---
title: Vercel Sandbox
slug: vercel-sandbox
url: "https://toolweight.com/options/vercel-sandbox"
homepage: "https://vercel.com/docs/vercel-sandbox"
categories: sandbox-providers
last_verified: 2026-07-23
license: CC-BY-4.0
---

# Vercel Sandbox

> Firecracker microVMs for running untrusted code from inside a Vercel deployment.

Vercel Sandbox runs Firecracker microVMs on the same infrastructure as Vercel Functions, exposed through an SDK meant to be called from a Vercel app. The product has moved a long way from its ephemeral launch: sandboxes are now persistent by default, snapshotting their filesystem on stop and resuming from it, with an explicit fork call, custom images from Vercel's container registry, and a per-sandbox egress firewall that takes a domain allowlist. Billing follows Vercel's active-CPU model, which is unusually kind to agent workloads that spend most of their life waiting. The catch is placement: it runs in a single US region.

## Identity

|  |  |
| --- | --- |
| Name | Vercel Sandbox |
| Company | Vercel |
| One-liner | Firecracker microVMs for running untrusted code from inside a Vercel deployment. |
| Site | https://vercel.com/docs/vercel-sandbox |
| Docs | https://vercel.com/docs/vercel-sandbox |
| Founded | 2015 |
| Funding | Series F |
| Brand | https://toolweight.com/vendors/Vercel |
| Compared in | 1 |

## Where it is compared

### [Sandbox providers](https://toolweight.com/compare/sandbox-providers)
Ranked **#6 of 20** on default weights.
| Field | Value | Confidence | Verified | Source | Note |
| --- | --- | --- | --- | --- | --- |
| Cold start | 1.8 s | Inferred | - | - | Estimate for create-to-first-output on a stock Node base image. |
| Cold start (claimed) | - | Unknown | - | - | Vercel says sandboxes "start in milliseconds" but publishes no figure, so there is nothing to record in this column. |
| Isolation | microvm | Vendor-claimed | 2026-07-23 | https://vercel.com/docs/sandbox/concepts | "Each sandbox runs in its own Firecracker microVM with a dedicated kernel", the same infrastructure as Vercel Functions. |
| Root in guest | ● | Vendor-claimed | 2026-01-15 | https://vercel.com/docs/vercel-sandbox | sudo is available in the sandbox. |
| Egress control | allowlist | Vendor-claimed | 2026-07-23 | https://vercel.com/docs/sandbox/concepts/firewall | The sandbox firewall takes three modes, changeable on a running sandbox: allow-all (the default), deny-all including DNS, and a user-defined policy that denies by default and allows a list of domains (wildcards supported) or address ranges. It also supports credential brokering and forwarding to a proxy you control. This is a genuine per-sandbox allowlist, and among the strongest egress stories in the roster. |
| Max runtime | 1440 min | Vendor-claimed | 2026-07-23 | https://vercel.com/docs/sandbox/pricing | 24 h maximum duration on Pro and Enterprise; 45 minutes on Hobby. This column records the paid-plan figure. The default timeout is still 5 minutes and must be raised explicitly at create time or via extendTimeout(). |
| Persistent FS | ◐ | Vendor-claimed | 2026-07-23 | https://vercel.com/docs/sandbox/concepts/persistent-sandboxes | Persistence is now the default: a sandbox snapshots its filesystem when a session stops and the next session resumes from it, billed as Snapshot Storage at $0.08/GB-month. Partial rather than yes because that is state surviving stop/resume rather than a durable volume, deleting the sandbox deletes its snapshots. Drives, which are the reattachable-volume shape, are in beta. |
| Snapshot & fork | ◐ | Vendor-claimed | 2026-07-23 | https://vercel.com/docs/sandbox/concepts/snapshots | Snapshots exist and Sandbox.fork spawns a child sandbox from another's current state, so branching works. Partial rather than yes because the snapshot captures the filesystem and installed packages, not a live memory image with the process tree intact, you re-run the processes, you do not resume them mid-flight. |
| Custom images | ● | Vendor-claimed | 2026-07-23 | https://vercel.com/docs/sandbox/concepts/images | Built-in Node and Python runtimes, or your own Docker image pushed to the Vercel Container Registry, or a saved snapshot. The fixed-runtimes-only limitation this row used to record no longer holds. |
| GPU | ○ | Inferred | - | - | - |
| Runtimes | python, javascript-typescript, bash, any-oci-image | Inferred | - | - | - |
| Preview URLs | ● | Vendor-claimed | 2026-01-15 | https://vercel.com/docs/vercel-sandbox | - |
| Browser inside | ○ | Inferred | - | - | - |
| File up/download | ● | Vendor-claimed | 2026-01-15 | https://vercel.com/docs/vercel-sandbox | - |
| Sydney region | ○ | Vendor-claimed | 2026-07-23 | https://vercel.com/docs/sandbox/pricing | Sandboxes provision in iad1 only, a single US region, not merely US-first. |
| Concurrent limit | 2,000 sandboxes | Vendor-claimed | 2026-07-23 | https://vercel.com/docs/sandbox/pricing | Published limits: Hobby 10, Pro 2,000, Enterprise 2,000+. This column takes the standard paid tier, so 2,000. Note this page clamps concurrency scoring at 1,000, so the surplus earns nothing, but the recorded figure is the published one. A separate rate limit caps vCPU allocation at 200 vCPUs/minute on Pro, which binds first for bursty creates. |
| MCP server | ○ | Inferred | - | - | No first-party sandbox MCP server. |
| SDKs | typescript | Inferred | - | - | - |
| Streaming output | ● | Vendor-claimed | 2026-01-15 | https://vercel.com/docs/vercel-sandbox | - |
| Price / hour | $0.341 /hr | Inferred | 2026-07-23 | https://vercel.com/docs/sandbox/pricing | Worst case, derived from the current Sandbox rate card: Active CPU $0.128/vCPU-hr and Provisioned Memory $0.0212/GB-hr give 2 × 0.128 + 4 × 0.0212 = $0.341. This assumes both vCPUs pinned for the full hour; because Active CPU excludes time blocked on I/O, a sandbox waiting on a model costs a small fraction of it. The previous $0.30 here implied $0.0106/GB-hr, which is Fluid Compute's memory rate rather than Sandbox's. |
| Meter | per-second | Vendor-claimed | 2026-01-15 | https://vercel.com/docs/vercel-sandbox | - |
| Idle cost | active-cpu-only | Vendor-claimed | 2026-07-23 | https://vercel.com/docs/sandbox/pricing | "Time spent waiting for I/O (such as network requests, database queries, or AI model calls) does not count toward Active CPU." The most agent-friendly meter here. Provisioned memory still bills for the whole session, so idle is cheap rather than free. |
| GitHub stars | - | Inferred | - | - | - |
| Funding | series-c-plus | Community-reported | - | - | - |
| Shipped | 2025 | Vendor-claimed | 2026-01-15 | https://vercel.com/changelog | - |
| Positioning | Run untrusted code from your Vercel app in an ephemeral microVM. | Inferred | - | - | - |

