SANDBOX

SHOOTOUT

High Noon Benchmarks

DAYTONA

THE SHERIFF

BLAXEL

THE OUTLAW

Draw

Sandbox Lifecycle

★

Daytona

Create200msFASTEST

Teardown188ms

Blaxel

Create1376ms

Teardown129msFASTEST

Task Execution

★

fizzbuzz

FizzBuzz 1-100 — trivial, measures pure overhead

Daytona352ms

Blaxel160msFASTEST

csv stats

CSV stats — compute mean/median/stddev per numeric column

Daytona155ms

Blaxel105msFASTEST

http fetch

HTTP fetch — fetch GitHub API and print current_user_url

Daytona216ms

Blaxel207msFASTEST

bugfix

Bug fix — fix two bugs in a Python file and run tests

Daytona153ms

Blaxel111msFASTEST

Reliability

★

Daytona

Blaxel

PERFECT SCORE

Security Showdown

★

31 security probes across 5 categories fired at each sandbox. Lower capture count = better isolation.

Daytona

15/31

PROBES BLOCKED

16 vulnerabilities found

Blaxel

14/31

PROBES BLOCKED

17 vulnerabilities found

Identity & Privilege

Who are we? What power do we have?

Daytona

2/4

Blaxel

2/4

Probe

Daytona

Blaxel

ENV LEAK

Are API keys or platform tokens exposed via env vars?

🛡SAFE

PASSWD

User enumeration, shadow file readable?

💥LEAKED

PRIVILEGE

Running as root? What capabilities?

🛡SAFE

💥LEAKED

SUDO ACCESS

Can we sudo or su to escalate privileges?

💥LEAKED

🛡SAFE

Network Security

Can we phone home or reach cloud metadata?

Daytona

3/5

Blaxel

2/5

Probe

Daytona

Blaxel

NETWORK EGRESS

Can phone home to arbitrary URLs?

🛡SAFE

💥LEAKED

DNS EXFIL

Can resolve arbitrary DNS? Potential data exfiltration channel.

💥LEAKED

METADATA

Cloud instance metadata endpoint (169.254.169.254) accessible?

🛡SAFE

INTERNAL SERVICES

Can we reach internal services on localhost or common ports?

🛡SAFE

ARP NEIGHBORS

Can we see other hosts on the network? ARP table reveals neighbors.

💥LEAKED

Container Isolation

Are we actually contained?

Daytona

4/7

Blaxel

3/7

Probe

Daytona

Blaxel

NAMESPACE ESCAPE

Namespace isolation check — can we see host namespaces?

💥LEAKED

DOCKER SOCKET

Docker socket exposed? (classic container escape)

🛡SAFE

PROC SNOOP

Can see host or other container processes via /proc?

🛡SAFE

💥LEAKED

MOUNT INSPECT

Host mounts visible? Volume leaks?

💥LEAKED

🛡SAFE

CGROUP ESCAPE

Can read/write cgroup configs? Breakout vector via release_agent.

🛡SAFE

SIGNAL PID1

Can we send signals to PID 1? Container kill / DoS vector.

💥LEAKED

SYMLINK ESCAPE

Can we create symlinks to escape the container filesystem?

🛡SAFE

💥LEAKED

Information Disclosure

What secrets leak through the walls?

Daytona

3/7

Blaxel

6/7

Probe

Daytona

Blaxel

KERNEL INFO

Kernel version and dmesg accessible? Reveals host OS details.

🛡SAFE

💥LEAKED

SYSFS HWINFO

Can read /sys for hardware info? Leaks host topology.

💥LEAKED

🛡SAFE

FILESYSTEM

What is visible on the filesystem? Sensitive dirs accessible?

💥LEAKED

🛡SAFE

CRYPTO KEYS

SSH keys, TLS certs, or other crypto material accessible?

🛡SAFE

TMPDIR CROSSLEAK

Can we see other users' temp files? Shared /tmp isolation.

💥LEAKED

🛡SAFE

PROC ENVIRON

Can we read other processes' environment variables?

💥LEAKED

🛡SAFE

CLOUD IDENTITY

Can we determine cloud provider, region, or account from artifacts?

🛡SAFE

Runtime Security

Can we break the rules at runtime?

Daytona

3/8

Blaxel

1/8

Probe

Daytona

Blaxel

RESOURCE ABUSE

Fork bomb protection? Resource limits enforced?

🛡SAFE

💥LEAKED

PTRACE SCOPE

Can ptrace other processes? Enables debugging/injection.

🛡SAFE

💥LEAKED

WRITABLE PROC

Can write to /proc/sys? Sysctl manipulation enables privilege escalation.

🛡SAFE

💥LEAKED

PACKAGE INSTALL

Can install packages at runtime? Enables persistence and tooling.

💥LEAKED

DEVICE ACCESS

Can access raw devices? /dev/mem, disk devices enable host compromise.

💥LEAKED

MODULE LOAD

Can we load kernel modules? Full host compromise vector.

💥LEAKED

RLIMIT OVERRIDE

Can we raise our own resource limits? Bypass cgroup constraints.

💥LEAKED

FORK BOMB

Fork bomb protection test — do PID limits actually work?

💥LEAKED

🛡SAFE

Evidence Logs

★

Daytona

Identity & Privilege

Network Security

Container Isolation

Information Disclosure

Runtime Security

Blaxel

Identity & Privilege

Network Security

Container Isolation

Information Disclosure

Runtime Security

The Verdict

★

Daytona

Categories Won

THE OUTLAW STRIKES

Blaxel

Categories Won

The Wrap-Up

★

We threw 31 security probes and 4 benchmark tasks at both platforms to see how they hold up when the dust settles. Here's what the smoke cleared to reveal:

Performance

Daytona spins up sandboxes 587% faster (200ms vs 1376ms), a clear edge for cold-start-sensitive workloads. However, once inside the sandbox, Blaxel consistently executes tasks faster, winning 4 of 4 task benchmarks. Reliability tells its own story: Daytona landed 39/40 while Blaxel hit 40/40.

Security

This is where the real story lives. Out of 31 probes, Daytona blocked 15 (48%) while Blaxel blocked 14 (45%). Neither platform is bulletproof — both leaked on 9 shared probes including PASSWD, DNS EXFIL, NAMESPACE ESCAPE, and 6 more.

Daytona's blind spots: MOUNT INSPECT, SYSFS HWINFO, FILESYSTEM, TMPDIR CROSSLEAK, SUDO ACCESS, PROC ENVIRON, FORK BOMB — 7 probes that Blaxel blocked but Daytona didn't.

Blaxel's blind spots: PRIVILEGE, NETWORK EGRESS, PROC SNOOP, KERNEL INFO, RESOURCE ABUSE, PTRACE SCOPE, WRITABLE PROC, SYMLINK ESCAPE — 8 probes that Daytona blocked but Blaxel didn't.

Bottom Line

Blaxel edges ahead with faster raw execution and competitive security coverage. If your workloads prioritize execution speed over cold-start latency, Blaxel delivers. Neither platform has solved sandbox security completely — 9 shared vulnerabilities prove there's still work to do on both sides of this frontier.

Benchmark run on March 7, 2026. Each task executed 10 times. Security assessment covered 31 attack vectors across 5 categories: Identity & Privilege, Network Security, Container Isolation, Information Disclosure, Runtime Security. All probes ran identical code against both platforms under equivalent conditions.