Deno Sandbox vs Islo
Both run code in a microVM with its own kernel and keep API keys outside it. Deno Sandbox is built for short, locked-down runs of up to 30 minutes on a fixed 2 vCPU shape, while Islo gives each coding agent a VM that can stay up for hours, run Docker and pause with its memory kept.
The companies and products
Deno Sandbox
Deno Sandbox is part of Deno Deploy, the hosting platform from the company behind the Deno runtime, and runs untrusted or AI-generated code in Linux microVMs.
Each sandbox is a Firecracker microVM with 2 vCPU, up to 4 GB of memory and a 10 GB disk that is wiped when it ends, created from a TypeScript or Python SDK. Outbound traffic goes through a proxy that can enforce a host allowlist and swap placeholder secrets for real ones. It is built for short runs of agent or user code, and a sandbox can be promoted to a Deno Deploy app.
- Isolation
- Firecracker microVM per sandbox
Islo
Islo is an agent sandbox from Incredibuild: each coding agent gets its own microVM, with network rules and credentials handled at a gateway.
An Islo sandbox is a Linux microVM with its own kernel, built from a container image, with Claude Code, Cursor CLI and Codex preinstalled. Outbound traffic can pass through a gateway that allows or blocks hosts, injects credentials and logs every request. It is built for teams that run coding agents, evals and RL rollouts in the background, on Islo's cloud or in their own cloud account.
- Launched
- May 4, 2026
Which use cases each one fits
For each use case, Battleships prices every sandbox provider on the same workload and sorts them from the cheapest monthly bill up. “290th cheapest of 367” means 289 of the other 366 providers run that workload, with every feature it needs, for less. “With limits” means the provider runs it but misses something, so it is listed after every full match. Open a use case for its whole ranking and what each provider misses.
| Use case and its workload | Deno Sandbox: price rank | Islo: price rank | bochka: price rank |
|---|---|---|---|
| Software factory 100 at once · 4 vCPU / 8 GB · 2,200 sessions of 8 h a month A software factory runs builds and Docker for hours, which outlasts Deno's 30-minute lifetime; Islo runs Docker but documents no /dev/kvm or desktop, which bochka has. | 290th of 367, with limits $5,665 a month | 326th of 367, with limits $7,402 a month | 3rd cheapest of 367 $634 a month |
| Always-on AI employees 50 machines 24/7 · 2 vCPU / 4 GB Islo fits an assistant that lives on its machine all month and can pause it with memory between tasks, while a Deno sandbox ends after 30 minutes. | 287th of 366, with limits $5,803 a month | 30th cheapest of 366 $9,928 a month | 5th cheapest of 366 $657 a month |
| Code interpreter bursts 100 at once · 1 vCPU / 2 GB · 200,000 sessions of 1 min a month Short code bursts suit Deno best of the three, since it starts in under 200 ms and bills CPU only while code runs. | 141st of 345, with limits $329 a month | 153rd of 345, with limits $503 a month | 186th of 345, with limits $2,000 a month |
| Sandboxes for your users 300 at once · 2 vCPU / 4 GB · 30,000 sessions of 23 min a month Deno Builder allows 20 sandboxes at once per region and Islo Team is reported at 50, so 300 user sandboxes at once need a custom limit on both; bochka's plans go to hundreds. | 148th of 361, with limits $1,863 a month | 171st of 361, with limits $3,160 a month | Cheapest of 361 $209 a month |
| RL rollouts 1,000 at once · 2 vCPU / 4 GB · 1,000,000 sessions of 3 min a month | 122nd of 360, with limits $7,963 a month | 167th of 360, with limits $15,265 a month | 34th of 360, with limits $2,000 a month |
| Agent evals 250 at once · 4 vCPU / 8 GB · 15,000 sessions of 20 min a month Islo has a Harbor integration and gateway rules that stop trials from looking up answers; Deno's 2 vCPU, 30-minute sandboxes fit only short trials, and bochka runs more at once. | 296th of 364, with limits $1,563 a month | 198th of 364, with limits $2,456 a month | 10th cheapest of 364 $200 a month |
| CI runners 40 at once · 8 vCPU / 16 GB · 6,000 sessions of 12 min a month Islo runs Docker inside its VMs for CI jobs, while Deno does not document Docker; only bochka documents /dev/kvm for Android emulators. | 304th of 377, with limits $731 a month | 119th cheapest of 377 $1,507 a month | 4th cheapest of 377 $86 a month |
