Fly.io MachinesRaw Firecracker microVMs with a REST API, durable volumes and 35+ regions.93.2Pricing
- Price / hour (/hr)
- $0.031/hr
- Meter
- per-second
- Idle cost
- free-when-stopped
Sandbox providers compared: cold start, isolation and price Pricing Compared
- Hourly compute is compared most and rarely dominates the bill - Watch the meter's units: per-second vs per-minute on 400 twelve-second sandboxes is a completely different bill - Per-minute rounds every one of them up - Cloudflare's 10 ms granularity and Vercel's active-CPU model suit bursty agent traffic; minute blocks punish it - Watch idle: an agent session is mostly the sandbox waiting for a model to generate - Wall-clock billing means renting a CPU to wait on someone else's inference queue - Active-CPU or pause-to-storage vendors can be several times cheaper despite a higher headline rate - Check the pause API's latency first: pausing something you resume 400 ms later is a false economy - Hidden line items: snapshot storage per GB-month never garbage-collected, egress at cloud rates - More hidden costs: volumes that outlive their sandbox, and platform minimums like a paid Workers plan - A "$0.05/hr" provider can cost $150 before the first sandbox boots
- Providers
- 20
- Fields compared
- 3
- Source confidence
- 32%
- Last verified
- 2026-07-23 (2mo ago)
- Re-verified
- every 30 days
20 tools · verified 2mo ago
Fly.io MachinesRaw Firecracker microVMs with a REST API, durable volumes and 35+ regions.93.2
Cloudflare SandboxContainer sandboxes driven from a Worker, addressed through Durable Objects.92.9Pricing
- Price / hour (/hr)
- $0.18/hr
- Meter
- per-10ms
- Idle cost
- free-when-stopped
Pricing
- Price / hour (/hr)
- –
- Meter
- per-request
- Idle cost
- free-when-stopped
BlaxelAgent-first cloud claiming ~25 ms microVM boots from snapshots.79.2Pricing
- Price / hour (/hr)
- –
- Meter
- per-second
- Idle cost
- storage-only
CodeSandbox SDKFirecracker VMs with memory snapshots, from the online IDE, now owned by Together AI.79.2Pricing
- Price / hour (/hr)
- –
- Meter
- per-second
- Idle cost
- storage-only
FreestyleRun untrusted JavaScript and full dev servers, with git hosting and domains built in.79.2Pricing
- Price / hour (/hr)
- –
- Meter
- per-request
- Idle cost
- storage-only
RunloopDevboxes, blueprints and eval harnesses aimed at teams training coding agents.79.2Pricing
- Price / hour (/hr)
- –
- Meter
- per-second
- Idle cost
- storage-only
DaytonaSub-second container sandboxes for agent workloads, from a team that built a dev-env manager.78.6Pricing
- Price / hour (/hr)
- $0.17/hr
- Meter
- per-second
- Idle cost
- storage-only
E2BOpen-source Firecracker sandboxes with Python and TypeScript SDKs for AI agents.78.6Pricing
- Price / hour (/hr)
- $0.17/hr
- Meter
- per-second
- Idle cost
- storage-only
NamespaceFast microVM instances and CI runners with instant snapshots and cached builds.76.3Pricing
- Price / hour (/hr)
- –
- Meter
- per-minute
- Idle cost
- free-when-stopped
ModalServerless Python compute with a Sandbox API bolted onto a GPU-first platform.75.8Pricing
- Price / hour (/hr)
- $0.238/hr
- Meter
- per-second
- Idle cost
- active-cpu-only
IsloPer-agent isolated cloud sandboxes with enterprise policy controls, from Incredibuild.72.5Pricing
- Price / hour (/hr)
- –
- Meter
- –
- Idle cost
- –
Vercel SandboxFirecracker microVMs for running untrusted code from inside a Vercel deployment.71.5Pricing
- Price / hour (/hr)
- $0.341/hr
- Meter
- per-second
- Idle cost
- active-cpu-only
Val TownDeno isolates that run TypeScript on HTTP, cron and email triggers.70.4Pricing
- Price / hour (/hr)
- –
- Meter
- subscription
- Idle cost
- free-when-stopped
GitHub CodespacesDevcontainer-backed cloud VMs built for humans, occasionally repurposed for agents.66.5Pricing
- Price / hour (/hr)
- $0.18/hr
- Meter
- per-minute
- Idle cost
- storage-only
asciiAgent orchestration over Telegram, running on box's VM infrastructure.61.0Pricing
- Price / hour (/hr)
- –
- Meter
- subscription
- Idle cost
- –
boxPersistent Linux VMs with SSH, per-VM IPv4 and disk-level forking, priced flat.61.0Pricing
- Price / hour (/hr)
- –
- Meter
- subscription
- Idle cost
- –
exe.devPersistent VMs you SSH into, with root, apt and systemd, on a flat monthly plan.61.0Pricing
- Price / hour (/hr)
- –
- Meter
- subscription
- Idle cost
- –
NorthflankContainer platform with bring-your-own-cloud, GPUs and a sandbox-shaped API.44.6Pricing
- Price / hour (/hr)
- $0.07/hr
- Meter
- per-minute
- Idle cost
- full-rate
Self-hosted FirecrackerThe baseline: Firecracker on your own metal, plus every hard part you now own.40.3Pricing
- Price / hour (/hr)
- $0.03/hr
- Meter
- per-hour
- Idle cost
- full-rate
yespartialnounknown
Sources shown beside each value · Learn how sourcing works
measured vendor-claimed community inferredExpand any row for the source, verification date, and caveat behind every cell.
