Cloudflare Sandbox vs Modal VM Sandboxes

Both give each sandbox its own kernel. Cloudflare runs a container inside your Workers app that sleeps when idle and wakes on the next request, while Modal runs a full Linux VM with Docker and systemd that lasts up to 24 hours.

The companies and products

Cloudflare Sandbox

Cloudflare Sandbox SDK runs untrusted or AI-generated code in Linux containers on Cloudflare's network, driven from a Cloudflare Worker.

Each sandbox is a Cloudflare Container backed by a Durable Object, and each container runs in its own Firecracker microVM with its own kernel and network. You build a linux/amd64 image, pick an instance type of up to 4 vCPU and 12 GiB, and reach the sandbox through your own Worker. It suits teams already on Workers who want short-lived sandboxes that sleep when idle; for code that only calls known methods, Cloudflare also offers Dynamic Workers, which run JavaScript in V8 isolates.

Isolation: Firecracker microVM per container, own kernel and network
Largest instance: 4 vCPU, 12 GiB memory, 20 GB disk (defaults, can be raised)
Disk: Ephemeral by default: a container that sleeps starts again from a fresh disk
Plan needed: Workers Paid, $5 a month account minimum; not on the Free plan
Account limits: 1,500 vCPU, 6 TiB memory and 30 TB disk running at once
Placement: Instances spread across several regions of Cloudflare's network, nearest free one picked
Compliance: Cloudflare holds a SOC 2 Type II report

Modal VM Sandboxes

Modal is a serverless cloud for AI work, and VM Sandboxes are the version of its sandboxes that run in a virtual machine with their own Linux kernel.

You create a VM Sandbox from Python, TypeScript or Go code with runtime="vm", run commands in it, and terminate it when the job is done. Modal built the runtime on the Rust-based Cloud Hypervisor, so Docker, FUSE, systemd and nested cgroups work, with the same API, images and prices as its gVisor sandboxes. It became generally available on 1 October 2026 and suits teams that want many short-lived agent machines next to Modal's inference and training.

Founders: Erik Bernhardsson and Akshat Bubna
Offices: New York, Stockholm and San Francisco
Funding: Over $466M raised
Isolation: Virtual machine per sandbox on Cloud Hypervisor, with its own Linux 7.2 kernel
Generally available: 1 October 2026; early customers launched over 20 million VMs before that
Session length: Default 5 minutes, maximum 24 hours
Compliance: SOC 2 on every plan; HIPAA on Enterprise

Which use cases each one fits

For each use case, Battleships prices every sandbox provider on the same workload and sorts them from the cheapest monthly bill up. “13th cheapest of 345” means 12 of the other 344 providers run that workload, with every feature it needs, for less. “With limits” means the provider runs it but misses something, so it is listed after every full match. Open a use case for its whole ranking and what each provider misses.

