Northflank vs Deno Sandbox

Both run code in a microVM with its own kernel. Northflank is a broad cloud platform whose sandboxes run until you pause them, in sizes up to 20 vCPU and with GPUs, while Deno Sandbox gives you small 2 vCPU machines that start in under 200 ms and live up to 30 minutes.

The companies and products

Northflank

Northflank is a London developer platform for running services, jobs and databases on Kubernetes, and Sandboxes is its product for running untrusted code.

A Northflank sandbox is a container image deployed as a service: CPU sandboxes run in Kata microVMs with their own kernel, and GPU sandboxes run under gVisor. You create and drive them from the JavaScript or Python SDK, the CLI or the dashboard, on Northflank's cloud or inside your own. It suits teams that already want one platform for apps, databases, GPUs and sandboxes.

Kind of product: Full developer platform (services, jobs, databases, GPUs) with sandboxes as one workload type
Isolation: CPU sandboxes in microVMs (Kata), GPU sandboxes under gVisor
Regions: US, Canada, Brazil, UK, EU, Switzerland, Asia, Australia and South Africa; fixed per project
Your own cloud: Run on AWS, GCP, Azure, Oracle, CoreWeave and others, or put the control plane in your VPC on Enterprise
GPUs: L4, A100, H100, RTX PRO 6000 and more, billed per hour
Compliance: SOC 2 Type 2 and HIPAA

Deno Sandbox

Deno Sandbox is part of Deno Deploy, the hosting platform from the company behind the Deno runtime, and runs untrusted or AI-generated code in Linux microVMs.

Each sandbox is a Firecracker microVM with 2 vCPU, up to 4 GB of memory and a 10 GB disk that is wiped when it ends, created from a TypeScript or Python SDK. Outbound traffic goes through a proxy that can enforce a host allowlist and swap placeholder secrets for real ones. It is built for short runs of agent or user code, and a sandbox can be promoted to a Deno Deploy app.

Isolation: Firecracker microVM per sandbox
Machine size: 2 vCPU, 768 MB to 4 GB memory, 10 GB ephemeral disk
Lifetime: Bound to a session, up to 30 minutes
Regions: Amsterdam and Chicago; volumes only in Chicago
Plans: Sandboxes on Pro and Builder; 3 or 20 at once per region
Compliance: Deno Deploy states SOC2 and ISO27001; HIPAA BAA for enterprise contracts

Which use cases each one fits

For each use case, Battleships prices every sandbox provider on the same workload and sorts them from the cheapest monthly bill up. “38th cheapest of 377” means 37 of the other 376 providers run that workload, with every feature it needs, for less. “With limits” means the provider runs it but misses something, so it is listed after every full match. Open a use case for its whole ranking and what each provider misses.

