Cloudflare Sandbox vs Together Code Sandbox
Cloudflare Sandbox runs containers in their own microVMs inside Workers, sleeping when idle and waking on the next request, and anyone on Workers Paid can use it. Together Code Sandbox starts VMs from snapshots and can save their memory when they end, but Together has to enable it for your organization.
The companies and products
Cloudflare Sandbox
Cloudflare Sandbox SDK runs untrusted or AI-generated code in Linux containers on Cloudflare's network, driven from a Cloudflare Worker.
Each sandbox is a Cloudflare Container backed by a Durable Object, and each container runs in its own Firecracker microVM with its own kernel and network. You build a linux/amd64 image, pick an instance type of up to 4 vCPU and 12 GiB, and reach the sandbox through your own Worker. It suits teams already on Workers who want short-lived sandboxes that sleep when idle; for code that only calls known methods, Cloudflare also offers Dynamic Workers, which run JavaScript in V8 isolates.
- Largest instance
- 4 vCPU, 12 GiB memory, 20 GB disk (defaults, can be raised)
- Account limits
- 1,500 vCPU, 6 TiB memory and 30 TB disk running at once
- Compliance
- Cloudflare holds a SOC 2 Type II report
Together Code Sandbox
Together AI is a cloud for running and training AI models, and Code Sandbox is its product for running code in isolated VMs.
You build a snapshot from a Docker image or Dockerfile on Together's builder, then start sandboxes from it and run commands and file operations through the together-sandbox SDK or CLI. When a sandbox ends you can save its disk, and its memory too, as a new snapshot to start more sandboxes from. It is aimed at model-generated code, agent tool calls and reinforcement learning rollouts, and it must be enabled for your organization by Together. Together also sells Code Interpreter, a separate API that runs Python code in short sessions.
Which use cases each one fits
For each use case, Battleships prices every sandbox provider on the same workload and sorts them from the cheapest monthly bill up. “13th cheapest of 345” means 12 of the other 344 providers run that workload, with every feature it needs, for less. “With limits” means the provider runs it but misses something, so it is listed after every full match. Open a use case for its whole ranking and what each provider misses.
| Use case and its workload | Cloudflare Sandbox: price rank | Together Code Sandbox: price rank | bochka: price rank |
|---|---|---|---|
| Software factory 100 at once · 4 vCPU / 8 GB · 2,200 sessions of 8 h a month A software factory needs Docker, root and a disk that stays; Cloudflare resets the disk on sleep and turns off iptables, Together does not document Docker inside, and bochka has all of it. | 162nd of 367, with limits $1,543 a month | 65th of 367, with limits $528 a month | 3rd cheapest of 367 $634 a month |
| Always-on AI employees 50 machines 24/7 · 2 vCPU / 4 GB | 207th of 366, with limits $2,188 a month | 152nd of 366, with limits $1,095 a month | 5th cheapest of 366 $657 a month |
| Code interpreter bursts 100 at once · 1 vCPU / 2 GB · 200,000 sessions of 1 min a month Cloudflare fits short code-interpreter calls well, billing CPU only while busy; Together's Code Interpreter runs only Python in 60-minute sessions. | 13th cheapest of 345 $144 a month | 326th of 345, with limits $2,190 a month | 186th of 345, with limits $2,000 a month |
| Sandboxes for your users 300 at once · 2 vCPU / 4 GB · 30,000 sessions of 23 min a month Cloudflare and bochka both fit sandboxes for your users; on Together every port of a sandbox is public and preview URLs are still coming soon. | 9th cheapest of 361 $731 a month | 234th of 361, with limits $900 a month | Cheapest of 361 $209 a month |
