A sandbox without a network boundary is only half a sandbox
Vercel introduces a sandbox firewall to enforce network boundaries for untrusted code, addressing risks of data exfiltration and unauthorized access even when compute isolation is intact.
Running untrusted code safely requires both compute isolation and network control. A microVM alone cannot prevent data exfiltration, internal network probing, or credential misuse if outbound traffic remains unrestricted. Without a network boundary, untrusted code may bypass containment by sending data to external servers or scanning internal systems, rendering compute isolation insufficient for containment.
Recent research highlights that untrusted code can exploit overlooked network paths—such as DNS resolvers, misconfigured allowlists, or trusted package services—to escape containment. These are not compute escapes but bypasses where the security boundary fails despite intact VM or container boundaries. Practical containment requires accounting for every possible communication channel, including DNS, proxies, and internal networks.
A fully disconnected sandbox is impractical for many workloads, such as AI agents needing repository access or dependency installation. Instead, granular network policies should grant only the connectivity a workload requires. Policies must support domain-based rules, CIDR-based restrictions, and temporary access, denying unmatched traffic by default to minimize attack surfaces.
The Vercel Sandbox firewall enforces these policies outside the microVM, inspecting TLS handshake SNI and destination addresses to validate connections against domain and CIDR rules. Linux networking redirects traffic transparently, ensuring workloads do not require proxy configuration while maintaining original destination integrity.