Encrypted persistent volumes and other V3-attestation features are beta. GPU access requires enablement and a monthly commitment; ordinary container memory and ephemeral-root state are not retained by Stop. Read the source ↗

Confidential computing / Tinfoil Confidential Containers alternative

A Tinfoil Containers alternative for the agent execution lifecycle

Tinfoil Containers runs Docker workloads in hardware-backed confidential enclaves with remote attestation. It supports encrypted persistent volumes, but ordinary writable container state is ephemeral and stopped instances boot fresh enclaves. Confidential computing and attestation are distinct requirements from a persistent Linux sandbox lifecycle.

Start buildingCompare capabilities ↓

Reviewed 2026-10-19 · Published by the Sandbox0 team

When Tinfoil Confidential Containers fits

Tinfoil fits workloads requiring its hardware confidentiality, client verification and attested configuration. Keep a suitable enclave service whenever those guarantees are required; an ordinary Linux sandbox is not an equivalent security replacement.

When to consider Sandbox0

Choose Sandbox0 for compatible Linux agent execution needing whole writable RootFS persistence, automatic online growth and supported files while compute stays paused. Evaluate any required confidential-computing and attestation guarantees separately.

Capabilities

Tinfoil Confidential Containers and Sandbox0: what persists?

Feature comparison with documentation and verification status
Environment and runtime lifetimeTinfoil Confidential ContainersNot established in this reviewSandbox0ttl and hard_ttl default to 0 (disabled). Configure idle pause and deletion policies for the same persistent sandbox identity; an idle running sandbox still accrues compute charges.Read documentation →
Persistent filesTinfoil Confidential ContainersBeta encrypted persistent volumes retain data at configured unlocked mount paths; encrypted S3 storage is another application-data option.View evidence ↗Sandbox0The writable RootFS survives successful checkpoints, including software, system configuration, dependencies, and user data.Read documentation →
Whole RootFSTinfoil Confidential ContainersOrdinary writable Docker layers and ephemeral filesystem state are lost on stop; only the unlocked persistent mount is durable.View evidence ↗Sandbox0Persistence extends beyond /workspace to paths such as /usr/local, /etc, and /home. Runtime tmpfs and virtual filesystems are excluded.Read documentation →
Release compute, keep stateTinfoil Confidential ContainersStop/Deploy retains saved configuration and attached volumes but boots a new enclave and requires usable storage keys.View evidence ↗Sandbox0Pause compute between tasks; resume on available capacity. Default resume starts fresh processes from the saved filesystem.Read documentation →
Memory and process stateTinfoil Confidential ContainersThe lifecycle guide explicitly excludes suspended memory images and says in-memory state does not survive Stop.View evidence ↗Sandbox0Experimental memory checkpoints can preserve compatible process state. Use memory: true on both pause and resume on a compatible deployment. A filesystem checkpoint alone does not preserve running processes.Read documentation →

Online RootFS growth

On growth-enabled images, Sandbox0 automatically expands the writable RootFS as free space runs low, within a configured sparse logical ceiling up to 64 TiB. Agent processes keep running. Growth is enabled in the qualified Cloud region; confirm activation for other regions. Existing images and snapshots retain their captured storage geometry. The ceiling is logical capacity, not preallocated host disk.

The volume configuration size field does not allocate or resize a managed disk; capacity is selected when creating the disk. The reviewed contract does not establish automatic online growth of a complete durable writable RootFS.

Files while compute is paused

Sandbox0's Files API reads persistent files without resuming compute. Filesystem-only pauses also permit edits; retained-memory pauses are read-only and reject mutations with 409. SSH, SFTP, file watching, and runtime-only mounts require running compute.

Tinfoil’s encrypted volumes can remain detached and its S3 sidecar retains encrypted application data. Those services do not establish direct full-RootFS file operations against a stopped enclave. Sandbox0 supports its paused durable RootFS, with writes only for filesystem-only generations.

See paused file operations →

A writable root is optional but still ephemeral

Containers default to a read-only root, with supported configuration options for writable scratch or a writable root. The storage guide says writable Docker layers, pulled images and ordinary Docker volumes are memory-backed and lost on enclave stop. Only writes through an unlocked persistent-volume filesystem are durable.

