Which sandbox providers offer “outbound data included”?

Data the machine sends out is free or comes with a published allowance. Fully: Blaxel, Boat, Cloudflare Sandbox, InstaBox, Lizard, Modal, Runtime, Sandboxer and Sprites. With a catch: Vercel Sandbox.

Which sandbox providers offer “allow only some sites”?

Limit which internet addresses the machine can reach. Fully: Agent 37, Cloudflare Sandbox, Daytona, E2B, Modal, Runtime, Sprites, Tensorlake, Vercel Sandbox and boxd. With a catch: Blaxel and Boat. Not at all: InstaBox and Sandboxer.

Which sandbox providers offer “turn the internet off”?

Run a machine with no internet access at all. Fully: Agent 37, Cloudflare Sandbox, Daytona, E2B, Modal, Runtime, Tensorlake, Vercel Sandbox and boxd. With a catch: Boat, Sandboxer and Sprites.

Which sandbox providers offer “fixed outgoing IP”?

Traffic leaves from a known IP address that other services can whitelist. Fully: Runtime. With a catch: Blaxel and Modal. Not at all: E2B and Sandboxer.

Outbound network: egress, allowlists and static IP

The idea

Outbound access is usually open by default, because an agent that cannot reach a package registry is not much use. The interesting parts are the controls: can you deny everything, allow a list of hosts, and enforce it outside the machine so root inside cannot loosen it?

A static egress IP is a separate product. It matters when a third-party API allowlists your address, or when a rate limit is shared with every other sandbox on the host. Most providers here do not offer one; Runtime sells it for $5 a month, and E2B explicitly does not offer it on any plan.

The last question is billing. Egress is free at some providers, metered at others, and unpublished at a few. A generous free allowance can be the difference between a cheap agent and an expensive one.

Where providers split

The claim on the left, the provider's own words on the right

Open by default, closed on request

Runtime starts closed and makes you open a door; a sandbox can also be set to internet: false or an allowlist. Agent 37 offers allow-all, deny-all and an IPv4 allowlist, changeable live, and DNS counts as a connection. boxd's allowlist is enforced outside the machine, so root cannot loosen it.

Sandboxer, Lizard, InstaBox and Boat are open by default with no published allowlist. Boat has no API setting for network rules at all; its firewall is ufw inside the sandbox, and rules do not survive a snapshot.

A stable address is rare

Runtime sells a dedicated outbound address per account for $5 a month. Vercel's Secure Compute gives a private path to AWS, but the public path is billed as data transfer. Most others share an address: Sandboxer says outbound traffic shares the node's IP, and InstaBox's machines share one NAT address according to a third party.

E2B is explicit that there are no dedicated or static egress IPs on any plan, including Enterprise. A customer-operated proxy is the documented workaround. Morph charges egress as a billing component but publishes no rate, allowlist or static address.

Filtering is not the same as blocking

Blaxel's proxy can filter domains, but traffic from tools that ignore proxy environment variables is not filtered unless domain filter enforcement is enabled. Vercel's firewall matchers select requests for transformation and never block a request by themselves.

That distinction matters for an agent that runs arbitrary binaries: a proxy that only sees well-behaved HTTP clients is not a network boundary.

One worked case

The same job at every provider, from the documented defaults

The agent downloads 400 GB of dependencies

A build agent pulls container images and model weights all day. The job works everywhere; the bill and the controls do not.

Allow
Outbound is open by default at most providers, so the download starts without configuration.
Meter
The provider either bills per GB, includes an allowance, or publishes nothing at all.
Restrict
You try to narrow the agent to a package registry and find out whether the rule is enforced outside the machine.

At $0.02 or $0.15 a gigabyte, 400 GB is a line item; at Boat, Sandboxer and Sprites it is free. The second half is control: a proxy the agent can bypass is not a network boundary.

