Steel vs Kernel
Steel and Kernel both hand your agent a cloud Chromium over an API. Steel is open source, can run in your own network and caps each session by plan, while Kernel runs each browser on its own unikernel, bills memory by the second and charges nothing while a browser sits in standby.
The companies and products
Steel
Steel is an API that runs fleets of cloud browsers for AI agents: you create a session, connect Puppeteer, Playwright or Selenium, and release it when done.
Each Steel session is a headful Chromium in a VM in Steel's cloud, driven over CDP or through a computer-use input API, with a live viewer you can embed. Around it Steel sells managed proxies, CAPTCHA solving, saved browser profiles, a credentials vault that signs in for the agent, a files API and readable traces. It is a different kind of product from bochka: a managed browser, not a general sandbox, so this page compares where the two overlap, which is agents that use a browser.
Kernel
Kernel is browser infrastructure for web agents and automations: you create cloud Chromium browsers from its API and drive them over CDP.
Each Kernel browser is Chromium on its own Unikraft-based unikernel, headless (1 GB) or headful (8 or 16 GB) with Live View and a computer controls API. Around it Kernel sells stealth mode with proxies and a CAPTCHA solver, saved browser profiles, managed logins, session replays and an app runtime for your agent code. It is a different kind of product from bochka: a managed browser, not a general sandbox, so this page compares where the two overlap, which is agents that use a browser.
Which use cases each one fits
For each use case, Battleships prices every sandbox provider on the same workload and sorts them from the cheapest monthly bill up. “25th cheapest of 367” means 24 of the other 366 providers run that workload, with every feature it needs, for less. “With limits” means the provider runs it but misses something, so it is listed after every full match. Open a use case for its whole ranking and what each provider misses.
| Use case and its workload | Steel: price rank | Kernel: price rank | bochka: price rank |
|---|---|---|---|
| Software factory 100 at once · 4 vCPU / 8 GB · 2,200 sessions of 8 h a month Neither Steel nor Kernel is built for installs, builds and Docker; Steel has no shell, and Kernel's unikernel documents no container runtime, so this work belongs on a machine like bochka's. | 124th of 367, with limits $1,115 a month | 98th of 367, with limits $873 a month | 3rd cheapest of 367 $634 a month |
| Always-on AI employees 50 machines 24/7 · 2 vCPU / 4 GB An assistant that works all month hits Steel's 1 hour session cap on Scale, and loses its files when a Kernel browser is deleted; bochka keeps a disk and has no session cap on paid plans. | 238th of 366, with limits $3,070 a month | 203rd of 366, with limits $2,033 a month | 5th cheapest of 366 $657 a month |
| Code interpreter bursts 100 at once · 1 vCPU / 2 GB · 200,000 sessions of 1 min a month | 264th of 345, with limits $333 a month | 266th of 345, with limits $347 a month | 186th of 345, with limits $2,000 a month |
| Sandboxes for your users 300 at once · 2 vCPU / 4 GB · 30,000 sessions of 23 min a month 300 sandboxes at once is more than Steel's Scale limit of 100 or Kernel's Start-Up limit of 150, and each user gets a browser rather than a machine. | 244th of 361, with limits $990 a month | 228th of 361, with limits $768 a month | Cheapest of 361 $209 a month |
| RL rollouts 1,000 at once · 2 vCPU / 4 GB · 1,000,000 sessions of 3 min a month | 257th of 360, with limits $4,150 a month | 246th of 360, with limits $3,133 a month | 34th of 360, with limits $2,000 a month |
| Agent evals 250 at once · 4 vCPU / 8 GB · 15,000 sessions of 20 min a month | 348th of 364, with limits $400 a month | 252nd of 364, with limits $390 a month | 10th cheapest of 364 $200 a month |
