Blaxel vs Cloudflare Sandbox: State Persistence Compared

Your coding agent clones a repository, installs dependencies, and builds context. The user steps away for lunch. The sandbox sleeps, deletes every file, and starts the next request from a blank disk.

That failure mode defines the Blaxel vs Cloudflare Sandbox decision. Blaxel is the infrastructure foundation for autonomous agents. Its sandboxes hold filesystem and running process state in standby. Cloudflare Sandboxes are a Workers platform feature. They're ephemeral. Cloudflare deletes files, processes, and shell state whenever a sandbox sleeps.

This comparison evaluates state persistence, isolation and networking, and pricing. Blaxel fits production agents that carry state across sessions, especially coding agents. Cloudflare fits Workers-based teams running short, stateless executions.

TL;DR:

• State is the decision: Cloudflare deletes all files, processes, and shell state on sleep. Blaxel preserves filesystem, memory, and running processes in standby automatically.
• Resume speed gap: Blaxel resumes in under 25ms with full state intact. Cloudflare wakes fresh, requiring explicit backup restoration or full environment rebuild.
• Cloudflare for Workers teams: Stateless, disposable executions inside an existing Workers, Durable Objects, and R2 architecture fit Cloudflare's ephemeral model.
• Isolation transparency: Blaxel documents a custom Firecracker fork. Cloudflare confirms VM-based isolation but doesn't identify which runtime handles production sandboxes.
• Compliance scope: Blaxel publishes SOC 2 Type II, ISO 27001, and a HIPAA BAA add-on. Cloudflare's public SOC 2 scope list doesn't name Containers or Sandboxes.

What is Cloudflare?

Cloudflare is the company behind Cloudflare Sandboxes, a Workers platform feature. Cloudflare provides an SDK for running untrusted code in isolated environments across its network. Sandboxes sit alongside Workers, Durable Objects, and R2 storage within the Workers platform.

Sandboxes reached general availability on April 13, 2026, under the Workers Paid plan. The @cloudflare/sandbox SDK supports TypeScript and JavaScript only. Sandboxes run shell commands and execute three supported languages. Those languages are Python, JavaScript, and TypeScript. They also mount R2 buckets and expose services through preview URLs.

What is Blaxel?

Blaxel is the infrastructure foundation for autonomous agents. Its sandboxes run in Firecracker microVMs, each with its own kernel. This architecture provides kernel-level isolation for untrusted, AI-generated code.

A sandbox transitions to standby shortly after network connections close. Idle time carries zero compute cost. Standby preserves filesystem, memory, and running process state. However, unlimited standby duration doesn't guarantee durable long-term data persistence. Volumes provide that durability.

Beyond Sandboxes, Batch Jobs support parallel, fan-out workloads, while Volumes and Agent Drive, in private preview, provide storage. Model Gateway routes large language model (LLM) calls. Networking includes custom domains and proxy secrets injection, with dedicated egress gateways in private preview. Blaxel is a first-class sandbox provider in the OpenAI Agents SDK. The SDK builds on OpenAI's Codex harness. Blaxel Sandboxes provide its execution layer.

Head-to-head feature comparison

When Blaxel is the better choice

Blaxel fits workloads where the agent's environment is an asset worth keeping. Three cases separate the platforms: accumulated state, interactive latency, and procurement.

Agents that accumulate state across sessions

Coding agents and pull request review agents accumulate repositories, packages, and warm processes. The Delty case study uses Blaxel standby resume to bypass 2-minute Git clone operations. It reviews roughly 5,000 pull requests each month.

Cloudflare deletes that context whenever the sandbox sleeps. Its lifecycle documentation says, "All previous state is lost and the environment resets." The recovery path uses the Backup/Restore API. It archives a directory to R2 with a 3-day default time to live (TTL).

Recovering a previous filesystem snapshot requires an explicit restore call. Backups never capture memory or running processes. The team must write, test, and maintain that restore path. Blaxel preserves in-sandbox state automatically during standby. Guaranteed long-term retention still requires Volumes.

User-facing agents with a latency budget

Cloudflare wakes with fresh storage, so its wake path resembles creation rather than resume. In an interactive loop, this process creates a visible stall before output appears. Live previews can stall after each idle gap. Cloudflare must schedule and boot the container before it serves data.

Blaxel resumes in under 25ms. Network-based shutdown moves a sandbox to standby after about 15 seconds without connections. For coding-agent previews, that behavior reduces repeated environment setup and loading screens.

Compliance-scoped procurement

Blaxel publishes SOC 2 Type II and ISO 27001 certifications. It also offers a Health Insurance Portability and Accountability Act (HIPAA) Business Associate Agreement (BAA) add-on. Cloudflare's certifications apply at the company level. Its SOC 2 scope list doesn't name Containers or Sandboxes. Neither does its localization compatibility table.

An unlisted service scope can stall a security review. Reviewers cannot map company-level certification to the service running a workload. The question then moves to sales, legal, or an exception process. Each route can delay implementation.

Blaxel also identifies its isolation technology. Teams requiring a specific microVM boundary can document Firecracker without relying on an undisclosed runtime.

When Cloudflare Sandboxes may fit better

Cloudflare fits teams whose architecture already runs on its platform. A Worker can handle application logic while a Durable Object holds session identity. R2 can store artifacts, and the container can run code. Keeping those components together removes a cross-provider hop.