Use case and its workload	Northflank: price rank	Deno Sandbox: price rank	bochka: price rank
Software factory 100 at once · 4 vCPU / 8 GB · 2,200 sessions of 8 h a month A software factory runs installs and builds for hours, which fits Northflank's sizes better than Deno's 30-minute, 2 vCPU sandboxes; bochka also keeps the whole disk between runs.	159th of 367, with limits $1,477 a month	290th of 367, with limits $5,665 a month	3rd cheapest of 367 $634 a month
Always-on AI employees 50 machines 24/7 · 2 vCPU / 4 GB An assistant that lives on its machine all month cannot run on Deno past 30 minutes, and on Northflank only attached volumes survive a pause; bochka keeps the whole machine.	173rd of 366, with limits $1,365 a month	287th of 366, with limits $5,803 a month	5th cheapest of 366 $657 a month
Code interpreter bursts 100 at once · 1 vCPU / 2 GB · 200,000 sessions of 1 min a month Short code runs suit both: Deno starts in under 200 ms and bills CPU only while code runs, and Northflank has per-second plans from a tenth of a vCPU.	84th of 345, with limits $115 a month	141st of 345, with limits $329 a month	186th of 345, with limits $2,000 a month
Sandboxes for your users 300 at once · 2 vCPU / 4 GB · 30,000 sessions of 23 min a month Deno Builder allows 20 sandboxes at once per region and Northflank does not publish a limit; bochka's plans go to hundreds, with token-protected HTTPS by default.	89th of 361, with limits $815 a month	148th of 361, with limits $1,863 a month	Cheapest of 361 $209 a month
RL rollouts 1,000 at once · 2 vCPU / 4 GB · 1,000,000 sessions of 3 min a month Deno ranks above Northflank for RL rollouts in this table, though both are a compromise here and bochka ranks higher than either.	342nd of 360, with limits $1,762 a month	122nd of 360, with limits $7,963 a month	34th of 360, with limits $2,000 a month
Agent evals 250 at once · 4 vCPU / 8 GB · 15,000 sessions of 20 min a month	134th of 364, with limits $689 a month	296th of 364, with limits $1,563 a month	10th cheapest of 364 $200 a month
CI runners 40 at once · 8 vCPU / 16 GB · 6,000 sessions of 12 min a month Northflank fits CI jobs in this table and Deno's 2 vCPU, 30-minute shape does not; bochka adds Docker, /dev/kvm for emulators and free stops.	38th cheapest of 377 $352 a month	304th of 377, with limits $731 a month	4th cheapest of 377 $86 a month
24/7 dev boxes 1 machine 24/7 · 4 vCPU / 8 GB	151st of 368, with limits $59 a month	179th of 368, with limits $200 a month	18th cheapest of 368 $26 a month
Computer-use agents 50 at once · 4 vCPU / 8 GB · 20,000 sessions of 15 min a month Neither Northflank nor Deno Sandbox has a desktop, so you would build and stream one yourself; bochka ships a 60fps Linux desktop with Chromium.	151st of 369, with limits $371 a month	280th of 369, with limits $1,583 a month	6th cheapest of 369 $200 a month
Browser-use agents 50 at once · 2 vCPU / 4 GB · 30,000 sessions of 10 min a month	200th of 367, with limits $194 a month	284th of 367, with limits $783 a month	7th cheapest of 367 $200 a month
Scraping & bots (startup scale) 50 at once · 1 vCPU / 2 GB · 100,000 sessions of 3 min a month	196th of 346, with limits $117 a month	286th of 346, with limits $573 a month	6th cheapest of 346 $90 a month
Mass scraping & bots (undetectable) 1,000 at once · 1 vCPU / 2 GB · 3,000,000 sessions of 2 min a month	83rd of 338, with limits $2,049 a month	247th of 338, with limits $11,923 a month	71st of 338, with limits $1,800 a month
Parallel red teaming 200 at once · 2 vCPU / 4 GB · 5,000 sessions of 30 min a month	141st of 360, with limits $99 a month	251st of 360, with limits $367 a month	2nd cheapest of 360 $200 a month
GPU eval jobs 10 at once · 8 vCPU / 32 GB · 500 sessions of 30 min a month Northflank has GPU sandboxes from L4 to H100 and up; Deno Sandbox and bochka are CPU only.	4th cheapest of 98 $693 a month	Can't run it	Can't run it
macOS agents 5 at once · 4 vCPU / 8 GB · 1,000 sessions of 20 min a month	Can't run it	Can't run it	Can't run it

