Access and network
Putting an agent behind your own hostname is a feature some providers sell, some leave to a proxy you run, and several do not offer at all.
A custom domain is an HTTPS hostname you control, pointed at a port inside the sandbox. It matters when the URL is the product: a client-facing demo, a webhook receiver, or an agent whose address should not be a provider subdomain that changes.
There are three levels. Native: the provider issues a certificate for your hostname and routes it. Do-it-yourself: the provider gives you a stable hostname and you put your own proxy in front. Absent: no documented path, and the preview URL is what you have.
The differences are in the details: whether you can delegate a subdomain or must move a whole domain's nameservers, whether certificates are automatic, and whether the domain survives a resume.
The claim on the left, the provider's own words on the right
Runtime routes a sandbox's web port at your hostname with HTTPS. boxd lets you point one domain at a machine or delegate a wildcard subdomain to the whole organisation, and issues certificates automatically. Blaxel's preview URLs support optional auth and custom domains.
“boxd verifies your DNS and issues TLS certificates automatically.”
Sandboxer calls first-class custom domains a roadmap item and documents a CNAME plus your own TLS termination. E2B's guide sets up a customer-operated GCP VM running Caddy and Cloudflare DNS to proxy requests to the sandbox. Boat explicitly does not support custom domains.
“We will set up a GCP VM running Caddy server with Docker and Cloudflare DNS to proxy the requests to the Sandboxes.”
InstaBox, Morph, Sprites and Vercel Sandbox publish no sandbox custom-domain feature. InstaBox's API has no customDomain or cname field and its URL is a fixed vendor subdomain; a community report says Sprites lack custom domains the way regular Fly VMs have them; Vercel's domains apply to deployments, not Sandbox ports. For these, the honest answer is that no native path is published.
The details that decide the answer in practice
Whether you must move a whole domain's nameservers or can delegate one subdomain.
Whether the certificate is issued automatically.
Whether the domain survives a stop and resume, or must be re-pointed.
Whether the feature is native or a proxy you operate.
Whether the domain is for sandboxes or only for deployed apps.
Docs read 28 October 2026
| Provider | Does it? | What that means |
|---|---|---|
| Agent 37 | Yes | Custom domains are supported, but only by delegating a whole dedicated domain's nameservers; a subdomain of an existing domain cannot be registered. |
“Custom domain | https://{label}.yourdomain.com mirrors all of the above” | ||
| Blaxel | Yes | Preview URLs back a running sandbox with optional auth and custom domains. |
“Render an application in real-time through a direct preview URL backed by a running Blaxel sandbox, with optional auth and custom domains.” | ||
| Boat | No | Custom domains are explicitly unsupported. A CNAME to an on.boat.dev name does not work, and certificates are issued only for on.boat.dev names. |
“boat does not support custom domains.” | ||
| boxd | Yes | Point one domain at a machine or delegate a wildcard subdomain to the organisation; boxd verifies DNS and issues TLS certificates automatically. |
“boxd verifies your DNS and issues TLS certificates automatically.” | ||
| E2B | Partly | No native custom domain. The documented path is a customer-operated GCP VM running Caddy and Cloudflare DNS in front of the sandbox. |
“We will set up a GCP VM running Caddy server with Docker and Cloudflare DNS to proxy the requests to the Sandboxes.” | ||
| InstaBox | Not published | No custom-domain support is published. The public-port URL is a fixed vendor subdomain, and the OpenAPI PublicPort object has only port, name, url and machineId, with no customDomain or cname field. No roadmap entry exists. |
“The URL is https://<port>-<machine id without m_>.<domain>/.” | ||
| Lizard | Partly | Custom domains are documented for deployed app services, not for sandbox preview URLs. A sandbox preview stays on the provider's hostname. |
“You get https://<sandbox-id>-3000.sandbox.<region>.onlizard.com/?lizard_token=…” | ||
| Morph | Not published | No custom-domain feature appears in the documentation, API or terms. An HTTP service can be exposed, but it is served on a provider hostname. |
“Expose Http Service” | ||
| Runtime | Yes | A sandbox's web port can run at your own hostname with HTTPS, verified by DNS records and a certificate from Let's Encrypt. |
“Custom domain: a sandbox's web port at your own hostname, with HTTPS.” | ||
| Sandboxer | Partly | First-class custom domains are on the roadmap; the documented workaround is a CNAME to the hosted hostname with your own TLS termination. |
“First-class custom domains are on the roadmap.” | ||
| Sprites | Not published | No native custom-domain support is documented. A community report from April 2026 says Sprites lack custom domains and certificates the way regular Fly VMs do; current support was not confirmed, so treat a proxy as the only known path. |
“Sprites don’t have custom domains and certs the way regular Fly VMs do.” | ||
| Vercel Sandbox | Not published | Attaching a customer's own domain to a Sandbox port was not confirmed. Vercel domains apply to deployments, a different product; ask whether a separately managed proxy is supported. |
“Run untrusted or agent-generated code in isolated Linux microVMs.” | ||
Part of Access and network. Next: put two or three providers side by side.