with limits $704 a month | 98th cheapest of 377 $989 a month | 4th cheapest of 377 $86 a month |
| 24/7 dev boxes 1 machine 24/7 · 4 vCPU / 8 GB A dev box should keep its files: Cloudflare starts from a fresh disk after sleep, Google has no SSH and runs each command in a new shell, and bochka stops at no cost and resumes with its disk. | 70th cheapest of 368 $93 a month | 311th of 368, with limits $241 a month | 18th cheapest of 368 $26 a month |
| Computer-use agents 50 at once · 4 vCPU / 8 GB · 20,000 sessions of 15 min a month Google gives you a browser with a VNC view and a click and type API, Cloudflare removed its built-in desktop, and bochka streams a 60fps desktop with a computer-use API. | 166th of 369, with limits $460 a month | 283rd of 369, with limits $1,648 a month | 6th cheapest of 369 $200 a month |
| Browser-use agents 50 at once · 2 vCPU / 4 GB · 30,000 sessions of 10 min a month | 210th of 367, with limits $233 a month | 102nd of 367, with limits $824 a month | 7th cheapest of 367 $200 a month |
| Scraping & bots (startup scale) 50 at once · 1 vCPU / 2 GB · 100,000 sessions of 3 min a month | 250th of 346, with limits $286 a month | 53rd cheapest of 346 $515 a month | 6th cheapest of 346 $90 a month |
| Mass scraping & bots (undetectable) 1,000 at once · 1 vCPU / 2 GB · 3,000,000 sessions of 2 min a month | 169th of 338, with limits $5,741 a month | 210th of 338, with limits $8,240 a month | 71st of 338, with limits $1,800 a month |
| Parallel red teaming 200 at once · 2 vCPU / 4 GB · 5,000 sessions of 30 min a month Cloudflare containers cannot change iptables and take no raw TCP from outside, Google sandboxes have no root, and bochka gives full root networking, raw TCP and /dev/kvm. | 239th of 360, with limits $325 a month | 260th of 360, with limits $412 a month | 2nd cheapest of 360 $200 a month |
| GPU eval jobs 10 at once · 8 vCPU / 32 GB · 500 sessions of 30 min a month | Can't run it | Can't run it | Can't run it |
| macOS agents 5 at once · 4 vCPU / 8 GB · 1,000 sessions of 20 min a month | Can't run it | Can't run it | Can't run it |
Key features
| Feature | Cloudflare Sandbox | Google Agent Runtime | bochka |
|---|---|---|---|
| Isolation | Firecracker microVM per container, own kernel and network | Secure container sandboxing inside Google Cloud | Full VM with its own kernel on dedicated AMD Ryzen 9 9950X hosts |
| Root and Docker | Root; docker:dind with iptables and IP forwarding turned off | Runs as appuser with no sudo; images must not need root; no Docker | Root, systemd and full Docker on every machine |
| Nested virtualization | Not documented | Not documented | Yes, /dev/kvm (Android emulators, VMs) |
| Largest machine | 4 vCPU / 12 GiB / 20 GB disk by default (can be raised) | Runtime up to 8 vCPU and 32 GiB; sandbox maximum not published | Up to 16 vCPU / 32 GB, depending on plan |
| Files after a stop | Disk is fresh after sleep; snapshots (public beta, 30 days) or R2 backups when your code saves them | Pause keeps the file system at a lower, unpublished rate; the sandbox is deleted when its TTL ends | Disk kept; snapshot every minute and on stop; a stopped sandbox costs nothing |
| How long a sandbox lives | No fixed maximum runtime, but no guaranteed runtime either; host restarts wipe state | TTL of up to 7 days for a custom container and 14 days for Code Execution | No session cap on paid plans |
| Snapshots and branching | No fork; restore a saved snapshot or backup into a new sandbox | Snapshots keep memory and files; start many sandboxes from one snapshot | Fork a running sandbox without stopping it; no memory snapshots |
