Namespace vs Azure Container Apps Sandboxes
Namespace is a build and dev platform: CI runners, caches and Devboxes on Linux, macOS and Windows that stop after 4 to 24 hours. Azure Container Apps Sandboxes gives each agent a Linux microVM inside your Azure account, with no session cap, that suspends with its memory and wakes on traffic.
The companies and products
Namespace
Namespace is a dev platform for fast builds, tests and coding environments: CI runners, build caches and Devboxes, on its own hardware.
Most of Namespace is CI: a faster drop-in for GitHub Actions runners, with Docker, Bazel, Turborepo and Nix caching. Its Devboxes are remote Linux and macOS machines with persistent storage, made for people and AI coding agents, and they also host sessions for Claude Managed Agents, Cursor Cloud Agents and Devin. It is a different kind of product from bochka, so this page compares the part where they overlap: a machine an agent works on.
- Products
- GitHub Actions runners, Docker, Bazel, Turborepo and Nix caching, Devboxes, and a compute API
- Hardware
- Its own hardware in its own racks: AMD EPYC for Linux and Windows, Apple M4 Pro or M5 Max for macOS
- Linux Devboxes
- Run from a container image you choose and include Docker; the docs do not say whether each one has its own kernel
- Funding
- Announced a $42M Series B
- Compliance
- Trust center lists SOC 2 Type II
Azure Container Apps Sandboxes
Azure Container Apps Sandboxes is a service inside Microsoft Azure that gives each agent or user an isolated microVM you create, suspend and resume through an SDK.
It is part of Azure Container Apps, the hyperscaler's serverless container platform, and lives in your Azure subscription as a sandbox group resource. Each sandbox boots from an OCI image or a snapshot, has its own kernel, and can be suspended with its memory and resumed in under a second. It is built for teams already on Azure that want stateful code execution with Azure networking, identity and billing.
Which use cases each one fits
For each use case, Battleships prices every sandbox provider on the same workload and sorts them from the cheapest monthly bill up. “80th cheapest of 377” means 79 of the other 376 providers run that workload, with every feature it needs, for less. “With limits” means the provider runs it but misses something, so it is listed after every full match. Open a use case for its whole ranking and what each provider misses.
| Use case and its workload | Namespace: price rank | Azure Container Apps Sandboxes: price rank | bochka: price rank |
|---|---|---|---|
| Software factory 100 at once · 4 vCPU / 8 GB · 2,200 sessions of 8 h a month A software factory is a compromise on both: Namespace Devboxes stop after at most 24 hours, and Azure has no SSH, desktop or documented /dev/kvm; bochka is a full fit with all three. | 39th of 367, with limits $3,495 a month | 288th of 367, with limits $5,276 a month | 3rd cheapest of 367 $634 a month |
| Always-on AI employees 50 machines 24/7 · 2 vCPU / 4 GB An assistant that never stops is a compromise on both: a Namespace Devbox is shut down after at most 24 hours, and Azure bills every running second; bochka has no session cap on paid plans. | 303rd of 366, with limits $6,645 a month | 302nd of 366, with limits $6,544 a month | 5th cheapest of 366 $657 a month |
| Code interpreter bursts 100 at once · 1 vCPU / 2 GB · 200,000 sessions of 1 min a month Azure fits short code runs well, since a sandbox suspends with its memory and resumes in under a second, while Namespace and bochka are both compromises here. | 247th of 345, with limits $250 a month | 34th cheapest of 345 $354 a month | 186th of 345, with limits $2,000 a month |
| Sandboxes for your users 300 at once · 2 vCPU / 4 GB · 30,000 sessions of 23 min a month Azure fits sandboxes for your users by suspending idle ones with their memory, Namespace is a compromise, and bochka fits too with hosting on up to 50 ports. | 284th of 361, with limits $2,068 a month | 22nd cheapest of 361 $2,260 a month | Cheapest of 361 $209 a month |
