Serve cross-origin isolation headers required by the WebContainer sandbox

[priscaenoch]

Problem

The Sandbox and SharedSandbox pages use @webcontainer/api. WebContainer requires the page to be cross-origin isolated, which means the server must send:

• Cross-Origin-Opener-Policy: same-origin
• Cross-Origin-Embedder-Policy: require-corp (or credentialless)

No such headers are configured anywhere: not in the Vite dev server (vite.config.ts sets only server.proxy), not in nginx.conf, and not in vercel.json. As a result the sandbox will fail to boot outside of environments that happen to supply these headers.

What needs to be done

• Add the COOP/COEP headers to the Vite dev server (server.headers) so the sandbox works in local development.
• Add the same headers to nginx.conf for the Docker deployment.
• Add a headers block to vercel.json for the hosted deployment.
• Verify third-party assets still load under require-corp; if any break, evaluate credentialless and document the choice.
• Document the requirement in the README so alternative hosts are configured correctly.

Files

• vite.config.ts
• nginx.conf
• vercel.json
• README.md

Acceptance deliverables

• crossOriginIsolated is true on pages hosting the sandbox in dev, Docker, and the hosted deployment.
• The Sandbox page boots a WebContainer successfully.

Tests to pass

• Manual verification documented in the PR: crossOriginIsolated === true in the browser console on /sandbox.
• Existing tests continue to pass.

[OpensrcLord]

Hello @maintainer, I’d appreciate the opportunity to contribute to this issue. I’m detail-oriented and committed to delivering quality work.

[grantfox-oss]

🦊 GrantFox — @pharuq411 has been assigned to this issue as part of the Official Campaign | FWC26 campaign!

Next steps:

1. Open a Pull Request referencing this issue (e.g., Closes #20)
2. Your PR will be reviewed by the octraban maintainers

Good luck! Track your progress on GrantFox.