Together Code Sandbox vs Deno Sandbox

Together Code Sandbox gives you VMs up to 16 cores that can save their memory and run until you end them, but Together has to turn it on for your organization. Deno Sandbox is self-serve and starts a locked-down 2 vCPU microVM in under 200 ms, but each one lives at most 30 minutes.

The companies and products

Together Code Sandbox

Together AI is a cloud for running and training AI models, and Code Sandbox is its product for running code in isolated VMs.

You build a snapshot from a Docker image or Dockerfile on Together's builder, then start sandboxes from it and run commands and file operations through the together-sandbox SDK or CLI. When a sandbox ends you can save its disk, and its memory too, as a new snapshot to start more sandboxes from. It is aimed at model-generated code, agent tool calls and reinforcement learning rollouts, and it must be enabled for your organization by Together. Together also sells Code Interpreter, a separate API that runs Python code in short sessions.

Company: Together AI, a cloud for model inference, fine-tuning and GPU clusters
Isolation: A virtual machine per sandbox on Together's infrastructure
Access: The SDK and CLI must be enabled for your organization; you ask Together for access
Machine size: 0.1 to 16 cores, 1 to 8 GB of memory per core; disk size is not configurable
History: Built on CodeSandbox, now a Together company; the CodeSandbox-based SDK is deprecated and together-sandbox is its successor
Source code: The SDKs and CLI are MIT-licensed on GitHub; the platform itself is not

Deno Sandbox

Deno Sandbox is part of Deno Deploy, the hosting platform from the company behind the Deno runtime, and runs untrusted or AI-generated code in Linux microVMs.

Each sandbox is a Firecracker microVM with 2 vCPU, up to 4 GB of memory and a 10 GB disk that is wiped when it ends, created from a TypeScript or Python SDK. Outbound traffic goes through a proxy that can enforce a host allowlist and swap placeholder secrets for real ones. It is built for short runs of agent or user code, and a sandbox can be promoted to a Deno Deploy app.

Isolation: Firecracker microVM per sandbox
Machine size: 2 vCPU, 768 MB to 4 GB memory, 10 GB ephemeral disk
Lifetime: Bound to a session, up to 30 minutes
Regions: Amsterdam and Chicago; volumes only in Chicago
Plans: Sandboxes on Pro and Builder; 3 or 20 at once per region
Compliance: Deno Deploy states SOC2 and ISO27001; HIPAA BAA for enterprise contracts

Which use cases each one fits

For each use case, Battleships prices every sandbox provider on the same workload and sorts them from the cheapest monthly bill up. “65th cheapest of 367” means 64 of the other 366 providers run that workload, with every feature it needs, for less. “With limits” means the provider runs it but misses something, so it is listed after every full match. Open a use case for its whole ranking and what each provider misses.

