preview.vpod.sh serves one snapshot as a working terminal, on one URL, built to
be dropped into an <iframe> on somebody else’s page. Docs, changelogs and
landing pages get a real machine in the page rather than a recorded gif.
It does not boot on its own
A cold preview pulls the ~25 MB engine plus a compressed snapshot. On a docs page with three embeds, booting on load is a quarter of a gigabyte spent on a visitor who scrolled past. So the default is a poster: the snapshot’s name, its real size, and a button.autoboot=1 opts out of that, for a page where the embed is the reason the
visitor is there.
Parameters
Every parameter has a working default, and an unparsable value falls back to it
rather than erroring. An embed that renders a stack trace because somebody
typed
theme=apprentise is worse than one that renders in the wrong theme: you
see the wrong colours and fix it, where a visitor sees a broken product.
key is the one exception. A key that does not resolve gets an error page rather
than a default, because falling back to the keyless mode would quietly serve the
public catalogue to somebody who asked for a private snapshot.
Embedding a private snapshot
A snapshot you built in the console is not in the public catalogue, so the embed needs a publishable key —vpod_pk_, the kind guarded by an
origin allowlist rather than by secrecy:
Content-Security-Policy: frame-ancestors, so the browser is what refuses an embed from an origin you did
not list. An origin that is not on the list gets an error page instead of the
snapshot.
A preview hands the snapshot bytes to the visitor’s browser.
frame-ancestors
stops another site from mounting your embed; it does not stop a person looking at
your page from opening devtools. The allowlist covers “unlisted, and I don’t want
it embedded elsewhere”. It does not cover “must not leak” — that case is served
by not previewing it.Networking inside an iframe
Guest networking needsSharedArrayBuffer, which needs the document to be
cross-origin isolated. There are exactly two ways for an iframe to get that, and
the preview arranges the first:
Document-Isolation-Policy: isolate-and-credentiallesson the preview, so it is isolated whatever your page does. Chromium only, as of 2026-08.- Inheriting isolation from an embedder who serves
COOPandCOEPon their own page. That is whatallow="cross-origin-isolated"on the<iframe>is for: harmless on an ordinary page, and the path that works in browsers without DIP if your page is already isolated.
wget fails rather than hanging. The preview reports
which it got — as a badge in the corner, and as network: "sab" | "none" in the
bridge’s ready message.
If your own page is cross-origin isolated, it runs require-corp, which blocks
every cross-origin subresource that has not opted in. The preview opts in with
Cross-Origin-Resource-Policy: cross-origin on every response, so it loads.
Caching
The snapshot lands in origin-private storage on first boot, keyed by origin — the preview’s, not yours. One shared preview origin is what makes that worth something: a visitor who booted a preview on one site arrives warm at a preview on another. Theready message’s warm flag says which happened.