| CI runners 40 at once · 8 vCPU / 16 GB · 6,000 sessions of 12 min a month CI needs a shell, Docker and a known CPU size; neither Steel nor Kernel publishes a vCPU count or documents Docker, so both are a compromise. | 239th of 377, with limits $120 a month | 259th of 377, with limits $222 a month | 4th cheapest of 377 $86 a month |
| 24/7 dev boxes 1 machine 24/7 · 4 vCPU / 8 GB | 241st of 368, with limits $73 a month | 144th of 368, with limits $33 a month | 18th cheapest of 368 $26 a month |
| Computer-use agents 50 at once · 4 vCPU / 8 GB · 20,000 sessions of 15 min a month Kernel fits computer use with Live View and a computer controls API, Steel drives its browser with a computer-use input API, and bochka streams a 60fps desktop where the agent can use any Linux app. | 148th of 369, with limits $367 a month | 38th cheapest of 369 $1,878 a month | 6th cheapest of 369 $200 a month |
| Browser-use agents 50 at once · 2 vCPU / 4 GB · 30,000 sessions of 10 min a month All three fit: Steel and Kernel give your agent a cloud browser with proxies and CAPTCHA solving, and bochka gives it Chromium on a full VM where it can also run code. | 25th cheapest of 367 $470 a month | 21st cheapest of 367 $366 a month | 7th cheapest of 367 $200 a month |
| Scraping & bots (startup scale) 50 at once · 1 vCPU / 2 GB · 100,000 sessions of 3 min a month At startup scale all three fit; Steel and Kernel bring proxies and CAPTCHA solving, while bochka runs the scraper, its queue and its database on one machine. | 56th cheapest of 346 $540 a month | 45th cheapest of 346 $443 a month | 6th cheapest of 346 $90 a month |
| Mass scraping & bots (undetectable) 1,000 at once · 1 vCPU / 2 GB · 3,000,000 sessions of 2 min a month Kernel and Steel both fit mass scraping better than bochka: both solve CAPTCHAs and offer residential proxies, Kernel does not charge for its proxies, and Steel bills proxy bandwidth per GB. | 9th of 338, with limits $7,950 a month | 4th of 338, with limits $6,000 a month | 71st of 338, with limits $1,800 a month |
| Parallel red teaming 200 at once · 2 vCPU / 4 GB · 5,000 sessions of 30 min a month | 220th of 360, with limits $242 a month | 61st of 360, with limits $293 a month | 2nd cheapest of 360 $200 a month |
| GPU eval jobs 10 at once · 8 vCPU / 32 GB · 500 sessions of 30 min a month | Can't run it | Can't run it | Can't run it |
| macOS agents 5 at once · 4 vCPU / 8 GB · 1,000 sessions of 20 min a month | Can't run it | Can't run it | Can't run it |
Key features
| Feature | Steel | Kernel | bochka |
|---|---|---|---|
| Kind of product | A managed Chromium browser per session, driven over CDP | A managed Chromium browser per session, with an app runtime for your code | A full Linux VM per sandbox, with a desktop and Chromium inside |
| Isolation | Each session is a Chromium in a VM, per the docs; VM type not named | Each browser runs on its own Unikraft-based unikernel | Every sandbox is a full VM with its own kernel |
| Machine size | Not published; billed per browser hour | 1 GB headless, 8 or 16 GB headful; vCPU count not published | 4 vCPU / 8 GB by default, up to 16 vCPU / 32 GB by plan |
| Shell and Docker | No shell; you reach the browser through CDP and the REST API | SSH into the browser VM and process exec with an as_root option; no container runtime documented | SSH, root, systemd, Docker and /dev/kvm on every machine |
| Session length | 15 minutes on Launch, 1 hour on Scale, up to 24 hours on Enterprise | No documented cap while something drives the browser; deleted after an idle timeout of up to 72 hours | No session cap on paid plans |
| Idle and wake | Billed from create until release or timeout | Standby after 5 seconds idle with a memory snapshot and no usage charge | Stop and resume by API; a stopped sandbox costs nothing and resume reboots from disk |
