Comparison
Where OmniRun stands, including where it loses.
OmniRun next to the sandboxes people actually weigh it against: E2B, CubeSandbox and microsandbox in open source, and boxd as a managed alternative. Claims we could not check ourselves are marked as unverified.
Last reviewed . Spotted something out of date? Email hello@omnirun.io.
The short version
Where OmniRun loses today.
- No hibernate to disk yet: a paused OmniRun sandbox stays in memory and does not survive a restart.
- No fork, user snapshots or volumes yet. E2B, CubeSandbox, microsandbox and boxd all have some form of these.
- No self-service template builds yet: bringing your own image means running the build scripts on the host.
- Only the REST lifecycle is E2B-compatible. In-sandbox calls need the OmniRun SDK.
- No published start-time benchmark yet, so we do not put a number next to theirs.
Where OmniRun is different.
- Accounts, API tokens, quotas, previews and audit log are in the open code, not in a paid tier. Sign-in, previews and the audit log run on a single node once switched on in config; per-user quotas need the gateway.
- A single node runs on one bare-metal box with SQLite: no Kubernetes, Nomad or Postgres.
- A self-hosted backend for Claude Managed Agents.
- A managed option in the EU, operated by the team that builds it.
Capability matrix
Feature by feature, with notes.
“Vendor-stated” means taken from the vendor's own documentation and not measured by us.
YesPartialNoUnverified
| Capability | OmniRun | E2B | CubeSandbox | microsandbox | boxd |
|---|---|---|---|---|---|
| Openness and operations | |||||
| Open-source license | YesApache-2.0 | YesApache-2.0 runtime; production deploys are Enterprise | YesApache-2.0 | YesApache-2.0 | NoClosed source |
| Self-host | YesOne bare-metal box, SQLite, no Kubernetes | PartialE2B Embed runs on one KVM host, described as an evaluation package | YesSingle node to multi-node, Terraform or Kubernetes | YesLocal or embedded library and CLI | PartialPaid annual licence for a single binary |
| Multi-tenant accounts, tokens and quotas in the open code | YesSign-in and tokens on the node once configured; per-user quotas with the gateway | NoKept in E2B Cloud and Enterprise | NoRuntime without a tenant model | NoLocal-first runtime | PartialOrgs and API keys, closed source |
| Multi-node control plane | PartialGateway, in beta | Yes | Yes | No | Yes |
| Prometheus or OpenTelemetry metrics | NoPlanned for v0.2 | YesOpenTelemetry | PartialDashboard | Unverified | Unverified |
| Managed EU-hosted option | YesManaged by a14a | Unverified | Unverified | NoLocal-first | YesAmsterdam |
| Isolation and lifecycle | |||||
| Hardware (microVM) isolation | YesFirecracker | YesFirecracker | YesRustVMM / KVM | Yeslibkrun | YesKVM microVM |
| Sandbox start time | PartialSub-second snapshot restore; no public benchmark yet | UnverifiedAbout 150-200 ms, vendor-stated | UnverifiedUnder 60 ms, vendor-stated | UnverifiedUnder 100 ms, vendor-stated | UnverifiedUnder 10 ms from standby, vendor-stated |
| Pause in memory | Yes | Yes | Yes | Unverified | Yes |
| Hibernate to disk / survive a restart | NoPlanned for v0.2 | Yes | YesCross-node pause via object storage | Unverified | Yes |
| Fork a running sandbox | NoPlanned for v0.2 | Yes | YesClone | YesBranch | Yes |
| User snapshots and checkpoints | NoPlanned for v0.2 | Yes | Yes | Yes | Yes |
| Bring your own image | PartialOperator build scripts; API planned for v0.2 | YesTemplate builds | Yes | YesAny OCI image | PartialGolden images via snapshots |
| Per-sandbox CPU and memory sizing | NoFixed per template | Yes | Unverified | Yes | UnverifiedSources disagree |
| Persistent volumes | No | Yes | Yes | YesMounts | YesAttachable disks |
| Networking and secrets | |||||
| Turn network access off | Yes | Yes | Yes | Yes | Yes |
| Per-domain egress allowlist | PartialOpt-in SNI proxy, HTTPS only | Yes | Yes | Yes | Yes |
| Secrets that never enter the VM | No | Unverified | Yes | Yes | Yes |
| Public HTTPS preview URLs | Yes | Yes | Unverified | No | Yes |
| SSH and IDE access | No | Unverified | Unverified | No | Yes |
| Developer surface | |||||
| Stateful code interpreter | YesInterpreter contexts | Yes | Unverified | Yes | No |
| Desktop / computer use | Yes | Yes | Unverified | No | Yes |
| Works with the E2B SDK | PartialREST lifecycle only; in-sandbox calls need the OmniRun SDK | YesNative | YesVendor-stated | No | No |
| MCP server | NoPlanned | Yes | Unverified | Yes | PartialAgent skill |
| Claude Managed Agents backend | YesSelf-hosted worker | Unverified | Unverified | Unverified | PartialGuide |
| GPU | NoFirecracker has no GPU passthrough | No | Unverified | Unverified | No |
Sources: E2B runtime, Tencent CubeSandbox, microsandbox, boxd documentation, boxd FAQ, and the OmniRun source code. Capabilities change quickly in this field; check each project's documentation before you decide.
Read more
More head-to-heads.
Longer write-ups on how OmniRun compares, and why a microVM is a different boundary from a container.
Try it yourself.
Put OmniRun on one Linux box and run your own workload next to the others. Or talk to us about the managed service.
On your box$sudo omnictl install --single-node --loop-size 50GIn your code$npm i @omnirun/sdk