Ona vs Docker Cloud Sandboxes
Ona, formerly Gitpod, gives engineering teams cloud dev environments shared with its Codex agent, sold through sales and run in your own AWS or GCP account. Docker Cloud Sandboxes put the sbx agent microVM from your laptop on Docker's compute, pay as you go, for up to 24 hours per session.
The companies and products
Ona
Ona, formerly Gitpod, is a platform for cloud dev environments and background coding agents, and is now part of OpenAI.
Ona is a different kind of product from bochka: a dev-environment platform, not a sandbox API. Each task or developer gets an isolated VM built from a Dev Container config, which people open in a browser IDE, VS Code or JetBrains, and where Ona's Codex Agent can plan, code, test and open pull requests. It is built for engineering teams who want the same governed environment for every developer and agent; new customers run it in their own AWS or GCP account on an Enterprise contract.
Docker Cloud Sandboxes
Docker Cloud Sandboxes runs Docker's sbx coding-agent microVMs on Docker-managed compute instead of your laptop.
Each sandbox is a microVM with its own Linux kernel and its own Docker Engine, started from the same sbx CLI you use locally, with Claude Code, Codex and other agents ready to run. You can move a sandbox from your laptop to the cloud and back, publish HTTPS ports and SSH in. It launched on September 24, 2026, is billed pay-as-you-go on a personal Docker account, and is built for developers who want their local agent sandboxes to keep going off their machine.
- Launched
- September 24, 2026
- Session length
- 1 hour by default, extendable to 24 hours from creation
- Default quota
- 10 concurrent and 50 stored sandboxes per account
- Regions
- Not published
Which use cases each one fits
For each use case, Battleships prices every sandbox provider on the same workload and sorts them from the cheapest monthly bill up. “324th cheapest of 367” means 323 of the other 366 providers run that workload, with every feature it needs, for less. “With limits” means the provider runs it but misses something, so it is listed after every full match. Open a use case for its whole ranking and what each provider misses.
| Use case and its workload | Ona: price rank | Docker Cloud Sandboxes: price rank | bochka: price rank |
|---|---|---|---|
| Software factory 100 at once · 4 vCPU / 8 GB · 2,200 sessions of 8 h a month A software factory runs many agents for days; Docker stops each sandbox 24 hours after creation and runs 10 at once, and Ona needs an Enterprise contract, while bochka fits fully. | 324th of 367, with limits $7,315 a month | 280th of 367, with limits $4,928 a month | 3rd cheapest of 367 $634 a month |
| Always-on AI employees 50 machines 24/7 · 2 vCPU / 4 GB An always-on assistant needs auto-stop set to Never on Ona and cannot live in one Docker session, which ends after 24 hours; bochka has no session cap on paid plans. | 83rd of 366, with limits $8,504 a month | 276th of 366, with limits $5,110 a month | 5th cheapest of 366 $657 a month |
| Code interpreter bursts 100 at once · 1 vCPU / 2 GB · 200,000 sessions of 1 min a month Docker fits short code runs better than Ona here: small sandboxes billed by the second, with no monthly fee and memory kept across stops. | 335th of 345, with limits $5,320 a month | 119th of 345, with limits $233 a month | 186th of 345, with limits $2,000 a month |
| Sandboxes for your users 300 at once · 2 vCPU / 4 GB · 30,000 sessions of 23 min a month Neither is built to hand machines to your users: Ona targets your own engineers, and Docker defaults to 10 sandboxes at once on one personal account. | 330th of 361, with limits $5,988 a month | 136th of 361, with limits $1,628 a month | Cheapest of 361 $209 a month |
| RL rollouts 1,000 at once · 2 vCPU / 4 GB · 1,000,000 sessions of 3 min a month | 283rd of 360, with limits $9,773 a month | 114th of 360, with limits $7,000 a month | 34th of 360, with limits $2,000 a month |