Use case and its workload	Together Code Sandbox: price rank	Deno Sandbox: price rank	bochka: price rank
Software factory 100 at once · 4 vCPU / 8 GB · 2,200 sessions of 8 h a month A software factory runs installs, builds and Docker for hours, which outlasts Deno's 30-minute lifetime, while Together's VMs need Together to enable them and document no Docker inside; bochka has Docker, root and /dev/kvm on every machine.	65th of 367, with limits $528 a month	290th of 367, with limits $5,665 a month	3rd cheapest of 367 $634 a month
Always-on AI employees 50 machines 24/7 · 2 vCPU / 4 GB An assistant that lives on its machine all month cannot run on a Deno sandbox that ends after 30 minutes, and Together sandboxes have no idle detection or wake on request; bochka keeps the machine and its disk.	152nd of 366, with limits $1,095 a month	287th of 366, with limits $5,803 a month	5th cheapest of 366 $657 a month
Code interpreter bursts 100 at once · 1 vCPU / 2 GB · 200,000 sessions of 1 min a month Both fit short code runs: Deno starts in under 200 ms and bills CPU only while code runs, and Together's Code Interpreter runs Python in sessions billed per 60 minutes.	326th of 345, with limits $2,190 a month	141st of 345, with limits $329 a month	186th of 345, with limits $2,000 a month
Sandboxes for your users 300 at once · 2 vCPU / 4 GB · 30,000 sessions of 23 min a month Deno caps Builder at 20 sandboxes at once per region and its HTTPS URLs are public, and on Together every port is public with preview URLs still coming soon; bochka's URLs are token-protected by default.	234th of 361, with limits $900 a month	148th of 361, with limits $1,863 a month	Cheapest of 361 $209 a month
RL rollouts 1,000 at once · 2 vCPU / 4 GB · 1,000,000 sessions of 3 min a month Together can save a sandbox with its memory and start many copies with processes running, which suits rollouts, while Deno can only boot new sandboxes from read-only volume snapshots.	315th of 360, with limits $21,900 a month	122nd of 360, with limits $7,963 a month	34th of 360, with limits $2,000 a month
Agent evals 250 at once · 4 vCPU / 8 GB · 15,000 sessions of 20 min a month	258th of 364, with limits $450 a month	296th of 364, with limits $1,563 a month	10th cheapest of 364 $200 a month
CI runners 40 at once · 8 vCPU / 16 GB · 6,000 sessions of 12 min a month CI jobs that run Docker or Android emulators need Docker and /dev/kvm, which neither Together nor Deno documents and bochka has on every machine.	251st of 377, with limits $180 a month	304th of 377, with limits $731 a month	4th cheapest of 377 $86 a month
24/7 dev boxes 1 machine 24/7 · 4 vCPU / 8 GB A dev box that stays on all month needs a disk that persists and no lifetime cap, which rules out Deno's 30-minute sandboxes and is how bochka works by default.	210th of 368, with limits $22 a month	179th of 368, with limits $200 a month	18th cheapest of 368 $26 a month
Computer-use agents 50 at once · 4 vCPU / 8 GB · 20,000 sessions of 15 min a month Neither Together nor Deno has a desktop; bochka streams a Linux desktop at 60fps with Chromium for computer use.	184th of 369, with limits $600 a month	280th of 369, with limits $1,583 a month	6th cheapest of 369 $200 a month
Browser-use agents 50 at once · 2 vCPU / 4 GB · 30,000 sessions of 10 min a month	301st of 367, with limits $900 a month	284th of 367, with limits $783 a month	7th cheapest of 367 $200 a month
Scraping & bots (startup scale) 50 at once · 1 vCPU / 2 GB · 100,000 sessions of 3 min a month	219th of 346, with limits $180 a month	286th of 346, with limits $573 a month	6th cheapest of 346 $90 a month
Mass scraping & bots (undetectable) 1,000 at once · 1 vCPU / 2 GB · 3,000,000 sessions of 2 min a month	124th of 338, with limits $3,600 a month	247th of 338, with limits $11,923 a month	71st of 338, with limits $1,800 a month
Parallel red teaming 200 at once · 2 vCPU / 4 GB · 5,000 sessions of 30 min a month	167th of 360, with limits $150 a month	251st of 360, with limits $367 a month	2nd cheapest of 360 $200 a month
GPU eval jobs 10 at once · 8 vCPU / 32 GB · 500 sessions of 30 min a month	Can't run it	Can't run it	Can't run it
macOS agents 5 at once · 4 vCPU / 8 GB · 1,000 sessions of 20 min a month	Can't run it	Can't run it	Can't run it