Is the cheapest option the right one?
Price is one group of 3 fields out of 26. Everything else, features, limits, portability, how well any of it works for agents, is on the full sandbox providers compared: cold start, isolation and price comparison.
The pricing traps
- Hourly compute is compared most and rarely dominates the bill
- Watch the meter's units: per-second vs per-minute on 400 twelve-second sandboxes is a completely different bill
- Per-minute rounds every one of them up
- Cloudflare's 10 ms granularity and Vercel's active-CPU model suit bursty agent traffic; minute blocks punish it
- Watch idle: an agent session is mostly the sandbox waiting for a model to generate
- Wall-clock billing means renting a CPU to wait on someone else's inference queue
- Active-CPU or pause-to-storage vendors can be several times cheaper despite a higher headline rate
- Check the pause API's latency first: pausing something you resume 400 ms later is a false economy
- Hidden line items: snapshot storage per GB-month never garbage-collected, egress at cloud rates
- More hidden costs: volumes that outlive their sandbox, and platform minimums like a paid Workers plan
- A "$0.05/hr" provider can cost $150 before the first sandbox boots
How to choose in an afternoon
- Start with isolation, the only requirement you cannot retrofit
- Untrusted code needs a kernel boundary (microVM or gVisor) and outbound network control
- That shortlists Fly, Northflank, Cloudflare, E2B and self-hosted Firecracker
- Your own agent's code on your own data is a lower bar every provider clears
- Then decide: buying infrastructure or buying a product
- If the sandbox is your core loop, take the agent-native SDK and snapshot semantics (E2B, Daytona, Runloop)
- Treat the per-hour premium as the price of not maintaining an orchestrator
- If it is one feature, use what your platform gives you and revisit when the bill or boot time hurts
- Run one benchmark before signing: your real image, your real region, 50 cold creates, record p95 not p50
- p50 is a good day; p95 is what users see when the pool is cold, deciding instant vs broken
- If a vendor won't let you run that test on a trial account, that is the answer
How is this pricing data collected?
- Field values come from vendor docs, pricing pages and changelogs, each cell carrying its provenance
- Prices are list rate for ~2 vCPU and 4 GB, no commitment, normalised to hourly
- Per-second or credit vendors are marked inferred with arithmetic noted, or left null
- Claimed cold start is whatever the vendor puts on its homepage, scored at weight zero
- Vendors quote wildly different things: snapshot restore, guest boot, API return, or warm-pool p50
- Measured cold start is toolweight's own harness: single client, fixed region, TLS included
- It calls create-sandbox and blocks until a trivial command returns output, the full round trip
- Runs on an account with nothing alive after an idle period, so nothing is pool-warm
- Reports p50 and p95 over at least 50 runs so one good afternoon cannot flatter the number
- No cell currently carries measured confidence; the column is inferred estimates for now
- We would rather show an honest estimate than launder a vendor's number into a benchmark
- Four rows (box, ascii, exe.dev, Islo) are transcribed from box's own table at box.ascii.dev/compare
- That is the least neutral source here: a vendor's chart, its products first, rivals arranged around them
- toolweight has verified none of it; fields the table omits are left null and unknown
- Only a cell the table states directly is marked vendor-claimed
- Derived values (root off "Docker inside the VM", preview-URL off IP rows) are marked inferred
- A marketing row is not a measurement: "runs 24/7" and "1000+ concurrent VMs" stay unknown
- Absence is scored asymmetrically: a vendor omitting its own product is credited
- box and ascii are absent from the process-fork and sub-500 ms rows, and that is recorded
- A vendor omitting a rival counts as nothing: exe.dev and Islo's snapshot cells stay unknown
- These four rows stay this way until re-sourced from each vendor's own documentation
Pricing questions
Is a container enough to run LLM-generated code, or do I need a microVM?
- Your own model's code behind your own prompt: a hardened container is usually fine
- User-supplied code: assume a container escape is a matter of time and budget, shared-kernel isolation drips CVEs
- A microVM (Firecracker, Cloud Hypervisor) or gVisor gives a syscall boundary a guest kernel bug cannot cross
- Check what you buy: Daytona runs shared-kernel containers, and vendors call a namespace a "dedicated kernel"
- The price gap is now small enough that the container answer is rarely worth defending
Can I run a browser inside the sandbox instead of paying for a browser API?
- Yes, and for a handful of pages a day it is cheaper
- Chromium with a CDP endpoint costs compute you already pay for
- You lose residential egress, CAPTCHA handling and fingerprint work, so real bot defences will beat you
- Use the sandbox for your own apps and tooling; use a browser API when the site fights back
Do I pay while a sandbox sits idle waiting for the model to respond?
- It depends on the meter, and this is where bills go wrong
- Fly charges nothing for a stopped machine beyond storage
- E2B and CodeSandbox bill storage on a paused sandbox; Vercel bills active CPU, so network-blocked costs little
- Wall-clock per-second vendors charge for every token the model is still generating
- On agent workloads that idle time is usually the majority of the session
Every tool compared on this page
Related comparisons
Coding agents compared: Claude Code vs Codex CLI vs Cursor vs the restWhich AI coding agent should I use in 2026?Frontier LLM APIs compared, price, context, tool use and deprecation policyWhich frontier LLM API should I build on?Browser automation APIs compared (2026)Which hosted browser automation API should I use for AI agents and scraping?Vercel alternatives compared (2026)Which Vercel alternative should I use, and what happens to my bill if my site goes viral?