Choose Cloudflare when your execution is disposable and your application already uses Workers. Its egress model is strong for HTTP traffic. Outbound handlers run outside the container in the Workers runtime. They can hold secrets that the sandbox never sees.

Host access controls use glob patterns for per-host restrictions. Quick tunnels expose services without Domain Name System (DNS) setup. Wrangler also deploys custom images during deployment. Cloudflare's active-CPU billing suits stateless work. One-shot execution incurs no CPU charges while waiting for an LLM response. Memory and disk charges still apply to provisioned resources. If every run starts fresh, the ephemeral filesystem stops being a liability.

Blaxel has tradeoffs too. Standby state is not guaranteed durable storage, so long-term retention needs Volumes.

Pricing comparison

Cloudflare cannot supply the article's previous 1 vCPU and 2 GB normalized configuration. Its smallest 1 vCPU configuration provisions at least 3 GiB. The comparison therefore uses each platform's actual pricing structure rather than an unavailable shared configuration.

Cloudflare Sandboxes require the Workers Paid plan at $5 per month. At its 1 vCPU and 3 GiB minimum, memory costs about $0.027 per hour. A fully busy vCPU adds $0.072 per hour. That produces roughly $0.099 per active hour before disk and platform meters. Workers requests, Durable Objects, disk, and egress add separate charges. Egress costs $0.025/GB in North America and Europe after 1 TB monthly. Other regions cost more.

Blaxel pricing follows this structure:

• Free: The Free tier includes up to $200 in free credits plus usage costs.
• Pre-configured sandbox tiers and usage-based pricing: See Blaxel’s pricing page for the most up-to-date pricing information.
• Available add-ons: Available add-ons include email support, live Slack support, and HIPAA compliance.

Blaxel charges active compute and standby snapshot storage separately. Standby carries no compute charge. Cloudflare avoids idle compute charges by deleting the environment. Blaxel avoids them by snapshotting state for later resume.

Key differentiators and objection handling

"We already pay for Workers, and Sandboxes come with the platform." The integration also creates platform dependencies. Each sandbox requires a Worker frontend and a Durable Object. Cloudflare bills both components. Cloudflare's sandbox platform limits cap Workers subrequests at 50 per request. The HTTP transport was deprecated in June 2026 in favor of remote procedure calls (RPC). Under HTTP, each execution call consumed one subrequest. Blaxel provides an API and Python, TypeScript, and Go SDKs.

"The Backup/Restore API gives us persistence." It preserves disk only and requires an explicit restore after each wake. Cloudflare announced automatic snapshots in April 2026. The announcement described a rollout within weeks. Cloudflare's FAQ, dated August 28, 2026, still described snapshots as "coming soon." Blaxel preserves filesystem and running process state automatically during standby.

"Cloudflare uses VM isolation too, so security is equivalent." Cloudflare documents VM-based isolation. It describes its scheduler as runtime agnostic across gVisor, Firecracker, and QEMU. Cloudflare doesn't identify which runtime handles production sandboxes. Blaxel documents a custom Firecracker fork. That named boundary helps security reviewers assess protection for untrusted generated code.

Make the Blaxel vs Cloudflare Sandbox decision on state

Ask whether the agent's environment must survive between sessions. Cloudflare Sandboxes fit disposable executions within an existing Workers architecture. Agents that accumulate context benefit from standby state instead.

Blaxel was built for the second case. Its sandboxes preserve filesystem and running process state throughout unlimited standby duration. Each sandbox runs inside a Firecracker microVM with hardware-enforced isolation. Network detection manages the transition to standby without manual lifecycle handling.

Volumes add provisioned persistent storage when workloads require guaranteed durability. Agent Drive, currently in private preview, shares context and artifacts across agents and sessions. Batch Jobs handle parallel workloads, while networking covers custom domains and secret injection.

Review Blaxel agent infrastructure against your state, storage, and networking requirements. Then sign up free and test a sandbox through an idle-and-reconnect cycle. The result shows whether standby semantics match your agent architecture.

FAQs

Do Cloudflare Sandboxes keep files after they sleep?

No. Cloudflare deletes files when a sandbox sleeps or stops. It also terminates processes and resets shell state. The Backup/Restore API can archive a directory to R2. A later sandbox session can restore that archive through an explicit call.

How is Blaxel's standby different from Cloudflare's sleep?

Blaxel standby snapshots the sandbox rather than tearing down its state. The platform captures the filesystem, memory, and running processes after connections close. It doesn't preserve external network connections. Reconnecting restores the previous in-sandbox state without charging compute during standby. Use Volumes when the data requires guaranteed long-term durability.

Can I use Blaxel from an app running on Cloudflare Workers?

Yes. Blaxel exposes a REST API plus Python, TypeScript, and Go SDKs. Teams can call Blaxel from any HTTP client. Workers can retain routing and application logic. Agent code execution then runs on infrastructure that preserves state between sessions.

Which platform is better for coding agents?

The answer depends on the coding agent's state requirements. Blaxel suits agents that retain repositories, installed dependencies, warm processes, and live-preview state. Cloudflare suits disposable coding tasks within an existing Workers architecture. Preserving Cloudflare disk state requires rebuilding it or restoring a backup such as R2.

What happens to data when a Blaxel sandbox is destroyed?

A Blaxel sandbox mounts its root filesystem in memory. Destroying the sandbox wipes that filesystem. Data survives only when written to attached storage, such as Volumes or Agent Drive in private preview. Standby behaves differently because it snapshots the sandbox for reconnection.