Use case and its workload	Cloudflare Sandbox: price rank	Modal VM Sandboxes: price rank	bochka: price rank
Software factory 100 at once · 4 vCPU / 8 GB · 2,200 sessions of 8 h a month Neither keeps a workday's disk on its own: Cloudflare starts fresh after sleep and Modal ends the VM within 24 hours, while bochka keeps the disk and adds a desktop to check the app.	162nd of 367, with limits $1,543 a month	84th of 367, with limits $759 a month	3rd cheapest of 367 $634 a month
Always-on AI employees 50 machines 24/7 · 2 vCPU / 4 GB	207th of 366, with limits $2,188 a month	Can't run it	5th cheapest of 366 $657 a month
Code interpreter bursts 100 at once · 1 vCPU / 2 GB · 200,000 sessions of 1 min a month Short code-interpreter calls suit Cloudflare well, since CPU is billed only while busy and a container wakes on the next request.	13th cheapest of 345 $144 a month	Can't run it	186th of 345, with limits $2,000 a month
Sandboxes for your users 300 at once · 2 vCPU / 4 GB · 30,000 sessions of 23 min a month Cloudflare fits sandboxes for your users if your app already runs on Workers; bochka also fits and keeps each user's disk while a stopped sandbox costs nothing.	9th cheapest of 361 $731 a month	Can't run it	Cheapest of 361 $209 a month
RL rollouts 1,000 at once · 2 vCPU / 4 GB · 1,000,000 sessions of 3 min a month Huge bursts of short rollouts are where Modal shines, with 5,000 containers at once on Team, while Cloudflare is capped at 1,500 vCPU per account by default.	144th of 360, with limits $9,428 a month	171st of 360, with limits $16,322 a month	34th of 360, with limits $2,000 a month
Agent evals 250 at once · 4 vCPU / 8 GB · 15,000 sessions of 20 min a month	45th cheapest of 364 $818 a month	Can't run it	10th cheapest of 364 $200 a month
CI runners 40 at once · 8 vCPU / 16 GB · 6,000 sessions of 12 min a month Docker builds run more fully on Modal's VM than on Cloudflare, where iptables is off and disk is 20 GB by default; bochka adds /dev/kvm on every plan.	301st of 377, with limits $704 a month	188th of 377, with limits $1,064 a month	4th cheapest of 377 $86 a month
24/7 dev boxes 1 machine 24/7 · 4 vCPU / 8 GB A dev box should keep its files when you log off: Cloudflare wipes the disk on sleep, Modal stops within 24 hours, and bochka stops for free with its disk.	70th cheapest of 368 $93 a month	Can't run it	18th cheapest of 368 $26 a month
Computer-use agents 50 at once · 4 vCPU / 8 GB · 20,000 sessions of 15 min a month Neither ships a desktop: Cloudflare removed its built-in one and Modal only has an Xvfb and VNC example, while bochka has a 60fps desktop and a computer-use API.	166th of 369, with limits $460 a month	Can't run it	6th cheapest of 369 $200 a month
Browser-use agents 50 at once · 2 vCPU / 4 GB · 30,000 sessions of 10 min a month	210th of 367, with limits $233 a month	Can't run it	7th cheapest of 367 $200 a month
Scraping & bots (startup scale) 50 at once · 1 vCPU / 2 GB · 100,000 sessions of 3 min a month	250th of 346, with limits $286 a month	Can't run it	6th cheapest of 346 $90 a month
Mass scraping & bots (undetectable) 1,000 at once · 1 vCPU / 2 GB · 3,000,000 sessions of 2 min a month	169th of 338, with limits $5,741 a month	Can't run it	71st of 338, with limits $1,800 a month
Parallel red teaming 200 at once · 2 vCPU / 4 GB · 5,000 sessions of 30 min a month Modal's VM gives raw TCP tunnels and nested virtualization on request, Cloudflare blocks iptables changes and raw TCP, and bochka has full root networking and /dev/kvm.	239th of 360, with limits $325 a month	294th of 360, with limits $642 a month	2nd cheapest of 360 $200 a month
GPU eval jobs 10 at once · 8 vCPU / 32 GB · 500 sessions of 30 min a month	Can't run it	Can't run it	Can't run it
macOS agents 5 at once · 4 vCPU / 8 GB · 1,000 sessions of 20 min a month	Can't run it	Can't run it	Can't run it

