Sprites vs Azure Container Apps Sandboxes
Both give each agent an isolated Linux machine with its own kernel that rests when idle and wakes on traffic. Sprites is one fixed 8 vCPU machine with a 100 GB disk and agents preinstalled, while Azure lets you pick a size and image, snapshot memory, and run inside your Azure account in 40 regions.
The companies and products
Sprites
Sprites is Fly.io's product for agents: persistent Linux computers you create by API or CLI, which sleep when idle and wake on the next request.
Each Sprite is a Firecracker microVM with 8 vCPU, memory the platform manages, and a 100 GB ext4 disk that syncs to object storage. It runs one managed Ubuntu image with Claude Code, Codex, Gemini CLI and Cursor preinstalled, gets an HTTPS URL that wakes it, and bills only for the CPU and memory it actually uses while awake. It is built for coding agents, dev environments and user code that sit idle most of the time.
- Isolation
- Firecracker microVM per Sprite
- Regions
- Not selectable for Sprites
- Free start
- $30 trial credit per organization
Azure Container Apps Sandboxes
Azure Container Apps Sandboxes is a service inside Microsoft Azure that gives each agent or user an isolated microVM you create, suspend and resume through an SDK.
It is part of Azure Container Apps, the hyperscaler's serverless container platform, and lives in your Azure subscription as a sandbox group resource. Each sandbox boots from an OCI image or a snapshot, has its own kernel, and can be suspended with its memory and resumed in under a second. It is built for teams already on Azure that want stateful code execution with Azure networking, identity and billing.
Which use cases each one fits
For each use case, Battleships prices every sandbox provider on the same workload and sorts them from the cheapest monthly bill up. “63rd cheapest of 377” means 62 of the other 376 providers run that workload, with every feature it needs, for less. “With limits” means the provider runs it but misses something, so it is listed after every full match. Open a use case for its whole ranking and what each provider misses.
| Use case and its workload | Sprites: price rank | Azure Container Apps Sandboxes: price rank | bochka: price rank |
|---|---|---|---|
| Software factory 100 at once · 4 vCPU / 8 GB · 2,200 sessions of 8 h a month Sprites ranks 66th and Azure 288th here; both lack /dev/kvm and a desktop, and bochka ranks 3rd with SSH, Docker, systemd and /dev/kvm on every sandbox. | 66th of 367, with limits $546 a month | 288th of 367, with limits $5,276 a month | 3rd cheapest of 367 $634 a month |
| Always-on AI employees 50 machines 24/7 · 2 vCPU / 4 GB An always-on assistant is awkward on both: a Sprite needs a task hold renewed every hour, and Azure bills every running second, while bochka just keeps the machine on. | 157th of 366, with limits $1,166 a month | 302nd of 366, with limits $6,544 a month | 5th cheapest of 366 $657 a month |
| Code interpreter bursts 100 at once · 1 vCPU / 2 GB · 200,000 sessions of 1 min a month Azure ranks 34th and fits short code runs well, suspending with memory and resuming in under a second; Sprites ranks 93rd and also sleeps soon after the last command. | 93rd of 345, with limits $140 a month | 34th cheapest of 345 $354 a month | 186th of 345, with limits $2,000 a month |
| Sandboxes for your users 300 at once · 2 vCPU / 4 GB · 30,000 sessions of 23 min a month Azure ranks 22nd with a published quota and prewarmed starts, while Sprites does not publish how many machines can run at once on pay as you go; bochka ranks 1st. | 56th of 361, with limits $428 a month | 22nd cheapest of 361 $2,260 a month | Cheapest of 361 $209 a month |
| RL rollouts 1,000 at once · 2 vCPU / 4 GB · 1,000,000 sessions of 3 min a month | 105th of 360, with limits $6,540 a month | 153rd of 360, with limits $10,740 a month | 34th of 360, with limits $2,000 a month |
