Deno Sandbox

Watch the full announcement video on YouTube
Deno Sandbox is an SDK for instantly creating and managing secure, isolated VMs in the cloud on Deno Deploy.
Every Sandbox is an independent Linux microVM.
This means each Sandbox has its own strict permissions, network policies, directories, and isolated secrets—making Deno Sandbox perfect for AI agents, or any other dynamic workload where speed and security are paramount.
Specify who your Sandbox is allowed to talk to, and bind secrets so they're only revealed to approved destinations on the wire.
Sandboxes let you lock down outbound connections, so code can't leak data or phone home, even if it tries to.
Fast to get started and fast to run, Deno Sandbox is built for performance. New sandboxes spin up in milliseconds—almost faster than you can even think about it.
Expose your dev server over HTTP for live previews in any browser.
Connect to your sandbox via SSH with a single command.
Instantly access a disposable editor for demos or remote debugging
Each Deno Sandbox is a lightweight Linux microVM running on Deno Deploy, that you control via a simple API.
Each sandbox is fully isolated ,with its own filesystem, network stack, and process tree. You can control sandboxes programmatically using the Deno Sandbox SDK.
Each sandbox runs in its own Firecracker microVM—the same technology that powers AWS Lambda. See our security documentation for details on outbound network filtering and secret management.
All outbound connections route through a proxy where your security policy is enforced. You control exactly which hosts your code can reach.