Cloudflare Sandbox SDK vs Vercel Sandbox

Cloudflare Sandbox SDK

Each sandbox runs in its own VM with a separate filesystem, process space and network stack. No hosted API. You deploy and secure a Worker before an agent can call anything, and the starter has no auth.

Vercel Sandbox

Active CPU billing, so waiting on model responses costs only memory. Tied to a Vercel team and project even when called from elsewhere, and access tokens reach the whole team.

Cloudflare Sandbox SDK

1. Derive the sandbox ID from the authenticated user, as the docs advise. IDs aren't secrets
2. Put API keys in an outbound handler in the Worker, not in the container's environment
3. Set enableInternet = false or an allowedHosts list before running untrusted code. Internet access is on by default
4. Check that a restored backup has every directory you expect. Backups of 10 MB or more have open bugs
5. Start new projects on 1.0. The 0.x library only gets fixes until 31 December 2026

Vercel Sandbox

1. Call sandbox.stop() when the task is done. Memory bills until the session ends
2. Use Sandbox.getOrCreate with a name so retries land in the same sandbox
3. Set networkPolicy to deny-all for untrusted code. The default is allow-all
4. Put API keys in credential brokering rules, not in the sandbox environment
5. Pass persistent: false for one-off runs so no snapshot is stored or billed