# Vercel Sandbox

> Firecracker microVMs inside Vercel, billed on active CPU and provisioned memory.

Website: https://vercel.com/docs/sandbox  
Guide page: https://botperch.com/providers/vercel-sandbox/  
Checked: 2026-10-28

**Short answer:** One always-on personal agent (2 vCPU / 4 GiB / 20 GiB) costs about $73.12 a month here, with a catch: Sessions end after 24 hours, so an always-on machine has to be restarted by your own code. The AI model adds about $14.70 a month on top (GLM 5.3, 30 requests a day at 40k tokens each, median zero-retention price; from $6.84 at the cheapest host). Fits well: A Firecracker microVM with root, Docker and FUSE, up to 32 vCPU and 64 GB of NVMe.

Vercel Sandbox runs untrusted or agent-generated code in Firecracker microVMs, managed through a CLI, JavaScript SDK or Python SDK.
It is part of the Vercel platform rather than a separate product: usage sits on the Vercel plan, and the Hobby plan is restricted to non-commercial use.

**Who it is for:** Teams already on Vercel who want agent code execution with many regions and familiar account controls.

**Isolation:** Firecracker microVM with a dedicated kernel. Root access, Docker and FUSE are documented; systemd and nested virtualisation are not.

**Sizes and regions:** 1 or even numbers of vCPUs from 2 to 32 depending on plan, 2 GB of memory per vCPU, and 64 GB of ephemeral NVMe. Hobby caps at 4 vCPU / 8 GB, Pro at 8 / 16, Enterprise at 32 / 64. Nineteen regions; no GPU published.

## How it charges

- model: Metered usage against the Vercel plan, with a monthly credit on Pro.
- meter: Active CPU at $0.128 per CPU-hour, excluding time waiting on I/O; provisioned memory at $0.0212 per GB-hour with a one-minute minimum; creations, data transfer, snapshots and drives separately.
- stopped: No CPU or memory charge, but snapshots and drives keep billing. Persistent sandboxes create a billable snapshot when they stop.
- planFee: Vercel Pro is $20 a month and includes $20 of usage credit, which expires monthly.
- minimum: Memory bills in one-minute increments. Hobby has included quotas and pauses creation when they are exhausted.

Active CPU, excluding time spent waiting, plus provisioned memory for the whole session; persistent sandboxes keep their files as a snapshot between sessions.
- A persistent sandbox restores its files from a snapshot when it starts again, not its memory or running processes. Snapshot storage is $0.08 per GB-month; the calculator charges it on the full disk size, which overstates it if little is written.
- Each sandbox gets 64 GB of fast disk at no separate charge while it runs.
- Creations, data transfer and drives are billed separately and are not included.
- Sandboxes that cannot resume from a snapshot are removed after 14 days of inactivity.

## Monthly cost for each preset workload

- A personal agent that stays on (Hermes, OpenClaw): $73.12 (catch: Sessions end after 24 hours, so an always-on machine has to be restarted by your own code.)
- A coding agent for one developer: $32.91
- A code interpreter inside your product: $42.77
- A browser agent for a small team: $462.40
- Self-hosted n8n for a small team: $72.74 (catch: Sessions end after 24 hours, so an always-on machine has to be restarted by your own code.)
- A Discord or Slack bot for one server: $33.76 (catch: Sessions end after 24 hours, so an always-on machine has to be restarted by your own code.)
- Claude Code for a team of five: $162.10
- A scraper that runs four times a day: $20.00
- Your own remote MCP server: $20.00 (catch: Sessions end after 24 hours, so an always-on machine has to be restarted by your own code.)
- A: 1,000 short tasks: $35.47
- B: one always-on box: $161.18 (catch: Sessions end after 24 hours, so an always-on machine has to be restarted by your own code.)
- C: three hours a day: $20.00

## Fits well

- A Firecracker microVM with root, Docker and FUSE, up to 32 vCPU and 64 GB of NVMe.
- A workload that needs to run close to users: 19 regions, and the most of any provider here.
- A Vercel-hosted app that wants a sandbox next to its deployments, with credentials brokered out of the machine.

## Fits badly

- An always-on agent: the default session timeout is five minutes and the Hobby cap is 45 minutes.
- A confidential Hobby workload: Hobby content may be used for model training, and the plan is non-commercial.
- Anything needing SSH, a desktop or a raw TCP inbound port.

