Inception Architecture
Depth
0
→
1
→
2
9 total sandbox instances ·
3 providers
Kai
Orchestrator · Mac Mini
Open Claude
Daytona
L1 Sandbox
Claude Agent
Blaxel
L1 Sandbox
Claude Agent
Ona
L1 Sandbox
Claude Agent
Blaxel
via Daytona L1
Ona
via Daytona L1
Daytona
via Blaxel L1
Ona
via Blaxel L1
Daytona
via Ona L1
Blaxel
via Ona L1
Daytona
Blaxel
Ona
Active
Pending
Idle
Experiment Phases
1
Research & Plan
2
L1 Setup
3
L1 Testing
4
L2 Inception
5
Analysis
Research Log
17:39 PST
Kai's final benchmark report received! Daytona: 472ms cold start, 0.87s fib(35), 14GB/s I/O write, Claude Code 2.1.19 installs in 1.4s. iTool pattern validated — ~2s total setup.
17:38 PST
Security findings: Cloud metadata reachable (⚠️), /proc/1/environ leaks env vars (⚠️), Python SSL broken. /etc/shadow properly blocked (✅).
16:15 PST
DAYTONA SANDBOX CONFIRMED WORKING. Our own test: 176ms cold start (default image). Python 3.14, Node 25, npm 11.7, git 2.52 all pre-installed.
16:00 PST
API keys obtained for all 3 platforms. Fixed Daytona SDK import bug (daytona_sdk, not daytona). Fixed create() params.
15:17 PST
Kai's first report: Auth wall is universal blocker across ALL platforms. No headless signup anywhere. Preliminary scores: Daytona 4.0, Ona 3.5, Blaxel 3.2.
15:08 PST
Sent follow-up email to Kai with SDK-specific instructions for Daytona, Blaxel, Ona and the "intelligent tool" test protocol.
14:55 PST
Research complete: Daytona has best DIY orchestration docs (explicit PM+Dev pattern). Blaxel has best infra (25ms resume, built-in MCP per sandbox). Ona is most opinionated (devcontainer-based, Git-centric).
14:37 PST
Sent initial benchmark email to Kai (clawdfadi@icloud.com) with full security, performance, portability test scripts and reporting template.
14:20 PST
Created evaluation toolkit: benchmark_sandbox.py, sandbox_scorecard.xlsx, sandbox_findings.pptx, hackathon-research-plan.md.
14:00 PST
Hackathon started. Decided on inception architecture: Kai orchestrates 3 L1 sandboxes, each L1 creates 2 L2 sandboxes using the other providers.
Platform Scores
Daytona
—
/ 5.0
Blaxel
—
/ 5.0
Ona
—
/ 5.0
Performance Benchmarks
| Metric | Daytona | Blaxel | Ona |
|---|---|---|---|
| Cold Start | 472ms (best class) | 418ms | Unknown (devcontainer) |
| Warm/Resume | N/A | <25ms claimed | N/A |
| CPU (fib 35) | 0.87s | 1.19s | N/A |
| I/O Write | 14,046 MB/s | 636 MB/s | N/A |
| I/O Read | 1,928 MB/s | 2,287 MB/s | N/A |
| pip install | Pre-installed | Available | N/A |
| npm install | Pre-installed | Not installed | N/A |
| Network RTT | 8.5ms | 131ms | N/A |
Intelligent Tool Round-Trip
| Step | Daytona | Blaxel | Ona |
|---|---|---|---|
| 1. Provision sandbox | 472ms ✅ | 418ms ✅ | Auth blocked |
| 2. Install Claude | 1.4s ✅ | No npm ⚠️ | Not tested |
| 3. Delegate task | Works ✅ | Works (API) ✅ | Not tested |
| 4. Retrieve output | Works ✅ | Works ✅ | Not tested |
| 5. Stream capability | PTY supported | WebSocket | Automations API |
| 6. Teardown | Works ✅ | Available ✅ | Not tested |
| Total Round-Trip | ~2s setup ✅ | ~1s + npm setup | Blocked by auth |
Security Matrix
| Check | Daytona | Blaxel | Ona |
|---|---|---|---|
| Host FS blocked | ✅ Yes | ⚠️ /etc writable | N/A |
| Env vars clean | ⚠️ /proc leaks | ✅ Minimal | N/A |
| Metadata blocked | ❌ REACHABLE | ✅ Blocked | N/A |
| Process isolated | ✅ Non-root | ❌ ROOT (uid=0) | N/A |
| Resource limits | ✅ Enforced | ⚠️ Full caps | N/A |
Hurdles & Friction Log
Ona
blocker
API auth works (Connect RPC) but BLOCKED by credit card verification. Cannot create environments without billing setup — another human-required step.
Blaxel
blocker
Sandbox runs as ROOT with FULL Linux capabilities (CapEff=000001ffffffffff). /etc/shadow readable, /etc writable. Security model relies on microVM isolation.
All
blocker
Universal OAuth wall — ALL 3 platforms require browser-based signup. Zero support for headless account creation. An agent literally cannot start using any 'agent-native' platform without human help.
Daytona
friction
SDK import name mismatch — docs say 'from daytona import Daytona' but package is 'daytona_sdk'. Both Kai and antigravity agents hit this independently. 30+ minutes lost.
Daytona
friction
create(language='python') fails as documented. create() with NO params works best and gives Python 3.14 + Node 25 + npm + git.
Daytona
blocker
Cloud metadata endpoint (169.254.169.254) is REACHABLE — potential credential theft vector. Don't put secrets in sandbox env vars.
Daytona
friction
Python SSL broken inside sandbox (curl works fine). CA certificate bundle issue blocks Python's urllib/requests.
Blaxel
blocker
CLI requires interactive TTY for login — 'bl login' opens browser for OAuth. API key doesn't have direct SDK path like Daytona.
Ona
friction
Enterprise-focused with opaque pricing. More of a managed agent platform than raw sandbox API.
L2 Inception Status (Agent-Spawned Sandboxes)
| L1 Parent | L2 Child A | L2 Child B | Status |
|---|---|---|---|
| Daytona | Blaxel | Ona | Phase 4 |
| Blaxel | Daytona | Ona | Phase 4 |
| Ona | Daytona | Blaxel | Billing blocked |