| Agent evals 250 at once · 4 vCPU / 8 GB · 15,000 sessions of 20 min a month | 334th of 364, with limits $5,768 a month | 167th of 364, with limits $1,400 a month | 10th cheapest of 364 $200 a month |
| CI runners 40 at once · 8 vCPU / 16 GB · 6,000 sessions of 12 min a month CI that builds Android apps or VM images needs /dev/kvm, which bochka exposes and neither Ona nor Docker documents. | 365th of 377, with limits $5,461 a month | 172nd of 377, with limits $672 a month | 4th cheapest of 377 $86 a month |
| 24/7 dev boxes 1 machine 24/7 · 4 vCPU / 8 GB Ona is the stronger dev box of the two, with a browser IDE, VS Code, JetBrains and prebuilds, while Docker's sandboxes end after 24 hours. | 368th of 368, with limits $5,140 a month | 127th of 368, with limits $204 a month | 18th cheapest of 368 $26 a month |
| Computer-use agents 50 at once · 4 vCPU / 8 GB · 20,000 sessions of 15 min a month Computer-use agents need a screen; Ona offers an IDE and Docker a terminal, while bochka streams a 60fps desktop with Chromium. | 353rd of 369, with limits $5,691 a month | 268th of 369, with limits $1,400 a month | 6th cheapest of 369 $200 a month |
| Browser-use agents 50 at once · 2 vCPU / 4 GB · 30,000 sessions of 10 min a month | 150th of 367, with limits $5,346 a month | 277th of 367, with limits $700 a month | 7th cheapest of 367 $200 a month |
| Scraping & bots (startup scale) 50 at once · 1 vCPU / 2 GB · 100,000 sessions of 3 min a month | 146th of 346, with limits $5,468 a month | 262nd of 346, with limits $350 a month | 6th cheapest of 346 $90 a month |
| Mass scraping & bots (undetectable) 1,000 at once · 1 vCPU / 2 GB · 3,000,000 sessions of 2 min a month | 261st of 338, with limits $14,360 a month | 190th of 338, with limits $7,000 a month | 71st of 338, with limits $1,800 a month |
| Parallel red teaming 200 at once · 2 vCPU / 4 GB · 5,000 sessions of 30 min a month Docker can snapshot a running sandbox with its memory and restore copies, Ona cannot copy an environment, and bochka forks a running sandbox into many. | 93rd of 360, with limits $5,228 a month | 248th of 360, with limits $350 a month | 2nd cheapest of 360 $200 a month |
| GPU eval jobs 10 at once · 8 vCPU / 32 GB · 500 sessions of 30 min a month | Can't run it | Can't run it | Can't run it |
| macOS agents 5 at once · 4 vCPU / 8 GB · 1,000 sessions of 20 min a month | Can't run it | Can't run it | Can't run it |
Key features
| Feature | Ona | Docker Cloud Sandboxes | bochka |
|---|---|---|---|
| Isolation | Isolated VM per environment with dedicated compute, built from a Dev Container config | MicroVM with its own Linux kernel and its own Docker Engine | Full VM with its own kernel on dedicated AMD Ryzen 9 9950X hosts |
| Buying it | New Core subscriptions are closed; new customers buy Enterprise through sales | Pay-as-you-go on a personal Docker account, no monthly fee | Self-serve plans from a free trial up, from $20 a month |
| Session length | No hard cap; stops after 30 idle minutes by default, background work does not count, can be set to Never | 1 hour by default, at most 24 hours from creation | No cap on paid plans; you set the time to live |
| Sandboxes at once | Enterprise limit not published; per-user policy defaults to 10 running environments | 10 concurrent and 50 stored by default; no published way to raise it | 100 on the $20 plan, up to 2,000 on higher plans, self-serve |
| Stop and resume | Disk persists; in your own cloud its storage is billed while stopped, and Core archives after 3 days | Stop keeps memory and files for free; snapshots are deleted after 7 days of non-use | Disk saved every minute and on stop; a stopped sandbox keeps its disk and costs nothing |
| Fork | No environment copy; you can create a project from an environment's config | Snapshot a running sandbox with disk or disk and memory, then restore it as a new one | Fork a running sandbox into copies with its disk |