## Features

- **Isolation** (partly): Firecracker; root + Docker. A Firecracker microVM with a dedicated kernel, root, Docker and FUSE. systemd and nested virtualisation are not published. [source](https://vercel.com/docs/sandbox/concepts) [docs](https://vercel.com/docs/sandbox/concepts#isolation-architecture)
- **Sizes and regions** (yes): 19 regions. 1 or even numbers of vCPUs from 2 to 32 by plan, 2 GB of memory per vCPU, 64 GB of ephemeral NVMe, and 19 regions. No GPU published. [source](https://vercel.com/docs/sandbox/concepts) [docs](https://vercel.com/docs/sandbox/pricing#resource-limits)
- **Lifecycle** (partly): Filesystem only. Stopping ends the session. Persistent sandboxes save their filesystem and restore it into a new session, not RAM; restart background services with the onResume hook. [source](https://vercel.com/docs/sandbox/concepts/persistent-sandboxes) [docs](https://vercel.com/docs/sandbox/concepts/persistent-sandboxes)
- **Snapshots and forks** (partly): Filesystem only. Snapshots capture the filesystem and outlive the sandbox; taking one manually stops the session. Fork uses the current snapshot or falls back to a fresh create from the image. [source](https://vercel.com/docs/sandbox/concepts/snapshots) [docs](https://vercel.com/docs/sandbox/concepts/snapshots)
- **Storage** (partly): 64 GB ephemeral; drives. 64 GB of ephemeral NVMe per sandbox, plus drives billed on logical used size. Only one sandbox at a time can mount a drive read-write; snapshots are the sharing mechanism. [source](https://vercel.com/docs/sandbox/pricing#resource-limits) [docs](https://vercel.com/docs/sandbox/concepts/drives)
- **Idle and waking** (partly): 5 min session. A session timeout of five minutes by default, with a maximum session of 45 minutes on Hobby and 24 hours on Pro. No idle-activity timer is published. [source](https://vercel.com/docs/sandbox/concepts) [docs](https://vercel.com/docs/sandbox/pricing#runtime-limits)
- **Reaching it** (partly): Web ports only. Web ports can be exposed, up to 15 per sandbox, and traffic to them is billable. The dashboard's Connect tab gives a terminal in the browser. A general raw TCP inbound, standard SSH or public IPv4 is not published. [source](https://vercel.com/docs/sandbox/pricing#network) [docs](https://vercel.com/docs/sandbox/concepts#network-access)
- **Custom domains** (not-published): Not published. Attaching a customer's own domain to a Sandbox port was not confirmed. Vercel domains apply to deployments, a different product; ask whether a separately managed proxy is supported. [source](https://vercel.com/docs/sandbox)
- **Outbound network** (yes): $0.15/GB. Firewall rules default to allow-all and can be set per sandbox. Matchers transform requests but never block them, so an allowlist needs an explicit rule. [source](https://vercel.com/docs/sandbox/pricing#pricing) [docs](https://vercel.com/docs/sandbox/concepts/firewall)
- **Keys and secrets** (yes): No, proxy. Credentials brokering injects credentials into egressing traffic, so secrets never enter the sandbox and code inside cannot exfiltrate them. [source](https://vercel.com/docs/sandbox/concepts/firewall#credentials-brokering) [docs](https://vercel.com/docs/sandbox/concepts/firewall#credentials-brokering)
- **Ways to drive it** (partly): No; CLI or SDK. CLI, JavaScript and Python SDKs, and a dashboard that can stop or delete a sandbox and shows a lifecycle activity log. No SSH or desktop is published. [source](https://vercel.com/docs/sandbox) [docs](https://vercel.com/docs/sandbox/sdk-reference)
- **Built-in agents** (partly): Agents in image; no API. The default universal image includes coding agents and common utilities, but there is no agent-run API; you drive them yourself. [source](https://vercel.com/docs/sandbox) [docs](https://vercel.com/docs/sandbox/ecosystem)
- **Teams and accounts** (partly): Spend management. Team seats, spend management that can pause projects, and a lifecycle activity log. SAML costs $300 a month; fine-grained Sandbox key scopes and contractual residency are not published. [source](https://vercel.com/docs/plans/pro-plan#paid-add-ons) [docs](https://vercel.com/docs/plans/pro-plan#team-seats)
- **Billing models** (partly): $0.128/CPU-hour. Active CPU at $0.128 per CPU-hour excluding I/O wait, provisioned memory at $0.0212 per GB-hour with a one-minute minimum, plus creations, transfer, snapshots and drives. [source](https://vercel.com/docs/sandbox/pricing#pricing) [docs](https://vercel.com/docs/sandbox/pricing)
- **Trials and free tiers** (partly): Hobby quotas; 14-day Pro. Hobby has included quotas but is restricted to non-commercial use, and pauses sandbox creation when quotas run out. Pro has a 14-day trial with $20 in credits. [source](https://vercel.com/docs/plans/hobby) [docs](https://vercel.com/docs/plans/hobby)
- **The company** (yes): Vercel Inc.; 99.99% platform. Vercel Inc., Delaware; founded 2015 by Guillermo Rauch. Sandbox announced June 2025, generally available January 2026; $300M Series F at a $9.3B valuation in September 2025. Status page shows Sandbox Operational but no Sandbox-specific uptime figure. The 99.99% Enterprise SLA covers the platform and does not name Sandbox; Pro and Hobby have no SLA. SOC 2 Type 2 and ISO 27001 are platform-level; Sandbox scope is not established. Fee changes need written notice and apply from the next payment period; content may be deleted on termination. [source](https://vercel.com/legal/sla#services-availability)

