Cloudflare Sandbox vs Tensorlake
Both run each sandbox in its own microVM with its own kernel. Cloudflare Sandbox is a container inside the Workers platform that sleeps when idle and starts again from a fresh disk, while Tensorlake is a sandbox API whose named sandboxes suspend with their memory and running processes and can be copied into warm clones.
The companies and products
Cloudflare Sandbox
Cloudflare Sandbox SDK runs untrusted or AI-generated code in Linux containers on Cloudflare's network, driven from a Cloudflare Worker.
Each sandbox is a Cloudflare Container backed by a Durable Object, and each container runs in its own Firecracker microVM with its own kernel and network. You build a linux/amd64 image, pick an instance type of up to 4 vCPU and 12 GiB, and reach the sandbox through your own Worker. It suits teams already on Workers who want short-lived sandboxes that sleep when idle; for code that only calls known methods, Cloudflare also offers Dynamic Workers, which run JavaScript in V8 isolates.
- Largest instance
- 4 vCPU, 12 GiB memory, 20 GB disk (defaults, can be raised)
- Account limits
- 1,500 vCPU, 6 TiB memory and 30 TB disk running at once
- Compliance
- Cloudflare holds a SOC 2 Type II report
Tensorlake
Tensorlake is a San Francisco company that sells infrastructure for AI agents, with sandboxes as its main product.
Tensorlake Sandboxes are microVMs, backed by Firecracker and Cloud Hypervisor, that you create through an API and that boot in a few hundred milliseconds. Named sandboxes suspend when idle and keep their memory and running processes, and you can copy a running sandbox into several warm clones. Around them Tensorlake sells versioned file systems, hosted Git, an orchestration layer and a bring-your-own-cloud option, aimed at teams running coding agents, evals and RL rollouts.
- Headquarters
- San Francisco
- Investors shown
- Redpoint and Amplify Partners
Which use cases each one fits
For each use case, Battleships prices every sandbox provider on the same workload and sorts them from the cheapest monthly bill up. “13th cheapest of 345” means 12 of the other 344 providers run that workload, with every feature it needs, for less. “With limits” means the provider runs it but misses something, so it is listed after every full match. Open a use case for its whole ranking and what each provider misses.
| Use case and its workload | Cloudflare Sandbox: price rank | Tensorlake: price rank | bochka: price rank |
|---|---|---|---|
| Software factory 100 at once · 4 vCPU / 8 GB · 2,200 sessions of 8 h a month Tensorlake fits a full software factory because its sandboxes keep their files, while Cloudflare's disk resets on sleep; bochka adds nested virtualization and coding agents built in. | 162nd of 367, with limits $1,543 a month | 5th cheapest of 367 $1,010 a month | 3rd cheapest of 367 $634 a month |
| Always-on AI employees 50 machines 24/7 · 2 vCPU / 4 GB Always-on assistants need their files to stay; Tensorlake keeps files and memory through suspend, Cloudflare wipes the disk on sleep, and bochka keeps the disk with no session cap. | 207th of 366, with limits $2,188 a month | 9th cheapest of 366 $1,381 a month | 5th cheapest of 366 $657 a month |
| Code interpreter bursts 100 at once · 1 vCPU / 2 GB · 200,000 sessions of 1 min a month Short code-interpreter calls suit both: Cloudflare bills CPU only while busy and wakes on the next request, and Tensorlake boots in a few hundred milliseconds. | 13th cheapest of 345 $144 a month | 24th cheapest of 345 $250 a month | 186th of 345, with limits $2,000 a month |
| Sandboxes for your users 300 at once · 2 vCPU / 4 GB · 30,000 sessions of 23 min a month Both fit sandboxes for your users; Cloudflare puts egress rules in Worker code, Tensorlake takes allow and deny lists, and bochka adds per-sandbox usage and spend limits. | 9th cheapest of 361 $731 a month | 5th cheapest of 361 $471 a month | Cheapest of 361 $209 a month |