| RL rollouts 1,000 at once · 2 vCPU / 4 GB · 1,000,000 sessions of 3 min a month Together can save a sandbox with its memory and start many copies from it, which suits rollouts that branch from one warm state, once Together enables it for you. | 144th of 360, with limits $9,428 a month | 315th of 360, with limits $21,900 a month | 34th of 360, with limits $2,000 a month |
| Agent evals 250 at once · 4 vCPU / 8 GB · 15,000 sessions of 20 min a month Cloudflare fits agent evals with short sandboxes that wake on request; Together documents a Harbor guide for evals; bochka ships the coding agents with an API to prompt and follow each run. | 45th cheapest of 364 $818 a month | 258th of 364, with limits $450 a month | 10th cheapest of 364 $200 a month |
| CI runners 40 at once · 8 vCPU / 16 GB · 6,000 sessions of 12 min a month | 301st of 377, with limits $704 a month | 251st of 377, with limits $180 a month | 4th cheapest of 377 $86 a month |
| 24/7 dev boxes 1 machine 24/7 · 4 vCPU / 8 GB A dev box should keep its files when you log off; bochka stops at no cost with its disk kept, Cloudflare starts from a fresh disk after sleep, and Together saves state only when a sandbox ends. | 70th cheapest of 368 $93 a month | 210th of 368, with limits $22 a month | 18th cheapest of 368 $26 a month |
| Computer-use agents 50 at once · 4 vCPU / 8 GB · 20,000 sessions of 15 min a month Neither Cloudflare nor Together ships a desktop, so computer-use agents need one built into your image; bochka streams a 60fps desktop with Chromium. | 166th of 369, with limits $460 a month | 184th of 369, with limits $600 a month | 6th cheapest of 369 $200 a month |
| Browser-use agents 50 at once · 2 vCPU / 4 GB · 30,000 sessions of 10 min a month | 210th of 367, with limits $233 a month | 301st of 367, with limits $900 a month | 7th cheapest of 367 $200 a month |
| Scraping & bots (startup scale) 50 at once · 1 vCPU / 2 GB · 100,000 sessions of 3 min a month | 250th of 346, with limits $286 a month | 219th of 346, with limits $180 a month | 6th cheapest of 346 $90 a month |
| Mass scraping & bots (undetectable) 1,000 at once · 1 vCPU / 2 GB · 3,000,000 sessions of 2 min a month | 169th of 338, with limits $5,741 a month | 124th of 338, with limits $3,600 a month | 71st of 338, with limits $1,800 a month |
| Parallel red teaming 200 at once · 2 vCPU / 4 GB · 5,000 sessions of 30 min a month Red-team runs often need nested VMs and raw TCP; bochka has /dev/kvm and raw TCP, while neither Cloudflare nor Together documents nested virtualization or takes raw TCP from outside. | 239th of 360, with limits $325 a month | 167th of 360, with limits $150 a month | 2nd cheapest of 360 $200 a month |
| GPU eval jobs 10 at once · 8 vCPU / 32 GB · 500 sessions of 30 min a month | Can't run it | Can't run it | Can't run it |
| macOS agents 5 at once · 4 vCPU / 8 GB · 1,000 sessions of 20 min a month | Can't run it | Can't run it | Can't run it |
Key features
| Feature | Cloudflare Sandbox | Together Code Sandbox | bochka |
|---|---|---|---|
| Isolation | Firecracker microVM per container, own kernel and network | A VM per sandbox on Together's infrastructure | Full VM with its own kernel on dedicated AMD Ryzen 9 9950X hosts |
| Getting started | Self-serve on Workers Paid ($5 a month minimum), driven from your own Worker | The SDK and CLI must be enabled for your organization by Together | Sign up and start a sandbox from the API, CLI or dashboard |
| Largest machine | 4 vCPU / 12 GiB / 20 GB disk by default (can be raised) | 0.1 to 16 cores, 1 to 8 GB of memory per core; disk size fixed | Up to 16 vCPU / 32 GB, depending on plan |
| Files between sessions | Fresh disk after sleep; snapshots (public beta, 30 days) or R2 backups when your code saves them | End a sandbox with a snapshot of its disk, or disk and memory, to start from later | Disk saved every minute and on stop; a stopped sandbox costs nothing |
| Memory snapshots | No; snapshots keep the root filesystem, not memory or processes | Yes; a new sandbox comes back with its processes running | No; resuming boots the machine again with its disk |