## Capabilities

- Its own virtual machine: yes (Firecracker microVM) [source](https://vercel.com/docs/sandbox/concepts)
- Root access: yes (full root) [source](https://vercel.com/docs/sandbox/concepts)
- Docker inside: yes (Docker inside) [source](https://vercel.com/docs/sandbox/concepts)
- Nested virtualisation: not-published [source](https://vercel.com/docs/sandbox/concepts)
- Your own image: yes (custom image or snapshot) [source](https://vercel.com/docs/sandbox/concepts)
- Any size you like: partly (even cores only, 2 GB each). You choose cores in steps of two and each core comes with exactly 2 GB of memory, so memory cannot be set on its own. [source](https://vercel.com/docs/sandbox/pricing)
- Large machines: partly (32 cores on Enterprise only). Machines above 8 cores and 16 GB need the Enterprise plan; the self-serve plans stop there. [source](https://vercel.com/docs/sandbox/pricing)
- Resize while running: no (fixed for the session). The size is set when the sandbox is created and cannot be changed during its life. [source](https://vercel.com/docs/sandbox/pricing)
- GPUs: no (no GPU). No graphics processor option is published for sandboxes. [source](https://vercel.com/docs/sandbox/pricing)
- Choose the region: yes (19 regions) [source](https://vercel.com/docs/sandbox/pricing)
- Runs in the EU: yes (European regions) [source](https://vercel.com/docs/sandbox/concepts/snapshots)
- Pause keeps memory: no [source](https://vercel.com/docs/sandbox/concepts/persistent-sandboxes)
- Pre-started pools: no [source](https://vercel.com/docs/sandbox/concepts/persistent-sandboxes)
- Starts in under a second: yes (Sub-second) [source](https://vercel.com/docs/sandbox/concepts)
- Snapshots of files: yes (30-day default) [source](https://vercel.com/docs/sandbox/concepts/snapshots)
- Snapshots with memory: no [source](https://vercel.com/docs/sandbox/concepts/persistent-sandboxes)
- Copy a running machine: partly. A fork starts from a snapshot of the current state, and taking one stops the session it copies. [source](https://vercel.com/docs/sandbox/concepts/snapshots)
- Pick an older snapshot: yes (Keep last 1–10) [source](https://vercel.com/docs/sandbox/concepts/persistent-sandboxes)
- Reusable templates: yes [source](https://vercel.com/docs/sandbox/concepts)
- Automatic backups: partly (On every stop). A copy is saved each time the machine stops, but there is no schedule and only the last few are kept. [source](https://vercel.com/docs/sandbox/concepts/snapshots)
- Files survive a stop: yes [source](https://vercel.com/docs/sandbox/concepts/persistent-sandboxes)
- Separate volumes: yes [source](https://vercel.com/docs/sandbox/concepts/drives)
- One volume, several machines: partly. Only one machine can write a drive; others get a read-only copy taken when they mount it. [source](https://vercel.com/docs/sandbox/concepts/drives)
- Mount outside storage: no [source](https://vercel.com/docs/sandbox/concepts/drives)
- Large disk: yes (1 TiB drive) [source](https://vercel.com/docs/sandbox/concepts/drives)
- Can stay on indefinitely: partly (45 min Hobby, 24 h Pro). A single session cannot last beyond 45 minutes on the free plan or 24 hours on paid plans. [source](https://vercel.com/docs/sandbox/pricing)
- Choose the idle timeout: no [source](https://vercel.com/docs/sandbox/pricing)
- Wakes on a request: yes [source](https://vercel.com/docs/sandbox/concepts/persistent-sandboxes)
- Scheduled runs: yes [source](https://vercel.com/docs/cron-jobs)
- Public link to a port: yes (Exposed ports) [source](https://vercel.com/docs/sandbox/concepts)
- Private link: no. An exposed port is open to anyone with the link; there is no token or login in front of it. [source](https://vercel.com/docs/sandbox/concepts)
- Real SSH: partly (SSH-like shell). The command line is the provider's own tool that feels like SSH; a standard SSH client cannot connect. [source](https://vercel.com/docs/sandbox/working-with-sandbox)
- Terminal in the browser: yes (Dashboard tab) [source](https://vercel.com/changelog/connect-to-and-manage-sandboxes-from-the-dashboard)
- Tunnel to your computer: no. Exposed ports are reachable on the internet, but there is no documented way to map one onto your own computer. [source](https://vercel.com/docs/sandbox/concepts)
- Non-web ports: no. Only web ports can be exposed, so a database or game server cannot be reached from outside. [source](https://vercel.com/docs/sandbox/concepts)
- Your own domain: not-published [source](https://vercel.com/docs/sandbox)
- Automatic HTTPS: not-published [source](https://vercel.com/docs/sandbox)
- Outbound data included: partly (20 GB a month). Only 20 GB a month is included; beyond that, traffic costs $0.15 a gigabyte. [source](https://vercel.com/docs/sandbox/pricing)
- Allow only some sites: yes (Domain or address list) [source](https://vercel.com/docs/sandbox/concepts/firewall)
