On this page · 2 min
Where boxd stands out
The disk stays
A boxd machine keeps its 100 GB disk and its memory through sleep. A Cloudflare sandbox's disk is wiped when the instance stops; you save and restore a filesystem snapshot yourself, and processes start again.
Composable: the sandbox is one part of the kit
On Cloudflare you build that kit yourself out of Workers: cron triggers and Durable Objects for scheduling, your own Worker holding every token, and no documented network between sandboxes. Put together, boxd's parts ran the CI of 10 open-source projects 6× faster than one GitHub-hosted job.
| Feature | boxd | Cloudflare Sandbox |
|---|---|---|
| Composable | ||
| Ready machine described in code | Machine specs, built on one another | Dockerfile; config in your code |
| Machines create machines | Yes, signed in as the machine | Not published |
| Built-in integrations | 100+, credentials kept out | Your Worker holds tokens |
| Schedules and event triggers | Cron and events; sleeps between runs | Through Workers Cron Triggers |
| Standalone disks | Yes, outlive the machine | R2 mounts; no block volumes |
| Private network between machines | Org network, split by tags | Not published |
| Tailscale or NetBird | Both, built in | Workers VPC, for Workers |
| Agent skills or MCP | Agent skills; no MCP server | Skills and MCP servers |
Usable on its own
SSH in, open its URL, run an agent. A Cloudflare sandbox is driven by a Worker and Durable Object you write and deploy, which also route its preview URLs.
Room to work
boxd machines start at 2 vCPU and 8 GiB and go to 8 vCPU and 32 GiB. Cloudflare's largest instance is 4 vCPU, 12 GiB and 20 GB of disk.
Claude Code, Codex and OpenCode are already there
Every machine boots with all three installed, plus headless Chrome, a desktop you can open in the browser, Docker and the boxd CLI. Your API keys stay outside the machine: the guest holds a placeholder and our proxy swaps in the real value.
Timings are medians of ten runs on our production cluster, from a client in the same datacenter. How we measured
Side by side
Checked Oct 30, 2026. Each ↗ goes to where Cloudflare Sandbox says it. boxd's column is from our code and our own measurements.
| Feature | boxd | Cloudflare Sandbox |
|---|---|---|
| The machine | ||
| Full VM, own kernel | Yes, every machine | Container inside a Firecracker VM↗ |
| Default size | 2 vCPU · 8 GiB · 100 GB | 1/16 vCPU · 256 MiB · 2 GB↗ |
| Largest, self-serve | 8 vCPU · 32 GiB | 4 vCPU · 12 GiB · 20 GB↗ |
| Root, systemd, Docker | Yes, plus nested virtualization | Root; Docker with limits; single process↗ |
| CPU test (runs/s) | 12.6 (our run) | Not measured |
| Composable | ||
| Ready machine described in code | Machine specs, built on one another | Dockerfile; config in your code↗ |
| Machines create machines | Yes, signed in as the machine | Not published↗ |
| Built-in integrations | 100+, credentials kept out | Your Worker holds tokens↗ |
| Schedules and event triggers | Cron and events; sleeps between runs | Through Workers Cron Triggers↗ |
| Standalone disks | Yes, outlive the machine | R2 mounts; no block volumes↗ |
| Private network between machines | Org network, split by tags | Not published↗ |
| Tailscale or NetBird | Both, built in | Workers VPC, for Workers↗ |
| Agent skills or MCP | Agent skills; no MCP server | Skills and MCP servers↗ |
| Ready when you are | ||
| Sleeps with processes kept | Yes, standby and hibernate | No; disk is wiped↗ |
| Wakes on a request | Yes, HTTPS or SSH · app answers in 156 ms | Your Worker starts a new instance↗ |
| Starts from a snapshot, app running | Yes · app answers in 1.19 s | Filesystem only↗ |
| Session limit | None | No cap, no guarantee↗ |
| Built for agents | ||
| Coding agents installed | Claude Code, Codex, OpenCode | Install them yourself↗ |
| SSH | Native, own port per machine | Through wrangler↗ |
| HTTPS URL per port | Yes, plus custom domains | Routed by your Worker↗ |
| Raw TCP inbound | Yes, 3 ports per machine | No↗ |
| Secrets kept out | Yes, swapped in at the proxy | Yes, outbound handlers↗ |
| Price | ||
| vCPU-hour | $0.047, CPU used | $0.072 active only + $5/mo plan↗ |
| RAM GiB-hour | $0.014, memory in use | $0.009, provisioned↗ |
| While asleep | Hibernated: disk only | Stopped: free (disk gone)↗ |
| Also worth knowing | ||
| GPUs | No | No |
| Regions | Frankfurt (US waitlist) | Global↗ |
| SOC 2 | SOC 2 in progress | Cloudflare yes; Containers not in scope↗ |
| SAML SSO | No | Yes↗ |
| Egress allowlist | Yes | Yes, off by default↗ |
| Self-host | Yes, free to 16 vCPUs | No |
Where Cloudflare Sandbox is stronger
Global placement. Sandboxes run near the request across Cloudflare's network, with EU, US and FedRAMP jurisdictions.
Egress control. Internet off by default, per-host allow and deny lists, and credentials added by your Worker after traffic leaves the sandbox.
Tiny and cheap. Instances start at 1/16 vCPU and CPU is billed only while busy.
One platform. If you're on Workers already, the sandbox sits next to your code, storage and queues.
Questions
- Does a Cloudflare sandbox keep its files?
- Not by itself: the disk is ephemeral and is wiped when the instance stops. You can save a filesystem snapshot and restore it, or mount R2. A boxd machine keeps its disk and memory, so files and running processes are both there when it wakes.
- Do I need Workers to use boxd?
- No. A boxd machine is reachable on its own: SSH, an HTTPS URL per port, the CLI, the API and the Python and TypeScript SDKs.