Northflank vs Runloop: AI sandboxes, pricing, and infrastructure compared

Northflank and Runloop both provide isolated execution environments for AI agents and untrusted code, but they are built around different parts of the agent lifecycle. Runloop focuses on Devbox environments for AI coding agents, with microVM isolation. Northflank provides sandboxed infrastructure for the entire workload an agent operates on or generates, from the Harness where the agent runs to the services, databases, jobs, preview environments, and production workloads it deploys.

Northflank has operated microVM isolation since 2021. As a multi-tenant infrastructure platform, isolating untrusted workloads has always been a core requirement rather than a capability added specifically for AI agents. Today, Northflank uses Kata Containers with Cloud Hypervisor as its primary microVM approach, with Firecracker and gVisor where supported. This lets Northflank apply sandboxing across the agent lifecycle instead of limiting isolation to the agent's coding environment.

The term "AI agent sandbox" can make the infrastructure problem sound smaller than it is. An agent does not only execute code inside a sandbox. It can create services, provision databases, run jobs, install dependencies, call APIs, generate containers, create preview environments, and deploy applications. Once agents are responsible for creating and operating infrastructure, every workload they generate can be untrusted. That changes what sandboxing needs to cover.

An agent might start inside a Cloud Harness, execute generated code inside a sandbox, deploy an API, provision a database, schedule a background job, and create a preview environment for someone to review. Eventually, that same application may be deployed to production. The security boundary should not stop at the first sandbox. If the agent is untrusted, the workloads it creates need appropriate isolation, networking, secrets, and access controls too.

Northflank treats sandboxing as a core infrastructure capability that extends across this execution chain. The platform provides the Harness where the agent works, microVM-backed sandboxes where it executes code, and the infrastructure around those sandboxes, including services, databases, jobs, GPUs, networking, previews, and production workloads. This is the key difference in approach between Northflank and Runloop. Runloop is built around the Devbox, where the coding agent executes. Northflank provides the sandbox and the infrastructure for the workloads that the agent creates.

Product and plan details are current as of September 2026.

Both platforms use microVM-based isolation to separate sandbox workloads from the underlying host. Runloop provides a microVM for each Devbox, while Northflank uses Kata Containers with Cloud Hypervisor as its primary microVM-based isolation approach. Northflank also supports Firecracker and gVisor where supported.

Northflank has used microVM-based sandbox orchestration in production since 2021. Because sandboxing is part of the underlying multi-tenant infrastructure, it is not limited to the environment where an AI agent executes code. The same infrastructure can isolate agent environments as well as the services, jobs, and other workloads those agents create.

Runloop's model is centred on the individual Devbox where the coding agent runs. Its persistent environments, snapshots, and suspend and resume lifecycle make the Devbox the primary execution boundary. Northflank extends that boundary across the application stack, so the infrastructure generated by an agent can be sandboxed and managed alongside the environment where the agent itself runs.

Runloop Devboxes can be suspended and resumed while preserving the environment's state. Snapshots can also capture disk state for creating new environments from an existing baseline.

Northflank supports a different lifecycle model. Sandboxes and application workloads can be created, started, scaled to zero, restarted, and destroyed, while persistent volumes can retain data independently of the compute lifecycle. Templates and workflows can reproduce the surrounding infrastructure when a new environment is required.

This distinction matters when an AI agent's work extends beyond a single coding session. Northflank can persist the data that needs to persist while independently managing the lifecycle of the sandbox, services, workers, jobs, databases, and other infrastructure the agent creates. The sandbox is not the boundary of the application. It is one part of the infrastructure Northflank can isolate and manage.

Northflank Sandboxes can start in under one second, while Northflank can also scale application workloads horizontally as demand changes. Its infrastructure supports container images, Dockerfiles, Buildpacks, registries, node pools, placement controls, and BYOC infrastructure.

Runloop uses prebuilt blueprint images to prepare Devboxes with dependencies and environment configuration, and supports suspend and resume for returning to an existing environment.

The difference is the scope of what is being scaled. Northflank can scale the sandbox alongside the application infrastructure around it, including services, workers, jobs, databases, and GPU workloads. The same infrastructure that provisions an agent environment can scale the workloads that the agent creates.

Northflank Sandboxes use ephemeral root filesystems by default, with persistent volumes available when state needs to survive the sandbox lifecycle. Sandboxes can connect to other workloads through private networking, DNS, public and private ports, and network policies. This allows an isolated agent environment to interact with the databases and services it needs without putting those workloads on the public internet.

Northflank also supports GPU Sandboxes and GPU workloads across managed cloud and BYOC infrastructure, including GPUs such as H100, H200, A100, L4, L40S, and B200. This allows the same infrastructure platform to run agent execution, model workloads, and production applications.

Runloop provides persistent Devbox storage, networking, and controlled access to external services. GPU Devboxes are not supported.

Northflank supports Git based deployments, Dockerfiles, Buildpacks, external registries, Templates, Workflows, APIs, CLI, and SDKs. Northflank Skills extend this workflow to tools such as Claude Code, Codex, Cursor, and OpenCode, while Cloud Harnesses provide isolated development environments for AI coding agents.

Runloop provides SDKs, an API, CLI, and tools for building and interacting with Devboxes and agent workloads. Its platform also includes capabilities for agent evaluation and observability.