What each provider does

Agent 37: The agent's package downloads go out through the allowlist, and no egress rate or cap is published to price them.
Blaxel: Egress is included, and the proxy can filter domains, but tools that ignore proxy variables are not filtered unless enforcement is on.
Boat: Nothing is billed for traffic, and there is no API for network rules; ufw inside the sandbox is the control.
boxd: The allowlist is enforced outside the machine, so root inside cannot loosen it, and no egress price is published.
Cloudflare Sandbox: Outbound is off unless enableInternet is true; with it off, only allowedHosts or an outbound handler on ports 80 and 443 can leave.
Daytona: Package installs fail on Tier 1: outbound is restricted and cannot be overridden per sandbox; full internet needs a $500 top-up.
E2B: Domain and IP allow and deny rules are documented, but there is no dedicated egress address on any plan.
InstaBox: Each plan includes outbound data every month (100 GiB on Free, 1 TiB on Pro), then $0.02 per GiB. InstaBox's docs say nothing about which address outbound traffic leaves from.
Lizard: No per-GB charge inside 2 TB per account over a rolling 30 days, with no documented allowlist.
Modal: The download runs on the open default; over the plan allowance it bills $0.04 a GiB, including private traffic between containers.
Morph: Egress is a chargeable component in the terms, with no published rate, allowlist or static address.
Runtime: A dedicated outbound address costs $5 a month; without it the sandbox can be set to refuse everything or to an allowlist.
Sandboxer: Outbound is open with no allowlist, and traffic shares the node's IPv4 with other sandboxes.
Sprites: Outbound is unrestricted, bandwidth is not metered, and a DNS allowlist is opt-in and applied from outside.
Vercel Sandbox: Firewall rules default to allow-all, and traffic beyond the included 20 GB a month bills at $0.15 per GB.
Tensorlake: Egress is open by default and can be turned into an allowlist or a denylist, replaced live on a running sandbox; the traffic itself is not billed.

What to watch for

The details that decide the answer in practice

01
Whether the default is open or closed, and whether a deny-all rule also blocks DNS.
02
Whether the allowlist is enforced outside the machine, or by a proxy the agent can bypass.
03
Whether there is a static egress IP, and what it costs.
04
Whether egress is free, metered, or unpublished.
05
Whether sandboxes can reach each other over a private network.

