> There's no free lunch, Devbox doesn't provide the same guarantees as Docker
It provides _better_ guarantees than Docker. A standard Dockerfile contains this line:
RUN doas apt-get ugprade # boo, reproducibility is now screwed.
vs DevBox/Nix - https://r13y.com/ - is truely reproducible and can generate accurate SBOMs from the build chain vs scanning internals of Docker images with some post build tooling.
There's no free lunch, Devbox doesn't provide the same guarantees as Docker, but it's a great tradeoff for many app use cases.