| Docker and nested virtualization | Docker and root in the Dev Container; nested virtualization not documented | Its own Docker Engine, agent runs as non-root with sudo; nested virtualization not documented | Docker, root, systemd and /dev/kvm on every machine |
| Desktop and browser | Browser IDE, VS Code and JetBrains; no graphical desktop inside | Terminal sessions only | 60fps Linux desktop with Chromium and computer use |
| Coding agents | Codex Agent from chat, a Linear issue or an automation; Claude Code you run yourself | Claude Code, Codex, Copilot, OpenCode and more, attached to from the sbx CLI | Seven agents preinstalled, with a prompt, steer and events API to drive them from outside |
| Driving it from code | Python, TypeScript and Go SDK on the Enterprise plan only | Sandboxes API and the sbx CLI | API and SDK on every plan, including the trial |
| Keeping API keys out of the sandbox | Secrets injected as environment variables or files | Cloud proxy sets the auth header for AI services and custom hosts; the sandbox sees a placeholder | Credentials proxy for model providers and any HTTPS API; switch a credential to another account when credits run out |
| Inbound access | HTTPS URL per port for you, your organization or everyone; SSH; no raw TCP or public IP documented | Public HTTPS URL per published port, not behind Docker sign-in; not a TCP tunnel; SSH | HTTPS URLs for up to 50 ports, token-protected by default; raw TCP; dedicated IPv4 or IPv6 |
| Outbound rules | No egress allowlist documented | Allow and deny rules by host at a proxy, with allow-all, balanced and deny-all presets | Open internet, no provider-side allowlist |
| Where it runs | Enterprise runners in your own AWS or GCP account, in many regions; GPU instance types available | Docker-managed cloud, regions not published; same microVM runs on your laptop | EU only: Germany, Finland, France; no GPUs |
Every feature Battleships tracks (43)
| Feature | Ona | Docker Cloud Sandboxes | bochka |
|---|---|---|---|
| Full VM (own kernel) | Yes | Yes | Yes |
| Docker inside | Yes | Yes | Yes |
| Nested virtualization | No | No | Yes |
| Root | Yes | Yes | Yes |
| Systemd | Not published | Not published | Yes |
| Desktop GUI | No | No | Yes |
| Browser | Yes | No | Yes |
| Computer-use API | No | No | Yes |
| SSH | Yes | Yes | Yes |
| Persistent disk | Yes | Yes | Yes |
| Pause/resume | Yes | Yes | Yes |
| Automatic snapshots | No | Yes | Yes |
| Fork/clone | No | Yes | Yes |
| Live fork (no pause) | No | Yes | Yes |
| Memory fork | No | Yes | No |
| Custom image (Docker or snapshot) | Yes | Yes | Yes |
| ≥24 h sessions | Yes | Yes | Yes |
| Idle auto-stop | Yes | No | No |
| Wake on request | No | Not published | No |
| HTTPS preview URLs | Yes | Yes | Yes |
| Raw TCP inbound | No | Not published | Yes |
| Public IPv4 | No | No | No |
| Egress allowlist | No | Yes | No |
| Secret proxy | No | Yes | Yes |
| Secret proxy for any API | No | Yes | Yes |
| Preinstalled agents | Yes | Yes | Yes |
| Agent harness API | Yes | No | Yes |
| MCP server | No | Yes | No |
| GPU | Yes | No | No |
| Windows | No | No | No |
| Arm64 | No | Yes | No |
| Self-hosting | No | No | No |
| BYOC | Yes | No | No |
| Open source | No | No | No |
| Scoped API keys | Not published | Not published | Yes |
| Spend limits | Yes | Not published | Yes |
| Usage per sandbox (API) | No | No | Yes |
| Audit logs | No | Not published | No |
| SSO | Yes | Yes | No |
| SOC 2 | Yes | No | No |
| HIPAA | No | No | No |
| EU data residency | Yes | No | Yes |
| Zero data retention | Not published | Not published | Yes |
Performance
There is no comparable measurement for Ona or for Docker Cloud Sandboxes: neither is in the public hpc-sandbox-benchmarks runs we use, and Docker does not say what hardware it uses. bochka did 26.69 Node.js build-and-test runs per second at 4 vCPU / 8 GB in StarSling's run of 2026-09-29, on dedicated AMD Ryzen 9 9950X hosts.