Compare all 16

Docs read 28 October 2026

What the agent can reach, what can be blocked, and whether the outside world sees a stable address. This is where an agent that browses meets a firewall that was designed for a web app.
Provider	Egress price	Does it?	What that means
Agent 37	Not published	Yes	Allow-all, deny-all or an IPv4 allowlist of up to 100 entries, changeable live. DNS counts as a connection, and private ranges stay blocked. No static egress IP or published egress price.Agent 37 docs: Network access — allow-all, deny-all or an IPv4 allowlist ↗ Agent 37's own wordsdocs-confirmed “DNS counts as a connection. Under deny-all or a list, names do not resolve unless a resolver is on the list.” Agent 37docs-confirmed
Blaxel	Included in plan	Partly	A proxy can filter domains, but tools that ignore proxy environment variables are not filtered unless domain filter enforcement is enabled. Egress is included in the plan.Blaxel docs: Domain filtering ↗ Blaxel's own wordsdocs-confirmed “Traffic from tools that ignore proxy environment variables will not be filtered unless” Blaxeldocs-confirmed
Boat	$0, no cap stated	Partly	Outbound is open by default with no API for network rules; ufw inside the sandbox is the control, and firewall rules do not survive a snapshot. Egress is not billed.Boat docs: Firewall rules and outbound traffic ↗ Boat's own wordspricing-page “Network traffic. boat does not bill egress.” Boatpricing-page
boxd	Not published	Yes	A per-machine allowlist enforced outside the machine, so root inside cannot loosen it. Forks inherit it; a machine from a snapshot starts unrestricted.boxd docs: Egress control ↗ boxd's own wordsdocs-confirmed “An allowlist of just none cuts the machine off from the internet entirely.” boxddocs-confirmed
Cloudflare Sandbox	1 TB a month, then $0.025/GB	Partly	Off by default; only ports 80 and 443 through allowedHosts or an outbound handler. No static egress IP or private network. 1 TB a month is included in North America and Europe, then $0.025/GB; 500 GB elsewhere, then $0.04–$0.05.Cloudflare Sandbox docs: Handle outbound traffic ↗ Cloudflare Sandbox's own wordsdocs-confirmed “A Container starts with enableInternet: false by default, so it cannot reach the Internet.” Cloudflare Sandboxdocs-confirmed
Daytona	Tier 3 for internet	Partly	Tier 1 and 2 are restricted and cannot be overridden per sandbox; Tier 3 and 4 get full internet. Per-sandbox controls are block-all, CIDR, domain or an upstream proxy. No static egress IP or egress price is published.Daytona docs: Network Limits (Firewall) ↗ Daytona's own wordsdocs-confirmed “Tier 1 & Tier 2: Network access is restricted and cannot be overridden at the sandbox level.” Daytonadocs-confirmed
E2B	No rateno static IP	Yes	Outbound is open by default with documented domain and IP allow and deny rules. No dedicated or static egress IP on any plan, including Enterprise.E2B docs: Internet access ↗ E2B's own wordsdocs-confirmed “there are no dedicated or static egress IP addresses on any plan (including Enterprise).” E2Bdocs-confirmed
InstaBox	100 GiB–50 TiB included	Partly	No general egress allowlist is published; host scoping applies to Secrets, not all sandbox traffic. Each plan includes egress every month (100 GiB Free, 1 TiB Pro, 5 TiB Builder, 50 TiB Team), then $0.02 per GiB. Outbound addresses are not published.InstaBox docs: Limits — outbound bandwidth cap (no allowlist or static IP documented) ↗ InstaBox's own wordspricing-page “$0.02000” InstaBoxpricing-page
Lizard	2 TB per 30 days	Partly	Outbound is open with no documented allowlist. Sandbox egress has no per-GB charge, with 2 TB per account over a rolling 30 days included.Lizard docs: Limits — sandbox egress allowance ↗ Lizard's own wordsdocs-confirmed “Sandbox egress has no separate per-GB charge. The included allowance is 2 TB per account over a rolling 30 days” Lizarddocs-confirmed
Modal	$0.04/GiB	Yes	Open by default, with block-all, CIDR and domain allowlists; DNS leaks past the allowlists. Static IPs come from Proxies on Team and Enterprise. Egress is $0.04/GiB over 1, 10 or 100 TiB by plan.Modal docs: Sandbox networking: outbound access control ↗ Modal's own wordsdocs-confirmed “By default, Sandboxes can make outbound connections to any public IP address.” Modaldocs-confirmed
Morph	Charged, no rate	Not published	Egress is a chargeable component in the terms, but no per-GB rate, allowlist, static IP or filtering is published. Do not assume egress is free. Morph's own wordsdocs-confirmed “Typical components may include but are not limited to compute, snapshot storage, and egress.” Morphdocs-confirmed
Runtime	$5/mo static IP	Yes	internet: false refuses everything, an allow list is allow-list only, and deny always wins. A dedicated outbound address costs $5 a month, and sandboxes reach each other over a private name.Runtime docs: Outbound traffic ↗ Runtime's own wordspricing-page “Dedicated IPv4 \| $5 \| per 30-day month” Runtimepricing-page
Sandboxer	Not billed	Partly	Outbound is open by default with no allowlist product. Traffic shares the node's IPv4 and IPv6 with other sandboxes, so external rate limits are shared.Sandboxer docs: Security: network policy ↗ Sandboxer's own wordsdocs-confirmed “outbound internet is open by default” Sandboxerdocs-confirmed
Sprites	Not metered	Yes	Outbound is unrestricted by default, with an opt-in DNS allowlist applied from outside the Sprite. Bandwidth is not metered.Sprites docs: Networking — Egress policy ↗ Sprites's own wordsdocs-confirmed “Applying one is opt-in and done from outside the Sprite.” Spritesdocs-confirmed
Vercel Sandbox	$0.15/GB	Yes	Firewall rules default to allow-all and can be set per sandbox. Matchers transform requests but never block them, so an allowlist needs an explicit rule.Vercel Sandbox docs: Firewall ↗ Vercel Sandbox's own wordspricing-page “Sandbox Data Transfer \| 20 GB/month \| Included in Flat Rate CDN \| $0.15/GB” Vercel Sandboxpricing-page
Tensorlake	Allow/deny listsfree egress	Yes	allow_out takes domains, leading-wildcard domains, IPv4 addresses and CIDRs; deny_out wins on a conflict. The policy can be swapped on a running sandbox as one atomic change that closes existing connections, and a hostname that will not resolve rejects the update. allow_internet_access=false with an empty allowlist blocks DNS too. Egress is free.Tensorlake docs: Networking — outbound access, allow_out and deny_out ↗ Tensorlake's own wordsdocs-confirmed “values can be domains, leading-wildcard domains like *.example.com, IPv4 addresses, or IPv4 CIDR ranges” Tensorlakedocs-confirmed

