Isolation: what kind of computer you get
Every provider says “sandbox”. Underneath, it is a container, a gVisor container, a microVM or a full virtual machine, and that decides what your agent can install, run and break.
15 providers, 16 features
What will your agent do?
A sandbox is a computer you rent for an agent. The right one follows from the job, not from the hourly rate. Start with what the agent has to do, then read the features that decide it.
Pick the situation that sounds like yours
Each answer names the features that matter and the providers worth a look
Stay available all dayIt should answer whenever I message it.Run long jobsIt runs builds, training runs or multi-hour tasks.Answer when I askIt sits idle most of the day and answers a few requests.Build and test codeIt writes code, runs tests and needs a clean environment each time.Drive a browserIt clicks through websites, fills forms and watches pages change.One environment per customerIt gives each of my customers their own machine and address.Run GPU workIt needs a GPU for inference, rendering or training.Keep data in the EUIt processes data that has to stay in the European Union.
Running, paused, stopped
Three states, and a different part of the machine kept in each
Runningpause →Pausedmemory if the provider saves RAMstill billed
Pausedstop →Stoppedfiles keptmemory lost
Stoppeddelete →Deleteddisk gonesnapshots may remain
Providers disagree about which state is called pause, and two delete the disk on stop. The lifecycle page has the per-provider detail.
The machine
What you are actually renting, and how much of it you can choose.
Sizes, regions and hardware
A size is a bundle of CPU, memory and disk, and the bundle decides what you can run. A region decides how far away it is and whose laws it sits under. Neither is as flexible as the word “cloud” suggests.
State and storage
What survives when the machine is not running, and where it lives.
Lifecycle: stop, pause and sleep
Providers use seven words for four behaviours. The only question that matters is what is still running when the machine comes back.
Snapshots, forks and templates
Four jobs hide under “snapshot”: a restore point on one machine, a reusable image for new machines, a copy of a running machine, and a backup that survives losing the host. Ask which one you are getting.
Storage: disk, volumes and what persists
“Persistent” can mean the whole disk, one mounted folder, or fourteen days. It can also mean a separate volume that outlives the machine, which is a different product from the disk the machine boots with.
Staying on
The timers between an agent that answers and one that has quietly stopped.
Idle timers, waking and session limits
An always-available agent depends on three separate settings: a lifetime deadline, an idle timer, and a wake path. Providers bundle them differently, and the difference is most of your bill.
Access and network
How you and your agent reach each other, and who else can.
Reaching it: links, ports and who can open them
A machine nobody can reach is not an agent. There are four doors in — an HTTPS link, a raw TCP port, SSH, and the provider's API — and the important difference is who can open each one.
Custom domains
Putting an agent behind your own hostname is a feature some providers sell, some leave to a proxy you run, and several do not offer at all.
Outbound network: egress, allowlists and static IP
What the agent can reach, what can be blocked, and whether the outside world sees a stable address. This is where an agent that browses meets a firewall that was designed for a web app.
Keys and secrets
Three different things are called “secrets”: a value in an environment variable, a file on disk, and a placeholder that a proxy swaps for the real key. Only the third keeps the key away from the agent.
Running it
The surfaces you drive it with, the agents already inside, and the controls a team needs.
Ways to drive it
Dashboard, API, SDK, CLI, MCP, SSH, desktop. A provider can have all seven and still be unusable without a terminal, or have three and be genuinely click-driven.
Built-in agents
Some providers ship the machine with coding agents already installed and a way to prompt them. Others ship a computer and expect you to bring the agent.
Teams and accounts
Organisations, key scopes, spend limits, SSO, audit and residency. The features a team needs are rarely the ones a solo builder notices, and several providers only sell them on an enterprise tier.
Money
What the meter measures, and what it takes to try before you pay.
Billing models
The meter decides your bill more than the hourly rate does. Four shapes are in play: flat per size, per vCPU and per GB, a plan fee that returns as credit, and measured CPU.
Trials and free tiers
“Free trial” covers four different offers: a time-limited trial that converts, a one-off credit, a free plan that never charges, and a recurring allowance. They differ in what you get and what happens on day eight.
The company
Who is behind the machine, and what happens when it breaks.
Who is behind it
Entity, age, funding, status page, SLA, compliance and the terms that decide whether you can leave. This is the part of a sandbox that documentation testing cannot tell you.
Compare behaviour, not prices
Put two or three providers beside each other across all sixteen features, or read the list-price illustrations for the three shared workloads.
Side by side
Choose two or three providers and read them across the features that decide your case.
By situation
8 jobs, the features each one depends on, and the providers worth a look with their catches.
Reference costs
Three shared workloads priced from list rates, as illustrations rather than quotes.
What changed recently
Dated acquisitions, renames and price moves, each with the source and the date it was observed.
For your own workload, use battleships.dev, built by the Boat team. This site explains behaviour; that one prices it.
15 providers documented. Read how we checked, or go straight to the provider pages.