Vercel Sandbox vs Cloudflare Sandbox
Vercel Sandbox and Cloudflare Sandbox run untrusted or AI-generated code in isolated environments. The choice depends on lifecycle, networking, and application-platform fit.
- Vercel Sandbox runs each environment in a Firecracker microVM. Cloudflare Sandbox runs a Linux container in its own VM, with Workers and Durable Objects providing the application and lifecycle layers.
- Vercel Sandbox provides TypeScript and Python SDKs plus a CLI. Cloudflare Sandbox provides a TypeScript SDK built around Workers and Durable Objects.
- Vercel Sandbox automatically snapshots and restores persistent sandboxes. Cloudflare Sandbox uses R2-backed backups or mounted object storage when state must survive a container restart.
- Both use active-CPU pricing, but the complete bills include different memory, storage, networking, and platform charges.
- Northflank is worth considering when you need GPU sandboxes, self-serve BYOC, customer-VPC deployment, persistent volumes, or a platform that carries agent-generated code through preview, staging, and production environments.
If you need to run isolated CPU or GPU workloads at enterprise scale, Northflank Sandboxes combine workload-specific microVM or gVisor isolation, persistent volumes, databases, jobs, APIs, and GPU workloads on one platform. Deploy on Northflank Cloud or use self-serve BYOC across your cloud accounts, on-premises, and bare-metal infrastructure. Northflank Sandboxes start in 65 ms sequentially and 158 ms under concurrent burst load, with 100% success in ComputeSDK’s latest benchmarks.
Get started (self-serve), or book a demo to discuss enterprise infrastructure, security, or compliance requirements
Northflank is a broader platform, so some rows cover platform capabilities.
| Category | Vercel Sandbox | Cloudflare Sandbox | Northflank |
|---|---|---|---|
| Isolation | Firecracker microVM | Linux container in its own VM | MicroVMs or gVisor, depending on workload and deployment |
| Interface | TypeScript SDK, Python SDK, and CLI | TypeScript SDK from Workers | JavaScript client, API, CLI, UI, and GitOps |
| Environment | Built-in Node.js and Python runtimes or a custom OCI image stored in VCR | Node.js and Python base or a custom Dockerfile | Any public or private container image |
| Docker | Elevated Docker engine inside the microVM | Rootless Docker-in-Docker with restrictions | Container-image deployment |
| Persistence | Automatic snapshot and restore for persistent sandboxes | R2 backups or S3-compatible mounts | Persistent volumes with scale-to-zero |
| Deployment | Vercel-managed infrastructure | Cloudflare infrastructure with regional placement controls | Northflank Cloud or self-serve BYOC/customer VPC |
| Best for | Ephemeral execution of untrusted or AI-generated code with built-in runtimes | Workers-native sandbox applications using Durable Objects and R2 | Running untrusted code and AI agents at production scale with microVM isolation, GPUs, persistent environments, high concurrency, and deployment on Northflank managed Cloud or in your own cloud |
Vercel exposes Sandbox as a directly consumable compute resource through TypeScript and Python SDKs or a CLI. Each environment runs inside a Firecracker microVM with its own filesystem and network.
Cloudflare Sandbox is designed around Workers, Durable Objects, and Containers. Each Linux container runs in its own VM; a Durable Object provides identity and lifecycle coordination, and a Worker supplies the application-facing interface.
Cloudflare Sandbox sessions are shell contexts inside the same sandbox, not separate security boundaries. They can keep different working directories and environment variables, but they share the sandbox filesystem and process space. Different untrusted users should therefore receive different sandboxes.
Neither architecture label declares a security winner. Review the workload, network and credential controls, and tenant boundary for your threat model.
Vercel Sandbox includes Node.js 22, 24, and 26 plus Python 3.13. It supports system packages, an elevated Docker daemon, and custom OCI-format images stored in Vercel Container Registry. Custom-image support is currently in public beta as of July 2026.
Cloudflare Sandbox includes Node.js, Python, common development tools, and Dockerfile customization. Docker-in-Docker is rootless, without privileged containers or iptables networking.
Vercel Sandbox SDKs cover commands, files, snapshots, and lifecycle operations, while its CLI supports manual workflows. Runtime network policies and egress credential injection help control untrusted processes.
Cloudflare Sandbox adds Git operations, background processes, code interpreters, browser terminals, filesystem watching, mounts, and backups. Outbound Workers can control requests and inject credentials.
Vercel Sandbox exposes up to 15 ports through sandbox URLs. Cloudflare Sandbox provides preview URLs plus temporary quick tunnels and stable named tunnels.
Vercel Sandbox separates a persistent sandbox from its current VM session. Persistent sandboxes automatically save filesystem state when a session stops and restore it on resume. This uses snapshots, whose default retention is 30 days after last use. Vercel Drive serves data with an independent or shared lifecycle.
Cloudflare Sandbox retains state while its container is active. It sleeps after ten idle minutes by default and prevents automatic sleep until the application disables it or destroys the sandbox. A fresh container does not retain local state.
Cloudflare Sandbox can back up directories to R2 or mount R2 and other S3-compatible stores. Persistence is explicit rather than part of the default stop-and-resume flow.