| Agent evals 250 at once · 4 vCPU / 8 GB · 15,000 sessions of 20 min a month | 125th of 364, with limits $545 a month | 75th cheapest of 364 $1,728 a month | 10th cheapest of 364 $200 a month |
| CI runners 40 at once · 8 vCPU / 16 GB · 6,000 sessions of 12 min a month Both fit plain CI; Sprites ranks 63rd and Azure 103rd, and builds that need Android emulators or VM images need the /dev/kvm that bochka exposes. | 63rd cheapest of 377 $476 a month | 103rd cheapest of 377 $1,046 a month | 4th cheapest of 377 $86 a month |
| 24/7 dev boxes 1 machine 24/7 · 4 vCPU / 8 GB A dev box wants SSH; Sprites tunnels it through its CLI and Azure gives a shell through the aca CLI, while bochka has SSH, raw TCP and systemd. | 213th of 368, with limits $27 a month | 322nd of 368, with limits $262 a month | 18th cheapest of 368 $26 a month |
| Computer-use agents 50 at once · 4 vCPU / 8 GB · 20,000 sessions of 15 min a month Both are headless, so a computer-use agent needs a display and browser you set up yourself; bochka streams a 60fps desktop with Chromium. | 85th of 369, with limits $136 a month | 279th of 369, with limits $1,573 a month | 6th cheapest of 369 $200 a month |
| Browser-use agents 50 at once · 2 vCPU / 4 GB · 30,000 sessions of 10 min a month On both Sprites and Azure you install and run a headless browser yourself; bochka ships Chromium on a desktop you can watch. | 171st of 367, with limits $122 a month | 288th of 367, with limits $795 a month | 7th cheapest of 367 $200 a month |
| Scraping & bots (startup scale) 50 at once · 1 vCPU / 2 GB · 100,000 sessions of 3 min a month | 229th of 346, with limits $206 a month | 284th of 346, with limits $561 a month | 6th cheapest of 346 $90 a month |
| Mass scraping & bots (undetectable) 1,000 at once · 1 vCPU / 2 GB · 3,000,000 sessions of 2 min a month | 141st of 338, with limits $4,113 a month | 239th of 338, with limits $10,956 a month | 71st of 338, with limits $1,800 a month |
| Parallel red teaming 200 at once · 2 vCPU / 4 GB · 5,000 sessions of 30 min a month | 210th of 360, with limits $223 a month | 278th of 360, with limits $517 a month | 2nd cheapest of 360 $200 a month |
| GPU eval jobs 10 at once · 8 vCPU / 32 GB · 500 sessions of 30 min a month | Can't run it | Can't run it | Can't run it |
| macOS agents 5 at once · 4 vCPU / 8 GB · 1,000 sessions of 20 min a month | Can't run it | Can't run it | Can't run it |
Key features
| Feature | Sprites | Azure Container Apps Sandboxes | bochka |
|---|---|---|---|
| Isolation | Firecracker microVM with its own kernel | MicroVM per sandbox with its own kernel | Full VM with its own kernel on dedicated AMD Ryzen 9 9950X hosts |
| Machine size | Fixed 8 vCPU and 100 GB disk; memory managed by the platform | Tiers from 0.25 cores / 0.5 GB to 4 cores / 8 GB; up to 16 vCPU / 32 GB by API | You choose; up to 16 vCPU / 32 GB on the $100 plan and above |
| Image | One managed Ubuntu image; you install on top of it | Boots from an OCI image or a snapshot, with Microsoft images for dev and agents | Ubuntu VM with root; named snapshots to start new sandboxes from |
| Docker, systemd and /dev/kvm | Root and Docker with rough edges users report; no systemd; no /dev/kvm in the docs | Depends on the image: azure-dev ships Docker on systemd; the default ubuntu image has only Buildah; nested virtualization not documented | Root, Docker, systemd and /dev/kvm on every sandbox |
| Idle and wake | Pauses about 30 seconds after activity stops; wakes on the next request in 100 to 500 ms with memory | Auto-suspends after an idle timeout (5 minutes by default) with memory; traffic or a start command resumes it in under a second | Runs until you stop it or its time to live ends; a stopped sandbox costs nothing and is started by API |
| Snapshots and fork | Filesystem checkpoints that restore in place; no fork | Snapshot a running sandbox with its memory and create new sandboxes from it | Disk saved every minute and on stop; fork a running sandbox with its disk |
