Deno Sandbox vs SPACE

Deno Sandbox

Secrets stay outside the microVM and are substituted only on outbound requests to approved hosts, and an allowlist limits egress. The service is still in beta, sandboxes need the $20 Pro plan, lifetime is capped at 30 minutes, and no sandbox operation appears in the published OpenAPI document.

SPACE

Once deployed, SPACE's native API has a public OpenAPI 3.1 contract, stable error codes with a retryable flag and 24-hour idempotency keys, and egress and credential controls sit outside the VM. A person must first deploy it on a Linux x86_64 host with KVM and Kubernetes. Version 0.8.0 has no tagged release, changelog or public container images.

Deno Sandbox

1. Set DENO_DEPLOY_TOKEN to an organisation token (prefix ddo_) from Settings in console.deno.com. The organisation must be on Pro or above
2. Pass allowNet on every Sandbox.create(). The Security page says outbound access is unrestricted when it is omitted
3. Pass credentials through secrets with a hosts list, not env, so code in the VM sees only a placeholder
4. The default timeout ends the VM when the client disconnects. Pass a duration such as "10m" and reconnect with Sandbox.connect({ id }), up to 30 minutes
5. Create volumes in ord and start the sandbox in ord. A volume mounts only in its own region
6. exposeHttp URLs are public with no authentication. Treat the random subdomain as a secret

SPACE

1. Ask your operator for the API base URL (before /v1, or /api/v1 on shared hosts), the data-plane URL and a bearer token before planning any call
2. Poll the returned operation until it succeeds and the sandbox is running before creating a command. A 202 response is not readiness
3. Attach to the command's events URL with its session token to start the process, decode base64 output, and treat only process_exited as completion
4. Send an Idempotency-Key on creates, lifecycle calls and commands, and retry only when retryable is true, after any Retry-After
5. Save output as it arrives. Reconnecting with Last-Event-ID returns resync_required, not the missed output