| Idle behavior | Sleeps after inactivity and wakes on the next request | Runtime skips idle time between turns; sandboxes bill while they exist | TTL based (1 h default, changeable); no idle timer |
| Reaching the sandbox | HTTP and WebSocket previews routed through your Worker; no raw TCP or public IP | Through Google's API or a private endpoint in your VPC; no public URL documented | HTTPS URLs for up to 50 ports, token-protected; raw TCP; own IPv6 or IPv4 |
| Egress control | allowedHosts deny-by-default list plus outbound handlers you write in Worker code | Off unless the template turns it on; route through your VPC with Cloud NAT, a static IP, Cloud NGFW or Secure Web Proxy | Open internet on every plan; no provider-side allowlist |
| Keeping keys out of the sandbox | Your outbound handler adds the token for any HTTP or HTTPS host; you write the code | You provision and scope the credentials the agent uses | Managed proxy for model providers and any HTTPS API you register; switch a credential to another account |
| Desktop and browser | Built-in desktop removed in SDK 0.10.2; bring your own | A browser in a container with a VNC live view, a click, type and screenshot API, and CDP | 60fps desktop and Chromium, computer-use API, embeddable stream |
| Coding agents | Run Claude Code, Codex, OpenCode or Pi in your own image | Managed Agents API (Preview) runs Google's Antigravity harness | Claude Code, Codex, OpenCode and more built in, with a prompt, steer and events API |
| Regions | Several regions across Cloudflare's network | 23 locations in the US, Europe, Asia, Canada, Australia and Brazil | EU only: Germany, Finland, France |
Every feature Battleships tracks (43)
| Feature | Cloudflare Sandbox | Google Agent Runtime | bochka |
|---|---|---|---|
| Full VM (own kernel) | Yes | No | Yes |
| Docker inside | Yes | No | Yes |
| Nested virtualization | No | No | Yes |
| Root | Yes | No | Yes |
| Systemd | Not published | Not published | Yes |
| Desktop GUI | No | No | Yes |
| Browser | No | Yes | Yes |
| Computer-use API | No | Yes | Yes |
| SSH | Yes | No | Yes |
| Persistent disk | No | Yes | Yes |
| Pause/resume | No | Yes | Yes |
| Automatic snapshots | No | Yes | Yes |
| Fork/clone | No | Yes | Yes |
| Live fork (no pause) | No | Yes | Yes |
| Memory fork | No | Yes | No |
| Custom image (Docker or snapshot) | Yes | Yes | Yes |
| ≥24 h sessions | Yes | Yes | Yes |
| Idle auto-stop | Yes | No | No |
| Wake on request | Yes | No | No |
| HTTPS preview URLs | Yes | No | Yes |
| Raw TCP inbound | No | Not published | Yes |
| Public IPv4 | No | No | No |
| Egress allowlist | Yes | Yes | No |
| Secret proxy | Yes | No | Yes |
| Secret proxy for any API | Yes | No | Yes |
| Preinstalled agents | Yes | Yes | Yes |
| Agent harness API | Yes | Yes | Yes |
| MCP server | No | No | No |
| GPU | No | No | No |
| Windows | No | No | No |
| Arm64 | No | Yes | No |
| Self-hosting | No | No | No |
| BYOC | No | No | No |
| Open source | Yes | No | No |
| Scoped API keys | Not published | Not published | Yes |
| Spend limits | No | Not published | Yes |
| Usage per sandbox (API) | Not published | Yes | Yes |
| Audit logs | Yes | Not published | No |
| SSO | Yes | Yes | No |
| SOC 2 | Yes | Yes | No |
| HIPAA | Yes | Yes | No |
| EU data residency | Yes | Yes | Yes |
| Zero data retention | Not published | Not published | Yes |
Performance
Neither Cloudflare Sandbox nor Google Agent Runtime has a result on the hpc-sandbox-benchmarks Node.js build-and-test loop, so there is no CPU number to compare between them. bochka did 26.69 runs per second there at 4 vCPU / 8 GB, in StarSling's public run of 2026-09-29.