Node.js build-and-test loop at 4 vCPU / 8 GB, higher is better. Measured with the open hpc-sandbox-benchmarks suite. Ona and Docker Cloud Sandboxes have no published run in this suite yet, so there is no like-for-like number to compare.
Pricing in five scenarios
Each bill is priced from the providers' public price lists by the open Battleships engine, with the cheapest plan that runs the scenario.
| Scenario | Ona, a month | Docker Cloud Sandboxes, a month | bochka, a month |
|---|---|---|---|
| One coding agent, workdays 4 vCPU / 8 GB, 50 GB disk, 8 hours a day, 22 days a month, files kept between days | $5,030 · Enterprise (AWS Marketplace 12-month contract) · with limits | $49 · Docker Agentic Platform (pay-as-you-go) | $20 · $20/mo |
| One agent that never stops 4 vCPU / 8 GB, 50 GB disk, running 24/7 all month | $5,140 · Enterprise (AWS Marketplace 12-month contract) · with limits | $204 · Docker Agentic Platform (pay-as-you-go) · with limits | $26 · $20/mo |
| 50 agents in parallel 50 machines of 4 vCPU / 8 GB at once, 8-hour sessions, 1,100 sessions a month, Docker inside | $6,521 · Enterprise (AWS Marketplace 12-month contract) · with limits | $2,464 · Docker Agentic Platform (pay-as-you-go) · with limits | $317 · $20/mo × 3 seats |
| Sandboxes for your users 2 vCPU / 4 GB, 30,000 sessions of 10 minutes a month, up to 300 at once | $5,432 · Enterprise (AWS Marketplace 12-month contract) · with limits | $700 · Docker Agentic Platform (pay-as-you-go) · with limits | $200 · $100/mo × 2 seats |
| 1,000 short jobs at once 2 vCPU / 4 GB, 1,000 at once, 3 minutes each, 200,000 jobs a month | $5,955 · Enterprise (AWS Marketplace 12-month contract) · with limits | $1,400 · Docker Agentic Platform (pay-as-you-go) · with limits | $2,000 · $2000/mo · with limits |
Ona: New Core subscriptions are closed, so the Ona prices here use its Enterprise listing on AWS Marketplace: a 12-month, $60,000 contract, plus compute on your own AWS bill. Real Enterprise prices are negotiated with sales.
Docker Cloud Sandboxes: Docker bills per second for the size you pick, from $0.07 an hour for 1 vCPU / 2 GiB to $1.12 an hour for 16 vCPU / 32 GiB, with no monthly fee. A stopped sandbox costs nothing, and volumes and egress are free.
Docker Cloud Sandboxes: Plans start at $20 a month, and the whole fee is usage credit spent per second while sandboxes run. A stopped sandbox costs nothing and keeps its disk.
Limits in those scenarios
No Ona scenario fits as published, because a new customer can only buy Enterprise through sales, and the table assumes 3 environments at once since Ona publishes no Enterprise limit. Docker fits one coding agent on workdays, but its 24-hour session cap rules out an agent that never stops, and its default of 10 sandboxes at once rules out 50 agents, 300 user sandboxes and 1,000 short jobs. bochka fits every scenario except the 1,000-job burst, where its start limits queue the starts even on the $2,000 plan.
| Scenario | Ona | Docker Cloud Sandboxes | bochka |
|---|---|---|---|
| One coding agent, workdays |
| None that bite | None that bite |
| One agent that never stops |
|
| None that bite |
| 50 agents in parallel |
|
| None that bite |
| Sandboxes for your users |
|
| None that bite |
| 1,000 short jobs at once |
|
|
|
Which one should you use?