The specific capabilities

Each one checked for every provider, with the catch where a version falls short. All capabilities

Outbound network: capabilities by provider
Capability	Agent 37	Blaxel	Boat	boxd	Cloudflare Sandbox	Daytona	E2B	InstaBox	Lizard	Modal	Morph	Runtime	Sandboxer	Sprites	Tensorlake	Vercel Sandbox
Outbound data included	Agent 37: Not published. No rate published	Blaxel: Yes. Included in plan	Boat: Yes. $0	boxd: Not published	Cloudflare Sandbox: Yes. 1 TB a month	Daytona: Not published	E2B: Not published	InstaBox: Yes. 100 GiB free	Lizard: Yes. 2 TB per 30 days	Modal: Yes. 1 TiB, then $0.04	Morph: Not published. Charged, no rate	Runtime: Yes. 100 GiB a month	Sandboxer: Yes. Not billed	Sprites: Yes. Not metered	Tensorlake: Not published	Vercel Sandbox: With a catch. 20 GB a month. Only 20 GB a month is included; beyond that, traffic costs $0.15 a gigabyte.
Allow only some sites	Agent 37: Yes. 100 IPv4 entries	Blaxel: With a catch. Proxy filter. The filter only sees programs that use its settings; anything else gets out unless stricter enforcement is switched on.	Boat: With a catch. Firewall inside. The rules live inside the machine, where the agent has administrator rights and can undo them, and they are lost when the machine is restored.	boxd: Yes. 256 entries	Cloudflare Sandbox: Yes. Hosts or handler	Daytona: Yes. Domain or address list	E2B: Yes. Domain or address list	InstaBox: No. There is no setting that limits which sites a machine may reach.	Lizard: Not published	Modal: Yes. Domain or address list	Morph: Not published	Runtime: Yes. Allow list	Sandboxer: No. There is no allowlist or outbound firewall setting; every machine can reach the whole internet.	Sprites: Yes. Domain list	Tensorlake: Yes. Domains or addresses	Vercel Sandbox: Yes. Domain or address list
Turn the internet off	Agent 37: Yes. deny-all	Blaxel: Not published	Boat: With a catch. Firewall inside. You can block traffic with the machine's own firewall, but the agent has administrator rights there and the rules are lost on restore.	boxd: Yes. Allowlist none	Cloudflare Sandbox: Yes. Off by default	Daytona: Yes. block-all	E2B: Yes. On/off switch	InstaBox: Not published	Lizard: Not published	Modal: Yes. block_network	Morph: Not published	Runtime: Yes. internet: false	Sandboxer: With a catch. Firewall inside. There is no provider setting; you block traffic with the machine's own firewall, which the agent can undo.	Sprites: With a catch. Deny every domain. You can deny every domain by policy, but the machine keeps its network and the rule works by refusing name lookups.	Tensorlake: Yes. --no-internet	Vercel Sandbox: Yes. deny-all
Fixed outgoing IP	Agent 37: Not published	Blaxel: With a catch. Private preview. Dedicated addresses are in a private preview you must ask to join, and can only be attached when a machine is created.	Boat: Not published	boxd: Not published	Cloudflare Sandbox: Not published	Daytona: Not published	E2B: No. There is no dedicated or fixed outbound address on any plan, including Enterprise.	InstaBox: Not published	Lizard: Not published	Modal: With a catch. Team+, 5 addresses. Only Team and Enterprise plans get it, and each account can create one or three gateways holding up to five addresses each.	Morph: Not published	Runtime: Yes. $5 a month	Sandboxer: No. Shared host address. Outbound traffic shares the host machine's address with every other sandbox on it, so other services see one shared address.	Sprites: Not published	Tensorlake: Not published	Vercel Sandbox: Not published

YesWith a catchNoNot publishedHover or select a mark to see the catch.

