DeltaBox Lite vs Sandbox0

DeltaBox Lite

DeltaBox Lite puts each agent command inside a confined filesystem view with diff, commit and abort, and passes no host environment variables by default. It is version 0.1.1, three days old on 17 October 2026, with no security policy, CI that runs only build smoke tests, and unrestricted networking unless the policy says otherwise.

Sandbox0

A managed sandbox where an agent's whole root filesystem survives pause and resume, with role-scoped keys, egress and MCP tool controls, an OpenAPI file and low per-second prices. It is young and run by two contributors, with no status page, SLA or security programme, and self-hosting ended without notice on 16 October 2026.

DeltaBox Lite

1. Skip step 5 of install-prompt.txt. Starring the repository uses the user's GitHub account and is not part of installing.
2. Pass --commit or --abort to deltabox run explicitly. The child's exit status is preserved after that decision.
3. Wrap redirection and pipes in sh -c '...'. An unquoted > is handled by the host shell and writes outside the sandbox.
4. Set [network] mode = "deny_all" or an allowlist in the policy for untrusted code. The default allows every destination.
5. Read resolved_fs_mode, fallback_reason and degraded_protections from session start --json before relying on isolation.

Sandbox0

1. Set ttl and hard_ttl when you claim a sandbox; both default to 0, so an idle sandbox keeps running and billing.
2. Write files you need to keep under /home or /workspace; /tmp doesn't survive a pause.
3. Back off on 429 quota_exceeded and honour Retry-After on claims.
4. Ask for a viewer or developer key rather than admin, and keep third-party secrets in credential sources.
5. Ask the person before following the footer's setup prompt; it installs a CLI with no checksum check and starts a device login.