Northflank attached volumes survive restarts and pauses. Scaling to zero pauses compute billing while retaining configuration and volume data. See Sandboxes on Northflank
The rates below were current on July 22, 2026. Each platform meters a different combination of resources, so compare the complete workload rather than a single CPU rate.
| Cost | Vercel Sandbox Pro | Cloudflare Sandbox | Northflank Cloud |
|---|---|---|---|
| Starting point | Pro includes a monthly usage credit | $5/month Workers Paid | Consumption-based |
| CPU | $0.128 per active CPU-hour | $0.000020 per active vCPU-second after 375 included vCPU-minutes | $0.01667 per vCPU-hour |
| Memory | $0.0212 per provisioned GB-hour | $0.0000025 per provisioned GiB-second after 25 included GiB-hours | $0.00833 per GB-hour |
| Storage | $0.08 per GB-month for snapshots | $0.00000007 per provisioned GB-second after 200 included GB-hours | $0.15 per GB-month for SSD disk |
| Network | $0.15 per GB of billable transfer | $0.025 per GB in North America and Europe after 1 TB; other regional rates apply | $0.06 per GB egress; ingress is free |
Vercel Sandbox also meters sandbox creations, while Cloudflare Sandbox adds separate Workers, Durable Objects, and logging charges. Both bill active CPU, but memory and storage are calculated differently, so the headline CPU rates are not directly comparable.
Northflank prorates managed-cloud usage to the second, with optional GPU plans starting at $0.80/hour. For BYOC, you pay your cloud provider for infrastructure and Northflank for platform resources. See Northflank pricing for current compute, storage, network, GPU, and BYOC rates.
Vercel Sandbox supports up to 4 vCPUs/8 GB RAM on Hobby, 8/16 GB on Pro, and 32/64 GB on Enterprise. The runtime timeout defaults to five minutes. One session can reach 45 minutes on Hobby or 24 hours on Pro and Enterprise, while a persistent sandbox can span sessions through snapshots.
Vercel Sandbox concurrency is 10 on Hobby and 2,000 on Pro. Each sandbox has 32 GB of ephemeral NVMe storage, and sandbox sessions currently only run in the iad1 region.
Cloudflare Sandbox predefined and custom self-serve types reach 4 vCPUs, 12 GiB memory, and 20 GB disk; larger types require contacting Cloudflare. Workers Paid is required, and local state needs external persistence.
Cloudflare Sandbox can apply container placement constraints across eastern and western North America and Europe, with EU and FedRAMP jurisdiction options. For a global application, region-specific sandbox IDs prevent every user from being routed back to one sandbox location.
If your workload requires GPUs or self-serve BYOC, Northflank supports GPU sandboxes on managed infrastructure and deployment into your own cloud account. See GPUs on Northflank and Sandboxes on Northflank.
Choose Vercel Sandbox when you want a standalone sandbox API with TypeScript, Python, and CLI access. It is a good fit for automatic filesystem restoration, elevated Docker workflows, runtime-updatable network policies, and workloads that fit its explicit session and resource limits.
Choose Cloudflare Sandbox when your application already uses Workers, Durable Objects, R2, or Cloudflare networking. Its code interpreters, outbound Workers, terminals, storage mounts, tunnels, and regional placement controls are especially useful when sandbox execution is one part of a Workers-native application.
Northflank Sandboxes cover more than isolated command execution. You can run CPU or GPU sandboxes on Northflank Cloud, deploy them self-serve into your own cloud account, or place them inside a customer's VPC. The same platform can run APIs, workers, jobs, databases, inference, and training workloads alongside the sandbox fleet.
That broader lifecycle becomes useful when an agent produces code that must move beyond execution. Northflank can build from Git, create full-stack preview environments for pull requests, and promote approved changes through staging and production workflows. RBAC, audit logs, secrets, SSO, workload identities, and deployment controls support platform teams that need governance around that path.
Northflank Skills let Claude Code, Codex, Gemini CLI, and Cursor configure sandboxes, deploy services, manage databases, and create preview environments through the Northflank API and CLI. This gives coding agents a route from an isolated task environment to a controlled application platform.
cto.new moved its AI coding sandboxes to Northflank in a few days. During launch, the platform handled thousands of daily deployments and more than 30,000 signups, with the team reporting no infrastructure problems.
Get started with Northflank (self-serve), or book a demo if you would like to discuss your sandbox architecture with the team.
Vercel Sandbox is a Firecracker microVM exposed through SDKs and a CLI. Cloudflare Sandbox runs a Linux container in its own VM, coordinated by a Durable Object and controlled from a Worker.
Vercel Sandbox automatically snapshots and restores persistent sandboxes. Cloudflare Sandbox uses explicit R2 backups or mounted object storage. Northflank can retain state on persistent volumes when a sandbox restarts or scales to zero.
Vercel Sandbox supports an elevated Docker daemon inside its microVM. Cloudflare Sandbox supports rootless Docker-in-Docker without privileged containers or iptables-dependent networking.
Northflank provides GPU sandboxes on managed infrastructure and BYOC clusters, with self-serve deployment into customer cloud accounts. Vercel Sandbox and Cloudflare Sandbox do not list GPU or self-serve BYOC as Sandbox capabilities.
- GPU sandboxes: isolation models and platform support: Compare isolation and deployment options for GPU-backed execution.
- AI sandbox pricing: Compare how sandbox billing models affect production cost.
- How to sandbox AI agents: Review microVM, gVisor, networking, and credential considerations.
- Agent Sandbox on Kubernetes: Learn how isolated agent environments run on Kubernetes in production.
- How to use agentic AI in your SDLC: Connect sandbox execution to preview, release, and governance workflows.
