# Azure Container Apps Sandboxes

Official pricing: https://learn.microsoft.com/en-us/azure/container-apps/sandboxes-overview  
Category: hyperscaler · Isolation: vm

## Pricing regimes (raw)

- **Sandbox tiers XS-XL + programmatic sizes up to 16 vCPU / 32 GB (Consumption meters)** (sizes): XS 0.25 vCPU/0.5 GiB $0.027/h; S 0.5 vCPU/1 GiB $0.054/h; M 1 vCPU/2 GiB $0.108/h; L 2 vCPU/4 GiB $0.216/h; XL 4 vCPU/8 GiB $0.432/h; custom 8 vCPU / 16 GB (programmatic) 8 vCPU/16 GiB $0.864/h
- **Sandbox tiers + 1y savings plan (assumed to apply)** (sizes): XS 0.25 vCPU/0.5 GiB $0.02295/h; S 0.5 vCPU/1 GiB $0.0459/h; M 1 vCPU/2 GiB $0.0918/h; L 2 vCPU/4 GiB $0.1836/h; XL 4 vCPU/8 GiB $0.3672/h [commit]
- **Sandbox tiers + 3y savings plan (assumed to apply)** (sizes): XS 0.25 vCPU/0.5 GiB $0.02241/h; S 0.5 vCPU/1 GiB $0.04482/h; M 1 vCPU/2 GiB $0.08964/h; L 2 vCPU/4 GiB $0.17928/h; XL 4 vCPU/8 GiB $0.35856/h [commit]

## Features

Yes: snapshots, memory snapshots, fork/clone, pause/resume, persistent disk, volumes, idle auto-stop, ≥24 h sessions, custom image (Docker or snapshot), start from your own snapshot, your own Docker/OCI image, full VM (own kernel), root, code interpreter, preinstalled agents, HTTPS preview URLs, egress allowlist, open internet, private networking, SOC 2, HIPAA, SSO, Python, Node.js, credential injection, HTTP method/path egress rules, wake on request, live fork (no pause), memory fork, webhooks, audit logs, EU data residency, spend limits, automatic snapshots, snapshots on demand, gVisor or VM (no shared kernel), inbound access rules, firewall inside (nftables), secret proxy, secret proxy for any API, extra volumes, shared volumes

No: Docker inside, nested virtualization, systemd, browser, desktop GUI, computer-use API, browser + desktop control, anti-bot stealth, CAPTCHA solving, residential IPs, SSH, public IPv4, custom domains, raw TCP inbound, static egress IP, self-hosting, BYOC, open source, GPU, arm64, Windows, macOS, GPU desktop, live resize, MCP server, agent harness API, hosted agent API (their own agent)

Unknown: everything else. Evidence (source + quote) per feature: https://battleships.dev/data/providers/azure-container-apps-sandboxes.json → feature_evidence

## Caveats

- GA announced 2026-09-23 (Apps on Azure blog, raw/techcommunity_aca_sandboxes_ga_rss.txt). No Sandbox-specific meters exist in the Azure Retail Prices API; billing uses the Container Apps Consumption meters.
- Storage: "charged (coming soon) at Premium Azure Blob ZRS rates" for custom disk images and disk/memory snapshots (incl. automatic snapshots on stop); the OS disk each sandbox runs on is not billed. Premium Block Blob ZRS Data Stored = $0.20/GB-month (Retail API, eastus) -> snapshot_gib_month 0.2 is forward-looking; as of 2026-09-28 storage is not yet charged.
- Whether the Consumption free grant (180k vCPU-s / 360k GiB-s per subscription) covers Sandboxes is not stated; free.monthly_credit left 0.
- Region list is now published (40 regions). No sandbox-specific meters exist; if sandboxes bill the regional Consumption meters ("same pay-per-second pricing as Consumption Plan"), 19 regions incl. westeurope, westus2, uksouth, southeastasia, australiaeast, canadacentral charge $0.000034/vCPU-s (+41.7%) and $0.000004/GiB-s (+33%), i.e. about 1.40x the eastus tier prices (M $0.1512/h vs $0.108/h). Base-price regions include eastus, eastus2, centralus, westus, westus3, northeurope, francecentral, germanywestcentral, swedencentral, japaneast, eastasia, centralindia, brazilsouth.
- Savings plan applicability is inferred, not stated.
- Egress: Azure bandwidth rates, first 100 GB/month free then $0.087/GB (NA/EU), $0.12/GB (Asia). Data Disk / Blob volumes billed at Azure storage rates (not captured).
- Isolation: "per-sandbox microVM" (hypervisor not named); isolation enum set to firecracker for lack of a generic microvm value.
- GitHub Copilot cloud sandboxes are built on this service (GitHub docs).
- Programmatic custom sizes (any vCPU up to 16 at 2 GiB/vCPU) are represented by 8/16 and 16/32 presets inside the tiers regime; odd sizes between them price at the next preset up.
- Default auto-suspend is 300 s: a sandbox left idle keeps billing its full tier for 5 minutes before it stops (unless the client calls stop or sets a shorter idle timeout, e.g. 60 s).
- Quota: 500 concurrent active cores per organization (typical; per subscription+region) and 3,000 API requests/minute; increases by support request, may need review.
- No availability SLA and no availability-zone support; single-region service.
- Mixed GA/preview status: GA announced 2026-09-23, but the Learn lifecycle page (updated 2026-09-23) still says sandboxes are in preview and titles lifecycle/snapshots '(preview)'; the aca CLI reports 1.0.0-preview.1; Connectors and Triggers are preview.
- Memory-mode suspend is unavailable when a Data Disk volume is attached (disk-only suspend; processes restart on resume).
- Private Endpoint (inbound from your VNet) adds Container Apps 'Environment Private Endpoint' $0.10/h (~$73/month, eastus) plus Azure Private Link charges.

