DeltaBox: Millisecond-Level Sandbox Checkpoint/Rollback for AI Agents

> Paper: *DeltaBox: Scaling Stateful AI Agents with Millisecond-Level Sandbox Checkpoint/Rollback* > Authors: Yunpeng Dong, Jingkai He, Yuze Hou, Dong Du, Zhonghu Xu, Si Yu, Yubin Xia, Haibo Chen > arXiv: 2605.22781

The Problem: Slow State Management Cripples Agent Search

LLM-driven agents rely heavily on test-time search—MCTS, Best-of-N, RL rollouts, evolutionary algorithms—all of which require fast checkpointing and rollback of sandbox state, like an "undo key" for exploration. Existing mechanisms are far too slow:

| Approach | Example | Latency | Core Issue | |:---|:---|:---|:---| | File copying | shutil.copytree, Git stash | 100ms–10s | No process state; requires replaying history | | Container snapshots | Docker commit | 50ms–10s | No process state; restarts take seconds | | VM snapshots | Firecracker | 200ms–2s | Full-VM granularity, bloated state | | Logical checkpoints | LangGraph Checkpointer | <1ms | Cannot undo physical side effects (files on disk) |

All assume full copying of the state space per checkpoint. But agent workloads have a crucial property: consecutive checkpoints are highly similar—each step changes only a few files or memory pages. Full copying is wasted work whose latency scales with state size rather than actual change.

Key Insight: Save Only the Deltas

DeltaBox's core idea: since adjacent states are nearly identical, store only the differences. Making this work requires OS-level support across three hard problems: a delta filesystem, incremental process checkpoint/restore, and strict coupling between them.

DeltaFS: Hot Layer Switching

• Unlike OverlayFS, whose layer stack is frozen at mount time, DeltaFS introduces an ioctl that dynamically inserts a new writable layer and freezes the old one as read-only—without unmounting or interrupting processes.
• A four-phase ioctl flow: parse config → allocate private mount clones → RCU-style atomic array swap with generation bump and cache invalidation → delayed cleanup of old arrays.
• Checkpoint cost: ~1.12ms.
• Lazy file switching: a per-filesystem checkpoint_gen counter plus per-inode generation numbers; a fast path serves unchanged inodes with zero overhead, a slow path re-resolves and copy-ups.
• XFS reflink preserves extent maps on demoted files, so extents unmodified across N checkpoints share a single physical block—write amplification drops to proportional to dirty 4KB blocks.

DeltaCR: Incremental Process Snapshots

• Dual-path checkpointing hidden inside the LLM inference I/O window ("inference-masked checkpointing"): an asynchronous incremental CRIU dump to tmpfs (crash recovery) and a synchronous template-creating fork() for fast restore. CRIU's stop/cont costs ~15ms versus 1–9s LLM inference.
• Fast-path restore: kill agent, switch DeltaFS layer stack via ioctl, fork(template_k), SIGCONT, async-warm in background—~5ms, independent of RSS. Slow path (template miss) uses CRIU lazy-pages with userfaultfd plus async-warm prefetch, ~8ms.
• Async-warm: a dedicated thread on a separate CPU touches each anonymous writable page to force CoW privatization, eliminating synchronous page faults later.
• Network Proxy Daemon (NPD): Python LLM SDKs hold persistent HTTP/2 pools and thread pools that fork badly. NPD runs as a separate process owning all LLM connections, communicating with the agent over FIFO/shared memory, and is excluded from snapshots—avoiding deadlocks and polluted connection state.

Strict Coupling Protocol

Filesystem and memory state must be captured/restored atomically: checkpoint uses CRIU's SIGSTOP barrier so the DeltaFS ioctl observes the same quiescent instant; restore switches the FS layer stack before the new process resumes; dump failures roll back the FS ioctl with no half-consistent state.

Results

MCTS per-event latency (Django workload):

| Method | Checkpoint (ms) | Restore (ms) | |:---|---:|---:| | copytree+replay | 379.6 | 516.2 | | docker+replay | 48.7 | 1346.0 | | FC-Diff+dm | 475.4 | 1490.3 | | DeltaBox-std | 14.9 | 4.7 | | DeltaBox-LW | 2.1 | 21.5 |

• Restoration is 139–325x faster than Firecracker Diff.
• End-to-end trajectory time on 5 SWE-bench instances: DeltaBox 1.03–1.06x of pure LLM time vs. 1.87–4.29x for baselines; state management overhead drops from 47–77% to 3–6%—enabling 10x+ more exploration nodes per time budget.
• RL fan-out (Qwen2.5-7B, N=64): GPU utilization 100% vs. 87% (Firecracker), 82% (CubeSandbox), 54% (docker).
• Lightweight skip: 62.0% of 1,689 checkpoint events (read-only commands like grep, cat, git diff) bypass full C/R entirely.

Significance and Future Work

DeltaBox demonstrates that production-grade, millisecond-level coupled checkpoint/rollback is achievable through OS innovation—a paradigm shift from full-copy to incremental-delta state management, analogous to incremental backups and Git diffs but newly applied to joint process+filesystem state. Acknowledged limitations: network I/O is not rollback-able, template pool memory caps, single-threaded agents, and CRIU compatibility boundaries. Promising directions include cross-node template migration via RDMA/CXL, GPU state (CUDA context, VRAM) checkpointing, learned models for semantic skip (potentially >90% vs. 62%), and Spectre-safe template isolation. The deeper lesson: real efficiency comes not from doing things faster, but from doing less—the delta approach eliminates 99% of the copying.

References

• Yunpeng Dong et al. "DeltaBox: Scaling Stateful AI Agents with Millisecond-Level Sandbox Checkpoint/Rollback." arXiv:2605.22781, 2026.
• Compared systems: Firecracker, CubeSandbox, Docker, CRIU, LangGraph Checkpointer
• Related techniques: OverlayFS, XFS reflink, Linux fork(), userfaultfd
• Benchmarks: SWE-bench, MCTS trajectories, RL microbenchmarks