Key features

Feature	Northflank	Deno Sandbox	bochka
Isolation	Kata microVM with its own kernel for CPU; gVisor for GPU	Firecracker microVM with its own kernel	Full VM with its own kernel on dedicated AMD Ryzen 9 9950X hosts
Machine size	Plans from 0.1 vCPU up to 20 vCPU / 40 GB, more on request	2 vCPU fixed, 768 MB to 4 GB memory, 10 GB disk	4 vCPU / 8 GB by default, up to 16 vCPU / 32 GB on the $100 plan and above
Session length	No documented cap; runs until you pause or delete it	Up to 30 minutes; longer work can be promoted to a Deno Deploy app	No cap on paid plans; you set the time to live
What survives a stop	Only attached volumes, which bill while paused; the rest of the disk and all processes reset	Root disk wiped when the sandbox ends; opt-in volumes of 300 MB to 20 GB, Chicago only	The whole disk, saved every minute and on stop; a stopped sandbox costs nothing
Snapshots and fork	Filesystem snapshots of a running or stopping sandbox, opt-in; restore into a new one	Read-only snapshots of a volume that many new sandboxes can boot from; no fork of a running sandbox	Automatic disk snapshots; fork a running sandbox with its disk
Docker and nested virtualization	Own kernel, so Docker can run inside; /dev/kvm not documented	Root access; Docker and nested virtualization not documented	Docker, systemd and /dev/kvm for Android emulators and VMs
Desktop and browser	Headless; access by SDK, browser terminal or SSH	No desktop; a VS Code editor in the browser and SSH	60fps Linux desktop, Chromium and computer use built in
Coding agents	Harnesses with Claude Code, Codex, Cursor, OpenCode or Pi, reached through a terminal or SSH	A root image with Claude Code, run through the shell command API	Seven agents preinstalled, with a prompt, steer and events API
Keeping API keys out of the sandbox	Header injection for listed hosts in the network policy API	Secrets swapped in on outbound requests to approved hosts; the sandbox only sees a placeholder	Credentials proxy for model providers and any HTTPS API; switch a credential to another account when credits run out
Inbound access	HTTPS ports on a code.run domain, private by default; public TCP and UDP need a separate load balancer	HTTPS URL per exposed port, public without authentication; SSH	HTTPS URLs for up to 50 ports, token-protected by default; raw TCP
Outbound rules	Network policies with allow lists by IP, CIDR or domain	Host allowlist per sandbox (allowNet), enforced by a proxy outside the VM	Open internet, no provider-side allowlist
GPUs	L4, A100, H100, RTX PRO 6000 and more	No	No
Regions and hosting	US, Europe, Asia, Australia, South America and Africa; or your own cloud account	Amsterdam and Chicago	EU only (Germany, Finland, France)

Every feature Battleships tracks (43)

Feature	Northflank	Deno Sandbox	bochka
Full VM (own kernel)	Yes	Yes	Yes
Docker inside	Yes	Not published	Yes
Nested virtualization	No	No	Yes
Root	Not published	Yes	Yes
Systemd	Not published	Not published	Yes
Desktop GUI	No	No	Yes
Browser	No	No	Yes
Computer-use API	No	No	Yes
SSH	Yes	Yes	Yes
Persistent disk	Yes	Yes	Yes
Pause/resume	Yes	No	Yes
Automatic snapshots	Yes	No	Yes
Fork/clone	Yes	No	Yes
Live fork (no pause)	Yes	No	Yes
Memory fork	No	No	No
Custom image (Docker or snapshot)	Yes	Yes	Yes
≥24 h sessions	Yes	No	Yes
Idle auto-stop	No	No	No
Wake on request	No	No	No
HTTPS preview URLs	Yes	Yes	Yes
Raw TCP inbound	Yes	No	Yes
Public IPv4	No	No	No
Egress allowlist	Yes	Yes	No
Secret proxy	Yes	Yes	Yes
Secret proxy for any API	Yes	Yes	Yes
Preinstalled agents	Yes	Yes	Yes
Agent harness API	No	No	Yes
MCP server	No	No	No
GPU	Yes	No	No
Windows	No	No	No
Arm64	Yes	No	No
Self-hosting	Yes	No	No
BYOC	Yes	No	No
Open source	No	No	No
Scoped API keys	Not published	Not published	Yes
Spend limits	Not published	Yes	Yes
Usage per sandbox (API)	Yes	No	Yes
Audit logs	Yes	Not published	No
SSO	Yes	No	No
SOC 2	Yes	Yes	No
HIPAA	Yes	Yes	No
EU data residency	Yes	Yes	Yes
Zero data retention	Not published	Not published	Yes

Performance

NorthflankNot measured

Deno SandboxNot measured

bochka26.69 runs/s

There is no comparable CPU measurement for Northflank Sandboxes or Deno Sandbox: neither has a result on the StarSling hpc-sandbox-benchmarks test. bochka did 26.69 runs per second on that Node.js build-and-test loop at 4 vCPU / 8 GB, on dedicated AMD Ryzen 9 9950X hosts. Deno's fixed 2 vCPU shape could not run the 4 vCPU test as set up.