Node.js build-and-test loop at 4 vCPU / 8 GB, higher is better. Measured with the open hpc-sandbox-benchmarks suite. Cloudflare Sandbox and Google Agent Runtime have no published run in this suite yet, so there is no like-for-like number to compare.
Pricing in five scenarios
Each bill is priced from the providers' public price lists by the open Battleships engine, with the cheapest plan that runs the scenario.
| Scenario | Cloudflare Sandbox, a month | Google Agent Runtime, a month | bochka, a month |
|---|---|---|---|
| One coding agent, workdays 4 vCPU / 8 GB, 50 GB disk, 8 hours a day, 22 days a month, files kept between days | $39 · Workers Paid · with limits | $73 · Pay as you go | $20 · $20/mo |
| One agent that never stops 4 vCPU / 8 GB, 50 GB disk, running 24/7 all month | $148 · Workers Paid · with limits | $301 · Pay as you go | $26 · $20/mo |
| 50 agents in parallel 50 machines of 4 vCPU / 8 GB at once, 8-hour sessions, 1,100 sessions a month, Docker inside | $1,660 · Workers Paid · with limits | $3,626 · Pay as you go · with limits | $317 · $20/mo × 3 seats |
| Sandboxes for your users 2 vCPU / 4 GB, 30,000 sessions of 10 minutes a month, up to 300 at once | $476 · Workers Paid | $1,030 · Pay as you go | $200 · $100/mo × 2 seats |
| 1,000 short jobs at once 2 vCPU / 4 GB, 1,000 at once, 3 minutes each, 200,000 jobs a month | $1,889 · Workers Paid · with limits | $2,060 · Pay as you go | $2,000 · $2000/mo · with limits |
Cloudflare Sandbox: You need Workers Paid ($5 a month minimum). CPU is billed only while busy; memory and disk are billed on the instance size you picked until the container sleeps, and 4 vCPU always comes with 12 GiB.
Google Agent Runtime: Google bills $0.085 per vCPU-hour and $0.009 per GiB-hour allocated, with the first 50 vCPU-hours and 100 GiB-hours free each month. Sandboxes are billed while they exist, and disk and egress rates are not published.
Google Agent Runtime: You pick a monthly plan from $20, and all of it is usage credit billed per second while a sandbox runs. A stopped sandbox costs nothing and keeps its disk.
Limits in those scenarios
Cloudflare's disk resets after sleep, so the three scenarios that keep 50 GB of files do not fit without your own snapshot or backup code, and the 1,000-job burst needs 2,000 vCPU against a default account limit of 1,500. Google fits most scenarios but cannot run the 50-agent fleet because its sandboxes have no Docker, and every Google row leaves disk and egress unpriced. On bochka the burst is the problem: starts above 90 a minute wait in a queue, and the plan allows 600 starts an hour.
| Scenario | Cloudflare Sandbox | Google Agent Runtime | bochka |
|---|---|---|---|
| One coding agent, workdays |
|
| None that bite |
| One agent that never stops |
|
| None that bite |
| 50 agents in parallel |
|
| None that bite |
| Sandboxes for your users | None that bite |
| None that bite |
| 1,000 short jobs at once |
|
|
|
Which one should you use?
Use Cloudflare Sandbox when
your app already runs on Workers and you want short sandboxes with root and Docker that sleep when idle and wake on the next request.
- Root and Docker inside. Useful if your agent needs root: Cloudflare runs docker:dind in each sandbox, while Google sandboxes run as an unprivileged user.
- Sleeps when idle, wakes on request. Useful for many short, spiky sessions: a sandbox sleeps when idle, wakes on the next request, and bills CPU only while busy.
- Next to your Workers. If your app already runs on Workers, sandboxes sit next to Durable Objects and R2, with egress rules you write as code.
Use Google Agent Runtime when
you build agents with ADK or LangGraph on Google Cloud and want them hosted inside your own project, with locked sandboxes you can pause and snapshot.
