vercel-sandbox

Use @vercel/sandbox to run untrusted code in a separate Firecracker microVM instead of in-process options like vm2, which have known escapes. Create a sandbox with Sandbox.create(), run commands with runCommand, and call stop() in a finally block.

Pass the port in the ports array at create time, start your server bound to 0.0.0.0 rather than 127.0.0.1, then read the public URL with sandbox.domain(port). Poll until the port answers inside the VM before using the URL.

Yes. On Vercel it authenticates automatically via OIDC, but locally you run vercel link and vercel env pull for a VERCEL_OIDC_TOKEN, and in CI you set VERCEL_TOKEN, VERCEL_TEAM_ID, and VERCEL_PROJECT_ID.

runCommand invokes a binary directly with no shell, so pipes, redirects, &&, and globs do not work. Wrap such commands in bash -c, and note that non-zero exit codes do not throw, so check result.exitCode.

Use credential brokering: set a networkPolicy allow-list for the target domain with a transform rule that injects the authorization header at the egress firewall. The VM never holds the secret and cannot reach other TLS hosts.

Sessions last up to 45 minutes on Hobby and 24 hours on Pro and Enterprise, with 1 to 32 vCPUs depending on plan, 15 ports, and 64 GB disk. Persistent sandboxes resume into new sessions, so total lifetime is effectively unbounded.