| Reaching the sandbox | One HTTPS URL to one HTTP port; other ports and SSH only through the sprite proxy CLI | Public HTTPS routes per published port; private endpoint from your VNet; no SSH or public IP | SSH; HTTPS URLs for up to 50 ports, token-protected; raw TCP; dedicated IPv4 or IPv6 |
| Outbound rules | Optional DNS-based domain allowlist; private IPs always blocked | Egress policy with allow, deny, rewrite and header rules by host, path and method; VNet integration | Open internet, no provider-side allowlist |
| Keeping keys out of the sandbox | Connectors gateway holds the token for GitHub, Slack or any HTTP API, with path allow and block lists | Group secrets usable in egress header rules; Copilot and Anthropic tokens are injected into the sandbox at startup | Credentials proxy for model providers and any HTTPS API; switch a credential to another account when credits run out |
| Coding agents | Claude Code, Codex, Gemini CLI and Cursor preinstalled, run through exec or a console | Copilot CLI and Claude Code images, run through the exec API | Seven agents preinstalled, with a prompt, steer and events API to drive them from outside |
| Desktop and browser | Headless; no desktop or browser product | Headless; no desktop or managed browser | 60fps Linux desktop with Chromium, computer use and an embeddable stream |
| Scaling a fleet | Running cap not published on pay as you go; plans list caps from 20 to 2,000; 10 creates a minute without a plan | 500 concurrent active cores by default; more by Azure support request | Concurrency set by plan, up to 2,000 sandboxes, self-serve |
| Account and integrations | Fly.io account; remote MCP server and backends for Claude Managed Agents and Cursor Cloud Agents | Azure subscription with Microsoft Entra ID and a SandboxGroup role; Azure billing and VNets | Sign in with GitHub, Google or an emailed code; REST API, CLI and SDKs |
| Regions | Not selectable | 40 Azure regions, 9 of them in the EU | EU only (Germany, Finland, France), with EU data residency |
Every feature Battleships tracks (43)
| Feature | Sprites | Azure Container Apps Sandboxes | bochka |
|---|---|---|---|
| Full VM (own kernel) | Yes | Yes | Yes |
| Docker inside | Yes | Yes | Yes |
| Nested virtualization | No | No | Yes |
| Root | Yes | Yes | Yes |
| Systemd | No | Yes | Yes |
| Desktop GUI | No | No | Yes |
| Browser | No | No | Yes |
| Computer-use API | No | No | Yes |
| SSH | No | No | Yes |
| Persistent disk | Yes | Yes | Yes |
| Pause/resume | Yes | Yes | Yes |
| Automatic snapshots | Yes | Yes | Yes |
| Fork/clone | No | Yes | Yes |
| Live fork (no pause) | No | Yes | Yes |
| Memory fork | No | Yes | No |
| Custom image (Docker or snapshot) | Yes | Yes | Yes |
| ≥24 h sessions | Yes | Yes | Yes |
| Idle auto-stop | Yes | Yes | No |
| Wake on request | Yes | Yes | No |
| HTTPS preview URLs | Yes | Yes | Yes |
| Raw TCP inbound | No | No | Yes |
| Public IPv4 | No | No | No |
| Egress allowlist | Yes | Yes | No |
| Secret proxy | Yes | Yes | Yes |
| Secret proxy for any API | Yes | Yes | Yes |
| Preinstalled agents | Yes | Yes | Yes |
| Agent harness API | No | No | Yes |
| MCP server | Yes | No | No |
| GPU | No | No | No |
| Windows | No | No | No |
| Arm64 | No | No | No |
| Self-hosting | No | No | No |
| BYOC | No | No | No |
| Open source | No | No | No |
| Scoped API keys | Not published | Not published | Yes |
| Spend limits | Not published | Yes | Yes |
| Usage per sandbox (API) | No | Yes | Yes |
| Audit logs | Not published | Yes | No |
| SSO | Yes | Yes | No |
| SOC 2 | Yes | Yes | No |
| HIPAA | Yes | Yes | No |
| EU data residency | No | Yes | Yes |
| Zero data retention | Not published | Not published | Yes |
Performance
There is no comparable measurement for Sprites or for Azure Container Apps Sandboxes yet: neither is in the hpc-sandbox-benchmarks results we use. bochka did 26.69 runs per second on the Node.js build-and-test test at 4 vCPU / 8 GB, on dedicated AMD Ryzen 9 9950X hosts. This page makes no speed claim between the three.