| Files after a session | Files API keeps session files in org storage; profiles keep cookies and logins | The browser is deleted after its timeout; profiles keep cookies, storage and browser state, not files | The disk persists, with snapshots every minute and on stop |
| Fork | No fork; a new session can start from a saved profile or session context | No fork; browser pools keep fresh browsers warm | Fork a running sandbox into a copy |
| Browser and computer use | Headful Chrome, a computer-use input API, an embeddable live view with human takeover, mobile mode and traces | Headful Chromium with Live View, a computer controls API, CDP and session replays | 60fps desktop and Chromium, computer use and browser control, embeddable stream |
| Bot detection | Residential proxies billed per GB, CAPTCHA solving and dedicated IPs; a stealth browser on Enterprise | Stealth mode with an ISP proxy and a CAPTCHA solver; residential proxies; proxies not charged | Datacenter IPs and Chromium; no CAPTCHA solving |
| Reaching the machine | No inbound ports; a CDP websocket and a live view URL | No inbound ports; tokenized CDP and Live View URLs, and SSH port forwarding | HTTPS URLs for up to 50 ports, token-protected; raw TCP; dedicated IPv6 or IPv4 |
| Concurrency | 10 browsers on Launch, 100 on Scale, 1,000+ on Enterprise | 5, 10 and 150 browsers on Developer, Hobbyist and Start-Up; custom on Enterprise | Many sandboxes at once; bursts above 90 starts a minute are queued |
| Self-hosting | Open-source steel-browser (Apache-2.0) in Docker, and Steel Outpost inside your own network | Managed cloud; browser images are public on GitHub | Managed cloud only |
| Regions | us-east only; proxy location sets the visible IP | us-east, eu-west and ap-southeast; region choice from the Start-Up plan | EU only: Germany, Finland, France |
Every feature Battleships tracks (43)
| Feature | Steel | Kernel | bochka |
|---|---|---|---|
| Full VM (own kernel) | Yes | Yes | Yes |
| Docker inside | No | No | Yes |
| Nested virtualization | No | No | Yes |
| Root | No | Yes | Yes |
| Systemd | No | Not published | Yes |
| Desktop GUI | No | Yes | Yes |
| Browser | Yes | Yes | Yes |
| Computer-use API | Yes | Yes | Yes |
| SSH | No | Yes | Yes |
| Persistent disk | No | No | Yes |
| Pause/resume | No | Yes | Yes |
| Automatic snapshots | Yes | Yes | Yes |
| Fork/clone | No | No | Yes |
| Live fork (no pause) | No | No | Yes |
| Memory fork | No | No | No |
| Custom image (Docker or snapshot) | No | Yes | Yes |
| ≥24 h sessions | Yes | Yes | Yes |
| Idle auto-stop | Yes | Yes | No |
| Wake on request | No | Yes | No |
| HTTPS preview URLs | No | No | Yes |
| Raw TCP inbound | No | Not published | Yes |
| Public IPv4 | No | No | No |
| Egress allowlist | No | Yes | No |
| Secret proxy | No | No | Yes |
| Secret proxy for any API | No | No | Yes |
| Preinstalled agents | No | Yes | Yes |
| Agent harness API | No | No | Yes |
| MCP server | Yes | Yes | No |
| GPU | No | Yes | No |
| Windows | No | No | No |
| Arm64 | No | Not published | No |
| Self-hosting | Yes | No | No |
| BYOC | Yes | No | No |
| Open source | Yes | Yes | No |
| Scoped API keys | Not published | Not published | Yes |
| Spend limits | Not published | Yes | Yes |
| Usage per sandbox (API) | No | No | Yes |
| Audit logs | Not published | Yes | No |
| SSO | Yes | Yes | No |
| SOC 2 | No | Yes | No |
| HIPAA | Yes | Yes | No |
| EU data residency | No | Yes | Yes |
| Zero data retention | Not published | Yes | Yes |
Performance
There is no comparable measurement for either. Neither Steel nor Kernel was in StarSling's public CPU benchmark, and neither publishes how many vCPUs a browser gets, so there is no number to set against bochka's 26.69 runs per second at 4 vCPU / 8 GB. Steel says a session starts in under a second, and Kernel publishes cold starts under 20 ms.
