Vercel Sandbox vs semantic
Vercel Sandbox runs each sandbox in a Firecracker microVM on Vercel's infrastructure. [1] Its firewall supports allow-all, deny-all or a default-deny policy with domains and CIDRs, changeable on a running sandbox. [2]
Vercel brokers credentials: header-injection rules add secrets outside the sandbox, so they never enter it. [2] Semantic also keeps Git tokens and SSH keys on the host, and the gateway uses them only when the policy allows the action.
| Vercel Sandboxmanaged cloud | Semantic (smx)microVM + policy on your machines | |
|---|---|---|
| Isolation | Firecracker microVM, own kernel [1] | One microVM per agent, own kernel |
| Where it runs | Vercel infrastructure only [1] | Managed private beta; on-prem for enterprise (contact us) |
| Egress rules | Allow-all, deny-all or default-deny with domains and CIDRs [2] | Security profiles enforced by host firewall; metadata and link-local always closed |
| Credentials kept out | Credentials brokering via header injection [2] | Git tokens, SSH keys and model sign-ins stay on the host |
| File, Git, SSH permissions | not documented (per-agent Linux users in multi-agent mode) [3] | Per path, repo, branch and SSH host; deny beats allow; enforced on the host |
| Tamper-evident agent log | not documented (command logs) | Hash-chained log of runs, events and refusals; read with smx agent logs |
| Snapshots, pause/resume | Filesystem snapshotted on stop, manual snapshots; memory — [4] | Snapshot, pause and resume with memory, disk and running processes |
| Local hosts (Linux / WSL2 / macOS) | not documented (local development calls Vercel's cloud) [5] | Linux (KVM) and Windows via WSL2; macOS planned |
| License | SDK, CLI and images Apache-2.0; runtime not open source [6] | Proprietary (private beta) |
Which one fits
When Vercel Sandbox fits better
- You want fine-grained HTTP credential brokering with matchers on path, method and headers. [2]
- You already deploy on Vercel and want sandboxes next to your app. [5]
When Semantic fits better
- Code, data and credentials must stay in your environment; on-prem is available for enterprise (contact us).
- Agents work on your repos and you need branch-level Git and per-path file permissions enforced outside the agent.
- You need a tamper-evident log of what the agent did inside the sandbox, including refusals.
Credentials brokering
Vercel's firewall terminates TLS only for domains with transform or forward rules, using a CA unique to each sandbox, and can forward requests to your own proxy. [2] Semantic brokers at the action level: the host performs a Git push or SSH session for the agent when the policy allows it.
Questions
Can Vercel Sandbox run locally?
Local development calls Vercel's cloud. [5] Semantic's smx runs locally on Linux and WSL2.
Does Vercel Sandbox keep memory across stops?
Its docs describe filesystem snapshots; memory snapshots are not documented. [4]
Sources
- Vercel Sandbox concepts · last verified 2026-10-27
- Vercel Sandbox firewall · last verified 2026-10-27
- Vercel Sandbox multi-agent · last verified 2026-10-27
- Vercel Sandbox persistent sandboxes · last verified 2026-10-27
- Vercel Sandbox overview · last verified 2026-10-27
- vercel/sandbox repository · last verified 2026-10-27