Koyeb vs Azure Container Apps Sandboxes
Both start each sandbox in its own microVM and put it to sleep when idle. Koyeb adds GPUs and runs next to apps you host there, while Azure suspends a sandbox with its memory, wakes it in under a second and lives inside your Azure account.
The companies and products
Koyeb
Koyeb is a serverless cloud for apps, inference and sandboxes, and in February 2026 it agreed to join Mistral AI.
A Koyeb sandbox is a Koyeb service: a microVM started from any Docker image and driven from Python or JavaScript SDKs that run commands, read files and expose a port. It can scale to zero when idle and wake on the next request, and it can run on CPU or GPU instance types. It is built for teams that run AI agents or untrusted code next to apps they already host on Koyeb.
Azure Container Apps Sandboxes
Azure Container Apps Sandboxes is a service inside Microsoft Azure that gives each agent or user an isolated microVM you create, suspend and resume through an SDK.
It is part of Azure Container Apps, the hyperscaler's serverless container platform, and lives in your Azure subscription as a sandbox group resource. Each sandbox boots from an OCI image or a snapshot, has its own kernel, and can be suspended with its memory and resumed in under a second. It is built for teams already on Azure that want stateful code execution with Azure networking, identity and billing.
Which use cases each one fits
For each use case, Battleships prices every sandbox provider on the same workload and sorts them from the cheapest monthly bill up. “4th cheapest of 345” means 3 of the other 344 providers run that workload, with every feature it needs, for less. “With limits” means the provider runs it but misses something, so it is listed after every full match. Open a use case for its whole ranking and what each provider misses.
| Use case and its workload | Koyeb: price rank | Azure Container Apps Sandboxes: price rank | bochka: price rank |
|---|---|---|---|
| Software factory 100 at once · 4 vCPU / 8 GB · 2,200 sessions of 8 h a month A software factory needs Docker, a disk that lasts and /dev/kvm for emulators; neither Koyeb nor Azure documents nested virtualization, and bochka has all three. | 54th of 367, with limits $366 a month | 288th of 367, with limits $5,276 a month | 3rd cheapest of 367 $634 a month |
| Always-on AI employees 50 machines 24/7 · 2 vCPU / 4 GB | 135th of 366, with limits $923 a month | 302nd of 366, with limits $6,544 a month | 5th cheapest of 366 $657 a month |
| Code interpreter bursts 100 at once · 1 vCPU / 2 GB · 200,000 sessions of 1 min a month Both fit short code runs well; Koyeb sleeps after 5 idle minutes and wakes on the next request, and Azure suspends with memory and resumes in under a second. | 4th cheapest of 345 $66 a month | 34th cheapest of 345 $354 a month | 186th of 345, with limits $2,000 a month |
| Sandboxes for your users 300 at once · 2 vCPU / 4 GB · 30,000 sessions of 23 min a month Both fit sandboxes for your users; Koyeb costs less in this scenario, Azure keeps each user's memory across a suspend, and bochka ranks 1st with HTTPS on up to 50 ports per sandbox. | 6th cheapest of 361 $495 a month | 22nd cheapest of 361 $2,260 a month | Cheapest of 361 $209 a month |
| RL rollouts 1,000 at once · 2 vCPU / 4 GB · 1,000,000 sessions of 3 min a month | 237th of 360, with limits $1,631 a month | 153rd of 360, with limits $10,740 a month | 34th of 360, with limits $2,000 a month |
| Agent evals 250 at once · 4 vCPU / 8 GB · 15,000 sessions of 20 min a month Both fit agent evals; Koyeb can also give an eval a GPU, and Azure can seed many sandboxes from one memory snapshot. | 19th cheapest of 364 $429 a month | 75th cheapest of 364 $1,728 a month | 10th cheapest of 364 $200 a month |