| Fork | No fork; restore a saved snapshot or backup into a new sandbox | No live fork: the parent stops, then you start many sandboxes from its snapshot | Fork a running sandbox; the original keeps running |
| Docker, root and systemd | docker:dind with iptables and IP forwarding turned off | Commands run as user 1000 by default, root on request; Docker inside not documented | Full Docker, root and systemd on every machine |
| Nested virtualization | Not documented | Not documented | Yes, /dev/kvm for Android emulators and VMs |
| Idle and wake | Stops after inactivity and wakes on the next request | Time to live counts from creation; no idle detection and no wake on request | Runs until you stop it or its time to live ends (1 h default, changeable) |
| Reaching the sandbox | HTTP and WebSocket previews routed through your Worker; no raw TCP or public IP | All ports public; preview URLs coming soon; an experimental inbound allowlist | HTTPS URLs for up to 50 ports, token-protected by default; raw TCP; dedicated IPv6 or IPv4 |
| Egress control | allowedHosts deny-by-default list plus outbound handlers you write in Worker code | No egress allowlist documented | No provider-side allowlist |
| Keeping API keys out of the sandbox | Your outbound handler adds the token for any HTTP or HTTPS host; you write the code | No credentials proxy documented | Managed proxy for model providers and any HTTPS API; switch a credential to another account when credits run out |
| Desktop and browser | Built-in desktop removed in SDK 0.10.2; bring your own | None; headless command and file access only | 60fps desktop and Chromium, computer-use API, embeddable stream |
| Coding agents | Run Claude Code, Codex, OpenCode or Pi in your image; OpenCode has an SDK helper | Run your own agent through execs; a Harbor guide for agent evals | Claude Code, Codex, OpenCode and more preinstalled, with a prompt, steer and events API |
Every feature Battleships tracks (43)
| Feature | Cloudflare Sandbox | Together Code Sandbox | bochka |
|---|---|---|---|
| Full VM (own kernel) | Yes | Yes | Yes |
| Docker inside | Yes | Not published | Yes |
| Nested virtualization | No | No | Yes |
| Root | Yes | Yes | Yes |
| Systemd | Not published | Not published | Yes |
| Desktop GUI | No | No | Yes |
| Browser | No | No | Yes |
| Computer-use API | No | No | Yes |
| SSH | Yes | No | Yes |
| Persistent disk | No | Yes | Yes |
| Pause/resume | No | Yes | Yes |
| Automatic snapshots | No | No | Yes |
| Fork/clone | No | Yes | Yes |
| Live fork (no pause) | No | No | Yes |
| Memory fork | No | Yes | No |
| Custom image (Docker or snapshot) | Yes | Yes | Yes |
| ≥24 h sessions | Yes | Yes | Yes |
| Idle auto-stop | Yes | No | No |
| Wake on request | Yes | No | No |
| HTTPS preview URLs | Yes | Yes | Yes |
| Raw TCP inbound | No | No | Yes |
| Public IPv4 | No | No | No |
| Egress allowlist | Yes | No | No |
| Secret proxy | Yes | No | Yes |
| Secret proxy for any API | Yes | No | Yes |
| Preinstalled agents | Yes | No | Yes |
| Agent harness API | Yes | No | Yes |
| MCP server | No | Yes | No |
| GPU | No | No | No |
| Windows | No | No | No |
| Arm64 | No | No | No |
| Self-hosting | No | No | No |
| BYOC | No | No | No |
| Open source | Yes | No | No |
| Scoped API keys | Not published | Not published | Yes |
| Spend limits | No | Yes | Yes |
| Usage per sandbox (API) | Not published | Yes | Yes |
| Audit logs | Yes | Not published | No |
| SSO | Yes | Yes | No |
| SOC 2 | Yes | Yes | No |
| HIPAA | Yes | No | No |
| EU data residency | Yes | Not published | Yes |
| Zero data retention | Not published | Not published | Yes |
Performance
Neither Cloudflare Sandbox nor Together Code Sandbox has a result on the StarSling hpc-sandbox-benchmarks Node.js test, so there is no CPU number to compare them by. bochka did 26.69 runs per second on that test at 4 vCPU / 8 GB, on dedicated AMD Ryzen 9 9950X hosts.