Node.js build-and-test loop at 4 vCPU / 8 GB, higher is better. Measured with the open hpc-sandbox-benchmarks suite. Northflank and Deno Sandbox have no published run in this suite yet, so there is no like-for-like number to compare.

Pricing in five scenarios

Each bill is priced from the providers' public price lists by the open Battleships engine, with the cheapest plan that runs the scenario.

Scenario	Northflank, a month	Deno Sandbox, a month	bochka, a month
One coding agent, workdays 4 vCPU / 8 GB, 50 GB disk, 8 hours a day, 22 days a month, files kept between days	$32 · Developer Sandbox (free tier) · with limits	$53 · Pro · with limits	$20 · $20/mo
One agent that never stops 4 vCPU / 8 GB, 50 GB disk, running 24/7 all month	$108 · Developer Sandbox (free tier) · with limits	$200 · Builder · with limits	$26 · $20/mo
50 agents in parallel 50 machines of 4 vCPU / 8 GB at once, 8-hour sessions, 1,100 sessions a month, Docker inside	$1,322 · Developer Sandbox (free tier) · with limits	$2,779 · Builder · with limits	$317 · $20/mo × 3 seats
Sandboxes for your users 2 vCPU / 4 GB, 30,000 sessions of 10 minutes a month, up to 300 at once	$361 · Developer Sandbox (free tier) · with limits	$783 · Builder · with limits	$200 · $100/mo × 2 seats
1,000 short jobs at once 2 vCPU / 4 GB, 1,000 at once, 3 minutes each, 200,000 jobs a month	$688 · Developer Sandbox (free tier) · with limits	$1,563 · Builder · with limits	$2,000 · $2000/mo · with limits

Northflank: Northflank bills per second for the plan size you pick, with no monthly fee, until you pause the sandbox; there is no idle auto-pause. Volumes cost $0.15 per GB a month even while paused, and outbound traffic costs $0.06 per GB.

Deno Sandbox: Sandboxes need the Pro plan at $20 a month or Builder at $200 a month, which include CPU, memory and egress allowances shared with your Deno Deploy apps. Past those, CPU costs $0.10 per hour of active CPU time and memory $0.025 per GiB-hour for the whole life of the sandbox.

Deno Sandbox: Plans start at $20 a month, and the whole fee is usage credit. You pay per second while a sandbox runs, and a stopped sandbox costs nothing and keeps its whole disk.

Limits in those scenarios

Neither fits the five scenarios as written. On Northflank the limit that bites is what survives a stop, since only attached volumes keep their files, and it does not publish how many sandboxes can run at once, so 300 or 1,000 at a time is not confirmed. Deno Sandbox lives up to 30 minutes at a fixed 2 vCPU with up to 4 GB of memory, and Builder allows 20 at once per region. bochka fits four of the five; at 1,000 short jobs at once its top plan queues starts above 90 a minute.

Scenario	Northflank	Deno Sandbox	bochka
One coding agent, workdays	files survive a stop only in attached volumes: packages installed elsewhere reset	Pro: sessions capped at 0.5 h capped at 2 vCPU / 4 GiB largest size is 2 vCPU / 4 GiB disk beyond 10 GiB: price unknown	None that bite
One agent that never stops	files survive a stop only in attached volumes: packages installed elsewhere reset	Builder: sessions capped at 0.5 h capped at 2 vCPU / 4 GiB largest size is 2 vCPU / 4 GiB disk beyond 10 GiB: price unknown	None that bite
50 agents in parallel	files survive a stop only in attached volumes: packages installed elsewhere reset how many machines can run at once: limit not published, probably fine at 50 (the typical published limit is 50)	Builder: max 20 concurrent Builder: sessions capped at 0.5 h capped at 2 vCPU / 4 GiB largest size is 2 vCPU / 4 GiB	None that bite
Sandboxes for your users	not confirmed: how many machines can run at once (you need 300; the typical published limit is 50)	Builder: max 20 concurrent	None that bite
1,000 short jobs at once	not confirmed: how many machines can run at once (you need 1,000; the typical published limit is 50)	Builder: max 20 concurrent	max 2,400 starts/day (needs ~6,667) max 600 starts/hour (needs ~1,000) bursts above 90 starts/min are queued (a burst of 333 takes ~4 min to start)

Which one should you use?

