Which sandbox providers offer “your own domain”?

Serve what the machine runs at your own web address. Fully: Blaxel, Runtime and boxd. With a catch: Agent 37, Cloudflare Sandbox, Daytona, E2B, Lizard, Modal and Sandboxer. Not at all: Boat.

Which sandbox providers offer “automatic HTTPS”?

The provider gets and renews the security certificate for your domain. Fully: Agent 37, Blaxel, Cloudflare Sandbox, Runtime and boxd. With a catch: Lizard and Modal. Not at all: Boat, Daytona, E2B and Sandboxer.

Custom domains

The idea

A custom domain is an HTTPS hostname you control, pointed at a port inside the sandbox. It matters when the URL is the product: a client-facing demo, a webhook receiver, or an agent whose address should not be a provider subdomain that changes.

There are three levels. Native: the provider issues a certificate for your hostname and routes it. Do-it-yourself: the provider gives you a stable hostname and you put your own proxy in front. Absent: no documented path, and the preview URL is what you have.

The differences are in the details: whether you can delegate a subdomain or must move a whole domain's nameservers, whether certificates are automatic, and whether the domain survives a resume.

Where providers split

The claim on the left, the provider's own words on the right

Native, self-serve domains

Runtime routes a sandbox's web port at your hostname with HTTPS. boxd lets you point one domain at a machine or delegate a wildcard subdomain to the whole organisation, and issues certificates automatically. Blaxel's preview URLs support optional auth and custom domains.

“boxd verifies your DNS and issues TLS certificates automatically.”

boxd, guides/custom-domainsdocs-confirmed

Do it yourself, or not at all

Sandboxer calls first-class custom domains a roadmap item and documents a CNAME plus your own TLS termination. E2B's guide sets up a customer-operated GCP VM running Caddy and Cloudflare DNS to proxy requests to the sandbox. Boat explicitly does not support custom domains.

“We will set up a GCP VM running Caddy server with Docker and Cloudflare DNS to proxy the requests to the Sandboxes.”

E2B, network/custom-domaindocs-confirmed

Not published is not the same as no

InstaBox, Morph, Sprites and Vercel Sandbox publish no sandbox custom-domain feature. InstaBox's API has no customDomain or cname field and its URL is a fixed vendor subdomain; a community report says Sprites lack custom domains the way regular Fly VMs have them; Vercel's domains apply to deployments, not Sandbox ports. For these, the honest answer is that no native path is published.

One worked case

The same job at every provider, from the documented defaults

Point demo.acme.com at the agent's port

You own acme.com and want demo.acme.com to reach port 3000 inside the sandbox, with a valid certificate and no proxy for you to run.

DNS
Either you add a CNAME for one subdomain, or the provider asks you to move the whole domain's nameservers.
TLS
The provider issues a certificate, or you terminate TLS yourself in front of the sandbox.
Resume
The machine stops overnight. In the morning the hostname either still points at it or has to be re-pointed.

Only a handful of providers make this a native, self-serve feature with automatic certificates. For the rest the honest answer is a proxy you operate, a whole-domain delegation, or nothing published.

What each provider does

Agent 37: Possible only by delegating a whole dedicated domain's nameservers; a subdomain of your existing domain cannot be registered.
Blaxel: Preview URLs support custom domains, with optional auth.
Boat: Explicitly unsupported: a CNAME to on.boat.dev does not work, and certificates are issued only for on.boat.dev names.
boxd: Point one domain at the machine or delegate a wildcard subdomain to the organisation; DNS is verified and TLS issued automatically.
Cloudflare Sandbox: A wildcard DNS record and a Worker route send demo.acme.com to your Worker, which forwards to the sandbox.
Daytona: Not native: you host a preview proxy under demo.acme.com, and it starts stopped sandboxes before forwarding.
E2B: No native feature: the documented path is a customer-operated GCP VM running Caddy and Cloudflare DNS in front of the sandbox.
InstaBox: No custom-domain support is published, and the public-port URL is a fixed vendor subdomain.
Lizard: Documented for deployed app services, not for sandbox preview URLs; a preview stays on the provider hostname.
Modal: Available on Team and Enterprise only: add NS records to Modal's nameservers and ask on Slack to finish onboarding.
Morph: No custom-domain feature appears in the documentation, API or terms; an HTTP service is served on a provider hostname.
Runtime: The web port can run at your hostname with HTTPS, verified by DNS records and a Let's Encrypt certificate.
Sandboxer: A roadmap item: the documented workaround is a CNAME to the hosted hostname with your own TLS termination.
Sprites: No native support documented; a community report from April 2026 says Sprites lack custom domains the way regular Fly VMs have them.
Vercel Sandbox: Attaching your own domain to a Sandbox port was not confirmed; Vercel domains apply to deployments, a different product.
Tensorlake: On Tensorlake Cloud the hostname is fixed; a self-hosted BYOC ingress puts every sandbox under a domain you own.

