A sandbox without a network boundary is only half a sandbox
By Steven Van ·
Running untrusted code safely requires more than separating it from the host. You also have to control what that code can reach.
Vercel has published a detailed look at the network controls built into Vercel Sandbox, arguing that isolating untrusted code in a microVM only solves half the security problem: without control over outbound network access, that code can still exfiltrate data, probe internal services, or misuse credentials available inside the environment.
The Sandbox firewall runs on the host, outside the microVM, so code inside cannot modify or disable it. Outbound TCP connections and DNS queries are transparently redirected through the firewall, with no proxy configuration needed in the workload. For domain-restricted connections, the firewall reads the Server Name Indication in the TLS handshake to check the requested hostname against a domain policy, and separately checks the destination address against a CIDR policy. Ordinary allowed connections pass through undecrypted.
- Policies can combine domain rules with allowed and denied IP ranges, and can deny unmatched traffic by default; DNS traffic is filtered against the same domain policy.
- Connectivity can change during a workload's lifecycle, for example allowing package registry access during setup, then removing it before untrusted generated code runs.
- For configured domains, the firewall can selectively terminate TLS using a certificate authority unique to the sandbox, then inject or replace an authentication header before forwarding the request, so credentials never enter the microVM or leave the host unencrypted. The certificate authority is disposed of when the sandbox stops.
- Injected credentials can be scoped further by path, method, query, or request headers, so generated code can be allowed to submit results to one endpoint without gaining access to read other resources on the same API.
Vercel says request forwarding also lets developers put their own policy in the path, for cases where a workload needs to inspect payloads, enforce business rules, or record an audit trail rather than rely on a static allowlist. Full detail is in the announcement.
