Deno Sandbox

Executive Summary

Deno Sandbox provides on-demand Linux environments in Deno Deploy. Each sandbox runs in a Firecracker microVM, controlled remotely through an SDK or API. Its distinctive combination is compute isolation, destination-specific credential substitution, and a path from development work to a Deno Deploy application.^[1][2]

It belongs in the AI agent sandbox comparison. This is a managed service for builders assembling execution workflows, not a local Deno process with a restrictive command-line flag.

---

Product Overview

The SDK offers file operations, subprocess execution, a stateful JavaScript REPL, HTTP exposure, SSH, and a browser-based VS Code instance. These are remote execution interfaces; the SDK's supported client runtime does not limit the guest to JavaScript.^[5]

A minimal setup uses npm install @deno/sandbox and a Deploy organization token in the caller's DENO_DEPLOY_TOKEN. With Node.js 24+ and an ES module, a deliberately small workflow is:^[6]

import { Sandbox } from "@deno/sandbox";

await using sandbox = await Sandbox.create({
  allowNet: [],
});
console.log(await sandbox.sh`uname -s`.text());

The token belongs in the trusted caller. This example creates a guest without permitted outbound destinations, runs one command, and closes its session when the scope ends. It was checked against the documented APIs, not executed for this report.^[7][5][8]

---

Technical Architecture

Compute and credential boundaries

The microVM separates guest execution from the hosting system. Deno's own runtime permissions can provide another layer for TypeScript and JavaScript workloads; they are not the boundary for arbitrary guest binaries.^[2]

The secrets API gives guest code a placeholder and substitutes the actual value for requests to configured hosts. This differs from setting a normal environment variable through the SDK: its environment API explicitly demonstrates that code can read the injected value. Use the intended credential mechanism, and avoid putting the Deploy control-plane token inside the guest.^[7][5][6]

An allowNet policy accepts hostnames, wildcard subdomains, IP addresses, and optional ports. Omit it and outbound access is unrestricted. A destination rule controls reachability; it does not decide whether an authorized API operation is appropriate.^[7]

Lifecycle and persistent files

Default lifetime follows the client session. Duration-based timeouts allow reconnection after the client closes, and the API can extend a running timeout. The overview still lists a 30-minute limit; this review did not verify a longer contractual allowance. Design around the documented limit and confirm account-specific requirements before choosing it for long jobs.^[8][3]

Volumes hold writable data independently of a particular VM. Snapshots provide reusable filesystem images, and a writable volume can be created from a snapshot. The documented preparation path starts from builtin:debian-13, installs tools into a bootable volume, snapshots it, and uses that snapshot as another sandbox's root.^[4]

The volume guide currently restricts provisioning to Chicago, with a 300 MB–20 GB capacity range and one sandbox attached to a writable volume at a time. Snapshots can be reused concurrently, but must match the sandbox region. These are filesystem facilities; the reviewed material does not establish memory/process checkpoint recovery.^[4]

---

Strengths

• A complete Linux execution interface. Shell, files, processes, previews, and remote debugging cover more than evaluating a code string.^[5]
• Explicit persistence workflow. Prepared roots and writable volumes separate repeatable toolchains from changing data.^[4]
• Integrated deployment path. Deno documents promoting sandbox work into a Deploy application, useful when that is already the intended hosting destination.^[2]
• Several client languages. The Python SDK complements the JavaScript/TypeScript clients.^[3]

---

Cautions

• Raw-key protection is not action approval. Code can still exercise authority granted through a credential proxy. Simon Willison highlighted that distinction in the launch discussion; scope provider credentials and permitted operations accordingly.^[9]
• Published limits conflict. The older overview says five concurrent sandboxes per organization during pre-release. The current pricing table instead lists three per region on Pro and twenty on Builder. Budget using the plan table and verify the actual account quota; do not present the old five-instance value as universal.^[3][10]
• Durability requires preparation. Files on the default ephemeral disk disappear with the VM; a volume must be explicitly mounted for data intended to survive.^[7]
• Bun is not a supported SDK client. The package README identifies a WebSocket compatibility issue; a generic “JavaScript supported” label would hide that limitation.^[5]
• Startup claims are vendor measurements. The product advertises sub-200 ms starts, but this review did not reproduce that result or compare a matched workload across providers.^[1]

---

What Developers Say

In a February 9, 2026 Hacker News follow-up, nihakue confirmed an earlier missing CLI option had been fixed. They still found bootable-volume and snapshot commands awkward, but described the resulting SSH-and-Claude workflow positively. That is a useful account of setup friction and eventual success, not proof that the original defect remains today.^[11]

The launch discussion also examined credential substitution. Willison's warning about permitted actions is a design observation, not a reported escape. This review found no representative reliability or adoption measurement in the material inspected; no service trial or attack testing was performed.^[9]

---

Pricing & Licensing

Current public USD terms checked September 15, 2026:^[10][1]

Pro includes shared Deploy allowances of 50 CPU-hours, 750 memory GiB-hours, and 5 GiB of volume storage; Builder includes 500, 7,500, and 50 respectively. Sandbox compute shares the plan's CPU, memory, and egress meters. An idle CPU does not make allocated memory or retained storage free.^[10]

The February launch post carries older rates and allowances. They are historical, not the prices used above. The JavaScript SDK is MIT licensed, but that does not make the hosted service free or establish a self-hostable version of the service.^[2][5]

---

Competitive Positioning

Evaluate E2B, Sprites, and Vercel Sandbox against the same workload: process lifetime, persistent files, credential handling, region requirements, and total monthly cost. Deno's deployment integration is most relevant when the resulting application belongs on Deno Deploy.

Disclosure: Ry Walker is CEO and co-founder of Tembo. Tembo addresses the broader choice of a managed or self-hosted coding-agent platform, including isolated VM sessions, repository and ticket integrations, shared sessions, and review workflows. Deno Sandbox supplies execution primitives for a builder to assemble into a system. Tembo is relevant when a team wants that workflow already included; no integration between the products is asserted.^[12]

---

Ideal Customer Profile

Best fit: builders who need programmatic Linux execution, can make persistence explicit, and value the connection to Deno Deploy.

Poor fit: a free-tier requirement, long uninterrupted jobs beyond verified limits, or a storage topology incompatible with documented volume regions and attachment rules.

---

Viability Assessment

The product has public documentation, SDK packages, a commercial plan table, and user reports of real development workflows. Those establish availability, not a product-specific adoption total. The beta launch label and inconsistencies between overview limits and current pricing make quota and lifecycle verification part of evaluation.^{[2][5][10][11]}

---

Bottom Line

Deno Sandbox offers a coherent set of cloud execution, credential, storage, and deployment tools. Its value depends on how those controls match the workload, especially where state must survive and which external operations the agent may perform.

Recommended for: API-driven agent execution with explicit lifecycle and storage design.

Not recommended for: treating placeholder secrets as permission control or assuming old launch prices and limits still apply.

Outlook: check current account quotas, documented lifetime, and volume availability in a measured pilot before scaling.

---

Research by Ry Walker Research • methodology