WebContainers
StackBlitz's browser-based Node.js runtime: an operating system in WebAssembly that boots in a browser tab, runs npm/pnpm/yarn and dev servers client-side, and is free for open source with a commercial licence for production use. The reference in-browser Node.js runtime for client-side agent code execution, not a substitute for a server-side Linux sandbox.
Overview
WebContainers are StackBlitz's "browser-based runtime for executing Node.js applications": a WebAssembly-based operating system that boots inside a browser tab, runs the native npm, pnpm and yarn, and serves dev servers to an in-page preview. The @webcontainer/api package exposes WebContainer.boot(), fs, mount() and spawn(); only one instance can boot per page, and the host page must be cross-origin isolated (COOP/COEP headers). Chromium browsers are fully supported, Safari 16.4+ is in beta and Firefox is alpha. StackBlitz markets it for AI as a "secure agent runtime" where agents "install packages, write files, and execute code" with "zero compute costs, and zero virtual machines".
Isolation is the browser's own sandbox — the code runs on the end user's CPU, so nothing touches a server — which makes it a client-side execution environment rather than a cloud sandbox. Only JavaScript/TypeScript tooling runs: there is no Linux kernel, no native binaries and no Python beyond what can be ported to Wasm. The runtime is proprietary: it is "Always free for Open Source" and for prototypes, but production use in a for-profit setting requires a commercial licence (configured with configureAPIKey), priced on request; Enterprise adds self-hosted/VPC installation and SAML SSO.
Notable
- Licensing: free for open source and prototypes; production commercial use requires an API key and licence; pricing on request.
- Browser support: Chromium fully supported, Safari "in beta" from 16.4 TP, Firefox alpha; cross-origin isolation headers are mandatory.
- Only a single WebContainer instance can be booted concurrently per page, per the API reference.
WebContainers specifications
| Attribute | Details |
|---|---|
| Isolation | Browser tab sandbox — "everything is contained in a browser tab"; the runtime is WebAssembly executing inside the browser's security model and requires cross-origin isolation (COOP/COEP headers) for SharedArrayBuffer |
| Deployment | Local / OS-level |
| Open source | No |
| SDKs and interfaces | JavaScript/TypeScript |
| Cold start (vendor claim) | Site claims a dev environment can start "in milliseconds"; the API reference notes "Booting WebContainer is an expensive operation" |
| Max session length | Not documented |
| Persistence | In-memory filesystem for the life of the tab; mount() loads a file tree and fs reads it back; no built-in snapshots |
| GPU | No — WebAssembly Node.js runtime in the browser |
| Networking | Runs inside the user's browser; the host page must send Cross-Origin-Embedder-Policy: require-corp (or credentialless) and Cross-Origin-Opener-Policy: same-origin; third-party asset blocking in Brave/Firefox can break it |
| Pricing | "Always free for Open Source"; "Licensing is required for production usage of the API in a commercial, for-profit setting" (prototypes and POCs exempt), with pricing on request; Enterprise adds self-hosted/on-prem/VPC installation, private npm registries, SAML SSO and priority support |
| Free tier | Free for open source and for prototypes/POCs |
| Compliance | Not documented |
| Regions | Not applicable — executes in the end user's browser |
Facts from WebContainers’s public documentation, verified November 9, 2026. Performance numbers are vendor claims.
Strengths and trade-offs
Strengths
- You want agent-generated Node.js code to run and preview on the user's machine with no server compute
- You are building an in-browser IDE, tutorial or generative-UI product
- You are an open-source project or prototyping and can use it without a licence
Trade-offs
- Node.js/JavaScript only; no native binaries, Linux syscalls, Python or system packages
- Runs in the user's tab: nothing persists beyond the session, no server-side orchestration, one instance per page
- Proprietary with a paid licence for commercial production use; browser and header requirements limit where it works
Good fit for: In-browser coding products and agent UIs that need to run and preview Node.js code on the user's machine with zero server compute.
How WebContainers compares
| Sandbox | Isolation | Open source | Self-host / BYOC | Cold start (vendor) | Max session | Snapshots / pause | GPU | SDKs |
|---|---|---|---|---|---|---|---|---|
| WebContainers | Browser tab (WebAssembly) | No | No / No | ms (claimed) | Not documented | No / No | No | JavaScript/TypeScript |
| Pyodide | CPython in Wasm | Yes | Yes / No | Not documented | Not documented | No / No | No | JavaScript/TypeScript, Python |
| Together Code Sandbox | MicroVM | No | No / Not documented | 0.5 s (snapshot) | Until terminated | Yes / Yes | Not documented | Python, TypeScript |
| Val Town | Deno process sandbox | No | No / No | 100 ms deploy (claimed) | 1 min / 10 min (Pro) | No / Not documented | No | JavaScript/TypeScript, CLI, REST API, MCP server |
| Wasmtime | Wasm sandbox | Yes | Yes / No | Not documented | Embedder-set | No / Not documented | No | CLI, Rust, C, C++, Python, .NET, Go, Ruby |
Frequently asked questions
What is WebContainers?
How does WebContainers isolate code?
Is WebContainers open source?
How much does WebContainers cost?
What are the alternatives to WebContainers?
Sources
Cite this page
Agent Sandboxes. (2026). WebContainers. agentsandboxes.org. Last reviewed November 9, 2026. https://agentsandboxes.org/sandboxes/webcontainers/
Found an error or a missing sandbox? Submit a correction — every entry links to the sources it relies on.