## How this provider charges


ACA Sandboxes (`Microsoft.App/SandboxGroups`) are per-sandbox microVMs with suspend/resume (memory + disk snapshots),
volumes and egress policies. **GA announced 2026-09-23** (Apps on Azure blog; text saved in
raw/techcommunity_aca_sandboxes_ga_rss.txt). The Azure pricing page states: "Azure Container Apps Express and
Sandboxes follow the same pay-per-second pricing as Consumption Plan". There are no sandbox-specific meters in the
Azure Retail Prices API, so compute uses the Consumption meters ($0.000024/vCPU-s, $0.000003/GiB-s, eastus).

Reference XL tier (4 cores / 8 GB) = **$0.432/h**.

## Regime table

| Regime | When it applies | How billed | Numbers | Source |
|---|---|---|---|---|
| Running, tier XS | 0.25 core / 0.5 GB / 20 GB disk (GA blog: 5 GB disk) | Per second on tier allocation | $0.027/h | docs tier table + Consumption meters (Retail API) |
| Running, tier S | 0.5 / 1 GB / 20 GB | Same | $0.054/h | same |
| Running, tier M (default) | 1 / 2 GB / 20 GB | Same | $0.108/h | same |
| Running, tier L | 2 / 4 GB / 40 GB | Same | $0.216/h | same |
| Running, tier XL | 4 / 8 GB / 80 GB | Same | $0.432/h | same |
| Programmatic sizes | Up to 16 vCPU / 32 GB / 320 GB disk | Same meters (assumed) | 16/32 = $1.728/h | GA blog |
| Stopped / suspended | Manual stop, lifecycle policy, auto-suspend after idle (no ingress, exec, shell or file ops) | No CPU or memory charges | $0 compute | docs, GA blog |
| Snapshot + custom image storage | Memory+disk or disk-only snapshots (incl. automatic ones on stop), custom disk images (one copy regardless of how many sandboxes boot from it); OS disk not billed | "Charged (coming soon) at Premium Azure Blob ZRS rates" | Premium Block Blob ZRS Data Stored $0.20/GB-month (Retail API eastus); **$0 today** | GA blog; Retail API |
| Volumes | Azure Blob (shared) / Data Disk (single mount) / BYO Blob | Azure storage rates | not captured | docs |
| Savings plan | Azure savings plan for compute | Consumption SP meters (applicability inferred) | 1y $0.0000204 / $0.00000255; 3y $0.00001992 / $0.00000249 | Retail API |
| Egress | Internet out | Azure bandwidth | 100 GB/month free, $0.087/GB NA/EU, $0.12/GB Asia | Retail API "Bandwidth" |
| Free grant | Consumption 180k vCPU-s / 360k GiB-s | **Unclear whether it covers Sandboxes** | not assumed | — |
| Auto-delete | N days after stop | Stops storage charges | configurable | docs |

## Gotchas

1. **Snapshot storage becomes a real cost** once the "coming soon" Premium Blob ZRS charge starts: $0.20/GB-month is 2.5x EBS snapshots and 40x what GitHub charges for the same service's snapshots in Copilot.
2. **Every stop takes a snapshot** (memory mode = RAM + disk), so stopped sandboxes accrue storage until auto-delete.
3. **Region availability and premium-region multipliers (+42% in westeurope etc.) are not published** for Sandboxes.
4. **Entra ID accounts only**; personal Microsoft accounts can't use Sandboxes.
5. Docs say XS has 20 GB disk; the GA blog says 5 GB.

## Worked example

XL tier (4 / 8 GB), 50 concurrent x 8 h/day x 22 days = **8,800 sandbox-hours**, stopped (snapshotted) between
shifts, 30% CPU (no effect), 50 GiB snapshots retained, 100 GiB egress (free 100 GB).

| Regime | Calculation | Total / month |
|---|---|---|
| XL on-demand, today (storage not yet charged) | 8,800 x 0.432 | **$3,801.60** |
| XL on-demand, once snapshot storage is charged | $3,801.60 + 50 x $0.20 | **$3,811.60** |
| XL + 3y savings plan committed 24/7 | 50 x 730 x 0.35856 = $13,087.44 | **$13,087.44** (worse) |
| M tier (1 / 2 GB) if the agent fits | 8,800 x 0.108 + $10 | **$960.40** |
| Anti-pattern: never stopped (24 h/day) | 50 x 730 x 0.432 | **$15,768.00** |