What to watch for

The details that decide the answer in practice

01
Whether you must move a whole domain's nameservers or can delegate one subdomain.
02
Whether the certificate is issued automatically.
03
Whether the domain survives a stop and resume, or must be re-pointed.
04
Whether the feature is native or a proxy you operate.
05
Whether the domain is for sandboxes or only for deployed apps.

Compare all 16

Docs read 28 October 2026

Putting an agent behind your own hostname is a feature some providers sell, some leave to a proxy you run, and several do not offer at all.
Provider	Path to your domain	Does it?	What that means
Agent 37	Whole domain only	Yes	Custom domains are supported, but only by delegating a whole dedicated domain's nameservers; a subdomain of an existing domain cannot be registered.Agent 37 docs: Custom domains — mirror every workspace URL on your own domain ↗ Agent 37's own wordsdocs-confirmed “Custom domain \| https://{label}.yourdomain.com mirrors all of the above” Agent 37docs-confirmed
Blaxel	Native, optional auth	Yes	Preview URLs back a running sandbox with optional auth and custom domains.Blaxel docs: Custom domains ↗ Blaxel's own wordsdocs-confirmed “Render an application in real-time through a direct preview URL backed by a running Blaxel sandbox, with optional auth and custom domains.” Blaxeldocs-confirmed
Boat	Not supported	No	Custom domains are explicitly unsupported. A CNAME to an on.boat.dev name does not work, and certificates are issued only for on.boat.dev names.Boat docs: Custom domain (not supported) ↗ Boat's own wordsdocs-confirmed “boat does not support custom domains.” Boatdocs-confirmed
boxd	Native, automatic TLS	Yes	Point one domain at a machine or delegate a wildcard subdomain to the organisation; boxd verifies DNS and issues TLS certificates automatically.boxd docs: Custom domains ↗ boxd's own wordsdocs-confirmed “boxd verifies your DNS and issues TLS certificates automatically.” boxddocs-confirmed
Cloudflare Sandbox	Worker route + DNS	Partly	Not a sandbox feature: a wildcard DNS record and a Worker route send every preview hostname to your Worker. TLS and authentication are yours.Cloudflare Sandbox docs: Serve previews on their own hostnames ↗ Cloudflare Sandbox's own wordsdocs-confirmed “A wildcard DNS record and the route .example-previews.com/ send every preview hostname to your Worker.” Cloudflare Sandboxdocs-confirmed
Daytona	Own proxy	Partly	No native custom domain. The documented route is your own preview proxy, which can also start stopped sandboxes before forwarding.Daytona docs: Custom Preview Proxy ↗ Daytona's own wordsdocs-confirmed “host your proxy under your own domain” Daytonadocs-confirmed
E2B	Own proxy in front	Partly	No native custom domain. The documented path is a customer-operated GCP VM running Caddy and Cloudflare DNS in front of the sandbox.E2B docs: Custom domain ↗ E2B's own wordsdocs-confirmed “We will set up a GCP VM running Caddy server with Docker and Cloudflare DNS to proxy the requests to the Sandboxes.” E2Bdocs-confirmed
InstaBox	Not published	Not published	No custom-domain support is published. The public-port URL is a fixed vendor subdomain, and the OpenAPI PublicPort object has only port, name, url and machineId, with no customDomain or cname field. No roadmap entry exists. InstaBox's own wordsdocs-confirmed “The URL is https://<port>-<machine id without m_>.<domain>/.” InstaBoxdocs-confirmed
Lizard	App services only	Partly	Custom domains are documented for deployed app services, not for sandbox preview URLs. A sandbox preview stays on the provider's hostname.Lizard docs: Networking and custom domains — app services, not sandbox preview URLs ↗ Lizard's own wordsdocs-confirmed “You get https://<sandbox-id>-3000.sandbox.<region>.onlizard.com/?lizard_token=…” Lizarddocs-confirmed
Modal	Team+, manual	Yes	Custom domains for sandbox tunnels are on Team and Enterprise, with a manual setup step: NS records plus a Slack request.Modal docs: Sandbox networking: custom domains ↗ Modal's own wordsdocs-confirmed “Custom domains for Sandbox tunnels are available on the Team and Enterprise plans.” Modaldocs-confirmed
Morph	Not published	Not published	No custom-domain feature appears in the documentation, API or terms. An HTTP service can be exposed, but it is served on a provider hostname. Morph's own wordsdocs-confirmed “Expose Http Service” Morphdocs-confirmed
Runtime	Native, Let's Encrypt	Yes	A sandbox's web port can run at your own hostname with HTTPS, verified by DNS records and a certificate from Let's Encrypt.Runtime docs: Custom domains ↗ Runtime's own wordsdocs-confirmed “Custom domain: a sandbox's web port at your own hostname, with HTTPS.” Runtimedocs-confirmed
Sandboxer	CNAME plus your TLS	Partly	First-class custom domains are on the roadmap; the documented workaround is a CNAME to the hosted hostname with your own TLS termination.Sandboxer docs: Hosting: custom domains (roadmap only) ↗ Sandboxer's own wordsdocs-confirmed “First-class custom domains are on the roadmap.” Sandboxerdocs-confirmed
Sprites	Not published	Not published	No native custom-domain support is documented. A community report from April 2026 says Sprites lack custom domains and certificates the way regular Fly VMs do; current support was not confirmed, so treat a proxy as the only known path. Sprites's own wordsthird-party “Sprites don’t have custom domains and certs the way regular Fly VMs do.” Spritesthird-party
Vercel Sandbox	Not published	Not published	Attaching a customer's own domain to a Sandbox port was not confirmed. Vercel domains apply to deployments, a different product; ask whether a separately managed proxy is supported. Vercel Sandbox's own wordsdocs-confirmed “Run untrusted or agent-generated code in isolated Linux microVMs.” Vercel Sandboxdocs-confirmed
Tensorlake	BYOC ingress only	Partly	No custom-domain setting exists on Tensorlake Cloud: sandboxes live under sandbox.tensorlake.ai. In the BYOC mode where you run the ingress, you supply the NLB, an ACM certificate and a public DNS zone, and each sandbox gets a subdomain of your base domain.Tensorlake docs: Set up BYOC on AWS — run the ingress on your own domain ↗ Tensorlake's own wordsdocs-confirmed “You own the endpoint and its domain” Tensorlakedocs-confirmed