- Turn the internet off: yes (deny-all) [source](https://vercel.com/docs/sandbox/concepts/firewall)
- Fixed outgoing IP: not-published [source](https://vercel.com/docs/sandbox/concepts)
- Stored secrets: partly (Passed each time). There is no saved list of secrets for a sandbox; you pass the values each time you create or run one. [source](https://vercel.com/docs/sandbox/concepts)
- Secrets the agent cannot read: yes (Outside the machine) [source](https://vercel.com/docs/sandbox/concepts/firewall)
- Limited API keys: partly (Team tokens). Tokens are limited to a team, but no read-only or sandbox-only scope is published. [source](https://vercel.com/docs/sandbox)
- Create from the website: no [source](https://vercel.com/docs/sandbox/concepts/persistent-sandboxes)
- Command-line tool: yes [source](https://vercel.com/docs/sandbox/cli-reference)
- Python SDK: yes [source](https://vercel.com/docs/sandbox)
- TypeScript SDK: yes [source](https://vercel.com/docs/sandbox)
- Documented HTTP API: no. Sandbox is driven through the SDKs and the CLI; no HTTP API is documented. [source](https://vercel.com/docs/sandbox)
- MCP server: no. No MCP server manages sandboxes; Vercel's MCP material is about building MCP servers on Vercel. [source](https://vercel.com/docs/sandbox)
- Interactive terminal over the API: yes [source](https://vercel.com/docs/sandbox/cli-reference)
- Files over the API: yes [source](https://vercel.com/docs/sandbox/sdk-reference)
- Coding agents preinstalled: yes [source](https://vercel.com/docs/sandbox)
- Send it a prompt: no. Agents are in the image but there is no API that runs one; you open a terminal or use the CLI. [source](https://vercel.com/docs/sandbox)
- One-click Hermes: no. A Hermes guide exists, but you follow terminal steps; nothing is one click. [source](https://vercel.com/docs/sandbox/ecosystem/hermes)
- One-click OpenClaw: no. No OpenClaw template or one-click route is documented. [source](https://vercel.com/docs/sandbox/ecosystem)
- Browser built in: no. No browser is documented in the image or as an API; agents in the image are terminal tools. [source](https://vercel.com/docs/sandbox)
- Desktop for computer use: no. No desktop, VNC or computer-use API is published for Sandbox. [source](https://vercel.com/docs/sandbox)
- Runs other platforms' agents: yes [source](https://vercel.com/docs/sandbox/ecosystem)
- Team workspace: yes [source](https://vercel.com/docs/plans/pro-plan)
- Roles and permissions: yes [source](https://vercel.com/docs/plans/pro-plan)
- Single sign-on: partly ($300/month). SAML single sign-on is a paid add-on at $300 a month. [source](https://vercel.com/docs/plans/pro-plan)
- Hard spending cap: partly. Spend Management can pause projects at an amount you set, but it is a project pause rather than a sandbox stop. [source](https://vercel.com/docs/sandbox/pricing)
- Usage alerts: yes [source](https://vercel.com/docs/sandbox/pricing)
- Audit log: partly. Audit Logs are a Vercel Enterprise feature; Sandbox-specific coverage is not established. [source](https://vercel.com/docs/audit-log)
- Billed per second: partly (memory rounds to a minute). Memory is counted in whole minutes, so a 20-second task is charged for a full minute of memory. [source](https://vercel.com/docs/sandbox/pricing)
- CPU billed only while working: yes (active CPU only) [source](https://vercel.com/docs/sandbox/pricing)
- Paused costs only storage: yes (compute stops) [source](https://vercel.com/docs/sandbox)
- No monthly fee: partly (Hobby free; Pro $20). The free Hobby plan is for personal projects only; commercial use needs the $20-a-month Pro plan. [source](https://vercel.com/docs/plans/pro-plan)
- Flat monthly price: no (active CPU plus memory). The bill is active processor time plus memory for as long as the sandbox runs. [source](https://vercel.com/docs/sandbox/pricing)
- Ongoing free tier: partly (Hobby, personal use only). The free Hobby plan is limited to personal projects and stops creating sandboxes when its allowance runs out. [source](https://vercel.com/docs/plans/hobby)
- Free starting credit: partly ($20 in a 14-day trial). The credit is part of a 14-day Pro trial, not a standing signup credit. [source](https://vercel.com/docs/plans/hobby)
- Try without a card: not-published [source](https://vercel.com/docs/plans/hobby)
- Public status page: yes [source](https://www.vercel-status.com)
- Uptime promise (SLA): partly (99.99%, Enterprise). The 99.99% Enterprise SLA covers the platform and does not name Sandbox. [source](https://vercel.com/legal/sla)
- SOC 2 report: partly. Vercel holds SOC 2 Type 2, but Sandbox's place in the audit scope is not published. [source](https://vercel.com/docs/security/compliance)
- Data processing agreement: yes [source](https://vercel.com/legal/dpa)
- Open source or self-hostable: no. Vercel Sandbox is hosted on Vercel; no self-hosted edition is published. [source](https://vercel.com/docs/sandbox)

