Articles · November 12, 2026
How long until a fresh sandbox runs your first command?
Cold create to first successful command across eight agent sandbox providers, plus the four I could not measure and why.
When an agent needs a sandbox, the first thing it does is ask for one and run something in it. So the first number I care about is simple: how long from “give me a new sandbox” until a shell command actually comes back?
I tested that on every agent sandbox provider I could get working. Eight made it to a number. Four did not, and the reasons are part of the result.
The numbers
Five fresh sandboxes per provider, default image, from one laptop over the public Internet. p50 with min and max:
| Provider | p50 | min | max |
|---|---|---|---|
| Cloudflare Sandbox | 483 ms | 467 ms | 888 ms |
| Fly.io Sprites | 623 ms | 505 ms | 746 ms |
| Vercel Sandbox | 662 ms | 632 ms | 1067 ms |
| Freestyle | 976 ms | 897 ms | 1572 ms |
| Tensorlake | 1919 ms | 1895 ms | 2490 ms |
| BoxLite Cloud | 4067 ms | 3752 ms | 4428 ms |
| Upstash Box | 5019 ms | 2756 ms | 11667 ms |
| Celesto | 6939 ms | 6030 ms | 17304 ms |
That is five runs each from one location, not a full benchmark. It ranks wide gaps, not close ones. The live chart, every replicate and the raw JSON are on the leaderboard page.
How it is measured
- Start the clock right before the SDK’s create call.
- Run
echo okevery 250 ms until it exits 0. That moment is the headline number. - Run
uname -aonce to make sure it is a real Linux guest. - Destroy the sandbox, even if something failed.
This was inspired by StarSling’s sandbox benchmarks, which compare providers on full CI pipelines. This one only measures the first step.
Things that surprised me
Second and third are basically a tie. Fly.io Sprites and Vercel Sandbox landed 39 ms apart at p50. With five runs from one laptop that is not a real gap, so treat them as tied behind Cloudflare.
Cloudflare is fast but has a catch. You can only drive a Cloudflare sandbox from inside a Worker. My number goes laptop to Worker to container, so it includes that extra hop and still came out first. If your agent already lives in a Worker, you skip the hop.
SDKs disagree about what “created” means. Tensorlake, BoxLite and Upstash wait inside create until the sandbox is running. Cloudflare and Celesto return early and the first command waits instead. That is why I only compare the end-to-end number.
Spread matters as much as the median. BoxLite stayed between 3.8 and 4.4 seconds every time. Upstash went from 2.8 to 11.7 seconds, partly because its SDK checks readiness every 2 seconds. Celesto’s first run took 17 seconds and the other four were 6 to 7.
Three SDKs needed a workaround. Tensorlake’s TypeScript SDK throws DataCloneError under Bun after creating the sandbox, so I use their REST API. Vercel’s newest SDK (4.0.0) would not load on Bun 1.2.19, so I pinned 3.9.1. Celesto’s API now wants an Idempotency-Key on create that its SDK does not send, so I add it myself.
The four I could not measure
A skipped provider is not a slow provider, so these are not ranked:
- E2B: a new workspace is blocked until a $5 card verification payment.
- Runloop: signup is invite only, and its docs say the company is winding down its services.
- boat: the API key works, but creating a sandbox needs a started plan with a card on file.
- Novita: the account had no balance yet. Their docs say the free credit unlocks after an onboarding survey.
I will add each one as soon as it runs, with the same method.
What this does not tell you
Default machine sizes differ by vendor. It says nothing about disk, CPU or how fast your actual build runs once the sandbox is up.
This took me a couple of evenings. If you run a sandbox company and think I set something up wrong, DM me on X and I will rerun it.