Daytona vs DeltaBox Lite

Daytona

API keys with per-action scopes, so an agent can create sandboxes without being able to delete them. The container class shares the host kernel. Only the VM classes get their own.

DeltaBox Lite

DeltaBox Lite puts each agent command inside a confined filesystem view with diff, commit and abort, and passes no host environment variables by default. It is version 0.1.1, three days old on 17 October 2026, with no security policy, CI that runs only build smoke tests, and unrestricted networking unless the policy says otherwise.

Daytona

1. Pick a Linux VM class for untrusted code or when memory must survive a pause. Container sandboxes stop and archive instead
2. Set autoStopInterval yourself. The 15-minute idle default can stop a sandbox while the agent is still thinking
3. Give the agent a key without delete:sandboxes if it shouldn't destroy work
4. Read Retry-After-{throttler} on a 429 before retrying sandbox creation
5. Check the organisation's tier before relying on outbound calls from inside the sandbox

DeltaBox Lite

1. Skip step 5 of install-prompt.txt. Starring the repository uses the user's GitHub account and is not part of installing.
2. Pass --commit or --abort to deltabox run explicitly. The child's exit status is preserved after that decision.
3. Wrap redirection and pipes in sh -c '...'. An unquoted > is handled by the host shell and writes outside the sandbox.
4. Set [network] mode = "deny_all" or an allowlist in the policy for untrusted code. The default allows every destination.
5. Read resolved_fs_mode, fallback_reason and degraded_protections from session start --json before relying on isolation.