| RL rollouts 1,000 at once · 2 vCPU / 4 GB · 1,000,000 sessions of 3 min a month | 356th of 360, with limits $9,012 a month | 153rd of 360, with limits $10,740 a month | 34th of 360, with limits $2,000 a month |
| Agent evals 250 at once · 4 vCPU / 8 GB · 15,000 sessions of 20 min a month | 282nd of 364, with limits $1,043 a month | 75th cheapest of 364 $1,728 a month | 10th cheapest of 364 $200 a month |
| CI runners 40 at once · 8 vCPU / 16 GB · 6,000 sessions of 12 min a month All three fit; CI runners with Docker, Bazel and Turborepo caches are Namespace's main product, and bochka adds /dev/kvm for Android or VM builds. | 80th cheapest of 377 $765 a month | 103rd cheapest of 377 $1,046 a month | 4th cheapest of 377 $86 a month |
| 24/7 dev boxes 1 machine 24/7 · 4 vCPU / 8 GB Both are compromises for a 24/7 dev box: a Namespace Devbox stops after at most 24 hours, and Azure has no SSH; a bochka machine takes SSH and stays up. | 126th of 368, with limits $168 a month | 322nd of 368, with limits $262 a month | 18th cheapest of 368 $26 a month |
| Computer-use agents 50 at once · 4 vCPU / 8 GB · 20,000 sessions of 15 min a month Namespace has a screenshot and click API on macOS Devboxes only and Azure's sandboxes are headless; bochka streams a 60fps Linux desktop with Chromium. | 67th of 369, with limits $982 a month | 279th of 369, with limits $1,573 a month | 6th cheapest of 369 $200 a month |
| Browser-use agents 50 at once · 2 vCPU / 4 GB · 30,000 sessions of 10 min a month | 285th of 367, with limits $789 a month | 288th of 367, with limits $795 a month | 7th cheapest of 367 $200 a month |
| Scraping & bots (startup scale) 50 at once · 1 vCPU / 2 GB · 100,000 sessions of 3 min a month | 259th of 346, with limits $332 a month | 284th of 346, with limits $561 a month | 6th cheapest of 346 $90 a month |
| Mass scraping & bots (undetectable) 1,000 at once · 1 vCPU / 2 GB · 3,000,000 sessions of 2 min a month | 226th of 338, with limits $9,012 a month | 239th of 338, with limits $10,956 a month | 71st of 338, with limits $1,800 a month |
| Parallel red teaming 200 at once · 2 vCPU / 4 GB · 5,000 sessions of 30 min a month | 242nd of 360, with limits $339 a month | 278th of 360, with limits $517 a month | 2nd cheapest of 360 $200 a month |
| GPU eval jobs 10 at once · 8 vCPU / 32 GB · 500 sessions of 30 min a month | Can't run it | Can't run it | Can't run it |
| macOS agents 5 at once · 4 vCPU / 8 GB · 1,000 sessions of 20 min a month Only Namespace fits: it runs macOS on Apple Silicon, and neither Azure's sandboxes nor bochka run macOS. | 6th cheapest of 36 $1,205 a month | Can't run it | Can't run it |
Key features
| Feature | Namespace | Azure Container Apps Sandboxes | bochka |
|---|---|---|---|
| Isolation | Linux Devboxes run from a container image on Namespace's own hardware; the docs do not say if each has its own kernel | MicroVM per sandbox with its own kernel | Full VM with its own kernel on dedicated AMD Ryzen 9 9950X hosts |
| CPU speed (Node.js build-and-test, 4 vCPU / 8 GB) | 21.79 runs/s | Not measured | 26.69 runs/s |
| How long a session can run | Devboxes stop after 4, 5 or 24 hours by plan, raisable to 24 at most | No session cap; runs until stopped or suspended when idle | No session cap on paid plans |
| Docker and nested virtualization | Docker in Linux Devboxes; /dev/kvm on Linux compute instances | Docker depends on the image (azure-dev ships it); nested virtualization not documented | Docker, root, systemd and /dev/kvm on every machine |
| Desktop and computer use | Screenshot and click API on macOS Devboxes only; VNC and RDP for compute instances | Headless; no desktop or managed browser | 60fps Linux desktop and Chromium, computer use and browser control, embeddable stream |
