Isolation: what kind of computer you get
Every provider says “sandbox”. Underneath, it is a container, a gVisor container, a microVM or a full virtual machine, and that decides what your agent can install, run and break.
Features
Sixteen features, one connected argument each
Each page starts with the idea, shows where providers split with quoted examples, names what to watch for, and ends with all twelve compared. The table is the last step, not the first.
The machine
What you are actually renting, and how much of it you can choose.
Sizes, regions and hardware
A size is a bundle of CPU, memory and disk, and the bundle decides what you can run. A region decides how far away it is and whose laws it sits under. Neither is as flexible as the word “cloud” suggests.
State and storage
What survives when the machine is not running, and where it lives.
Lifecycle: stop, pause and sleep
Providers use seven words for four behaviours. The only question that matters is what is still running when the machine comes back.
Snapshots, forks and templates
Four jobs hide under “snapshot”: a restore point on one machine, a reusable image for new machines, a copy of a running machine, and a backup that survives losing the host. Ask which one you are getting.
Storage: disk, volumes and what persists
“Persistent” can mean the whole disk, one mounted folder, or fourteen days. It can also mean a separate volume that outlives the machine, which is a different product from the disk the machine boots with.
Staying on
The timers between an agent that answers and one that has quietly stopped.
Idle timers, waking and session limits
An always-available agent depends on three separate settings: a lifetime deadline, an idle timer, and a wake path. Providers bundle them differently, and the difference is most of your bill.
Access and network
How you and your agent reach each other, and who else can.
Reaching it: links, ports and who can open them
A machine nobody can reach is not an agent. There are four doors in — an HTTPS link, a raw TCP port, SSH, and the provider's API — and the important difference is who can open each one.
Custom domains
Putting an agent behind your own hostname is a feature some providers sell, some leave to a proxy you run, and several do not offer at all.
Outbound network: egress, allowlists and static IP
What the agent can reach, what can be blocked, and whether the outside world sees a stable address. This is where an agent that browses meets a firewall that was designed for a web app.
Keys and secrets
Three different things are called “secrets”: a value in an environment variable, a file on disk, and a placeholder that a proxy swaps for the real key. Only the third keeps the key away from the agent.
Running it
The surfaces you drive it with, the agents already inside, and the controls a team needs.
Ways to drive it
Dashboard, API, SDK, CLI, MCP, SSH, desktop. A provider can have all seven and still be unusable without a terminal, or have three and be genuinely click-driven.
Built-in agents
Some providers ship the machine with coding agents already installed and a way to prompt them. Others ship a computer and expect you to bring the agent.
Teams and accounts
Organisations, key scopes, spend limits, SSO, audit and residency. The features a team needs are rarely the ones a solo builder notices, and several providers only sell them on an enterprise tier.
Money
What the meter measures, and what it takes to try before you pay.
Billing models
The meter decides your bill more than the hourly rate does. Four shapes are in play: flat per size, per vCPU and per GB, a plan fee that returns as credit, and measured CPU.
Trials and free tiers
“Free trial” covers four different offers: a time-limited trial that converts, a one-off credit, a free plan that never charges, and a recurring allowance. They differ in what you get and what happens on day eight.
The company
Who is behind the machine, and what happens when it breaks.
Who is behind it
Entity, age, funding, status page, SLA, compliance and the terms that decide whether you can leave. This is the part of a sandbox that documentation testing cannot tell you.