Use Northflank when

your sandboxes run for hours, need more than 2 vCPU or a GPU, or must live in regions outside Europe or in your own cloud account.

Bigger machines and GPUs. For work that needs more than 2 vCPU or a GPU: Northflank goes to 20 vCPU / 40 GB and has cards up to H100.
No 30-minute limit. For agents that run for hours: a Northflank sandbox runs until you pause it, with no documented session cap.
Many regions or your own cloud. For teams far from Europe or bound to their own AWS, GCP or Azure account, next to their other apps.

Use Deno Sandbox when

you run short pieces of untrusted code that must start in milliseconds and reach only the hosts you allow, especially if you already deploy on Deno Deploy.

Starts in under 200 ms. For one sandbox per request: Deno says a sandbox starts in under 200 ms, and CPU bills only while code runs.
Locked-down outbound traffic. For untrusted code: each sandbox can be limited to a list of hosts, enforced by a proxy outside the VM.
A path to Deno Deploy. For teams on Deno Deploy: a sandbox can be promoted to a Deploy app and bills on the same meters.

Where bochka fits

If your agents work on one machine for hours or days, look at bochka as well. It gives each agent a full VM whose whole disk is still there after a stop, with Docker, /dev/kvm, a desktop, a browser and coding agents you drive from your code.

The whole machine comes back

On Northflank a pause wipes everything outside attached volumes, and a Deno sandbox wipes its root disk when it ends. bochka saves the whole disk every minute and on stop, so an agent never reinstalls its tools.

Emulators, a desktop and a browser inside

Both Northflank and Deno Sandbox are headless and document no /dev/kvm, so a computer-use agent needs a desktop image you build and stream yourself. bochka ships a 60fps desktop with Chromium and runs Android emulators.

Agents you drive from outside

Northflank Harnesses are reached through a terminal or SSH, and Deno runs Claude Code through shell commands you parse yourself. bochka preinstalls seven agents with an API to prompt, steer and follow them.

Use bochka when your agents do real work on one machine for hours or days and should find it as they left it: installs, Docker, emulators, a desktop and a browser, with the agent driven from your code. Compare it one to one: bochka vs Northflank and bochka vs Deno Sandbox.

Questions people ask

Is Northflank cheaper than Deno Sandbox?

In all five scenarios on this page, yes: one agent that never stops is $108 a month on Northflank against $200 on Deno, and 50 agents in parallel are $1,322 against $2,779. bochka is $26 and $317 a month for the same two.

Which is faster?

Neither Northflank nor Deno Sandbox has a result on the CPU benchmark bochka is measured on, so there is no fair speed ratio. Deno says a sandbox starts in under 200 ms, and Northflank offers bigger machines, up to 20 vCPU.

How long can a sandbox run on each?

Northflank documents no session cap: a sandbox runs until you pause or delete it. A Deno sandbox lives up to 30 minutes, and longer work can be promoted to a Deno Deploy app. bochka has no cap on paid plans.

Do they keep files between runs?

Only on volumes. Northflank keeps attached volumes when paused and resets the rest of the disk, and Deno wipes the root disk when a sandbox ends, with volumes only in Chicago. bochka keeps the whole disk and saves it every minute.

Can Northflank or Deno Sandbox run Docker?

Northflank gives each sandbox its own kernel, so Docker can run inside. Deno's docs do not say Docker works inside a sandbox. bochka runs Docker and systemd and exposes /dev/kvm for Android emulators and VMs.

Which has GPUs?

Northflank has GPU sandboxes under gVisor with cards from L4 to H100 and more. Deno Sandbox and bochka run on CPUs only.

Try bochka

Install the CLI, then run bochka new.

Product preview