| Suspend, idle stop and wake | Devboxes stop after an idle timeout and start again when you connect; instances can suspend with RAM kept | Auto-suspend with memory and disk; resume in under a second, woken by traffic or a start command | Disk saved every minute and on stop; a stopped sandbox costs nothing; resume boots again |
| Fork | No fork | Snapshot a running sandbox with its memory and create new sandboxes from it | Fork a running sandbox with its disk |
| Reaching the sandbox | HTTPS URLs that need a Namespace login, TCP through a CLI port-forward; no public IP | Public HTTPS routes per published port; shell through the aca CLI, no SSH; no public IP | SSH, HTTPS URLs for up to 50 ports, token-protected; raw TCP; dedicated IPv6 or IPv4 |
| Outbound rules | Egress policies by domain per Devbox blueprint, runner or instance | Allow, deny, rewrite and header rules by host, path and method; VNet integration | Open internet, no provider-side allowlist |
| Keeping keys out of the sandbox | Egress rules inject a header from Namespace Vault, outside the workload | Group secrets in egress header rules; Copilot and Anthropic tokens are injected into the sandbox at start | Credentials proxy for model keys and any HTTPS API; switch a credential to another account when credits run out |
| Coding agents | Hosts Claude Managed Agents, Cursor and Devin sessions through those partners; MCP server | Copilot CLI and Claude Code images, run through the exec API | Claude Code, Codex, OpenCode and more preinstalled, with a prompt, steer and events API |
| Scaling a fleet | A vCPU and memory pool per plan, 32 vCPU on Developer up to 160 on Business | 500 concurrent active cores by default, more by Azure support request | Up to 2,000 sandboxes by plan, self-serve |
| Operating systems | Linux, macOS on Apple Silicon, and Windows on Team plans and up | Linux only | Linux only; Wine for Windows apps |
| Regions | Several regions; keeping a workload in one region needs Enterprise | 40 Azure regions, 9 of them in the EU | EU only (Germany, Finland, France) |
Every feature Battleships tracks (43)
| Feature | Namespace | Azure Container Apps Sandboxes | bochka |
|---|---|---|---|
| Full VM (own kernel) | Yes | Yes | Yes |
| Docker inside | Yes | Yes | Yes |
| Nested virtualization | Yes | No | Yes |
| Root | Yes | Yes | Yes |
| Systemd | Not published | Yes | Yes |
| Desktop GUI | Yes | No | Yes |
| Browser | No | No | Yes |
| Computer-use API | Yes | No | Yes |
| SSH | Yes | No | Yes |
| Persistent disk | Yes | Yes | Yes |
| Pause/resume | Yes | Yes | Yes |
| Automatic snapshots | Yes | Yes | Yes |
| Fork/clone | No | Yes | Yes |
| Live fork (no pause) | No | Yes | Yes |
| Memory fork | No | Yes | No |
| Custom image (Docker or snapshot) | Yes | Yes | Yes |
| ≥24 h sessions | Yes | Yes | Yes |
| Idle auto-stop | Yes | Yes | No |
| Wake on request | Yes | Yes | No |
| HTTPS preview URLs | Yes | Yes | Yes |
| Raw TCP inbound | Yes | No | Yes |
| Public IPv4 | No | No | No |
| Egress allowlist | Yes | Yes | No |
| Secret proxy | Yes | Yes | Yes |
| Secret proxy for any API | Yes | Yes | Yes |
| Preinstalled agents | Yes | Yes | Yes |
| Agent harness API | No | No | Yes |
| MCP server | Yes | No | No |
| GPU | No | No | No |
| Windows | Yes | No | No |
| Arm64 | Yes | No | No |
| Self-hosting | No | No | No |
| BYOC | No | No | No |
| Open source | No | No | No |
| Scoped API keys | Not published | Not published | Yes |
| Spend limits | Yes | Yes | Yes |
| Usage per sandbox (API) | No | Yes | Yes |
| Audit logs | Yes | Yes | No |
| SSO | Yes | Yes | No |
| SOC 2 | Yes | Yes | No |
| HIPAA | No | Yes | No |
| EU data residency | Yes | Yes | Yes |
| Zero data retention | Not published | Not published | Yes |
Performance
In StarSling's public run of 2026-09-29 at 4 vCPU / 8 GB, bochka did 26.69 Node.js build-and-test runs per second and Namespace did 21.79, so the same build takes about a fifth longer on Namespace. Azure Container Apps Sandboxes has no comparable measurement yet, so this page makes no speed claim for it.