Source 1 ↗Source 2 ↗

Encrypted volumes require keys, mounts and independent lifecycle management

Encrypted persistent volumes are beta under V3 attestation. They attach to one enclave at a time and require successful key release/unlock before use. Stopped and detached volumes continue consuming provisioned capacity; deleting an instance leaves volumes unattached, so deleting the instance alone does not erase data or end volume billing.

Source 1 ↗Source 2 ↗Source 3 ↗

Stop retains configuration and volumes rather than process memory

The lifecycle guide explicitly says Stopped is not a suspended memory image. Deploy boots a new enclave from saved configuration and current secrets. In-memory state and ephemeral filesystem writes do not survive Stop. The separate encrypted S3 sidecar offers application-data persistence rather than complete RootFS continuity.

Source 1 ↗Source 2 ↗

Pricing

Compare billing models, then price your workload

CPU allocation, memory, billing minimums, disk, plan fees, and supported workload differ. These meters are not equal-performance machine quotes. Confirm region, resource units, and included allowances before estimating a total.

Tinfoil Confidential Containers

Pricing reviewed 2026-10-19

Containers base plan
$20/month plus usage
Separate from the $20 Chat subscription.
Rate source ↗
Container CPU
$0.06 per core-hour
Rate source ↗
Container memory
$0.01 per GB-hour
Rate source ↗
Provisioned persistent storage
$0.000382735 per GB-hour
Decimal GB capacity; billed until deleted, including detached and stopped periods.
Rate source ↗
H200 GPU reference
$6.17 per GPU-hour with a monthly commitment
GPU access must be enabled; this is not a short on-demand interval.
Rate source ↗

Containers use hourly CPU, memory and GPU billing, not shorter on-demand intervals. GPUs require monthly commitment. Volume charges persist after instance or subscription cancellation until the volume is deleted; confirm any account storage allowance. Preserve decimal GB pricing rather than silently relabeling it GiB.

Check current Tinfoil Confidential Containers pricing ↗

Sandbox0

$0.015/GiB-hour compute (billed by the second at approximately $0.000004167/GiB-second), plus $0.02/GiB-month of retained incremental RootFS and memory checkpoint data. Shared base images and platform recovery retention are excluded; paused sandboxes accrue storage charges only.

Compute / GiB-hour
$0.015
Retained data / GiB-month
$0.02
Paused compute
$0.00

A 4 GiB agent, 100 running hours

$6.00 compute

4 GiB × 100 hours, billed by the second. Keeping 20 GiB of billable incremental data for a full billing month adds $0.40. CPU is derived from memory by the platform; choose a tier that fits your workload.

Understand storage billing →

Before migrating from Tinfoil Confidential Containers

  1. Inventory confidentiality/attestation requirements, public measured configuration, private images, encrypted mount paths and key-release dependencies.
  2. Retain required confidential services and export authorized data with verified key access; port only compatible Linux agent execution.
  3. Test system-path retention, growth and paused files separately from enclave security properties and hourly/monthly resource commitments.

Common questions

Is Sandbox0 a drop-in Tinfoil Confidential Containers replacement?

Evaluate API compatibility and product scope. These products serve different core workflows, so a change may require a different architecture.

Does keeping files also keep a running agent?

Filesystem state and volatile process state are separate. Sandbox0 requires explicit compatible memory checkpoints to preserve running processes; its default filesystem resume starts fresh processes.

Sources and review scope

The Boat team's Battleships directory is the discovery source. References below describe the product and plan discussed on this page. Check current availability, regional terms and billing units before migrating. Where the cited material does not establish a capability or price, the comparison identifies that uncertainty.

Battleships research record ↗docs.tinfoil.sh/containers/config-runtime.md ↗docs.tinfoil.sh/containers/encrypted-volumes.md ↗docs.tinfoil.sh/containers/overview.md ↗docs.tinfoil.sh/containers/lifecycle.md ↗docs.tinfoil.sh/containers/persistent-storage.md ↗tinfoil.sh/pricing ↗Sandbox0 RootFS capacity →

Related comparisons

Caution vs Sandbox0 →Agency Tool Company vs Sandbox0 →Agent 37 vs Sandbox0 →Agent Relay vs Sandbox0 →AgentComputer vs Sandbox0 →ainclave vs Sandbox0 →