Use Ona when
your engineers want a governed cloud IDE shared with a Codex agent, inside your own AWS or GCP account or with a GPU.
- A full cloud IDE for your team. Useful if engineers work beside their agents: Ona has browser, VS Code and JetBrains IDEs with Dev Containers and prebuilds.
- Runs in your own cloud. Useful if environments must stay inside your own AWS or GCP account, in a region you pick.
- GPU environments. Useful if agents need a GPU: Ona's Enterprise runners can use instance types such as an A10G VM with 16 vCPU and 64 GB.
Use Docker Cloud Sandboxes when
you already run agents in sbx on your laptop and want a few to keep going in the cloud for up to a day, with memory kept across stops and strict outbound rules.
- Start today, pay by the second. Useful for a few agents now: sign up on a personal account, no monthly fee, from $0.07 an hour.
- Stop and fork with memory. Useful for agents that pause between steps: a stopped sandbox comes back with its memory and running processes.
- The same sandbox on your laptop. If you already run sbx locally, the cloud is the same microVM and CLI, and you can move work between them.
Where bochka fits
Ona is a team IDE you buy through sales, and Docker's cloud sandboxes are short sessions you attach to from a terminal. If your own code starts and drives agents that run for days, need a screen or /dev/kvm, or run by the dozen, look at bochka: full VMs with an API on every plan, disks saved every minute, free stops and fork of a running sandbox.
No session cap, room to run wide
Docker ends a sandbox 24 hours after creation and runs 10 at once, so your code must stop and resume long agents. Ona stops after 30 idle minutes unless set to Never. bochka has no cap on paid plans and runs 100 at once on $20.
A whole machine, screen included
Neither Ona nor Docker documents /dev/kvm or a graphical desktop, so Android emulators and computer-use agents need a separate service. Every bochka machine has /dev/kvm, systemd and a 60fps desktop with Chromium.
Drive agents inside from outside
Ona's SDK needs an Enterprise contract, and on Docker you attach to an agent's terminal and parse its text to know when it is done. bochka gives you a prompt, steer and events API for seven preinstalled agents on every plan.
Use bochka when your code starts and drives the agents: they run for days or by the dozen, need /dev/kvm, a desktop or open ports, and have to keep their work and fork while running. Compare it one to one: bochka vs Ona and bochka vs Docker Cloud Sandboxes.
Questions people ask
Is Ona cheaper than Docker Cloud Sandboxes?
No. One coding agent on workdays is $49 a month on Docker against $5,030 on Ona, which we price from its Enterprise listing on AWS Marketplace since Core is closed. The same agent is $20 a month on bochka.
Which is faster, Ona or Docker Cloud Sandboxes?
We cannot say: neither has a comparable CPU measurement in the benchmark runs we use. bochka did 26.69 Node.js build-and-test runs per second at 4 vCPU / 8 GB.
Can Ona and Docker Cloud Sandboxes run Docker?
Yes. Ona runs Docker with root inside the Dev Container, and each Docker cloud sandbox has its own Docker Engine. Neither documents /dev/kvm for Android emulators or VMs, which bochka exposes on every machine.
Can an agent run longer than 24 hours?
On Ona, yes, if auto-stop is set to Never, since only idle time stops an environment. A Docker cloud sandbox ends 24 hours after creation, and resuming starts a new timer. bochka has no session cap on paid plans.
Can I sign up for Ona today?
Not self-serve. Ona's billing docs say new Core subscriptions are no longer available, so new customers go through sales for Enterprise. Docker Cloud Sandboxes and bochka are both self-serve.
Is bochka SOC 2 compliant?
SOC 2 is in progress. We're open about where we stand: live status at status.bochka.xyz and our data retention policy at docs.bochka.xyz/data-retention.
Try bochka
Install the CLI, then run bochka new.
Product preview