Node.js build-and-test loop at 4 vCPU / 8 GB, higher is better. Measured with the open hpc-sandbox-benchmarks suite. Namespace measured on: Linux compute instance (unit-minutes, PAYG/overage $0.0015). Azure Container Apps Sandboxes has no published run in this suite yet, so there is no like-for-like number to compare.
Pricing in five scenarios
Each bill is priced from the providers' public price lists by the open Battleships engine, with the cheapest plan that runs the scenario.
| Scenario | Namespace, a month | Azure Container Apps Sandboxes, a month | bochka, a month |
|---|---|---|---|
| One coding agent, workdays 4 vCPU / 8 GB, 50 GB disk, 8 hours a day, 22 days a month, files kept between days | $50 · Devbox (pay as you go) | $68 · Pay-as-you-go | $20 · $20/mo |
| One agent that never stops 4 vCPU / 8 GB, 50 GB disk, running 24/7 all month | $176 · Devbox (pay as you go) · with limits | $262 · Pay-as-you-go · with limits | $26 · $20/mo |
| 50 agents in parallel 50 machines of 4 vCPU / 8 GB at once, 8-hour sessions, 1,100 sessions a month, Docker inside | $2,198 · Devbox (pay as you go) | $3,421 · Pay-as-you-go | $317 · $20/mo × 3 seats |
| Sandboxes for your users 2 vCPU / 4 GB, 30,000 sessions of 10 minutes a month, up to 300 at once | $1,214 · Devbox (pay as you go) | $989 · Pay-as-you-go | $200 · $100/mo × 2 seats |
| 1,000 short jobs at once 2 vCPU / 4 GB, 1,000 at once, 3 minutes each, 200,000 jobs a month | $3,237 · Devbox (pay as you go) | $2,148 · Pay-as-you-go | $2,000 · $2000/mo · with limits |
Namespace: Devboxes are billed in Devbox Minutes at $0.004 each, pay as you go on every plan, and a 4 vCPU / 8 GB Devbox uses one a minute. The Team ($100) and Business ($250) plan minutes cover runners and instances, not Devboxes, and stored files cost $0.20 per GB-month.
Azure Container Apps Sandboxes: Azure bills per second on the Container Apps Consumption meters for the vCPU and memory of the sandbox's tier while it runs, idle time before auto-suspend included. There is no plan fee, stopped sandboxes pay no CPU or memory, and some regions charge more.
Azure Container Apps Sandboxes: Plans start at $20 a month, and the whole fee is usage credit spent per second on running sandboxes. A stopped sandbox costs nothing and keeps its disk.
Limits in those scenarios
On Namespace the limit that bites is time: a Devbox is shut down after 4, 5 or 24 hours by plan, so the agent that never stops has to restart at least once a day. Azure has no session cap but bills a running sandbox every second, so the always-on scenario only gets to $262 a month with a 3-year commitment, and its default quota of 500 active cores caps a fleet until support raises it. Neither publishes a limit that stops the 1,000 short jobs, while bochka's start limits queue that burst on the $2,000 plan.
| Scenario | Namespace | Azure Container Apps Sandboxes | bochka |
|---|---|---|---|
| One coding agent, workdays |
| None that bite | None that bite |
| One agent that never stops |
|
| None that bite |
| 50 agents in parallel |
| None that bite | None that bite |
| Sandboxes for your users |
| None that bite | None that bite |
| 1,000 short jobs at once |
| None that bite |
|
Which one should you use?
Use Namespace when
you need macOS or Windows machines, faster GitHub Actions runners with build caches, or Devboxes for people that stop when idle and start on connect.
