---
title: Vercel Sandbox
slug: vercel-sandbox
url: "https://toolweight.com/tools/vercel-sandbox"
homepage: "https://vercel.com/docs/vercel-sandbox"
categories: sandbox-providers
last_verified: 2026-11-07
dataset_version: 0738be72
license: CC-BY-4.0
---

# Vercel Sandbox

> Firecracker microVMs for running untrusted code from inside a Vercel deployment.

- Firecracker microVMs on the same infrastructure as Vercel Functions, via an SDK for Vercel apps
- Now persistent by default: filesystem snapshots on stop, resume, and an explicit fork call
- Custom images from Vercel's registry, plus a per-sandbox egress firewall with a domain allowlist
- Active-CPU billing suits waiting agent workloads; the catch is a single US region

## Identity

|  |  |
| --- | --- |
| Name | Vercel Sandbox |
| Company | Vercel |
| One-liner | Firecracker microVMs for running untrusted code from inside a Vercel deployment. |
| Site | https://vercel.com/docs/vercel-sandbox |
| Docs | https://vercel.com/docs/vercel-sandbox |
| Founded | 2015 |
| Funding | Series F |
| Compared in | 1 |

## Where it is compared

### [Sandbox providers](https://toolweight.com/compare/sandbox-providers)
Ranked **#9 of 19** on default weights.
| Field | Value | Confidence | Verified | Source | Note | Permalink |
| --- | --- | --- | --- | --- | --- | --- |
| Cold start | 1.8s | Inferred | - | - | Estimate for create-to-first-output on a stock Node base image. | https://toolweight.com/compare/sandbox-providers#vercel-sandbox--cold_start_measured |
| Cold start (claimed) | - | Unknown | - | - | Vercel says sandboxes "start in milliseconds" but publishes no figure, so there is nothing to record in this column. | https://toolweight.com/compare/sandbox-providers#vercel-sandbox--cold_start_claimed |
| Isolation | microvm | Vendor-claimed | 2026-07-23 | https://vercel.com/docs/sandbox/concepts | "Each sandbox runs in its own Firecracker microVM with a dedicated kernel", the same infrastructure as Vercel Functions. | https://toolweight.com/compare/sandbox-providers#vercel-sandbox--isolation_tech |
| Root in guest | ● | Vendor-claimed | 2026-01-15 | https://vercel.com/docs/vercel-sandbox | sudo is available in the sandbox. | https://toolweight.com/compare/sandbox-providers#vercel-sandbox--root_access |
| Egress control | allowlist | Vendor-claimed | 2026-07-23 | https://vercel.com/docs/sandbox/concepts/firewall | The sandbox firewall takes three modes, changeable on a running sandbox: allow-all (the default), deny-all including DNS, and a user-defined policy that denies by default and allows a list of domains (wildcards supported) or address ranges. It also supports credential brokering and forwarding to a proxy you control. This is a genuine per-sandbox allowlist, and among the strongest egress stories in the roster. | https://toolweight.com/compare/sandbox-providers#vercel-sandbox--egress_control |
| Max runtime | 24h | Vendor-claimed | 2026-07-23 | https://vercel.com/docs/sandbox/pricing | 24 h maximum duration on Pro and Enterprise; 45 minutes on Hobby. This column records the paid-plan figure. The default timeout is still 5 minutes and must be raised explicitly at create time or via extendTimeout(). | https://toolweight.com/compare/sandbox-providers#vercel-sandbox--max_runtime |
| Persistent FS | ◐ | Vendor-claimed | 2026-07-23 | https://vercel.com/docs/sandbox/concepts/persistent-sandboxes | Persistence is now the default: a sandbox snapshots its filesystem when a session stops and the next session resumes from it, billed as Snapshot Storage at $0.08/GB-month. Partial rather than yes because that is state surviving stop/resume rather than a durable volume, deleting the sandbox deletes its snapshots. Drives, which are the reattachable-volume shape, are in beta. | https://toolweight.com/compare/sandbox-providers#vercel-sandbox--persistent_fs |
| Snapshot & fork | ◐ | Vendor-claimed | 2026-07-23 | https://vercel.com/docs/sandbox/concepts/snapshots | Snapshots exist and Sandbox.fork spawns a child sandbox from another's current state, so branching works. Partial rather than yes because the snapshot captures the filesystem and installed packages, not a live memory image with the process tree intact, you re-run the processes, you do not resume them mid-flight. | https://toolweight.com/compare/sandbox-providers#vercel-sandbox--snapshot_fork |