| RL rollouts 1,000 at once · 2 vCPU / 4 GB · 1,000,000 sessions of 3 min a month Tensorlake ranks first here: it runs up to 1,000 sandboxes at once on Pro and clones a warm state, while Cloudflare has no fork and bochka's start-rate limits queue big bursts. | 144th of 360, with limits $9,428 a month | Cheapest of 360 $5,637 a month | 34th of 360, with limits $2,000 a month |
| Agent evals 250 at once · 4 vCPU / 8 GB · 15,000 sessions of 20 min a month | 45th cheapest of 364 $818 a month | 24th cheapest of 364 $506 a month | 10th cheapest of 364 $200 a month |
| CI runners 40 at once · 8 vCPU / 16 GB · 6,000 sessions of 12 min a month Docker builds need room; Cloudflare caps disk at 20 GB by default and turns off iptables for Docker, while Tensorlake and bochka run Docker with systemd. | 301st of 377, with limits $704 a month | 54th cheapest of 377 $424 a month | 4th cheapest of 377 $86 a month |
| 24/7 dev boxes 1 machine 24/7 · 4 vCPU / 8 GB Cloudflare is a compromise for a dev box because the disk resets on sleep, Tensorlake is built around suspending idle sandboxes, and bochka stops at no cost and keeps its disk. | 70th cheapest of 368 $93 a month | 185th of 368, with limits $250 a month | 18th cheapest of 368 $26 a month |
| Computer-use agents 50 at once · 4 vCPU / 8 GB · 20,000 sessions of 15 min a month Tensorlake ships an XFCE desktop with Firefox over VNC, Cloudflare removed its built-in desktop, and bochka has a 60fps desktop with a computer-use API. | 166th of 369, with limits $460 a month | 9th cheapest of 369 $294 a month | 6th cheapest of 369 $200 a month |
| Browser-use agents 50 at once · 2 vCPU / 4 GB · 30,000 sessions of 10 min a month | 210th of 367, with limits $233 a month | 13th cheapest of 367 $250 a month | 7th cheapest of 367 $200 a month |
| Scraping & bots (startup scale) 50 at once · 1 vCPU / 2 GB · 100,000 sessions of 3 min a month | 250th of 346, with limits $286 a month | 22nd cheapest of 346 $250 a month | 6th cheapest of 346 $90 a month |
| Mass scraping & bots (undetectable) 1,000 at once · 1 vCPU / 2 GB · 3,000,000 sessions of 2 min a month | 169th of 338, with limits $5,741 a month | 121st of 338, with limits $3,484 a month | 71st of 338, with limits $1,800 a month |
| Parallel red teaming 200 at once · 2 vCPU / 4 GB · 5,000 sessions of 30 min a month | 239th of 360, with limits $325 a month | 4th cheapest of 360 $250 a month | 2nd cheapest of 360 $200 a month |
| GPU eval jobs 10 at once · 8 vCPU / 32 GB · 500 sessions of 30 min a month | Can't run it | Can't run it | Can't run it |
| macOS agents 5 at once · 4 vCPU / 8 GB · 1,000 sessions of 20 min a month | Can't run it | Can't run it | Can't run it |
Key features
| Feature | Cloudflare Sandbox | Tensorlake | bochka |
|---|---|---|---|
| Isolation | Firecracker microVM per container, own kernel and network | Firecracker and Cloud Hypervisor microVMs with their own kernel; GPU sandboxes use gVisor | Full VM with its own kernel on dedicated AMD Ryzen 9 9950X hosts |
| Largest machine | 4 vCPU / 12 GiB / 20 GB disk by default (can be raised) | 16 vCPU / 64 GB RAM / 100 GB disk on Pro | Up to 16 vCPU / 32 GB, depending on plan |
| Files between sessions | Disk is fresh after sleep; snapshots (public beta, 30 days) or R2 backups when your code saves them | Named sandboxes suspend and keep files; ephemeral ones end on timeout | Disk kept; snapshot every minute and on stop; a stopped sandbox costs nothing |
| Memory snapshots | No: snapshots save the root filesystem, not memory or processes | Yes: suspend keeps memory and running processes and restores warm | No: disk is kept, resume reboots the machine |
| Clone a running sandbox | No fork; restore a saved snapshot or backup into a new sandbox | Copy a running or suspended sandbox into N warm clones with memory | Fork a running sandbox (disk) without stopping it |