Key features

Feature	Together Code Sandbox	Deno Sandbox	bochka
Isolation	A VM per sandbox on Together's infrastructure	Firecracker microVM with its own kernel	Full VM with its own kernel on dedicated AMD Ryzen 9 9950X hosts
Getting started	The SDK and CLI must be enabled for your organization by Together; only Code Interpreter is self-serve	Self-serve on the Pro or Builder plan of Deno Deploy	Sign up and start a sandbox from the API, CLI or dashboard
Machine size	0.1 to 16 cores, 1 to 8 GB of memory per core; disk size fixed	2 vCPU fixed, 768 MB to 4 GB memory, 10 GB disk	4 vCPU / 8 GB by default, up to 16 vCPU / 32 GB on the $100 plan and above
Session length	Runs until you end it or its time to live, counted from creation, runs out	Up to 30 minutes; longer work can be promoted to a Deno Deploy app	No cap on paid plans; you set the time to live
Saving state	End a sandbox with a snapshot of its disk, or disk and memory; new sandboxes resume with processes running	Root disk wiped at the end; opt-in volumes of 300 MB to 20 GB, Chicago only	Whole disk saved every minute and on stop; a stopped sandbox costs nothing
Fork	No live fork: the parent stops, then you start many sandboxes from its snapshot	No fork; new sandboxes can boot from a read-only volume snapshot	Fork a running sandbox; the original keeps running
Docker and nested virtualization	Commands run as user 1000 by default, root on request; Docker inside and nested virtualization not documented	Root access; Docker and nested virtualization not documented	Docker, systemd and root, plus /dev/kvm for Android emulators and VMs
Shell access	Commands, interactive shells and files through the SDK and CLI; no SSH	SSH, a VS Code editor in the browser and a shell command API	SSH, plus exec and files over the API
Inbound access	All ports public; preview URLs coming soon; an experimental inbound allowlist	HTTPS URL per exposed port, public without authentication	HTTPS URLs for up to 50 ports, token-protected by default; raw TCP
Outbound rules	No outbound allowlist documented	Host allowlist per sandbox, enforced by a proxy outside the VM	Open internet, no provider-side allowlist
Keeping API keys out of the sandbox	No credentials proxy documented	Secrets swapped in on outbound requests to approved hosts	Credentials proxy for model providers and any HTTPS API; switch a credential to another account when credits run out
Desktop and coding agents	No desktop; run your own agent through execs	No desktop; a root image with Claude Code, run through shell commands	60fps Linux desktop with Chromium, and seven agents preinstalled with a prompt, steer and events API
Start time	Starts from a snapshot; no start time published	Under 200 ms	Boots a full VM
Hosted code interpreter	Code Interpreter API runs Python in sessions billed per 60 minutes	None; run code through the sandbox SDK	No separate product; run code through exec in a sandbox

Every feature Battleships tracks (43)

Feature	Together Code Sandbox	Deno Sandbox	bochka
Full VM (own kernel)	Yes	Yes	Yes
Docker inside	Not published	Not published	Yes
Nested virtualization	No	No	Yes
Root	Yes	Yes	Yes
Systemd	Not published	Not published	Yes
Desktop GUI	No	No	Yes
Browser	No	No	Yes
Computer-use API	No	No	Yes
SSH	No	Yes	Yes
Persistent disk	Yes	Yes	Yes
Pause/resume	Yes	No	Yes
Automatic snapshots	No	No	Yes
Fork/clone	Yes	No	Yes
Live fork (no pause)	No	No	Yes
Memory fork	Yes	No	No
Custom image (Docker or snapshot)	Yes	Yes	Yes
≥24 h sessions	Yes	No	Yes
Idle auto-stop	No	No	No
Wake on request	No	No	No
HTTPS preview URLs	Yes	Yes	Yes
Raw TCP inbound	No	No	Yes
Public IPv4	No	No	No
Egress allowlist	No	Yes	No
Secret proxy	No	Yes	Yes
Secret proxy for any API	No	Yes	Yes
Preinstalled agents	No	Yes	Yes
Agent harness API	No	No	Yes
MCP server	Yes	No	No
GPU	No	No	No
Windows	No	No	No
Arm64	No	No	No
Self-hosting	No	No	No
BYOC	No	No	No
Open source	No	No	No
Scoped API keys	Not published	Not published	Yes
Spend limits	Yes	Yes	Yes
Usage per sandbox (API)	Yes	No	Yes
Audit logs	Not published	Not published	No
SSO	Yes	No	No
SOC 2	Yes	Yes	No
HIPAA	No	Yes	No
EU data residency	Not published	Yes	Yes
Zero data retention	Not published	Not published	Yes

Performance

Together Code SandboxNot measured

Deno SandboxNot measured

bochka26.69 runs/s

There is no comparable CPU measurement for Together Code Sandbox or Deno Sandbox. bochka did 26.69 runs per second on the StarSling hpc-sandbox-benchmarks Node.js test at 4 vCPU / 8 GB, on dedicated AMD Ryzen 9 9950X hosts; Together was not in that run, and Deno's fixed 2 vCPU shape could not run the 4 vCPU test.

Node.js build-and-test loop at 4 vCPU / 8 GB, higher is better. Measured with the open hpc-sandbox-benchmarks suite. Together Code Sandbox and Deno Sandbox have no published run in this suite yet, so there is no like-for-like number to compare.

