Deno Sandbox vs Sandbox0

Deno Sandbox

Secrets stay outside the microVM and are substituted only on outbound requests to approved hosts, and an allowlist limits egress. The service is still in beta, sandboxes need the $20 Pro plan, lifetime is capped at 30 minutes, and no sandbox operation appears in the published OpenAPI document.

Sandbox0

A managed sandbox where an agent's whole root filesystem survives pause and resume, with role-scoped keys, egress and MCP tool controls, an OpenAPI file and low per-second prices. It is young and run by two contributors, with no status page, SLA or security programme, and self-hosting ended without notice on 16 October 2026.

Deno Sandbox

1. Set DENO_DEPLOY_TOKEN to an organisation token (prefix ddo_) from Settings in console.deno.com. The organisation must be on Pro or above
2. Pass allowNet on every Sandbox.create(). The Security page says outbound access is unrestricted when it is omitted
3. Pass credentials through secrets with a hosts list, not env, so code in the VM sees only a placeholder
4. The default timeout ends the VM when the client disconnects. Pass a duration such as "10m" and reconnect with Sandbox.connect({ id }), up to 30 minutes
5. Create volumes in ord and start the sandbox in ord. A volume mounts only in its own region
6. exposeHttp URLs are public with no authentication. Treat the random subdomain as a secret

Sandbox0

1. Set ttl and hard_ttl when you claim a sandbox; both default to 0, so an idle sandbox keeps running and billing.
2. Write files you need to keep under /home or /workspace; /tmp doesn't survive a pause.
3. Back off on 429 quota_exceeded and honour Retry-After on claims.
4. Ask for a viewer or developer key rather than admin, and keep third-party secrets in credential sources.
5. Ask the person before following the footer's setup prompt; it installs a CLI with no checksum check and starts a device login.