| Docker inside | docker:dind with iptables and IP forwarding turned off | Yes, on the tensorlake/ubuntu-systemd image | Full Docker, root and systemd |
| Nested virtualization | Not documented | No: sandboxes set SANDBOX_KVM_AVAILABLE=0 | Yes, /dev/kvm (Android emulators, VMs) |
| Desktop and computer use | Built-in desktop removed in SDK 0.10.2; bring your own | XFCE desktop with Firefox over VNC, with screenshot, mouse and keyboard calls | 60fps desktop and Chromium, computer-use API, embeddable stream |
| Coding agents | Run Claude Code, Codex, OpenCode or Pi in your image; OpenCode has an SDK helper | You bring and run your own agent; managed images are plain OS bases | Claude Code, Codex, OpenCode and more built in, with a prompt, steer and events API |
| Keeping keys out of the sandbox | Your outbound handler adds the token for any HTTP or HTTPS host; you write the code | Stored secrets are injected into the sandbox | Managed proxy for model providers and any HTTPS API you register; real keys never enter the sandbox |
| Inbound traffic | HTTP and WebSocket previews routed through your Worker; no raw TCP or public IP | HTTP, WebSocket and gRPC through an authenticated proxy on exposed ports | HTTPS URLs for up to 50 ports, token-protected, plus raw TCP and its own IP |
| Outbound rules | allowedHosts deny-by-default list plus outbound handlers you write in Worker code | allow_out and deny_out lists by domain, IP or CIDR, or no internet at all | No provider-side allowlist; you set your own firewall as root |
| Idle handling | Stops after inactivity and wakes on the next request | Idle timeout, 600 s by default, then suspend or terminate | Time-to-live (1 h by default, changeable or off); no idle timer |
| GPUs and where it runs | No GPUs; several regions across Cloudflare's network | GPU sandboxes by request; US and EU, or your own cloud through BYOC | No GPUs; EU only: Germany, Finland, France |
Every feature Battleships tracks (43)
| Feature | Cloudflare Sandbox | Tensorlake | bochka |
|---|---|---|---|
| Full VM (own kernel) | Yes | Yes | Yes |
| Docker inside | Yes | Yes | Yes |
| Nested virtualization | No | No | Yes |
| Root | Yes | Yes | Yes |
| Systemd | Not published | Yes | Yes |
| Desktop GUI | No | Yes | Yes |
| Browser | No | Yes | Yes |
| Computer-use API | No | Yes | Yes |
| SSH | Yes | Yes | Yes |
| Persistent disk | No | Yes | Yes |
| Pause/resume | No | Yes | Yes |
| Automatic snapshots | No | Yes | Yes |
| Fork/clone | No | Yes | Yes |
| Live fork (no pause) | No | Yes | Yes |
| Memory fork | No | Yes | No |
| Custom image (Docker or snapshot) | Yes | Yes | Yes |
| ≥24 h sessions | Yes | Yes | Yes |
| Idle auto-stop | Yes | Yes | No |
| Wake on request | Yes | Yes | No |
| HTTPS preview URLs | Yes | Yes | Yes |
| Raw TCP inbound | No | No | Yes |
| Public IPv4 | No | No | No |
| Egress allowlist | Yes | Yes | No |
| Secret proxy | Yes | No | Yes |
| Secret proxy for any API | Yes | No | Yes |
| Preinstalled agents | Yes | No | Yes |
| Agent harness API | Yes | No | Yes |
| MCP server | No | No | No |
| GPU | No | Yes | No |
| Windows | No | No | No |
| Arm64 | No | No | No |
| Self-hosting | No | No | No |
| BYOC | No | Yes | No |
| Open source | Yes | No | No |
| Scoped API keys | Not published | Not published | Yes |
| Spend limits | No | Not published | Yes |
| Usage per sandbox (API) | Not published | No | Yes |
| Audit logs | Yes | Not published | No |
| SSO | Yes | Yes | No |
| SOC 2 | Yes | Yes | No |
| HIPAA | Yes | Yes | No |
| EU data residency | Yes | Yes | Yes |
| Zero data retention | Not published | Yes | Yes |
Performance
bochka scores 26.69 runs/s on the hpc-sandbox-benchmarks Node.js build-and-test loop at 4 vCPU / 8 GB. Neither Cloudflare Sandbox nor Tensorlake has a result on that benchmark, so there is no comparable CPU number between the three. Tensorlake's docs say its default image starts in a few hundred milliseconds.