Key features

Feature	Cloudflare Sandbox	Modal VM Sandboxes	bochka
Isolation	Firecracker microVM per container, own kernel and network	VM with its own Linux 7.2 kernel on Cloud Hypervisor	Full VM with its own kernel on dedicated AMD Ryzen 9 9950X hosts
CPU benchmark (4 vCPU / 8 GB)	No result on this benchmark	15.54 runs/s	26.69 runs/s
Longest session	No fixed maximum, but no guaranteed runtime; stops after an inactivity timeout	24 hours (default 5 minutes)	No cap on paid plans; you set the time to live
Files between sessions	Fresh disk after sleep; snapshots (public beta, 30 days) or R2 backups your code saves	Gone when the VM ends; only Volumes and filesystem snapshots keep files	Disk kept; saved every minute and on stop; a stopped sandbox costs nothing
Fork	No fork; restore a saved snapshot or backup into a new sandbox	Snapshot the filesystem into an image and boot many new sandboxes; memory snapshots in alpha	Fork a running sandbox with its disk, without stopping it
Docker inside	docker:dind with iptables and IP forwarding turned off	Docker, systemd and root; start dockerd yourself as the entrypoint	Full Docker, root and systemd in every sandbox
Nested virtualization	Not documented	Team and Enterprise plans only, on request	Yes, /dev/kvm on every plan
Desktop and browser	Built-in desktop removed in SDK 0.10.2; bring your own	Not offered; an example sets up Xvfb and VNC yourself	60fps desktop, Chromium and computer-use API built in
Coding agents and API keys	Run agents in your image; your outbound handler adds tokens for any HTTP or HTTPS host	Examples only; secrets are environment variables, or your own proxy in a sidecar	Claude Code, Codex and others preinstalled with a prompt, steer and events API; managed proxy keeps real keys out
Inbound traffic	HTTP and WebSocket previews through your Worker; no raw TCP or public IP	Encrypted and raw TCP tunnels, connect tokens, inbound IP allowlist	HTTPS URLs for up to 50 ports, token-protected; raw TCP
Outbound network rules	allowedHosts deny-by-default list plus outbound handlers you write in Worker code	Block all, IP-range allowlist, domain allowlist (beta)	Open internet, no provider-side allowlist
Sleep when idle	Stops after inactivity and wakes on the next request	No paused state; you terminate the sandbox or it times out	TTL based (1 h default, changeable); stop for free and resume with the disk
Running at once	1,500 vCPU per account by default, can be raised	100 containers on Starter, 5,000 on Team	Start limits per plan: the $2,000 plan starts up to 90 a minute and 600 an hour
Regions	Several regions across Cloudflare's network, nearest free one picked	US, EU and Asia-Pacific; pinning a region costs 1.15x to 1.75x	EU only: Germany, Finland, France

Every feature Battleships tracks (43)

Feature	Cloudflare Sandbox	Modal VM Sandboxes	bochka
Full VM (own kernel)	Yes	Yes	Yes
Docker inside	Yes	Yes	Yes
Nested virtualization	No	Yes	Yes
Root	Yes	Yes	Yes
Systemd	Not published	Yes	Yes
Desktop GUI	No	No	Yes
Browser	No	No	Yes
Computer-use API	No	No	Yes
SSH	Yes	Yes	Yes
Persistent disk	No	Yes	Yes
Pause/resume	No	No	Yes
Automatic snapshots	No	No	Yes
Fork/clone	No	Yes	Yes
Live fork (no pause)	No	Yes	Yes
Memory fork	No	Yes	No
Custom image (Docker or snapshot)	Yes	Yes	Yes
≥24 h sessions	Yes	Yes	Yes
Idle auto-stop	Yes	Yes	No
Wake on request	Yes	No	No
HTTPS preview URLs	Yes	Yes	Yes
Raw TCP inbound	No	Yes	Yes
Public IPv4	No	No	No
Egress allowlist	Yes	Yes	No
Secret proxy	Yes	No	Yes
Secret proxy for any API	Yes	No	Yes
Preinstalled agents	Yes	No	Yes
Agent harness API	Yes	No	Yes
MCP server	No	No	No
GPU	No	No	No
Windows	No	No	No
Arm64	No	No	No
Self-hosting	No	No	No
BYOC	No	No	No
Open source	Yes	No	No
Scoped API keys	Not published	Not published	Yes
Spend limits	No	Not published	Yes
Usage per sandbox (API)	Not published	Not published	Yes
Audit logs	Yes	Yes	No
SSO	Yes	Yes	No
SOC 2	Yes	Yes	No
HIPAA	Yes	Yes	No
EU data residency	Yes	Yes	Yes
Zero data retention	Not published	Not published	Yes

Performance

Cloudflare SandboxNot measured

Modal VM Sandboxes15.54 runs/s

bochka26.69 runs/s

On the hpc-sandbox-benchmarks Node.js build-and-test loop at 4 vCPU / 8 GB, bochka did 26.69 runs per second and Modal's VM runtime did 15.54, so bochka did about 1.7 times the CPU work in the same time. Cloudflare has no result on that benchmark, so there is no comparable CPU number for it. This measures CPU speed only, not start time.