| 24/7 dev boxes 1 machine 24/7 · 4 vCPU / 8 GB A dev box that stays on all month works on Islo and bochka, which have no session cap, but not on Deno, which wipes its root disk when a sandbox ends. | 179th of 368, with limits $200 a month | 112th cheapest of 368 $402 a month | 18th cheapest of 368 $26 a month |
| Computer-use agents 50 at once · 4 vCPU / 8 GB · 20,000 sessions of 15 min a month Neither Deno Sandbox nor Islo has a desktop or a computer-use API; bochka streams a 60fps desktop with Chromium that agents can see and click. | 280th of 369, with limits $1,583 a month | 310th of 369, with limits $2,210 a month | 6th cheapest of 369 $200 a month |
| Browser-use agents 50 at once · 2 vCPU / 4 GB · 30,000 sessions of 10 min a month | 284th of 367, with limits $783 a month | 113th of 367, with limits $1,105 a month | 7th cheapest of 367 $200 a month |
| Scraping & bots (startup scale) 50 at once · 1 vCPU / 2 GB · 100,000 sessions of 3 min a month | 286th of 346, with limits $573 a month | 66th cheapest of 346 $748 a month | 6th cheapest of 346 $90 a month |
| Mass scraping & bots (undetectable) 1,000 at once · 1 vCPU / 2 GB · 3,000,000 sessions of 2 min a month | 247th of 338, with limits $11,923 a month | 265th of 338, with limits $14,966 a month | 71st of 338, with limits $1,800 a month |
| Parallel red teaming 200 at once · 2 vCPU / 4 GB · 5,000 sessions of 30 min a month | 251st of 360, with limits $367 a month | 47th of 360, with limits $746 a month | 2nd cheapest of 360 $200 a month |
| GPU eval jobs 10 at once · 8 vCPU / 32 GB · 500 sessions of 30 min a month | Can't run it | Can't run it | Can't run it |
| macOS agents 5 at once · 4 vCPU / 8 GB · 1,000 sessions of 20 min a month | Can't run it | Can't run it | Can't run it |
Key features
| Feature | Deno Sandbox | Islo | bochka |
|---|---|---|---|
| Isolation | Firecracker microVM with its own kernel | MicroVM with its own kernel for each agent computer | Full VM with its own kernel on dedicated AMD Ryzen 9 9950X hosts |
| Machine size | 2 vCPU fixed, 768 MB to 4 GB memory, 10 GB disk | You choose CPU cores, memory and disk, billed per unit | 4 vCPU / 8 GB by default, up to 16 vCPU / 32 GB on the $100 plan and above |
| Session length | Up to 30 minutes; longer work can be promoted to a Deno Deploy app | No published cap; runs until you stop it or a lifecycle rule pauses it | No cap on paid plans; you set the time to live |
| Disk that persists | Root disk wiped when the sandbox ends; opt-in volumes of 300 MB to 20 GB, Chicago only | Files kept across pause and resume | The whole disk is kept, saved every minute and on stop; a stopped sandbox costs nothing |
| Pause and resume | No pause; a sandbox ends when its session does | Pause keeps files, processes and memory; can pause after idle time and wake on the next exec, file access or webhook | Stop and resume from disk; resume reboots the VM |
| Snapshots and fork | Read-only snapshots of a volume that new sandboxes can boot from | Snapshot a running sandbox's files, then start new sandboxes from it | Automatic disk snapshots; fork a running sandbox with its disk |
| Docker and nested virtualization | Root access; Docker and nested virtualization not documented | Docker inside and sudo; no /dev/kvm or nested virtualization documented | Docker, systemd and /dev/kvm for Android emulators and VMs |
| Desktop and computer use | No desktop; a VS Code editor in the browser and SSH | A browser inside the sandbox for testing; no desktop or computer-use API | Linux desktop streamed at 60fps, Chromium and computer use built in |
| Reaching the sandbox | HTTPS URL per exposed port, public without authentication; SSH | HTTPS share links anyone with the URL can open, expiring after 24 hours by default; SSH through the CLI | HTTPS URLs for up to 50 ports, token-protected by default; raw TCP |
| Outbound rules | Host allowlist per sandbox, enforced by a proxy outside the VM | Gateway rules by host, path and HTTP method, with default deny, rate limits and per-request logs | Open internet, no provider-side allowlist |
| Keeping API keys out of the sandbox | Secrets swapped in on outbound requests to approved hosts | Gateway injects stored credentials into outbound requests for any host | Credentials proxy for model providers and any HTTPS API; switch a credential to another account when credits run out |
| Coding agents | A root image with Claude Code, run through the shell command API | Claude Code, Cursor CLI and Codex preinstalled; factory lines with events, steer and follow-ups | Seven agents preinstalled, with a prompt, steer and events API |