Node.js build-and-test loop at 4 vCPU / 8 GB, higher is better. Measured with the open hpc-sandbox-benchmarks suite. Sprites and Azure Container Apps Sandboxes have no published run in this suite yet, so there is no like-for-like number to compare.
Pricing in five scenarios
Each bill is priced from the providers' public price lists by the open Battleships engine, with the cheapest plan that runs the scenario.
| Scenario | Sprites, a month | Azure Container Apps Sandboxes, a month | bochka, a month |
|---|---|---|---|
| One coding agent, workdays 4 vCPU / 8 GB, 50 GB disk, 8 hours a day, 22 days a month, files kept between days | $23 · Pay-as-you-go | $68 · Pay-as-you-go | $20 · $20/mo |
| One agent that never stops 4 vCPU / 8 GB, 50 GB disk, running 24/7 all month | $92 · Pay-as-you-go | $262 · Pay-as-you-go · with limits | $26 · $20/mo |
| 50 agents in parallel 50 machines of 4 vCPU / 8 GB at once, 8-hour sessions, 1,100 sessions a month, Docker inside | $1,120 · Pay-as-you-go | $3,421 · Pay-as-you-go | $317 · $20/mo × 3 seats |
| Sandboxes for your users 2 vCPU / 4 GB, 30,000 sessions of 10 minutes a month, up to 300 at once | $314 · Pay-as-you-go · with limits | $989 · Pay-as-you-go | $200 · $100/mo × 2 seats |
| 1,000 short jobs at once 2 vCPU / 4 GB, 1,000 at once, 3 minutes each, 200,000 jobs a month | $1,134 · Pay-as-you-go · with limits | $2,148 · Pay-as-you-go | $2,000 · $2000/mo · with limits |
Sprites: Sprites bills measured CPU time at $0.0385 per CPU-hour and actual memory at $0.021875 per GB-hour, only while the Sprite is awake, plus storage on the bytes you write. Optional plans buy fixed CPU, memory and storage allowances that are not credit.
Azure Container Apps Sandboxes: Azure bills per second on the Container Apps Consumption meters for the vCPU and memory of the sandbox's tier while it runs, idle time before auto-suspend included. There is no plan fee, and some regions such as West Europe charge more.
Azure Container Apps Sandboxes: Plans start at $20 a month, and the whole fee is usage credit. You pay per second for the size you pick while a sandbox runs, and a stopped sandbox costs nothing and keeps its disk.
Limits in those scenarios
Sprites does not publish how many Sprites can run at once on pay as you go, so 300 sandboxes for your users and 1,000 jobs at once are not confirmed. Azure handles both bursts, but its default quota of 500 active cores caps a fleet until support raises it. For an agent that never stops, a Sprite needs a task hold renewed every hour, and Azure only gets close with a 3-year savings plan commitment. bochka has no session cap on paid plans, but at 1,000 short jobs at once even its $2,000 plan queues starts.
| Scenario | Sprites | Azure Container Apps Sandboxes | bochka |
|---|---|---|---|
| One coding agent, workdays | None that bite | None that bite | None that bite |
| One agent that never stops | None that bite |
| None that bite |
| 50 agents in parallel |
| None that bite | None that bite |
| Sandboxes for your users |
| None that bite | None that bite |
| 1,000 short jobs at once |
| None that bite |
|
Which one should you use?
Use Sprites when
you want a ready machine with coding agents installed that sleeps when idle, wakes on a request and bills only the CPU and memory it really uses.