| CI runners 40 at once · 8 vCPU / 16 GB · 6,000 sessions of 12 min a month Azure fits CI runners and Koyeb is a compromise here; builds of Android apps or VM images need /dev/kvm, which only bochka exposes. | 142nd of 377, with limits $88 a month | 103rd cheapest of 377 $1,046 a month | 4th cheapest of 377 $86 a month |
| 24/7 dev boxes 1 machine 24/7 · 4 vCPU / 8 GB A dev box wants SSH and a disk that stays; Koyeb and Azure have no SSH, and Koyeb's local disk is lost on redeploy. | 217th of 368, with limits $37 a month | 322nd of 368, with limits $262 a month | 18th cheapest of 368 $26 a month |
| Computer-use agents 50 at once · 4 vCPU / 8 GB · 20,000 sessions of 15 min a month Computer-use agents need a screen; Koyeb and Azure sandboxes are headless, while bochka streams a 60fps Linux desktop with Chromium. | 81st of 369, with limits $123 a month | 279th of 369, with limits $1,573 a month | 6th cheapest of 369 $200 a month |
| Browser-use agents 50 at once · 2 vCPU / 4 GB · 30,000 sessions of 10 min a month | 172nd of 367, with limits $123 a month | 288th of 367, with limits $795 a month | 7th cheapest of 367 $200 a month |
| Scraping & bots (startup scale) 50 at once · 1 vCPU / 2 GB · 100,000 sessions of 3 min a month | 172nd of 346, with limits $89 a month | 284th of 346, with limits $561 a month | 6th cheapest of 346 $90 a month |
| Mass scraping & bots (undetectable) 1,000 at once · 1 vCPU / 2 GB · 3,000,000 sessions of 2 min a month | 65th of 338, with limits $1,683 a month | 239th of 338, with limits $10,956 a month | 71st of 338, with limits $1,800 a month |
| Parallel red teaming 200 at once · 2 vCPU / 4 GB · 5,000 sessions of 30 min a month | 233rd of 360, with limits $299 a month | 278th of 360, with limits $517 a month | 2nd cheapest of 360 $200 a month |
| GPU eval jobs 10 at once · 8 vCPU / 32 GB · 500 sessions of 30 min a month Koyeb runs GPU instances up to H100 and H200, and neither Azure Container Apps Sandboxes nor bochka has GPUs. | 3rd cheapest of 98 $628 a month | Can't run it | Can't run it |
| macOS agents 5 at once · 4 vCPU / 8 GB · 1,000 sessions of 20 min a month | Can't run it | Can't run it | Can't run it |
Key features
| Feature | Koyeb | Azure Container Apps Sandboxes | bochka |
|---|---|---|---|
| Isolation | MicroVM per instance | MicroVM per sandbox with its own kernel | Full VM with its own kernel on dedicated AMD Ryzen 9 9950X hosts |
| Biggest machine | Instance types up to 40 vCPU / 128 GB, and GPU types far larger | Tiers up to 4 cores / 8 GB; up to 16 vCPU / 32 GB by API | Up to 16 vCPU / 32 GB on the $100 plan and above |
| GPUs | RTX 4000 SFF Ada up to H100, H200 and multi-GPU | No | No |
| Disk that survives | Local disk is lost on redeploy; volumes (preview, 1 to 10 GB, Frankfurt and Washington) persist | Memory and disk kept across a suspend | Disk is kept across stops and saved every minute, with snapshots |
| Sleep and wake | Scales to zero after 5 idle minutes or more and wakes on the next request; Light Sleep wakes in about 200 ms | Auto-suspend with memory after an idle timeout; traffic or a start command resumes it in under a second with processes running | Auto-stop timer you set; a stopped sandbox costs nothing, keeps its disk and boots again by API |
| Snapshots and fork | SDK snapshots of the filesystem, or with running processes, then new sandboxes from a snapshot (experimental) | Snapshot a running sandbox with its memory and create new sandboxes from it | Fork a running sandbox with its disk |
| Nested virtualization | Not documented | Not documented | Yes, /dev/kvm for Android emulators and VMs |