| Custom images | ● | Vendor-claimed | 2026-07-23 | https://vercel.com/docs/sandbox/concepts/images | Built-in Node and Python runtimes, or your own Docker image pushed to the Vercel Container Registry, or a saved snapshot. The fixed-runtimes-only limitation this row used to record no longer holds. | https://toolweight.com/compare/sandbox-providers#vercel-sandbox--custom_images |
| GPU | ○ | Inferred | - | - | - | https://toolweight.com/compare/sandbox-providers#vercel-sandbox--gpu |
| Runtimes | python, javascript-typescript, bash, any-oci-image | Inferred | - | - | - | https://toolweight.com/compare/sandbox-providers#vercel-sandbox--language_runtimes |
| Preview URLs | ● | Vendor-claimed | 2026-01-15 | https://vercel.com/docs/vercel-sandbox | - | https://toolweight.com/compare/sandbox-providers#vercel-sandbox--preview_urls |
| Browser inside | ○ | Inferred | - | - | - | https://toolweight.com/compare/sandbox-providers#vercel-sandbox--browser_in_sandbox |
| File up/download | ● | Vendor-claimed | 2026-01-15 | https://vercel.com/docs/vercel-sandbox | - | https://toolweight.com/compare/sandbox-providers#vercel-sandbox--file_transfer_api |
| Sydney region | ○ | Vendor-claimed | 2026-07-23 | https://vercel.com/docs/sandbox/pricing | Sandboxes provision in iad1 only, a single US region, not merely US-first. | https://toolweight.com/compare/sandbox-providers#vercel-sandbox--sydney_region |
| Concurrent limit | 2,000 sandboxes | Vendor-claimed | 2026-07-23 | https://vercel.com/docs/sandbox/pricing | Published limits: Hobby 10, Pro 2,000, Enterprise 2,000+. This column takes the standard paid tier, so 2,000. Note this page clamps concurrency scoring at 1,000, so the surplus earns nothing, but the recorded figure is the published one. A separate rate limit caps vCPU allocation at 200 vCPUs/minute on Pro, which binds first for bursty creates. | https://toolweight.com/compare/sandbox-providers#vercel-sandbox--max_concurrency |
| MCP server | ○ | Inferred | - | - | No first-party sandbox MCP server. | https://toolweight.com/compare/sandbox-providers#vercel-sandbox--mcp_server |
| SDKs | typescript | Inferred | - | - | - | https://toolweight.com/compare/sandbox-providers#vercel-sandbox--sdk_languages |
| Streaming output | ● | Vendor-claimed | 2026-01-15 | https://vercel.com/docs/vercel-sandbox | - | https://toolweight.com/compare/sandbox-providers#vercel-sandbox--streaming_stdout |
| Price / hour | $0.341/hr | Inferred | 2026-07-23 | https://vercel.com/docs/sandbox/pricing | Worst case, derived from the current Sandbox rate card: Active CPU $0.128/vCPU-hr and Provisioned Memory $0.0212/GB-hr give 2 × 0.128 + 4 × 0.0212 = $0.341. This assumes both vCPUs pinned for the full hour; because Active CPU excludes time blocked on I/O, a sandbox waiting on a model costs a small fraction of it. The previous $0.30 here implied $0.0106/GB-hr, which is Fluid Compute's memory rate rather than Sandbox's. | https://toolweight.com/compare/sandbox-providers#vercel-sandbox--price_per_hour |
| Meter | per-second | Vendor-claimed | 2026-01-15 | https://vercel.com/docs/vercel-sandbox | - | https://toolweight.com/compare/sandbox-providers#vercel-sandbox--billing_granularity |
| Idle cost | active-cpu-only | Vendor-claimed | 2026-07-23 | https://vercel.com/docs/sandbox/pricing | "Time spent waiting for I/O (such as network requests, database queries, or AI model calls) does not count toward Active CPU." The most agent-friendly meter here. Provisioned memory still bills for the whole session, so idle is cheap rather than free. | https://toolweight.com/compare/sandbox-providers#vercel-sandbox--idle_billing |
| GitHub stars | 0 | Community-reported | 2026-11-07 | https://github.com/vercel/sandbox | vercel/sandbox SDK, 220 stars, rounds to 0 thousand. | https://toolweight.com/compare/sandbox-providers#vercel-sandbox--github_stars |
| Funding | series-c-plus | Community-reported | - | - | - | https://toolweight.com/compare/sandbox-providers#vercel-sandbox--funding_stage |
| Shipped | 2025 | Vendor-claimed | 2026-01-15 | https://vercel.com/changelog | - | https://toolweight.com/compare/sandbox-providers#vercel-sandbox--launched |
| Positioning | Run untrusted code from your Vercel app in an ephemeral microVM. | Inferred | - | - | - | https://toolweight.com/compare/sandbox-providers#vercel-sandbox--positioning |

