Deno Sandbox vs Morph Cloud

Deno Sandbox

Secrets stay outside the microVM and are substituted only on outbound requests to approved hosts, and an allowlist limits egress. The service is still in beta, sandboxes need the $20 Pro plan, lifetime is capped at 30 minutes, and no sandbox operation appears in the published OpenAPI document.

Morph Cloud

Pause and snapshot keep memory and running processes, and one call branches an instance into several copies. A public OpenAPI file covers 69 operations. No terms of service, privacy policy or security page was found, the free plan includes no compute credit, and the changelog holds one entry from November 2024.

Deno Sandbox

1. Set DENO_DEPLOY_TOKEN to an organisation token (prefix ddo_) from Settings in console.deno.com. The organisation must be on Pro or above
2. Pass allowNet on every Sandbox.create(). The Security page says outbound access is unrestricted when it is omitted
3. Pass credentials through secrets with a hosts list, not env, so code in the VM sees only a placeholder
4. The default timeout ends the VM when the client disconnects. Pass a duration such as "10m" and reconnect with Sandbox.connect({ id }), up to 30 minutes
5. Create volumes in ord and start the sandbox in ord. A volume mounts only in its own region
6. exposeHttp URLs are public with no authentication. Treat the random subdomain as a secret

Morph Cloud

1. Set ttl_seconds and ttl_action when starting an instance. Nothing in the docs stops an instance with no TTL from billing MCUs
2. Pass auth_mode: api_key when exposing an HTTP service. The default is none, which makes the URL public
3. Enable wake_on_ssh before calling exec on an instance that may be paused. There is no separate exec wake setting
4. Use /api/instance/list and /api/snapshot/list with page and limit (default 50, maximum 1,000). The plain list routes return everything
5. On a 503 from snapshot, branch, pause or reboot, wait for the Retry-After value before repeating the call