Node.js build-and-test loop at 4 vCPU / 8 GB, higher is better. Measured with the open hpc-sandbox-benchmarks suite. Steel and Kernel have no published run in this suite yet, so there is no like-for-like number to compare.
Pricing in five scenarios
Each bill is priced from the providers' public price lists by the open Battleships engine, with the cheapest plan that runs the scenario.
| Scenario | Steel, a month | Kernel, a month | bochka, a month |
|---|---|---|---|
| One coding agent, workdays 4 vCPU / 8 GB, 50 GB disk, 8 hours a day, 22 days a month, files kept between days | $250 · Scale · with limits | $5 · Free / Developer · with limits | $20 · $20/mo |
| One agent that never stops 4 vCPU / 8 GB, 50 GB disk, running 24/7 all month | $250 · Scale · with limits | $34 · Free / Developer · with limits | $26 · $20/mo |
| 50 agents in parallel 50 machines of 4 vCPU / 8 GB at once, 8-hour sessions, 1,100 sessions a month, Docker inside | $784 · Scale · with limits | $625 · Start-Up · with limits | $317 · $20/mo × 3 seats |
| Sandboxes for your users 2 vCPU / 4 GB, 30,000 sessions of 10 minutes a month, up to 300 at once | $510 · Scale · with limits | $420 · Start-Up · with limits | $200 · $100/mo × 2 seats |
| 1,000 short jobs at once 2 vCPU / 4 GB, 1,000 at once, 3 minutes each, 200,000 jobs a month | $950 · Scale · with limits | $747 · Start-Up · with limits | $2,000 · $2000/mo · with limits |
Steel: Steel bills browser hours by the minute, rounded up: $0.10 an hour on the free Launch plan and $0.08 on Scale, which costs $250 a month and includes $100 of usage. Proxy bandwidth, CAPTCHA solves and browser tools are billed on top.
Kernel: Kernel bills $0.0000166667 per GB-second of memory while a browser is active, so an 8 GB headful browser costs more per hour than a 1 GB headless one. Standby and proxies are free, and plans of $0, $30 and $200 a month include $5, $10 and $50 of usage.
Kernel: You pick a monthly plan from $20, and all of it becomes usage credit spent per second on running sandboxes. A stopped sandbox costs nothing and keeps its disk.
Limits in those scenarios
None of the scenarios fits Steel or Kernel as written, because each prices one browser, not a 4 vCPU / 8 GB machine with a disk and Docker. Any run over 15 minutes needs Steel's Scale plan, and even then sessions stop after 1 hour, so one coding agent on workdays comes to $250 a month on Steel against $5 on Kernel and $20 on bochka. Steel's Scale caps you at 100 browsers and Kernel's Start-Up at 150, so 300 sandboxes for your users and 1,000 short jobs at once need Enterprise on both. On bochka, the 1,000-job burst is the one that does not fit: bursts above 90 starts a minute are queued.
| Scenario | Steel | Kernel | bochka |
|---|---|---|---|
| One coding agent, workdays |
|
| None that bite |
| One agent that never stops |
|
| None that bite |
| 50 agents in parallel |
|
| None that bite |
| Sandboxes for your users |
|
| None that bite |
| 1,000 short jobs at once |
|
|
|
Which one should you use?
Use Steel when
you want an open-source browser you can host yourself or run inside your network, plus a Files API, human takeover and simple browser-hour billing.
- Open source and self-hosted. Useful if browsers must run on your own machines: steel-browser is Apache-2.0, and Steel Outpost runs inside your network.