| Sandboxes at once | Pro 3 and Builder 20 per region | Free 5 and Team 50 running, per launch coverage; paused ones do not count | 100 to 2,000 running sandboxes by plan |
| Regions | Amsterdam and Chicago | US West, or inside your own cloud account with BYOC | EU only (Germany, Finland, France) |
Every feature Battleships tracks (43)
| Feature | Deno Sandbox | Islo | bochka |
|---|---|---|---|
| Full VM (own kernel) | Yes | Yes | Yes |
| Docker inside | Not published | Yes | Yes |
| Nested virtualization | No | No | Yes |
| Root | Yes | Yes | Yes |
| Systemd | Not published | Not published | Yes |
| Desktop GUI | No | No | Yes |
| Browser | No | Yes | Yes |
| Computer-use API | No | No | Yes |
| SSH | Yes | Yes | Yes |
| Persistent disk | Yes | Yes | Yes |
| Pause/resume | No | Yes | Yes |
| Automatic snapshots | No | Yes | Yes |
| Fork/clone | No | Yes | Yes |
| Live fork (no pause) | No | Yes | Yes |
| Memory fork | No | No | No |
| Custom image (Docker or snapshot) | Yes | Yes | Yes |
| ≥24 h sessions | No | Yes | Yes |
| Idle auto-stop | No | Yes | No |
| Wake on request | No | Yes | No |
| HTTPS preview URLs | Yes | Yes | Yes |
| Raw TCP inbound | No | No | Yes |
| Public IPv4 | No | No | No |
| Egress allowlist | Yes | Yes | No |
| Secret proxy | Yes | Yes | Yes |
| Secret proxy for any API | Yes | Yes | Yes |
| Preinstalled agents | Yes | Yes | Yes |
| Agent harness API | No | Yes | Yes |
| MCP server | No | No | No |
| GPU | No | No | No |
| Windows | No | No | No |
| Arm64 | No | No | No |
| Self-hosting | No | No | No |
| BYOC | No | Yes | No |
| Open source | No | No | No |
| Scoped API keys | Not published | Not published | Yes |
| Spend limits | Yes | Not published | Yes |
| Usage per sandbox (API) | No | Yes | Yes |
| Audit logs | Not published | Yes | No |
| SSO | No | Yes | No |
| SOC 2 | Yes | Not published | No |
| HIPAA | Yes | Not published | No |
| EU data residency | Yes | No | Yes |
| Zero data retention | Not published | Not published | Yes |
Performance
There is no comparable measurement for either Deno Sandbox or Islo: neither is in StarSling's hpc-sandbox-benchmarks run. In that run of 2026-09-29, bochka did 26.69 Node.js build-and-test runs per second at 4 vCPU / 8 GB. Deno's fixed 2 vCPU shape could not run that 4 vCPU test as set up.
Node.js build-and-test loop at 4 vCPU / 8 GB, higher is better. Measured with the open hpc-sandbox-benchmarks suite. Deno Sandbox and Islo have no published run in this suite yet, so there is no like-for-like number to compare.
Pricing in five scenarios
Each bill is priced from the providers' public price lists by the open Battleships engine, with the cheapest plan that runs the scenario.
| Scenario | Deno Sandbox, a month | Islo, a month | bochka, a month |
|---|---|---|---|
| One coding agent, workdays 4 vCPU / 8 GB, 50 GB disk, 8 hours a day, 22 days a month, files kept between days | $53 · Pro · with limits | $101 · Free | $20 · $20/mo |
| One agent that never stops 4 vCPU / 8 GB, 50 GB disk, running 24/7 all month | $200 · Builder · with limits | $420 · Free | $26 · $20/mo |
| 50 agents in parallel 50 machines of 4 vCPU / 8 GB at once, 8-hour sessions, 1,100 sessions a month, Docker inside | $2,779 · Builder · with limits | $4,863 · Team | $317 · $20/mo × 3 seats |
| Sandboxes for your users 2 vCPU / 4 GB, 30,000 sessions of 10 minutes a month, up to 300 at once | $783 · Builder · with limits | $1,382 · Team · with limits | $200 · $100/mo × 2 seats |
| 1,000 short jobs at once 2 vCPU / 4 GB, 1,000 at once, 3 minutes each, 200,000 jobs a month | $1,563 · Builder · with limits | $3,053 · Team · with limits | $2,000 · $2000/mo · with limits |
Deno Sandbox: Sandboxes need Deno Deploy Pro at $20 a month or Builder at $200 a month; the fee is not credit but includes CPU, memory and egress allowances shared with your Deploy apps. Past those, CPU costs $0.10 per hour of active CPU time and memory $0.025 per GiB-hour for the whole life of the sandbox.
Islo: Islo has no plan fee: it bills each CPU core and each GB of memory and disk while a sandbox runs, billed per hour, with signup credits and no card. An idle sandbox keeps billing until a pause-after-idle timer fires, and egress has no published price.
Islo: Plans start at $20 a month, and the whole fee is usage credit spent per second while a sandbox runs. A stopped sandbox costs nothing and keeps its disk.