**Verdict.** No longer the deliberately narrow product it launched as, and this row was wrong about it for months. Persistence is now the default, snapshots and fork are shipped and billed, custom images come from Vercel's own registry, sessions run 24 h on a paid plan, and the egress firewall, deny-all or a per-sandbox domain allowlist, updatable while the sandbox runs, is one of the better isolation stories here rather than an omission. What remains genuinely narrow is placement: iad1 and nothing else, which rules it out for data residency and adds a fixed round trip from anywhere that is not the US east coast. The active-CPU meter is still the quiet advantage, because an agent session blocked on inference costs a fraction of the headline rate.

## Alternatives

- [ascii](https://toolweight.com/options/ascii), Agent orchestration over Telegram, running on box's VM infrastructure.
- [Blaxel](https://toolweight.com/options/blaxel), Agent-first cloud claiming ~25 ms microVM boots from snapshots.
- [box](https://toolweight.com/options/box), Persistent Linux VMs with SSH, per-VM IPv4 and disk-level forking, priced flat.
- [Cloudflare Sandbox](https://toolweight.com/options/cloudflare-sandbox), Container sandboxes driven from a Worker, addressed through Durable Objects.
- [CodeSandbox SDK](https://toolweight.com/options/codesandbox-sdk), Firecracker VMs with memory snapshots, from the online IDE, now owned by Together AI.
- [Daytona](https://toolweight.com/options/daytona), Sub-second container sandboxes for agent workloads, from a team that built a dev-env manager.
- [Self-hosted Firecracker](https://toolweight.com/options/diy-firecracker), The baseline: Firecracker on your own metal, plus every hard part you now own.
- [E2B](https://toolweight.com/options/e2b), Open-source Firecracker sandboxes with Python and TypeScript SDKs for AI agents.
- [exe.dev](https://toolweight.com/options/exe-dev), Persistent VMs you SSH into, with root, apt and systemd, on a flat monthly plan.
- [Fly.io Machines](https://toolweight.com/options/fly-machines), Raw Firecracker microVMs with a REST API, durable volumes and 35+ regions.
- [Freestyle](https://toolweight.com/options/freestyle), Run untrusted JavaScript and full dev servers, with git hosting and domains built in.
- [GitHub Codespaces](https://toolweight.com/options/github-codespaces), Devcontainer-backed cloud VMs built for humans, occasionally repurposed for agents.

## Licence and attribution

Data from toolweight (https://toolweight.com), licensed CC-BY-4.0.

- Licence: [CC-BY-4.0](https://creativecommons.org/licenses/by/4.0/)
- Canonical HTML: https://toolweight.com/options/vercel-sandbox
- Machine-readable: https://toolweight.com/options/vercel-sandbox.md · https://toolweight.com/api/v1 · https://toolweight.com/mcp
- toolweight takes no affiliate revenue and sells no placements. Corrections: https://toolweight.com/suggest