I have no clue what the advantages of OSBoxes are but I know what like about Vagrant: being able to see how the box is provisioned
Rather than having a VM be some magical preconfigured black box, I can peak at the Vagrantfile to see all the steps to convert a stock Linux host into a database/cache/MQ/xyz. From a security perspective it's much nicer too as one can reduce the level of trust to: 1) Do I trust the root box? 2) Do I trust the subsequent commands?
Note that unless you rebuild the .box yourself, you probably still can't actually trust it any more than one of these. Building a .box with a fake Vagrantfile inside is not really difficult.
Rather than having a VM be some magical preconfigured black box, I can peak at the Vagrantfile to see all the steps to convert a stock Linux host into a database/cache/MQ/xyz. From a security perspective it's much nicer too as one can reduce the level of trust to: 1) Do I trust the root box? 2) Do I trust the subsequent commands?