| Getting a shell | Commands through the Python and JavaScript SDKs; no SSH | Interactive shell through the aca CLI, SDK or portal; no SSH | SSH, plus CLI and API exec |
| Inbound access | One exposed HTTPS port at a time, plus an optional TCP proxy to one port; no dedicated IP | Public HTTPS routes per published port; private endpoint from your VNet at extra cost; no public IP | HTTPS URLs for up to 50 ports, token-protected by default; raw TCP; dedicated IPv4 or IPv6 |
| Outbound rules | Block all outbound traffic, or allow only listed IPs and CIDRs | Egress policy with allow, deny, rewrite and header rules by host, path and method; VNet integration | Open internet, no provider-side allowlist |
| Desktop and browser | No desktop or browser in the sandbox SDK | Headless; no desktop or managed browser | 60fps Linux desktop with Chromium and computer use |
| Coding agents | Tutorials that run agents through the command API; an MCP server lets agents manage Koyeb | Copilot CLI and Claude Code images, run through the exec API | Seven agents preinstalled, with a prompt, steer and events API |
| Keeping API keys out of the sandbox | Secrets are set as environment variables inside the service | Group secrets usable in egress header rules; Copilot and Anthropic tokens are injected into the sandbox at startup | Credentials proxy for model providers and any HTTPS API; switch a credential to another account when credits run out |
| Regions | Frankfurt, Paris, Washington D.C., AWS US East, Singapore, Tokyo, plus San Francisco in preview | 40 Azure regions, 9 of them in the EU | EU only (Germany, Finland, France) |
Every feature Battleships tracks (43)
| Feature | Koyeb | Azure Container Apps Sandboxes | bochka |
|---|---|---|---|
| Full VM (own kernel) | Yes | Yes | Yes |
| Docker inside | Yes | Yes | Yes |
| Nested virtualization | No | No | Yes |
| Root | Not published | Yes | Yes |
| Systemd | Not published | Yes | Yes |
| Desktop GUI | No | No | Yes |
| Browser | No | No | Yes |
| Computer-use API | No | No | Yes |
| SSH | No | No | Yes |
| Persistent disk | Yes | Yes | Yes |
| Pause/resume | Yes | Yes | Yes |
| Automatic snapshots | Yes | Yes | Yes |
| Fork/clone | Yes | Yes | Yes |
| Live fork (no pause) | Not published | Yes | Yes |
| Memory fork | Yes | Yes | No |
| Custom image (Docker or snapshot) | Yes | Yes | Yes |
| ≥24 h sessions | Yes | Yes | Yes |
| Idle auto-stop | Yes | Yes | No |
| Wake on request | Yes | Yes | No |
| HTTPS preview URLs | Yes | Yes | Yes |
| Raw TCP inbound | Yes | No | Yes |
| Public IPv4 | No | No | No |
| Egress allowlist | Yes | Yes | No |
| Secret proxy | No | Yes | Yes |
| Secret proxy for any API | No | Yes | Yes |
| Preinstalled agents | Yes | Yes | Yes |
| Agent harness API | No | No | Yes |
| MCP server | Yes | No | No |
| GPU | Yes | No | No |
| Windows | No | No | No |
| Arm64 | No | No | No |
| Self-hosting | Yes | No | No |
| BYOC | Yes | No | No |
| Open source | No | No | No |
| Scoped API keys | Not published | Not published | Yes |
| Spend limits | No | Yes | Yes |
| Usage per sandbox (API) | No | Yes | Yes |
| Audit logs | Yes | Yes | No |
| SSO | Yes | Yes | No |
| SOC 2 | Yes | Yes | No |
| HIPAA | No | Yes | No |
| EU data residency | Yes | Yes | Yes |
| Zero data retention | Not published | Not published | Yes |
Performance
There is no comparable CPU measurement for Koyeb or for Azure Container Apps Sandboxes: neither was part of the hpc-sandbox-benchmarks run. bochka did 26.69 runs per second on that Node.js build-and-test loop at 4 vCPU / 8 GB. Koyeb publishes a CPU share of at least 0.25 dedicated vCPU per GB of memory, bursting to all cores, so this page makes no speed claim between them.