- A managed home for your agent code. Useful if you build agents with ADK or LangGraph: Agent Runtime hosts them and skips billing for idle time between turns.
- State you can pause and branch. Useful if you need to keep a sandbox's files on pause, or branch many sandboxes from one memory snapshot.
- Inside your Google Cloud network. Useful if agents must stay in a Google Cloud perimeter, with egress off by default and 23 locations to pick from.
Where bochka fits
Both are built around short, controlled runs: Cloudflare forgets the disk when a sandbox sleeps, and Google locks the sandbox down without root and deletes it after a week. If your agents do long, real work like builds, Docker stacks, emulators and a desktop, bochka gives each one a full VM that keeps its files.
A full VM with root, Docker and /dev/kvm
Cloudflare runs Docker with iptables turned off and 20 GB of disk by default; Google has no sudo and no Docker at all, so you bake every tool into an image ahead of time.
A disk that stays, with no session cap
Cloudflare wipes the disk on sleep unless your code saves a snapshot, kept 30 days; Google deletes a sandbox when its TTL ends, 7 days at most. bochka saves the disk every minute, and a stopped sandbox costs nothing.
Coding agents driven from outside
On Cloudflare you install each agent in your image and write the handler that adds every key; Google only runs its own Antigravity harness, in Preview. bochka ships Claude Code, Codex and more, with keys kept outside.
Use bochka when your agents need a real computer for hours: root, Docker, a desktop and public URLs on a full VM that keeps its disk, with coding agents built in. Compare it one to one: bochka vs Cloudflare Sandbox and bochka vs Google Agent Runtime.
Questions people ask
Is Cloudflare Sandbox cheaper than Google Agent Runtime?
In all five scenarios on this page, Cloudflare's estimate is lower: $39 against $73 for one agent on workdays, $148 against $301 for one agent all month, and $476 against $1,030 for sandboxes for your users. But Cloudflare does not fit the scenarios that keep files between days, and bochka comes to $20, $26 and $200 for those three.
Which is faster?
There is no comparable CPU measurement for either one. bochka did 26.69 Node.js build-and-test runs per second at 4 vCPU / 8 GB, but Cloudflare and Google were not part of that run.
Can I run Docker in Cloudflare Sandbox or Google Agent Runtime?
On Cloudflare, yes, with docker:dind and the daemon's iptables and IP forwarding turned off. On Google, no: commands run as the unprivileged user appuser with no sudo. bochka runs full Docker with root and systemd.
Which one keeps my files?
Google can pause a sandbox with its file system and snapshot its memory, but deletes it when its TTL ends. Cloudflare starts from a fresh disk after sleep unless your code saved a snapshot or an R2 backup. bochka keeps the disk on its own and saves it every minute.
Is Google Agent Runtime the same as Vertex AI Agent Engine?
Yes. Google renamed Vertex AI Agent Engine to Agent Runtime in April 2026, as part of Gemini Enterprise Agent Platform. Its code, shell and browser sandboxes are a separate part called Agent Sandbox.
Where does each one run?
Cloudflare places containers in several regions of its network and picks the nearest free one. Google runs in 23 locations across the US, Europe, Asia, Canada, Australia and Brazil. bochka runs in the EU only, in Germany, Finland and France.
Try bochka
Install the CLI, then run bochka new.
Product preview
More comparisons
- bochka vs Cloudflare Sandbox
- bochka vs Google Agent Runtime
- E2B vs Cloudflare Sandbox
- Daytona vs Cloudflare Sandbox
- Modal vs Cloudflare Sandbox
- Vercel Sandbox vs Cloudflare Sandbox
- Cloudflare Sandbox vs Blaxel
- Cloudflare Sandbox vs Runloop
- Cloudflare Sandbox vs Tensorlake
- Cloudflare Sandbox vs Morph Cloud
- Cloudflare Sandbox vs CodeSandbox SDK
- Cloudflare Sandbox vs Northflank