Cloudflare Sandbox SDK vs Morph Cloud

Cloudflare Sandbox SDK

Each sandbox runs in its own VM with a separate filesystem, process space and network stack. No hosted API. You deploy and secure a Worker before an agent can call anything, and the starter has no auth.

Morph Cloud

Pause and snapshot keep memory and running processes, and one call branches an instance into several copies. A public OpenAPI file covers 69 operations. No terms of service, privacy policy or security page was found, the free plan includes no compute credit, and the changelog holds one entry from November 2024.

Cloudflare Sandbox SDK

1. Derive the sandbox ID from the authenticated user, as the docs advise. IDs aren't secrets
2. Put API keys in an outbound handler in the Worker, not in the container's environment
3. Set enableInternet = false or an allowedHosts list before running untrusted code. Internet access is on by default
4. Check that a restored backup has every directory you expect. Backups of 10 MB or more have open bugs
5. Start new projects on 1.0. The 0.x library only gets fixes until 31 December 2026

Morph Cloud

1. Set ttl_seconds and ttl_action when starting an instance. Nothing in the docs stops an instance with no TTL from billing MCUs
2. Pass auth_mode: api_key when exposing an HTTP service. The default is none, which makes the URL public
3. Enable wake_on_ssh before calling exec on an instance that may be paused. There is no separate exec wake setting
4. Use /api/instance/list and /api/snapshot/list with page and limit (default 50, maximum 1,000). The plain list routes return everything
5. On a 503 from snapshot, branch, pause or reboot, wait for the Retry-After value before repeating the call