Node.js build-and-test loop at 4 vCPU / 8 GB, higher is better. Measured with the open hpc-sandbox-benchmarks suite. Koyeb and Azure Container Apps Sandboxes have no published run in this suite yet, so there is no like-for-like number to compare.
Pricing in five scenarios
Each bill is priced from the providers' public price lists by the open Battleships engine, with the cheapest plan that runs the scenario.
| Scenario | Koyeb, a month | Azure Container Apps Sandboxes, a month | bochka, a month |
|---|---|---|---|
| One coding agent, workdays 4 vCPU / 8 GB, 50 GB disk, 8 hours a day, 22 days a month, files kept between days | $29 · Pro | $68 · Pay-as-you-go | $20 · $20/mo |
| One agent that never stops 4 vCPU / 8 GB, 50 GB disk, running 24/7 all month | $57 · Pro | $262 · Pay-as-you-go · with limits | $26 · $20/mo |
| 50 agents in parallel 50 machines of 4 vCPU / 8 GB at once, 8-hour sessions, 1,100 sessions a month, Docker inside | $475 · Pro | $3,421 · Pay-as-you-go | $317 · $20/mo × 3 seats |
| Sandboxes for your users 2 vCPU / 4 GB, 30,000 sessions of 10 minutes a month, up to 300 at once | $329 · Scale | $989 · Pay-as-you-go | $200 · $100/mo × 2 seats |
| 1,000 short jobs at once 2 vCPU / 4 GB, 1,000 at once, 3 minutes each, 200,000 jobs a month | $485 · Scale · with limits | $2,148 · Pay-as-you-go | $2,000 · $2000/mo · with limits |
Koyeb: Koyeb bills each instance per second at a fixed price per instance type, and Deep Sleep costs nothing. Pro costs $29 a month with $10 of usage included and Scale $299 a month with $100 included; the rest of the fee is not credit.
Azure Container Apps Sandboxes: Azure bills per second on the Container Apps Consumption meters for the vCPU and memory of the sandbox's tier while it runs, idle time before auto-suspend included. There is no plan fee, and some regions such as West Europe and UK South charge more.
Azure Container Apps Sandboxes: Plans start at $20 a month, and the whole fee is usage credit. You pay per second while a sandbox runs, and a stopped sandbox costs nothing and keeps its disk.
Limits in those scenarios
Koyeb's priced shape is eco-xlarge, which has a 20 GiB disk with no published price for more, and eco instances guarantee only half of each vCPU, so at 1,000 short jobs at once it throttles and does not fit. Azure handles that burst, but it bills a running sandbox until it suspends, so the always-on agent only gets close with a 3-year commitment. Azure also caps a fleet at 500 active cores by default until support raises it, and Koyeb's Pro plan allows 100 services and Scale 1,000.
| Scenario | Koyeb | Azure Container Apps Sandboxes | bochka |
|---|---|---|---|
| One coding agent, workdays |
| None that bite | None that bite |
| One agent that never stops |
|
| None that bite |
| 50 agents in parallel | None that bite | None that bite | None that bite |
| Sandboxes for your users | None that bite | None that bite | None that bite |
| 1,000 short jobs at once |
| None that bite |
|
Which one should you use?
Use Koyeb when
your sandboxes need GPUs or big CPU machines, sleep most of the time and wake on a request, or sit next to apps you already run on Koyeb.
- GPUs in the same platform. Useful when an agent or eval needs a GPU: Koyeb runs instances from RTX 4000 cards up to H100 and H200.