Pricing in five scenarios

Each bill is priced from the providers' public price lists by the open Battleships engine, with the cheapest plan that runs the scenario.

Scenario	Together Code Sandbox, a month	Deno Sandbox, a month	bochka, a month
One coding agent, workdays 4 vCPU / 8 GB, 50 GB disk, 8 hours a day, 22 days a month, files kept between days	$5 · Together pay-as-you-go (prepaid credits; Code Interpreter only) · with limits	$53 · Pro · with limits	$20 · $20/mo
One agent that never stops 4 vCPU / 8 GB, 50 GB disk, running 24/7 all month	$22 · Together pay-as-you-go (prepaid credits; Code Interpreter only) · with limits	$200 · Builder · with limits	$26 · $20/mo
50 agents in parallel 50 machines of 4 vCPU / 8 GB at once, 8-hour sessions, 1,100 sessions a month, Docker inside	$264 · Together pay-as-you-go (prepaid credits; Code Interpreter only) · with limits	$2,779 · Builder · with limits	$317 · $20/mo × 3 seats
Sandboxes for your users 2 vCPU / 4 GB, 30,000 sessions of 10 minutes a month, up to 300 at once	$900 · Together pay-as-you-go (prepaid credits; Code Interpreter only) · with limits	$783 · Builder · with limits	$200 · $100/mo × 2 seats
1,000 short jobs at once 2 vCPU / 4 GB, 1,000 at once, 3 minutes each, 200,000 jobs a month	$6,000 · Together pay-as-you-go (prepaid credits; Code Interpreter only) · with limits	$1,563 · Builder · with limits	$2,000 · $2000/mo · with limits

Together Code Sandbox: Together lists Code Sandbox at $0.0446 per vCPU-hour and $0.0149 per GiB-hour, but the VMs must be enabled for your organization, so the tables price Code Interpreter: $0.03 per 60-minute session from prepaid credits, with a $5 minimum purchase.

Deno Sandbox: Sandboxes need the Pro plan at $20 a month or Builder at $200 a month, with CPU, memory and egress allowances shared with Deno Deploy apps. Past those, CPU costs $0.10 per hour of active CPU time and memory $0.025 per GiB-hour for the sandbox's whole life.

Deno Sandbox: Plans start at $20 a month, and the whole fee becomes usage credit. You pay per second while a sandbox runs, and a stopped sandbox costs nothing and keeps its disk.

Limits in those scenarios

Neither fits any of the five scenarios as written. The Together column is Code Interpreter, so sessions end after 60 minutes, keep no disk, run only Python and have no published size. Deno sandboxes live up to 30 minutes on 2 vCPU with up to 4 GB, and Builder allows 20 at once per region, short of 50 agents. bochka fits four of the five; for 1,000 short jobs at once its top plan queues starts above 90 a minute.

Scenario	Together Code Sandbox	Deno Sandbox	bochka
One coding agent, workdays	Together pay-as-you-go (prepaid credits; Code Interpreter only): sessions capped at 1 h missing persistent disk machine size not published different kind of product: code interpreter	Pro: sessions capped at 0.5 h capped at 2 vCPU / 4 GiB largest size is 2 vCPU / 4 GiB disk beyond 10 GiB: price unknown	None that bite
One agent that never stops	Together pay-as-you-go (prepaid credits; Code Interpreter only): sessions capped at 1 h missing persistent disk machine size not published different kind of product: code interpreter	Builder: sessions capped at 0.5 h capped at 2 vCPU / 4 GiB largest size is 2 vCPU / 4 GiB disk beyond 10 GiB: price unknown	None that bite
50 agents in parallel	Together pay-as-you-go (prepaid credits; Code Interpreter only): sessions capped at 1 h missing persistent disk, Docker inside machine size not published different kind of product: code interpreter	Builder: max 20 concurrent Builder: sessions capped at 0.5 h capped at 2 vCPU / 4 GiB largest size is 2 vCPU / 4 GiB	None that bite
Sandboxes for your users	machine size not published different kind of product: code interpreter machine size per session not published egress price not published	Builder: max 20 concurrent	None that bite
1,000 short jobs at once	machine size not published different kind of product: code interpreter machine size per session not published egress price not published	Builder: max 20 concurrent	max 2,400 starts/day (needs ~6,667) max 600 starts/hour (needs ~1,000) bursts above 90 starts/min are queued (a burst of 333 takes ~4 min to start)

Which one should you use?