Node.js build-and-test loop at 4 vCPU / 8 GB, higher is better. Measured with the open hpc-sandbox-benchmarks suite. Cloudflare Sandbox and Tensorlake have no published run in this suite yet, so there is no like-for-like number to compare.
Pricing in five scenarios
Each bill is priced from the providers' public price lists by the open Battleships engine, with the cheapest plan that runs the scenario.
| Scenario | Cloudflare Sandbox, a month | Tensorlake, a month | bochka, a month |
|---|---|---|---|
| One coding agent, workdays 4 vCPU / 8 GB, 50 GB disk, 8 hours a day, 22 days a month, files kept between days | $39 · Workers Paid · with limits | $250 · Pro | $20 · $20/mo |
| One agent that never stops 4 vCPU / 8 GB, 50 GB disk, running 24/7 all month | $148 · Workers Paid · with limits | $250 · Pro | $26 · $20/mo |
| 50 agents in parallel 50 machines of 4 vCPU / 8 GB at once, 8-hour sessions, 1,100 sessions a month, Docker inside | $1,660 · Workers Paid · with limits | $1,030 · Pro | $317 · $20/mo × 3 seats |
| Sandboxes for your users 2 vCPU / 4 GB, 30,000 sessions of 10 minutes a month, up to 300 at once | $476 · Workers Paid | $293 · Pro | $200 · $100/mo × 2 seats |
| 1,000 short jobs at once 2 vCPU / 4 GB, 1,000 at once, 3 minutes each, 200,000 jobs a month | $1,889 · Workers Paid · with limits | $1,127 · Pro | $2,000 · $2000/mo · with limits |
Cloudflare Sandbox: You need Workers Paid ($5 a month minimum). CPU is billed only while busy; memory and disk are billed on the instance size you picked until the container sleeps, and 4 vCPU always comes with 12 GiB.
Tensorlake: Pro is $250 per billing cycle, which includes 25,000 CU of usage, then $0.01 per CU. CPU is billed while active, RAM and disk on what you allocate, and a suspended sandbox pays snapshot storage.
Tensorlake: Small users can buy prepaid Usage Credits packs from $5 at higher rates instead of Pro; sandboxes stop when the balance hits zero. The tables price the Pro path.
Tensorlake: You pick a monthly plan from $20, and the whole fee becomes usage credit, billed per second while a sandbox runs. A stopped sandbox costs nothing and keeps its disk.
Limits in those scenarios
Cloudflare's disk resets after sleep, so the three long-running agent scenarios, which need a persistent disk, do not fit without your own snapshot or backup code. A Cloudflare account runs 1,500 vCPU at once by default, short of the 2,000 vCPU the 1,000-job burst needs, though the limit can be raised. Tensorlake fits all five scenarios on Pro, which allows 1,000 sandboxes at once. bochka fits four; the burst runs into its start limits, since even the $2,000 plan queues bursts above 90 starts a minute.
| Scenario | Cloudflare Sandbox | Tensorlake | bochka |
|---|---|---|---|
| One coding agent, workdays |
| None that bite | None that bite |
| One agent that never stops |
| None that bite | None that bite |
| 50 agents in parallel |
| None that bite | None that bite |
| Sandboxes for your users | None that bite | None that bite | None that bite |
| 1,000 short jobs at once |
| None that bite |
|
Which one should you use?
Use Cloudflare Sandbox when
your app already runs on Workers and you want short sandboxes that sleep when idle, wake on the next request, and follow egress rules you write in code.
- Programmable egress. Cloudflare can block every host except the ones you list, and run your own Worker code on each outbound request.
- Sleeps when idle, wakes on request. Useful for many short, spiky sessions: a sandbox sleeps when quiet, wakes on the next request, and bills CPU only while busy.