## Usability

- Dashboard: The Vercel dashboard can stop or delete a sandbox and shows a lifecycle activity log.
- Without code: No documented no-code path; the workflows are CLI and SDK.
- Signup: A Vercel account. Card requirement depends on the plan and trial path; Hobby is non-commercial only.
- Docs: Vercel's docs cover sandbox concepts, SDK, pricing and limits. Support follows the Vercel plan.
- Trips people up: The default timeout is 5 minutes, and the maximum session is 45 minutes on Hobby, 24 hours on Pro.
- Trips people up: Persistent sandboxes bill snapshot storage automatically.
- Trips people up: Active CPU excludes I/O wait, so the meter is not wall-clock time.
- Trips people up: Hobby pauses sandbox creation when quotas run out.

## Company

- Legal entity: Vercel Inc., a Delaware corporation. [source](https://vercel.com/legal/dpa)
- Founded: 2015, by Guillermo Rauch, who is CEO. Sandbox was announced in June 2025 and went GA in January 2026. [source](https://vercel.com/blog/series-f)
- Funding: $300M Series F at a $9.3B valuation in September 2025, co-led by Accel and GIC. [source](https://vercel.com/blog/series-f)
- Headcount: 600, per Forbes in September 2025. No current company-confirmed figure. [source](https://www.forbes.com/companies/vercel/)
- Status and SLA: Sandbox is listed as operational with no Sandbox-specific percentage. The 99.99% Enterprise SLA does not name Sandbox. [source](https://vercel.com/legal/sla#services-availability)
- Certification: SOC 2 Type 2 and ISO 27001:2022 at platform level; Sandbox's place in that scope is not published. [source](https://vercel.com/docs/security/compliance#soc-2-type-2)

## Caveats

- **Persistence is billed by default** (open): Persistent sandboxes save their filesystem when stopped, and each automatic snapshot consumes snapshot storage billed separately from compute.
- **The session limit is not a lifetime limit** (open): The maximum duration applies to a single session: 45 minutes on Hobby, 24 hours on Pro and Enterprise. Persistent sandboxes can be resumed into a new session.
- **Hobby is non-commercial** (open): The Hobby plan restricts users to non-commercial, personal use only.
- **Hobby quota reset wording differs** (contradiction): One page says creation pauses until 30 days after first use; another says until the next billing cycle.
- **Fork is not a live memory copy** (open): Fork uses the current saved snapshot or falls back to a fresh create from the image; manual snapshotting stops the source.

## Sources

- [Overview](https://vercel.com/docs/sandbox)
- [Concepts](https://vercel.com/docs/sandbox/concepts)
- [Persistence](https://vercel.com/docs/sandbox/concepts/persistent-sandboxes)
- [Snapshots](https://vercel.com/docs/sandbox/concepts/snapshots)
- [Pricing](https://vercel.com/docs/sandbox/pricing)