Deno Sandbox vs Microsoft Execution Containers

Deno Sandbox

Secrets stay outside the microVM and are substituted only on outbound requests to approved hosts, and an allowlist limits egress. The service is still in beta, sandboxes need the $20 Pro plan, lifetime is capped at 30 minutes, and no sandbox operation appears in the published OpenAPI document.

Microsoft Execution Containers

MXC puts nine operating-system sandbox backends behind one typed request, with network access denied by default and a JSON Schema for the stable 1.0.0 contract. Version 1.0.0 is two days old as of 8 October 2026. Enforcement varies by backend, and isolation_session cannot restrict networking at all.

Deno Sandbox

1. Set DENO_DEPLOY_TOKEN to an organisation token (prefix ddo_) from Settings in console.deno.com. The organisation must be on Pro or above
2. Pass allowNet on every Sandbox.create(). The Security page says outbound access is unrestricted when it is omitted
3. Pass credentials through secrets with a hosts list, not env, so code in the VM sees only a placeholder
4. The default timeout ends the VM when the client disconnects. Pass a duration such as "10m" and reconnect with Sandbox.connect({ id }), up to 30 minutes
5. Create volumes in ord and start the sandbox in ord. A volume mounts only in its own region
6. exposeHttp URLs are public with no authentication. Treat the random subdomain as a secret

Microsoft Execution Containers

1. Import from @microsoft/mxc-sdk/v1. The package root exports nothing.
2. Call getPlatformSupport() first and stop if isSupported is false. getAvailableBackends() is advisory and launch-time validation still applies.
3. Set network.egress.default to allow only when the task needs it. Omitted network policy resolves to deny in every direction.
4. Never pass --audit to an executor for untrusted code. It turns off all sandbox security for the workload.
5. Read ExecutionResult.warnings after each run. Security warnings arrive there and are not written to stdout or stderr.