The specific capabilities

Each one checked for every provider, with the catch where a version falls short. All capabilities

Custom domains: capabilities by provider
Capability	Agent 37	Blaxel	Boat	boxd	Cloudflare Sandbox	Daytona	E2B	InstaBox	Lizard	Modal	Morph	Runtime	Sandboxer	Sprites	Tensorlake	Vercel Sandbox
Your own domain	Agent 37: With a catch. Dedicated domain only. You must hand over the whole domain and the records that direct it, so it cannot also run your website or email, and it needs $100 of top-ups first.	Blaxel: Yes. Wildcard subdomains	Boat: No. Custom domains are explicitly unsupported; a redirect from your domain to the provider's name does not work either.	boxd: Yes. Per machine or org	Cloudflare Sandbox: With a catch. Through your Worker. You point a catch-all address at your own small program rather than at the machine, so routing is yours to run.	Daytona: With a catch. Own proxy. You have to run your own forwarding service under your domain; the provider does not attach the domain for you.	E2B: With a catch. Own proxy. You have to run a server of your own in front of the machine to use your domain.	InstaBox: Not published	Lizard: With a catch. Apps only. Custom domains work for deployed apps, not for a sandbox's preview link.	Modal: With a catch. Team+, manual. Only Team and Enterprise plans get it, and you must move the domain's name servers and ask support to finish setup.	Morph: Not published	Runtime: Yes. Your hostname	Sandboxer: With a catch. CNAME and your certificate. You point a name at the provider's address and supply the security certificate yourself; a native feature is only planned.	Sprites: Not published	Tensorlake: Not published	Vercel Sandbox: Not published
Automatic HTTPS	Agent 37: Yes. Platform certificate	Blaxel: Yes. Issued per domain	Boat: No. There is no custom domain, so there is no certificate for the provider to manage.	boxd: Yes. Automatic	Cloudflare Sandbox: Yes. Zone certificate	Daytona: No. You run the forwarding service, so you also get and renew the certificate.	E2B: No. The certificate is obtained by the server you run in front of the machine, not by the provider.	InstaBox: Not published	Lizard: With a catch. Apps only. Certificates are handled for deployed apps, but a sandbox preview has no domain to certify.	Modal: With a catch. Team+, manual. Certificates come with the domain, but only on Team and Enterprise plans and after a manual setup step.	Morph: Not published	Runtime: Yes. Let's Encrypt	Sandboxer: No. You point the name and terminate the certificate yourself.	Sprites: Not published	Tensorlake: Not published	Vercel Sandbox: Not published

YesWith a catchNoNot publishedHover or select a mark to see the catch.

Questions to ask before you sign

Each one targets something the documentation does not answer

Can I delegate one subdomain with a CNAME, or do I have to move the whole domain's nameservers?
Who issues and renews the certificate, and how long does that take?
Does the hostname survive a stop and resume, or must it be re-pointed?
Is the domain for sandboxes or only for deployed apps?
If it is not native, what exactly do I have to run in front, and who pays for it?

Common questions

Answered from the capability checks; each links to the provider-by-provider detail and its sources

Which sandbox providers offer “your own domain”?: Serve what the machine runs at your own web address. Fully: Blaxel, Runtime and boxd. With a catch: Agent 37, Cloudflare Sandbox, Daytona, E2B, Lizard, Modal and Sandboxer. Not at all: Boat. See each provider's catch
Which sandbox providers offer “automatic HTTPS”?: The provider gets and renews the security certificate for your domain. Fully: Agent 37, Blaxel, Cloudflare Sandbox, Runtime and boxd. With a catch: Lizard and Modal. Not at all: Boat, Daytona, E2B and Sandboxer. See each provider's catch

Part of Access and network. Next: put two or three providers side by side.