Amazon Bedrock AgentCore Code Interpreter vs DeltaBox Lite

Amazon Bedrock AgentCore Code Interpreter

Each session runs in its own microVM with 2 vCPU, 8 GB and a 10 GB disk for up to eight hours, and IAM can scope access to one interpreter. Sessions cannot be paused or resumed, and an AWS account with IAM set-up is needed before a first call.

DeltaBox Lite

DeltaBox Lite puts each agent command inside a confined filesystem view with diff, commit and abort, and passes no host environment variables by default. It is version 0.1.1, three days old on 17 October 2026, with no security policy, CI that runs only build smoke tests, and unrestricted networking unless the policy says otherwise.

Amazon Bedrock AgentCore Code Interpreter

1. Start a session with StartCodeInterpreterSession, then pass its id in the x-amzn-code-interpreter-session-id header on every InvokeCodeInterpreter call
2. Set sessionTimeoutSeconds when starting. The default is 900 seconds and the maximum is eight hours, and the session ends itself at the timeout
3. Stop sessions when done. Billing runs per second while code is busy, and a session left open counts against the 1,000 concurrent-session quota
4. Use bedrock-agentcore 1.18.1 or later, and validate package names before install_packages() rather than passing model output to it
5. Retry ThrottlingException (429) and InternalServerException (500) with exponential backoff, and treat ServiceQuotaExceededException, returned as HTTP 402, as a quota to raise

DeltaBox Lite

1. Skip step 5 of install-prompt.txt. Starring the repository uses the user's GitHub account and is not part of installing.
2. Pass --commit or --abort to deltabox run explicitly. The child's exit status is preserved after that decision.
3. Wrap redirection and pipes in sh -c '...'. An unquoted > is handled by the host shell and writes outside the sandbox.
4. Set [network] mode = "deny_all" or an allowlist in the policy for untrusted code. The default allows every destination.
5. Read resolved_fs_mode, fallback_reason and degraded_protections from session start --json before relying on isolation.