Vercel Sandbox adds Secure Compute for dedicated networking
Vercel Sandbox now supports Secure Compute, letting teams connect their sandboxes to a dedicated network. Outbound public-internet traffic leaves through the network's static IPs, and sandboxes can reach private resources in an AWS VPC through VPC peering.
- Vercel Sandbox can now connect to a team's Secure Compute dedicated network.
- Public-internet traffic exits through the network's static IPs, and sandboxes can reach private AWS VPC resources via VPC peering.
- Networks are set with a networkId in code or the --network-id flag in the CLI.
- Existing sandboxes can change networks with sandbox.update(), effective from the next session.
- Available to Enterprise teams with Secure Compute.
What the integration does
According to Vercel, connecting a sandbox to a Secure Compute network gives it two networking properties. First, traffic headed to the public internet exits through the static IPs of the team's dedicated network. Second, the sandbox can reach private resources inside an AWS VPC by way of VPC peering.
Static outbound IPs matter for teams whose external services only accept requests from known addresses. VPC peering matters for workloads that need to talk to resources that are not exposed publicly. The source does not describe specific use cases beyond these two capabilities.
How to attach a sandbox to a network
Vercel says a sandbox can be attached to a network either in code or through the CLI. In code, developers pass an existing Secure Compute network ID when creating the sandbox. The example in the announcement uses the @vercel/sandbox package and sets a networkId option inside Sandbox.create.
In the CLI, the sandbox create command accepts a --network-id flag followed by the network ID value. Vercel's example runs npx sandbox@latest create --network-id your_network_id_here.
Both routes require a Secure Compute network to exist already, since the sandbox is pointed at an existing network ID rather than creating a new network.
Changing networks on existing sandboxes
Sandboxes that already exist can be attached to a network or moved to a different one with sandbox.update(). Vercel notes that the change takes effect on the next session. A session that is already running keeps its current network until it stops.
This means an update does not interrupt active work. Teams that switch a sandbox's network should expect the new setting to apply only once the current session ends and a new one begins.
Availability and what it means
The feature is available to Enterprise teams that have Secure Compute. Vercel points readers to the Sandbox documentation for more detail.
For those teams, the update brings sandbox workloads under the same dedicated network setup they may already use for other Vercel resources, with predictable outbound IPs and private access to AWS VPC resources. Teams without Secure Compute or an Enterprise plan are not covered by this announcement.
Vercel: Vercel Sandbox now supports Secure Compute