- Bigger CPU machines. For heavy jobs, Koyeb instance types go up to 40 vCPU / 128 GB, well past Azure's 16 vCPU / 32 GB.
- Next to apps you already host. A Koyeb sandbox is a Koyeb service, so teams already serving apps or inference there keep one platform and one bill.
Use Azure Container Apps Sandboxes when
your team already runs on Azure and wants sandboxes that suspend with their memory, sit behind strict egress rules, or handle large bursts of short jobs.
- Suspend with memory, wake on traffic. Good for stateful jobs that sleep between requests: a sandbox keeps its memory and resumes in under a second.
- Fine-grained outbound rules. Its egress policy can allow, deny or rewrite each outbound request by host, path and method, with VNet integration.
- Inside Azure, in 40 regions. Teams already on Azure get Entra ID, Azure billing and their VNets, in 40 regions on six continents.
Where bochka fits
Koyeb and Azure are both built for short sandboxes that sleep between requests. If your agents instead work for hours on one machine, building, running Docker, starting emulators and using a browser, look at bochka: each agent gets a whole VM that keeps its disk, with a desktop, SSH and coding agents built in.
A whole computer with /dev/kvm and SSH
bochka gives root, systemd, Docker, SSH and /dev/kvm on dedicated AMD Ryzen 9 9950X hosts. Neither Koyeb nor Azure documents nested virtualization or offers SSH, so Android emulators and VMs must run elsewhere and remote editors need workarounds.
A screen and a browser for every agent
Every bochka sandbox streams a 60fps Linux desktop with Chromium and computer-use tools. Koyeb and Azure sandboxes are headless, so a browser agent means building a browser, virtual display and streaming stack into your own image.
Agents driven from outside, keys kept outside
Seven coding agents come preinstalled with a prompt, steer and events API, and a credentials proxy keeps real keys out of the sandbox. On Koyeb keys are environment variables, and Azure injects agent tokens at startup, where a prompt-injected agent can read them.
Use bochka when your agents need a whole computer for hours: a disk that stays, Docker, /dev/kvm, SSH, a desktop and a browser, with coding agents and a credentials proxy built in. Compare it one to one: bochka vs Koyeb and bochka vs Azure Container Apps Sandboxes.
Questions people ask
Is Koyeb cheaper than Azure Container Apps Sandboxes?
In the scenarios on this page, yes, where both fit: $475 against $3,421 a month for 50 agents in parallel, and $329 against $989 for sandboxes for your users. For 1,000 short jobs at once, Azure fits and Koyeb's burstable CPU does not. bochka costs $317 and $200 in those two scenarios.
Which is faster, Koyeb or Azure Container Apps Sandboxes?
Neither has a comparable CPU measurement yet, so there is no speed claim between them. bochka did 26.69 runs per second on the hpc-sandbox-benchmarks Node.js loop at 4 vCPU / 8 GB.
Which one keeps my files and memory when it sleeps?
Azure suspends a sandbox with its memory and disk and resumes running processes in under a second. Koyeb loses the local disk on redeploy and a deep sleep discards the VM, so lasting files need a volume or an experimental SDK snapshot. bochka keeps the disk and saves it every minute, but a resume boots the machine again.
Can I run Docker or Android emulators in Koyeb or Azure?
Koyeb starts each sandbox from any Docker image, and on Azure the azure-dev image ships Docker while the default ubuntu image has only Buildah. Neither documents /dev/kvm, so Android emulators and VMs are out; bochka runs Docker on every sandbox and exposes /dev/kvm.
Which one has GPUs?
Koyeb runs instances from an RTX 4000 SFF Ada up to H100 and H200, billed per second. Azure Container Apps Sandboxes and bochka are CPU only.
Is bochka SOC 2 compliant?
SOC 2 is in progress. We're open about where we stand: live status at status.bochka.xyz and our data retention policy at docs.bochka.xyz/data-retention.
Try bochka
Install the CLI, then run bochka new.
Product preview