Node.js build-and-test loop at 4 vCPU / 8 GB, higher is better. Measured with the open hpc-sandbox-benchmarks suite. Cloudflare Sandbox and Together Code Sandbox have no published run in this suite yet, so there is no like-for-like number to compare.
Pricing in five scenarios
Each bill is priced from the providers' public price lists by the open Battleships engine, with the cheapest plan that runs the scenario.
| Scenario | Cloudflare Sandbox, a month | Together Code Sandbox, a month | bochka, a month |
|---|---|---|---|
| One coding agent, workdays 4 vCPU / 8 GB, 50 GB disk, 8 hours a day, 22 days a month, files kept between days | $39 · Workers Paid · with limits | $5 · Together pay-as-you-go (prepaid credits; Code Interpreter only) · with limits | $20 · $20/mo |
| One agent that never stops 4 vCPU / 8 GB, 50 GB disk, running 24/7 all month | $148 · Workers Paid · with limits | $22 · Together pay-as-you-go (prepaid credits; Code Interpreter only) · with limits | $26 · $20/mo |
| 50 agents in parallel 50 machines of 4 vCPU / 8 GB at once, 8-hour sessions, 1,100 sessions a month, Docker inside | $1,660 · Workers Paid · with limits | $264 · Together pay-as-you-go (prepaid credits; Code Interpreter only) · with limits | $317 · $20/mo × 3 seats |
| Sandboxes for your users 2 vCPU / 4 GB, 30,000 sessions of 10 minutes a month, up to 300 at once | $476 · Workers Paid | $900 · Together pay-as-you-go (prepaid credits; Code Interpreter only) · with limits | $200 · $100/mo × 2 seats |
| 1,000 short jobs at once 2 vCPU / 4 GB, 1,000 at once, 3 minutes each, 200,000 jobs a month | $1,889 · Workers Paid · with limits | $6,000 · Together pay-as-you-go (prepaid credits; Code Interpreter only) · with limits | $2,000 · $2000/mo · with limits |
Cloudflare Sandbox: You need Workers Paid ($5 a month minimum). CPU is billed only while busy; memory and disk are billed on the instance size until the container sleeps, and 4 vCPU always comes with 12 GiB.
Together Code Sandbox: Together lists Code Sandbox at $0.0446 per vCPU-hour and $0.0149 per GiB-hour, but the VMs must be enabled for you, so the table uses Code Interpreter: $0.03 per 60-minute session from prepaid credits ($5 minimum).
Together Code Sandbox: Plans start at $20 a month, and the whole fee becomes usage credit, billed per second while a sandbox runs. A stopped sandbox costs nothing and keeps its disk.
Limits in those scenarios
Cloudflare's disk resets after sleep and tops out at 20 GB by default, so the scenarios that keep 50 GB of files between days do not fit without your own snapshot code, and its 1,500 vCPU account limit is short of the 2,000 vCPU the 1,000-job burst needs. The Together column is Code Interpreter, so no scenario fits: sessions last 60 minutes, nothing is kept, it runs only Python and the machine size is not published. Cloudflare does fit sandboxes for your users.
| Scenario | Cloudflare Sandbox | Together Code Sandbox | bochka |
|---|---|---|---|
| One coding agent, workdays |
|
| None that bite |
| One agent that never stops |
|
| None that bite |
| 50 agents in parallel |
|
| None that bite |
| Sandboxes for your users | None that bite |
| None that bite |
| 1,000 short jobs at once |
|
|
|
Which one should you use?
Use Cloudflare Sandbox when
your app already runs on Workers and you want short sandboxes you can start today that sleep when idle, wake on the next request and follow egress rules you write.
- Start today on Workers. Anyone on Workers Paid can create sandboxes now, next to Durable Objects and R2, with no access request.
- Sleeps when idle, wakes on request. Useful for many short, spiky sessions: a sandbox sleeps when idle, wakes on the next request, and bills CPU only while busy.