- Next to the rest of Workers. If your app already runs on Workers, sandboxes sit next to Durable Objects and R2, in several regions of Cloudflare's network.
Use Tensorlake when
agents must resume mid-process or fan out from one warm state, or when you need GPUs, US regions or sandboxes in your own cloud account.
- Memory snapshots and warm clones. Useful when an agent must pick up mid-process: Tensorlake saves a sandbox's memory and copies it into warm clones.
- Bigger sandboxes that keep their files. Pro sandboxes go up to 16 vCPU, 64 GB RAM and 100 GB disk, and named ones keep their files through suspend.
- GPUs and your own cloud. Tensorlake offers GPU sandboxes by request and can run in your own AWS, GCP, Azure, CoreWeave, Nebius or bare-metal account.
Where bochka fits
If your agents work for hours on builds, tests, emulators and a desktop, look at bochka. It is a full VM that keeps its disk, runs coding agents you drive from outside, and keeps real API keys out of the machine. Neither Cloudflare Sandbox nor Tensorlake does all of that.
Emulators and VMs run inside
Tensorlake sandboxes have no /dev/kvm and Cloudflare does not document it, so an Android emulator or a VM has nowhere to start. bochka exposes /dev/kvm and full Docker with systemd, while Cloudflare runs Docker with iptables turned off.
Agents ready, keys kept outside
On both, you install the agent harness yourself. Tensorlake injects stored secrets into the sandbox the agent controls, and on Cloudflare you write and maintain the Worker code that adds every token. bochka ships the agents and a credential proxy.
Reach it like a server
Cloudflare routes only HTTP and WebSocket through your Worker, and Tensorlake's proxy carries HTTP, WebSocket and gRPC, so a database or other raw TCP service an agent starts can't be reached. bochka gives HTTPS URLs on 50 ports plus raw TCP.
Use bochka when your agents do real work for hours: builds, tests, full Docker, emulators and a desktop, with coding agents built in and keys kept outside the machine. Compare it one to one: bochka vs Cloudflare Sandbox and bochka vs Tensorlake.
Questions people ask
Is Cloudflare Sandbox cheaper than Tensorlake?
The per-hour estimates are often lower on Cloudflare, but Cloudflare does not fit the scenarios that keep files between sessions. For sandboxes for your users, where both fit, Tensorlake is $293 a month against $476 on Cloudflare. bochka is $200 a month for the same workload.
Which is faster?
Neither has a result on the hpc-sandbox-benchmarks CPU test, so there is no fair speed comparison. Tensorlake says its default image boots in a few hundred milliseconds, and a Cloudflare sandbox wakes on the next request. bochka scores 26.69 runs/s on that test.
Which one keeps my files?
Tensorlake's named sandboxes suspend with their files, memory and running processes. Cloudflare starts from a fresh disk after sleep unless your code saved a snapshot (public beta, kept 30 days) or an R2 backup. bochka keeps the disk on its own and saves it every minute.
Can I run Docker inside either one?
Yes. Tensorlake runs Docker on its ubuntu-systemd image. Cloudflare supports docker:dind with iptables and IP forwarding turned off. bochka runs full Docker with root and systemd.
Which has GPUs?
Tensorlake offers GPU sandboxes by request, running on gVisor. Cloudflare Sandbox and bochka have no GPUs.
Where do they run?
Cloudflare places containers in several regions of its network. Tensorlake runs in the US and the EU, or in your own cloud through BYOC. bochka runs only in the EU, in Germany, Finland and France.
Try bochka
Install the CLI, then run bochka new.
Product preview
More comparisons
- bochka vs Cloudflare Sandbox
- bochka vs Tensorlake
- E2B vs Cloudflare Sandbox
- Daytona vs Cloudflare Sandbox
- Modal vs Cloudflare Sandbox
- Vercel Sandbox vs Cloudflare Sandbox
- Cloudflare Sandbox vs Blaxel
- Cloudflare Sandbox vs Runloop
- Cloudflare Sandbox vs Morph Cloud
- Cloudflare Sandbox vs CodeSandbox SDK
- Cloudflare Sandbox vs Northflank
- Cloudflare Sandbox vs Fly.io Machines