Node.js build-and-test loop at 4 vCPU / 8 GB, higher is better. Measured with the open hpc-sandbox-benchmarks suite. Modal VM Sandboxes measured on: VM Sandbox, request = size. Cloudflare Sandbox has no published run in this suite yet, so there is no like-for-like number to compare.

Pricing in five scenarios

Each bill is priced from the providers' public price lists by the open Battleships engine, with the cheapest plan that runs the scenario.

Scenario	Cloudflare Sandbox, a month	Modal VM Sandboxes, a month	bochka, a month
One coding agent, workdays 4 vCPU / 8 GB, 50 GB disk, 8 hours a day, 22 days a month, files kept between days	$39 · Workers Paid · with limits	$15 · Starter · with limits	$20 · $20/mo
One agent that never stops 4 vCPU / 8 GB, 50 GB disk, running 24/7 all month	$148 · Workers Paid · with limits	$178 · Starter · with limits	$26 · $20/mo
50 agents in parallel 50 machines of 4 vCPU / 8 GB at once, 8-hour sessions, 1,100 sessions a month, Docker inside	$1,660 · Workers Paid · with limits	$2,229 · Starter · with limits	$317 · $20/mo × 3 seats
Sandboxes for your users 2 vCPU / 4 GB, 30,000 sessions of 10 minutes a month, up to 300 at once	$476 · Workers Paid	$792 · Team	$200 · $100/mo × 2 seats
1,000 short jobs at once 2 vCPU / 4 GB, 1,000 at once, 3 minutes each, 200,000 jobs a month	$1,889 · Workers Paid · with limits	$3,193 · Team · with limits	$2,000 · $2000/mo · with limits

Cloudflare Sandbox: You need Workers Paid ($5 a month minimum). CPU is billed only while busy, and memory and disk are billed on the instance size in 10 ms steps until the container sleeps; 4 vCPU always comes with 12 GiB.

Modal VM Sandboxes: Modal bills by the second for the higher of what you request or use, until the sandbox ends. Starter is free with $30 of monthly credit, Team is $250 a month with $100 of credit, and pinning a region costs 1.15x to 1.75x.

Modal VM Sandboxes: Plans start at $20 a month and the whole fee becomes usage credit, billed per second while a sandbox runs. A stopped sandbox costs nothing and keeps its disk.

Limits in those scenarios

Cloudflare's disk resets after sleep, and Modal's VM keeps files only in Volumes or snapshots, so neither fits the workday, always-on or 50-agent scenarios as priced; Modal's Starter plan also caps a session at 24 hours. For 1,000 jobs at once, Cloudflare's 1,500 vCPU account cap is short of the 2,000 needed, and Modal's Team price relies on shared vCPUs that other tenants can slow. On bochka that burst hits start limits: the $2,000 plan starts 600 sandboxes an hour and queues bursts above 90 a minute.

Scenario	Cloudflare Sandbox	Modal VM Sandboxes	bochka
One coding agent, workdays	missing persistent disk	files survive a stop only in Volumes: packages installed elsewhere reset	None that bite
One agent that never stops	missing persistent disk	Starter: sessions capped at 24 h files survive a stop only in Volumes: packages installed elsewhere reset	None that bite
50 agents in parallel	missing persistent disk	files survive a stop only in Volumes: packages installed elsewhere reset	None that bite
Sandboxes for your users	None that bite	None that bite	None that bite
1,000 short jobs at once	Workers Paid: max 1,500 vCPU running at once (needs 2,000)	shared vCPUs on this tier (Modal (VM Sandboxes) sells dedicated cores separately as “VM Sandbox, request = size”): heavy, sustained CPU use can be slowed by other tenants	max 2,400 starts/day (needs ~6,667) max 600 starts/hour (needs ~1,000) bursts above 90 starts/min are queued (a burst of 333 takes ~4 min to start)

Which one should you use?