- Files and human takeover built in. Useful if runs leave downloads behind or need a person to step in: a Files API keeps session files, and the live view allows takeover.
- Simple browser-hour billing. Useful if you want one rate per browser: Steel bills browser hours by the minute, $0.10 an hour on Launch and $0.08 on Scale.
Use Kernel when
your agents idle between steps and you want free standby, stealth with proxies included, long driven sessions, or browsers in the US, EU or Asia.
- Free standby with memory kept. Useful if agents sit idle between steps: a Kernel browser stops charging after 5 seconds idle and comes back with its pages loaded.
- Stealth with proxies included. Useful for sites that block bots: stealth mode routes through an ISP proxy, solves CAPTCHAs, and Kernel does not charge for proxies.
- Three regions and no session cap. Useful for users in the US, EU or Asia, or long runs: a driven Kernel browser has no documented lifetime cap.
Where bochka fits
Steel and Kernel are browser products, not general sandboxes, so this is about the overlap. If what you are really running is agents that browse and then install packages, run builds, Docker or a dev server, both leave you hosting a second machine next to the browser. bochka puts the browser, the shell and the coding agent on one full Linux VM.
A whole machine, not only a browser
A Steel session has no shell and a Kernel browser is a unikernel with no documented Docker, and neither publishes a vCPU count. bochka gives 4 vCPU / 8 GB by default with root, systemd, Docker and /dev/kvm.
A disk that stays, and a fork
A Kernel browser's files go when it is deleted, and Steel cuts Scale sessions at 1 hour, reloading a profile each time. bochka keeps the disk with snapshots every minute, stops for free and forks a running sandbox.
Coding agents driven from outside
With Steel or Kernel you still host the agent, its files and its API keys. bochka ships Claude Code, Codex and OpenCode inside, driven by a prompt, steer and events API, and its credentials proxy keeps real keys out.
Use bochka when your agent browses and also works: installs, builds, Docker and dev servers on a full VM with no session cap on paid plans, a disk that stays, a 60fps desktop and coding agents built in. Compare it one to one: bochka vs Steel and bochka vs Kernel.
Questions people ask
Is Steel cheaper than Kernel?
In this table Kernel comes out lower in every scenario: one agent running all month is $34 on Kernel against $250 on Steel, and 50 agents in parallel are $625 against $784. Steel's long runs need the Scale plan at $250 a month, while Kernel bills memory by the second and nothing in standby. Neither fits these scenarios as a full machine.
Which is faster, Steel or Kernel?
There is no CPU measurement for either, and neither publishes a vCPU count per browser. Steel says sessions start in under a second, and Kernel publishes cold starts under 20 ms. bochka scores 26.69 runs per second at 4 vCPU / 8 GB in StarSling's benchmark.
Can Steel or Kernel run Docker?
No. A Steel session has no shell, and Kernel's browser is a single-purpose unikernel with no container runtime documented, though you can SSH in and run commands. On bochka each sandbox is a full VM with Docker, systemd and /dev/kvm.
How long can a session run on Steel and Kernel?
Steel caps sessions at 15 minutes on Launch, 1 hour on Scale and 24 hours on Enterprise. Kernel documents no cap while something drives the browser, and deletes an idle one after a timeout you can set up to 72 hours. bochka has no session cap on paid plans.
Can I self-host Steel or Kernel?
Steel's steel-browser runtime is open source under Apache-2.0 and runs in Docker, and Steel Outpost runs inside your own network. Kernel is a managed cloud, though its browser images are public on GitHub. bochka is a managed cloud only.
Which has better stealth and CAPTCHA solving?
Both solve CAPTCHAs and offer residential proxies. Kernel's stealth mode adds an ISP proxy and does not charge for proxies, while Steel bills proxy bandwidth per GB and keeps its stealth browser for Enterprise. bochka uses datacenter IPs and solves no CAPTCHAs.
Try bochka
Install the CLI, then run bochka new.
Product preview