The distinction is less about whether developers can create an isolated agent environment and more about what happens after the environment is created. Northflank connects agent execution directly to the infrastructure needed to build, deploy, and run the resulting application, including services, databases, jobs, GPUs, preview environments, and production workloads.

A sandbox is useful for testing code in isolation, but AI agents can generate much more than code. A typical agent workflow can produce an API service, worker, database, scheduled job, persistent volume, and networking between those components.

Northflank Preview Blueprints can reproduce that complete application topology for each branch or pull request, including applications, databases, jobs, volumes, private networking, and seed workflows. The same platform can then run those workloads in production, with the infrastructure controls needed throughout the lifecycle.

Runloop is built around the Devbox and the infrastructure needed for agent development and evaluation rather than a full stack application preview and production platform. For teams building agent-generated applications, Northflank connects the sandbox to the infrastructure running everything the agent creates, from services and databases to jobs, previews, and production workloads.

Runloop offers Deploy to VPC as an Enterprise offering. This allows Runloop infrastructure to run inside a customer's cloud environment with customer-managed network policies and data residency controls.

Northflank has offered self-service production BYOC since 2019. Northflank can deploy its data plane into a customer's AWS, GCP, Azure, Oracle, CoreWeave, Civo, or Nebius account, allowing the customer to retain control of the underlying cloud account, VPC, billing relationship, and committed cloud spend.

For environments with stricter requirements, Northflank also offers a forward-deployed control plane for regulated and air-gapped environments.

The difference is particularly relevant for organizations that need their AI agent infrastructure to run inside their own cloud account rather than on shared infrastructure.

Runloop provides security controls around the Devbox, including microVM isolation, Agent Gateways for credential proxying, network egress policies, and VPC deployment on Enterprise. Runloop is SOC 2 Type II certified and HIPAA and GDPR compliant.

Northflank provides security controls across both sandboxed workloads and the platform managing those workloads.

RBAC applies at the organisation, team, project, and resource levels. SAML and OIDC SSO integrate with enterprise identity providers, while audit logs provide visibility from the organisation level down to individual resources and can be exported to SIEM systems.

Northflank is SOC 2 Type 2 and HIPAA compliant, with Enterprise BAAs. The forward-deployed control plane supports environments that require the platform to operate without external network dependencies.

The distinction is that Runloop's security model is closely tied to the Devbox and agent execution environment, while Northflank applies governance and security controls across the wider infrastructure lifecycle.

That becomes increasingly important as agents move from writing code to provisioning and operating infrastructure.

Northflank Cloud charges $0.01667 per vCPU hour and $0.00833 per GB hour for memory, billed per second. BYOC uses a separate platform pricing model, with cloud infrastructure billed directly by the underlying provider.

Runloop charges $0.108 per CPU hour and $0.0252 per GB hour for memory, with storage billed separately. Suspended Devboxes do not incur compute and memory charges, although storage continues to be billed.

For example, 200 continuously running workloads with 1 vCPU and 4 GB of memory for 720 hours would cost approximately $7,199 on Northflank compared with $30,067 on Runloop based on the published compute rates. That is approximately 76% lower on Northflank under these assumptions. Actual costs depend on CPU and memory allocation, storage, GPU usage, workload lifecycle, and infrastructure model. The broader difference is that Northflank pricing applies to the infrastructure primitives used across the application stack, so the same platform can handle sandbox execution alongside the services, databases, jobs, and other workloads an agent creates.

Runloop is focused on Devbox infrastructure for AI coding agents, with microVM isolation, persistent environments, snapshots, networking, and tooling for agent development and evaluation.

Northflank is designed for teams that need the sandbox and the infrastructure around it. Agents can work inside isolated environments, while the services, workers, jobs, databases, GPUs, previews, and other workloads they create can run through the same platform.

The key difference is where the platform boundary ends. With Runloop, the Devbox is the primary execution environment for the agent. With Northflank, the sandbox is one infrastructure primitive within a broader application and AI platform, allowing teams to manage the agent, its execution environment, and the workloads it produces through the same control plane.

Both provide microVM-based isolation for AI agent workloads. Runloop focuses on the Devbox where AI coding agents execute. Northflank provides microVM-backed sandboxes as part of a platform that can also run the services, databases, jobs, GPUs, previews, and production workloads generated by those agents.

Yes. Northflank provides CPU and GPU sandboxes alongside Cloud Harnesses, services, jobs, managed databases, networking, Preview Environments, Workflows, and BYOC. Runloop provides Devbox infrastructure focused on AI coding agent development, evaluation, and coordination.

Northflank treats sandboxing as a core infrastructure capability. MicroVM isolation has been part of the platform since 2021 because Northflank has always needed to safely run untrusted workloads in a multi-tenant environment.

For AI agents, that means the security boundary can extend beyond the agent's coding environment to the workloads the agent generates, including services, databases, jobs, preview environments, and production workloads.

Runloop offers VPC deployment as an enterprise offering that runs Runloop infrastructure inside a customer's cloud environment. Northflank provides self-service BYOC across AWS, GCP, Azure, Oracle, CoreWeave, Civo, and Nebius.

Both can reduce the cost of inactive workloads. Runloop suspend stops compute and memory billing while preserving the Devbox state, with storage continuing to incur charges. Northflank scale-to-zero stops compute billing while attached persistent volumes are retained, and sandboxes can resume with sub-1-second boot times.

The difference is that Northflank's scale-to-zero model applies across the wider application platform, including services, jobs, and other workloads, rather than only the coding environment.