- Egress rules you can program. Cloudflare can block every host except the ones you list, and run your own code on each outbound request.
Use Together Code Sandbox when
you already run models on Together, can get the VMs enabled, and want to save a sandbox with its memory and branch many runs from it.
- Memory snapshots to branch from. Useful for rollouts and test variants: save a sandbox with its memory and start many copies with processes still running.
- Sandboxes next to your models. Handy if you already run inference or fine-tuning on Together: sandboxes and models share one account and API key.
- Very small machines and a Python runner. Good for many light jobs: sandboxes start at a tenth of a core, and a Python interpreter API bills per session.
Where bochka fits
Cloudflare suits short sandboxes inside a Workers app, and Together suits branching from warm memory snapshots once it is enabled for you. If your agents work for hours on builds, Docker, emulators, a browser and servers other people reach, bochka gives each one a whole machine that keeps its files, with the agents and their keys already set up.
A whole machine, not a trimmed one
Cloudflare runs Docker with iptables turned off and caps disk at 20 GB by default; Together runs commands as a normal user and documents neither Docker inside nor /dev/kvm. bochka has full Docker, root, systemd and /dev/kvm.
Files that survive every stop
On Cloudflare a sleeping sandbox wakes on an empty disk unless your code saved a snapshot; Together saves state only when a sandbox ends. bochka saves the disk every minute and can fork a sandbox while it runs.
Agents, desktop and keys built in
On both you bake the agent and any desktop into your own image, and on Cloudflare you write the code that adds each token. bochka preinstalls the agents, streams a 60fps desktop and keeps real keys outside in a proxy.
Use bochka when your agents do real work for hours: builds, full Docker, emulators, a desktop and servers others reach over HTTPS or raw TCP, on a machine that keeps its files between sessions. Compare it one to one: bochka vs Cloudflare Sandbox and bochka vs Together Code Sandbox.
Questions people ask
Is Cloudflare Sandbox cheaper than Together Code Sandbox?
Together's only self-serve price is Code Interpreter at $0.03 per 60-minute session, which looks cheap for small runs but does not fit these scenarios. Where it scales, Cloudflare costs less: $476 against $900 a month for sandboxes for your users, and $1,889 against $6,000 for 1,000 short jobs at once.
Which is faster, Cloudflare Sandbox or Together Code Sandbox?
There is no comparable CPU measurement for either one. bochka did 26.69 runs per second on the StarSling hpc-sandbox-benchmarks Node.js test at 4 vCPU / 8 GB, and neither Cloudflare nor Together was part of that run.
Can Cloudflare Sandbox or Together Code Sandbox run Docker?
Cloudflare supports docker:dind with the daemon's iptables and IP forwarding turned off. Together builds sandboxes from Docker images, but its new SDK does not document Docker inside a sandbox. bochka runs full Docker with root and systemd.
Which one keeps my files?
Cloudflare keeps files only while the container runs; after sleep it starts from a fresh disk unless your code saved a snapshot or an R2 backup. Together can save a sandbox's disk, or disk and memory, as a snapshot when it ends. bochka saves the disk every minute and on stop.
Can I sign up for Together Code Sandbox today?
The together-sandbox SDK and CLI must be enabled for your organization, so you ask Together for access. Code Interpreter is self-serve with prepaid credits. Cloudflare Sandbox is self-serve on Workers Paid.
Try bochka
Install the CLI, then run bochka new.
Product preview
More comparisons
- bochka vs Cloudflare Sandbox
- bochka vs Together Code Sandbox
- E2B vs Cloudflare Sandbox
- Daytona vs Cloudflare Sandbox
- Modal vs Cloudflare Sandbox
- Vercel Sandbox vs Cloudflare Sandbox
- Cloudflare Sandbox vs Blaxel
- Cloudflare Sandbox vs Runloop
- Cloudflare Sandbox vs Tensorlake
- Cloudflare Sandbox vs Morph Cloud
- Cloudflare Sandbox vs CodeSandbox SDK
- Cloudflare Sandbox vs Northflank