- Ready to use with no setup. For teams that want a machine with coding agents installed and nothing to choose: one image, one shape, a URL that wakes it.
- Bills only what it really uses. For mostly idle agents: a Sprite pauses about 30 seconds after work stops and bills the CPU time and memory it actually used.
- Plugs into agent platforms. For teams on Claude Managed Agents or Cursor Cloud Agents, Sprites can be the machine behind them, with a remote MCP server.
Use Azure Container Apps Sandboxes when
your team runs on Azure and wants short stateful sandboxes with memory snapshots, strict egress rules, large bursts or regions outside the EU.
- Memory snapshots that seed new sandboxes. For stateful jobs: snapshot a running sandbox with its memory and start many new ones from it, already warm.
- Fine-grained outbound rules. For teams that must hold agents to set hosts: allow, deny or rewrite each outbound request by host, path and method.
- Inside Azure, in 40 regions. For teams already on Azure: Entra ID, Azure billing and your VNets, in 40 regions on six continents.
Where bochka fits
Sprites and Azure are both built around machines that rest when idle and wake on traffic. If your agents instead work for hours on real projects, bochka gives each one a whole computer: SSH, Docker, systemd, /dev/kvm, a desktop, forks and agents you drive from outside, with no session cap on paid plans.
A whole machine with /dev/kvm and SSH
Neither documents nested virtualization, so Android emulators and VM builds cannot start. A Sprite has no systemd, and Azure needs the right image for Docker. Both reach SSH only through their own CLI.
A screen and a browser for every agent
Sprites and Azure are both headless, so a computer-use or browser agent needs a display server, a browser and a streaming layer you install and keep working. bochka streams a 60fps desktop with Chromium.
Agents driven from outside, keys kept outside
Both run their preinstalled agents through raw exec, so you write the code that prompts and watches them. Azure also injects Copilot and Anthropic tokens into the sandbox, where a prompt-injected agent can read them.
Use bochka when your agents need a whole computer for hours: SSH, Docker, systemd, emulators, a desktop and browser, forks, and coding agents driven from outside. Compare it one to one: bochka vs Sprites and bochka vs Azure Container Apps Sandboxes.
Questions people ask
Is Sprites cheaper than Azure Container Apps Sandboxes?
In every scenario we priced, Sprites comes out lower: one coding agent on workdays is $23 a month on Sprites against $68 on Azure, and 50 agents in parallel are $1,120 against $3,421. bochka is lower than both, at $20 and $317. Azure is the one that fits 1,000 short jobs at once, at $2,148 a month.
Which is faster, Sprites or Azure Container Apps Sandboxes?
Neither has a comparable CPU measurement yet, so we make no speed claim. Both wake fast: a Sprite resumes in 100 to 500 ms with memory, and an Azure sandbox resumes in under a second with its processes running.
Can Sprites and Azure Container Apps Sandboxes run Docker?
Users run Docker on Sprites, with reported rough edges for containers that run as non-root, and Sprites do not run systemd. On Azure it depends on the image: azure-dev ships Docker on systemd, and the default ubuntu image has only Buildah. bochka runs Docker, systemd and /dev/kvm on every sandbox.
Can I SSH into Sprites or Azure sandboxes?
Not directly on either. Sprites tunnels SSH through its sprite proxy CLI after you install a server, and Azure gives an interactive shell through the aca CLI, SDK or portal. bochka sandboxes have SSH, raw TCP and a dedicated IP.
Which one keeps an agent running all month?
Neither is built for it. A Sprite pauses about 30 seconds after activity stops unless a task hold, renewed each hour, keeps it awake. Azure keeps a sandbox running but bills every second until it suspends, so the always-on scenario at $262 a month needs a 3-year commitment.
Where do Sprites and Azure Container Apps Sandboxes run?
Sprites does not let you choose a region. Azure runs in 40 regions, 9 of them in the EU. bochka runs only in the EU, in Germany, Finland and France, with EU data residency.
Try bochka
Install the CLI, then run bochka new.
Product preview