What outbound data costs

Data the machine sends out. Most agents send little, but a scraper or a file server can send a lot. Not included in the calculator. Every rate card

Provider	Cost	Detail
Agent 37	Not published	Not published: the billing docs meter only compute and disk. Source
Blaxel	Free	Included: Included. Listed as included on the pricing table. Source
Boat	Free	Included: Not billed. Boat says it does not bill egress; no cap is published. Source
boxd	Not published	Not published; do not assume it is free. Source
Cloudflare Sandbox	$0.025 per GiB	Included: 1 TB a month in North America and Europe. $0.04–$0.05 per GB elsewhere, with 500 GB included. Outbound traffic is off unless turned on. Source
Daytona	Not published	Not published: the pricing page lists compute, memory and storage only. Source
E2B	Not published	Not published: the rate table lists vCPU, memory and storage only. Source
InstaBox	$0.02 per GiB	Included: 100 GiB on Free, 1 TiB on Pro, 5 TiB on Builder. Sending is capped at about 50 Mbit/s per machine. Source
Lizard	Allowance, then not published	Included: 2 TB per account over a rolling 30 days. No price is published beyond the allowance; Lizard asks you to contact it first. Source
Modal	$0.04 per GiB	Included: 1 TiB a month on Starter, 10 TiB on Team. Counted across the whole workspace. Source
Morph	Not published	Named as billable in the terms, but no rate is published. Source
Runtime	$0.0215 per GiB	Included: 100 GiB a month per account. $0.02 per decimal GB after that. Source
Sandboxer	Free	Included: Not billed. The pricing FAQ says bandwidth is not billed. Source
Sprites	Free	Included: Not metered. Sprites bandwidth "isn't metered today". Source
Tensorlake	Free	Included: Not billed. Tensorlake lists egress as free. Source
Vercel Sandbox	Allowance, then not published	Included: 20 GB a month on Hobby; bundled into the Flat Rate CDN on Pro. Enterprise pays $0.15 per GB. Downloads into the sandbox are free. Source

Questions to ask before you sign

Each one targets something the documentation does not answer

Is the default open or closed, and does a deny-all rule also block DNS?
Is the allowlist enforced outside the machine, or by a proxy the agent can bypass with a raw socket?
Is there a static egress IP, what does it cost, and is it per sandbox or per account?
Is egress free, metered, or unpublished — and what is the allowance before overage?
Can sandboxes reach each other over a private network, or does everything go out to the internet?

Common questions

Answered from the capability checks; each links to the provider-by-provider detail and its sources

Which sandbox providers offer “outbound data included”?: Data the machine sends out is free or comes with a published allowance. Fully: Blaxel, Boat, Cloudflare Sandbox, InstaBox, Lizard, Modal, Runtime, Sandboxer and Sprites. With a catch: Vercel Sandbox. See each provider's catch
Which sandbox providers offer “allow only some sites”?: Limit which internet addresses the machine can reach. Fully: Agent 37, Cloudflare Sandbox, Daytona, E2B, Modal, Runtime, Sprites, Tensorlake, Vercel Sandbox and boxd. With a catch: Blaxel and Boat. Not at all: InstaBox and Sandboxer. See each provider's catch
Which sandbox providers offer “turn the internet off”?: Run a machine with no internet access at all. Fully: Agent 37, Cloudflare Sandbox, Daytona, E2B, Modal, Runtime, Tensorlake, Vercel Sandbox and boxd. With a catch: Boat, Sandboxer and Sprites. See each provider's catch
Which sandbox providers offer “fixed outgoing IP”?: Traffic leaves from a known IP address that other services can whitelist. Fully: Runtime. With a catch: Blaxel and Modal. Not at all: E2B and Sandboxer. See each provider's catch

Part of Access and network. Next: put two or three providers side by side.