Use Cloudflare Sandbox when

your app already runs on Workers and you want short sandboxes that sleep when idle, wake on the next request, and follow egress rules you write as code.

Sleeps when idle, wakes on request. Useful for many short, spiky sessions: a sandbox sleeps when quiet, wakes on the next request, and bills CPU only while busy.
Egress rules you can program. Cloudflare can block every host except the ones you list, and run your own Worker code on each outbound request.
Built into the Workers platform. If your app already runs on Workers, sandboxes sit next to Durable Objects and R2 with little to wire up.

Use Modal VM Sandboxes when

you need a real VM with Docker and systemd for jobs that finish within a day, run huge bursts, or already run your models on Modal.

A real VM with Docker and systemd. Modal's VM runs its own Linux kernel, so Docker, FUSE and systemd work as they would on a normal Linux machine.
Very large bursts. Useful for huge bursts of short jobs: Team runs 5,000 containers at once, and memory snapshots are in alpha.
One platform with inference and training. If you already serve or train models on Modal, sandboxes, GPUs and models share one account and one bill.

Where bochka fits

Cloudflare and Modal both suit short sandboxes that end and get thrown away. If your agents work for hours or days and come back to the same machine, bochka gives them a full VM that keeps its disk, runs a desktop and comes with coding agents ready to drive from outside.

Files that stay put

Cloudflare starts from a fresh disk after sleep, and a Modal VM ends within 24 hours with its root disk. On both you write code to save snapshots, backups or Volumes and restore them. bochka saves the disk every minute and on stop.

A full machine for builds and UI checks

Cloudflare runs Docker with iptables off and 20 GB of disk by default, and Modal offers nested virtualization only on Team on request. Neither has a desktop. bochka has full Docker, /dev/kvm and a 60fps desktop on every plan.

Agents driven from outside, keys kept out

On Cloudflare you bake each agent into your image and write the outbound handler that adds tokens. Modal has examples only, with keys in environment variables or your own sidecar proxy. bochka ships the agents and a managed key proxy.

Use bochka when your agents work for hours or days on a machine they come back to: full Docker, /dev/kvm, a desktop and coding agents, on a faster VM that keeps its disk. Compare it one to one: bochka vs Cloudflare Sandbox and bochka vs Modal VM Sandboxes.

Questions people ask

Is Cloudflare Sandbox cheaper than Modal VM Sandboxes?

Usually, in our scenarios: 300 user sandboxes at once cost $476 a month on Cloudflare against $792 on Modal, and 50 parallel agents $1,660 against $2,229. For one coding agent on workdays Modal is lower ($15 against $39), and one always-on agent is $148 on Cloudflare against $178 on Modal. bochka costs $200, $317, $20 and $26 a month for those four.

Which is faster?

Modal's VM runtime did 15.54 runs per second on the hpc-sandbox-benchmarks CPU test at 4 vCPU / 8 GB. Cloudflare has no result on that test. bochka did 26.69, about 1.7 times Modal's CPU work in the same time.

Can Cloudflare Sandbox run Docker?

Yes, as docker:dind with the daemon's iptables and IP forwarding turned off, because containers cannot change iptables. Modal's VM runs Docker with systemd and root once you start dockerd as the entrypoint. bochka runs full Docker in every sandbox.

How long can each sandbox run?

A Modal VM Sandbox defaults to 5 minutes and stops at 24 hours at most. Cloudflare has no fixed maximum, but it stops an idle container and does not guarantee any runtime. bochka has no session cap on paid plans.

Do they keep my files?

Not on their own. Cloudflare starts from a fresh disk after sleep unless your code saved a snapshot or an R2 backup, and Modal keeps only what you put in a Volume or a filesystem snapshot. bochka keeps the whole disk across free stops.

Which handles big bursts of short jobs better?

Modal is built for it, with 5,000 containers at once on Team. Cloudflare's account cap is 1,500 vCPU at once by default, though it can be raised. bochka queues large bursts because of per-plan start limits.

Try bochka

Install the CLI, then run bochka new.

Product preview