- macOS and Windows. Pick Namespace if your agents build iOS or Mac apps or test on Windows: it runs macOS on Apple Silicon and Windows.
- CI runners and build caches. Pick Namespace for faster GitHub Actions: it is a drop-in runner with Docker, Bazel, Turborepo and Nix caching.
- Measured, fast Linux machines. Namespace runs on its own AMD EPYC hardware and was measured at 21.79 runs per second, while Azure has no comparable score.
Use Azure Container Apps Sandboxes when
your team already runs on Azure and wants short stateful sandboxes that suspend with their memory, wake on traffic, sit behind strict egress rules, or run outside the EU.
- Memory suspend and wake on traffic. Pick Azure for stateful jobs that sleep between requests: a sandbox suspends with its memory and resumes in under a second.
- No session cap and memory forks. Azure sandboxes run until stopped, and a snapshot of a running one can seed many new sandboxes with its memory.
- Inside Azure, in 40 regions. Teams already on Azure get Entra ID, Azure billing, VNets and fine-grained egress rules, in 40 regions.
Where bochka fits
If what you are really running is coding agents that work on Linux for hours or days, look at bochka. It gives each agent a full VM with no session cap, SSH, Docker and /dev/kvm, a 60fps desktop, and agents you drive from outside, which neither Namespace nor Azure ships together.
No clock and a real shell
A Namespace Devbox is shut down after at most 24 hours, so your code must restart it and resume. Azure has no cap but no SSH, so editors and tools that expect SSH need a workaround through its exec API.
A screen and nested VMs
Azure's sandboxes are headless and do not document /dev/kvm, and Namespace's display API works on macOS only. A Linux computer-use or Android agent means installing a desktop and VNC yourself, or paying for macOS minutes.
Agents and keys built in
On Namespace a partner runs the agent loop or you write it; Azure drives agents through raw exec and injects their tokens into the sandbox. bochka ships the agents, an API to steer them, and a proxy that keeps keys outside.
Use bochka when your agents work on Linux for hours or days and need a whole computer: SSH, Docker and /dev/kvm, a 60fps desktop, no session cap, and coding agents you drive from outside. Compare it one to one: bochka vs Namespace and bochka vs Azure Container Apps Sandboxes.
Questions people ask
Is Namespace cheaper than Azure Container Apps Sandboxes?
For longer sessions, yes in our scenarios: one coding agent on workdays is $50 a month on Namespace against $68 on Azure, and 50 agents in parallel are $2,198 against $3,421. For many short sessions Azure costs less, such as $989 against $1,214 for sandboxes for your users. bochka comes to $20, $317 and $200 for those three.
Which is faster, Namespace or Azure Container Apps Sandboxes?
Only Namespace has been measured: 21.79 runs per second on StarSling's Node.js build-and-test loop at 4 vCPU / 8 GB, against 26.69 for bochka. Azure has no comparable score yet, so we make no speed claim for it.
Can I run Docker on Namespace and Azure Container Apps Sandboxes?
Namespace Linux Devboxes include Docker. On Azure it depends on the image: azure-dev ships Docker on systemd, while the default ubuntu image has only Buildah. bochka runs Docker, systemd and /dev/kvm on every sandbox.
How long can a session run on each?
A Namespace Devbox is shut down after 4 hours on Developer, 5 on Team and 24 on Business, even while you work in it. Azure documents no session cap, and a sandbox runs until it is stopped or suspended when idle. bochka has no session cap on paid plans.
Can I SSH into them?
Azure gives you a shell through the aca CLI, the SDK or the portal, not SSH. Namespace reaches Devboxes through its own login and a CLI port-forward. Every bochka sandbox has an SSH endpoint, so editors that connect over SSH work as on any server.
Do either of them run macOS?
Namespace does, on Apple M4 Pro and M5 Max machines with Xcode, and it also runs Windows on Team plans and up. Azure Container Apps Sandboxes and bochka are Linux only.
Try bochka
Install the CLI, then run bochka new.
Product preview