**Verdict.** Now a broad, well-isolated product with active-CPU billing, held back only by a single US region.

## Alternatives

- [Blaxel](https://toolweight.com/tools/blaxel), Agent-first cloud claiming ~25 ms microVM boots from snapshots.
- [boat](https://toolweight.com/tools/boat), Persistent Ubuntu VMs for agents with SSH, Docker and disk-level fork, billed per second.
- [Cloudflare Sandbox](https://toolweight.com/tools/cloudflare-sandbox), Container sandboxes driven from a Worker, addressed through Durable Objects.
- [CodeSandbox SDK](https://toolweight.com/tools/codesandbox-sdk), Firecracker VMs with memory snapshots, from the online IDE, now owned by Together AI.
- [Daytona](https://toolweight.com/tools/daytona), Sub-second container sandboxes for agent workloads, from a team that built a dev-env manager.
- [Self-hosted Firecracker](https://toolweight.com/tools/diy-firecracker), The baseline: Firecracker on your own metal, plus every hard part you now own.
- [E2B](https://toolweight.com/tools/e2b), Open-source Firecracker sandboxes with Python and TypeScript SDKs for AI agents.
- [exe.dev](https://toolweight.com/tools/exe-dev), Persistent VMs you SSH into, with root, apt and systemd, on a flat monthly plan.
- [Fly.io Machines](https://toolweight.com/tools/fly-machines), Raw Firecracker microVMs with a REST API, durable volumes and 35+ regions.
- [Freestyle](https://toolweight.com/tools/freestyle), Run untrusted JavaScript and full dev servers, with git hosting and domains built in.
- [GitHub Codespaces](https://toolweight.com/tools/github-codespaces), Devcontainer-backed cloud VMs built for humans, occasionally repurposed for agents.
- [Islo](https://toolweight.com/tools/islo), Per-agent isolated cloud sandboxes with enterprise policy controls, from Incredibuild.

## Logo & brand colours

SVG files: https://toolweight.com/teams/vercel/logo.svg and https://toolweight.com/teams/vercel/mono.svg. JSON: https://toolweight.com/api/v1/brands/vercel.

| Hex | oklch |
| --- | --- |
| #000000 | oklch(0.0% 0.000 0.0) |

## Licence and attribution

Data from Toolweight (https://toolweight.com), licensed CC-BY-4.0.

- Licence: [CC-BY-4.0](https://creativecommons.org/licenses/by/4.0/)
- Canonical HTML: https://toolweight.com/tools/vercel-sandbox
- Machine-readable: https://toolweight.com/tools/vercel-sandbox.md · https://toolweight.com/api/v1 · https://toolweight.com/mcp
- Toolweight takes no affiliate revenue and sells no placements.