Use Together Code Sandbox when

you already run models on Together, can get the VMs enabled, and want sandboxes up to 16 cores that you save with their memory and branch from, or a simple Python runner billed per session.

Memory snapshots to branch from. Useful for rollouts and test variants: save a sandbox with its memory and start many copies with processes still running.
Bigger and smaller machines. Fits jobs that outgrow 2 vCPU: sandboxes go from a tenth of a core up to 16 cores, with no 30-minute end.
Sandboxes next to your models. Handy if you already run inference or fine-tuning on Together: sandboxes, Code Interpreter and models share one account.

Use Deno Sandbox when

you run short pieces of untrusted code that must start in milliseconds, reach only the hosts you allow, or run in the US, and you want to sign up and start today.

Self-serve today. Good if you want to start now: sandboxes come with the Pro plan, with no request to the provider first.
Locked-down outbound traffic. Useful for untrusted code: each sandbox can reach only a list of hosts, and real secrets never enter the VM.
Fast starts and a US region. Good for short bursts of code: a sandbox starts in under 200 ms, in Chicago or Amsterdam.

Where bochka fits

If your agents work for hours on installs, builds, Docker and servers, both products leave gaps: Deno ends every sandbox after 30 minutes on 2 vCPU, and Together's VMs need Together to switch them on and document no Docker inside. bochka gives each agent a full machine you can start today, with its disk kept, a desktop, and the agent and its keys already set up.

A full machine with Docker and /dev/kvm

Neither Together nor Deno documents Docker inside or nested virtualization, so compose stacks and Android emulators may not start. bochka has Docker, systemd, root and /dev/kvm on every machine.

A disk that stays and a live fork

A Deno sandbox wipes its disk after 30 minutes, and Together stops the parent to branch from it. bochka saves the whole disk every minute, charges nothing while stopped, and forks a running sandbox.

Agents, desktop and private hosting built in

On both you run your agent through shell commands, with no desktop and public ports. bochka preinstalls coding agents driven from outside, streams a 60fps desktop, and token-protects HTTPS on 50 ports.

Use bochka when your agents do real work for hours: installs, builds, Docker, emulators, a browser and servers other people reach, on a full machine whose disk is still there tomorrow. Compare it one to one: bochka vs Together Code Sandbox and bochka vs Deno Sandbox.

Questions people ask

Is Together Code Sandbox cheaper than Deno Sandbox?

The only self-serve Together price is Code Interpreter, and neither product fits these scenarios as written. Together looks cheaper for a workday agent, $5 against $53 a month, and for 50 agents, $264 against $2,779, but Deno is cheaper at scale: $783 against $900 for sandboxes for your users, and $1,563 against $6,000 for 1,000 short jobs at once.

Which is faster, Together Code Sandbox or Deno Sandbox?

Neither has a comparable CPU measurement. Deno says a sandbox starts in under 200 ms, and Together can start sandboxes from a memory snapshot with processes already running. Together goes up to 16 cores, while Deno is fixed at 2 vCPU.

Can Together Code Sandbox or Deno Sandbox run Docker?

Neither documents Docker inside a sandbox or nested virtualization. Together builds sandboxes from Docker images but does not read Docker Compose, and Deno gives root access without saying Docker works. bochka runs Docker and systemd and exposes /dev/kvm on every machine.

How long can each sandbox run?

A Deno sandbox lives up to 30 minutes, and longer work can be promoted to a Deno Deploy app. A Together sandbox runs until you end it or its time to live runs out, and Code Interpreter sessions last 60 minutes. A bochka sandbox has no lifetime cap on paid plans.

Can I sign up and use them today?

Deno Sandbox is self-serve on the Pro plan. Together's VM product must be enabled for your organization, so you ask Together first; only Code Interpreter is self-serve. bochka is self-serve from the $20 plan.

Is bochka SOC 2 compliant?

SOC 2 is in progress. We're open about where we stand: live status at status.bochka.xyz and our data retention policy at docs.bochka.xyz/data-retention.

Try bochka

Install the CLI, then run bochka new.

Product preview