Limits in those scenarios
Deno Sandbox fits none of the five scenarios as written: a sandbox lives up to 30 minutes on 2 vCPU and 4 GB, and Builder allows 20 at once per region. Islo fits the workday agent, the always-on agent and 50 agents in parallel, but its Team plan is reported at 50 running sandboxes, so 300 user sandboxes and 1,000 short jobs at once need a custom contract. Islo publishes no egress price, so its totals leave egress out. bochka fits four of the five; at 1,000 short jobs at once its top plan queues starts above 90 a minute.
| Scenario | Deno Sandbox | Islo | bochka |
|---|---|---|---|
| One coding agent, workdays |
|
| None that bite |
| One agent that never stops |
|
| None that bite |
| 50 agents in parallel |
|
| None that bite |
| Sandboxes for your users |
|
| None that bite |
| 1,000 short jobs at once |
|
|
|
Which one should you use?
Use Deno Sandbox when
you run short pieces of untrusted code that must start in milliseconds and reach only the hosts you allow, especially if you already deploy on Deno Deploy.
- Starts in under 200 ms. Good for one sandbox per request: Deno says a sandbox starts in under 200 ms, and CPU bills only while code runs.
- A path to Deno Deploy. Fits teams already on Deno Deploy: a sandbox can be promoted to a Deploy app and bills on the same meters.
- US and EU regions. Useful if you need both sides of the Atlantic on one service: sandboxes run in Chicago and Amsterdam.
Use Islo when
your coding agents run for hours with Docker, sit idle between tasks and should pause with memory kept, or must pass through egress rules that log every call, in the US or your own cloud.
- Agents that run for hours. Fits long agent tasks: an Islo sandbox has no published session cap and runs Docker inside its VM.
- Pause with memory, wake on request. Useful for agents idle between tasks: Islo pauses with memory kept and resumes on the next exec, file access or webhook.
- Egress rules with a log of every call. Useful if you must control what agents reach: rules by host, path and method, with each request logged.
Where bochka fits
Deno Sandbox and Islo both give an agent a headless Linux shell. If your agents also need to see a screen, boot an emulator or serve something people can reach for days, look at bochka. It runs a full VM with its own kernel, keeps the whole disk, and has no session cap on paid plans.
A desktop agents can see and use
Neither Deno Sandbox nor Islo has a desktop or a computer-use API, so an agent that must check a UI or click through an app needs a VNC stack and control layer you build into each image. bochka streams a 60fps desktop with Chromium.
Docker plus /dev/kvm
Deno does not document Docker, and Islo runs Docker but documents no /dev/kvm, so Android emulators and tools that start their own VMs stop at boot on both. bochka gives every machine Docker, systemd and /dev/kvm.
Ports you can host on
Deno exposes ports publicly with no authentication, and Islo share links open to anyone with the URL and expire after 24 hours by default. bochka serves up to 50 ports over HTTPS with token protection, plus raw TCP.
Use bochka when your agents need more than a shell: a desktop for computer use, /dev/kvm for emulators, ports you can host on, and a bigger machine whose disk is still there tomorrow. Compare it one to one: bochka vs Deno Sandbox and bochka vs Islo.
Questions people ask
Is Deno Sandbox cheaper than Islo?
On paper Deno's totals are lower: one coding agent on workdays comes to $53 a month against $101 on Islo, and one always-on agent to $200 against $420. But Deno fits none of those scenarios as written, because of its 30-minute lifetime and 2 vCPU shape, while Islo fits them. bochka comes to $20 and $26 for the same two.
Which is faster, Deno Sandbox or Islo?
Neither has a comparable CPU measurement in the public benchmarks we use. Deno says a sandbox starts in under 200 ms; Islo publishes no start time we could cite. bochka did 26.69 runs per second on StarSling's Node.js test at 4 vCPU / 8 GB.
Can Deno Sandbox or Islo run Docker?
Islo runs Docker inside its microVMs. Deno's docs give root access but do not say Docker works, and neither documents /dev/kvm for nested virtualization. bochka runs Docker and systemd and exposes /dev/kvm.
How long can a sandbox run on each?
A Deno sandbox lives up to 30 minutes and its root disk is wiped when it ends. Islo publishes no cap, and a sandbox runs until you stop it or a lifecycle rule pauses it. bochka has no cap on paid plans.
Can I limit what an agent reaches on the internet?
Yes on both. Deno takes a host allowlist per sandbox, and Islo's gateway allows or denies by host, path and HTTP method and logs each request. bochka has open internet, while its credentials proxy keeps real API keys out of the sandbox.
Where do Deno Sandbox and Islo run?
Deno Sandbox runs in Amsterdam and Chicago, with volumes only in Chicago. Islo runs in US West, or inside your own cloud account with BYOC. bochka runs only in the EU, in Germany, Finland and France.
Try bochka
Install the CLI, then run bochka new.
Product preview