AI Potluck
Infrastructure / Deployment

Vercel Sandbox

Vercel

Vercel Sandbox runs untrusted or agent-generated code in a Firecracker microVM with its own filesystem and network, started from a Vercel managed Linux image or a custom OCI image held in the Vercel Container Registry. Sandboxes persist by default, resuming where they stopped, and can be snapshotted, tagged, given root and system privileges, or split per agent by Linux user. JavaScript and Python SDKs and a CLI drive it.

The execution layer behind Vercel Open Agents. Runtime duration and concurrency are quota fields rather than product limits - a Hobby sandbox stops at 45 minutes where Pro and Enterprise run to 24 hours. The real ceiling is regional - Sandbox runs only in iad1. Verified 2026-08-14 via the Vercel Sandbox documentation and its pricing and quotas page.

Openness

1 high confidence
1.0
source
closed
service
proprietary Vercel Fluid-compute managed cloud (no self-host of the Firecracker microVM plane)
open-part
client SDK/CLI only (@vercel/sandbox JS + Python, vercel/sandbox on GitHub)
license
Proprietary, proprietary service

Closed managed service. The SDK and CLI are open, but they are only a client for Vercel’s proprietary microVM cloud, which cannot be self-hosted; an open client over a closed runtime is not open core, because the core is proprietary. It sits with the other proprietary sandbox clouds - Google Cloud Run, Fly Sprites, Northflank.

  • https://vercel.com/docs/sandbox recorded 2026-06-04

    Firecracker microVM isolation; SDK/CLI on GitHub vercel/sandbox; managed Vercel cloud, pay-for-active-CPU

  • https://vercel.com/docs/sandbox recorded 2026-08-13

    Each sandbox runs in a Firecracker microVM on Vercel; authentication is by Vercel OIDC token or Vercel access token; images come from Vercel Managed Images or the Vercel Container Registry. Only the SDKs and CLI are pointed at GitHub - the runtime itself is not distributed.

  • https://vercel.com/docs/sandbox/pricing recorded 2026-08-13

    Usage metered on Hobby, Pro and Enterprise plans across active CPU, provisioned memory, sandbox creations, data transfer and snapshot storage. No self-hosted, on-premises or source-available tier appears anywhere on the page.

Adoption

5 medium confidence
5.0

The npm downloads API reports 13,197,882 downloads of @vercel/sandbox over the window 2026-07-11 to 2026-08-09, clear of the 10M floor, which bands at level 5 on the software adoption scale. The package is the product’s own - its registry metadata describes it as the "Software Development Kit for Vercel Sandbox" and points at github.com/vercel/sandbox. The npm figure can be fetched again by hand but no automated feed reads it, so it is a measured number rather than a computed one. Package-manager pulls include CI and mirror inflation and overstate distinct human users; GA status and the large Vercel install base corroborate genuine production use. Confidence stays medium rather than high on that inflation caveat.

Capability

4 high confidence
4.0

Firecracker microVM isolation (top tier), millisecond cold-start and persistence with snapshots make it a strong agent sandbox; held at 4 rather than 5. Independent ComputeSDK TTI benchmarks measure a ~390ms median cold-start, 9th of 19 sandbox providers; the vendor’s "ms startup" framing is optimistic against the measured hundreds of milliseconds, though still solidly sub-second. The hold rests on scale rather than on runtime breadth. On breadth the docs read "Sandboxes run Linux images, with Ubuntu, Arch Linux, or any other Linux distribution you need" and offer "your own OCI images stored in Vercel Container Registry", which is the same any-image story that made Lambda the frontier, and the 45-minute execution cap applies to the Hobby tier only - the limits table gives Pro and Enterprise 24 hours. On scale the hold stands: 10,000 concurrent sandboxes and a 5,000 vCPU/min allocation ceiling against Lambda’s 15 trillion monthly invocations and 1000 additional concurrent executions every 10 seconds, and a single region, iad1, against Lambda everywhere. A hard regional cap is the stronger constraint. So 4, one rung below AWS Lambda, on a narrow and well-evidenced reason.

  • https://vercel.com/docs/sandbox recorded 2026-08-14

    "Sandboxes run Linux images, with Ubuntu, Arch Linux, or any other Linux distribution you need"; images come from Vercel Managed Images "or your own OCI images stored in Vercel Container Registry"; "Each sandbox runs in a secure Firecracker microVM with its own filesystem and network"; "Sandboxes start in milliseconds"; system-privileged processes "such as container runtimes like Docker, VPN clients, and FUSE filesystem drivers"; persistence is the default with snapshotting and attachable drives alongside it.

  • https://vercel.com/docs/sandbox/pricing recorded 2026-08-14

    The limits tables, which are where the 45 minutes came from and where it stops. Maximum duration is 45 minutes on Hobby and 24 hours on Pro and Enterprise; concurrent sandboxes 10, 10,000 and 10,000; maximum vCPUs 4, 8 and 32 with 8GB, 16GB and 64GB of memory; maximum vCPU allocation rate 40/min, 5,000/min and 5,000/min. "Currently, Vercel Sandbox is only available in the `iad1` region."

  • https://www.computesdk.com/benchmarks/sandboxes/ recorded 2026-07-09

    ComputeSDK TTI leaderboard (independent, 100 iters/day, 2026-07-09 run): median time-to-interactive ~390ms sequential / ~490ms burst @100 concurrent; 9th of 19 providers

Verified 2026-08-13