How Notion Workers run untrusted code at scale with Vercel Sandbox
By Steven Van ·
Notion built its custom-agent Workers on Vercel Sandbox, isolating each run in its own Firecracker microVM with brokered credentials.
Notion Workers extend Notion's Custom Agents with code that syncs external data, triggers automations, or calls other APIs, and that code can come from any third-party developer or agent, running on behalf of a user inside an enterprise workspace. To isolate it, Notion built Workers on Vercel Sandbox.
Each Worker runs in its own ephemeral Firecracker microVM, booting its own kernel with its own filesystem and network stack, so one Worker can't access another's data or state. Credentials a Worker needs for external services are injected into outbound requests through a proxy rather than exposed inside the sandbox, and network policies control which services a Worker can reach. Sandbox also snapshots and restores filesystem state to keep cold starts fast, and its billing model is built for agent workloads with low CPU utilization.
