CubeSandbox

CubeSandbox is an open-source sandbox service developed by TencentCloud, designed to run untrusted LLM-generated code safely inside hardware-isolated microVMs. Built on RustVMM and KVM, it delivers sub-60ms cold starts with less than 5MB of memory overhead per instance, making it practical to run thousands of concurrent AI agent sandboxes on a single node. The project is listed in the CNCF Landscape under AI-Native Infrastructure and is licensed under Apache 2.0.

What It Is

CubeSandbox is a self-hosted sandbox runtime for AI agents that sits between Docker containers and traditional VMs in the security/performance tradeoff space. Each sandbox gets its own Guest OS kernel — eliminating shared-kernel escape risks common to Docker — while the RustVMM-based hypervisor keeps boot times and memory overhead far below those of conventional VMs. It is compatible with the E2B SDK, meaning teams can migrate from E2B by swapping a single environment variable with no other code changes.

Architecture and Isolation Model

The system is composed of several purpose-built components working together:

• CubeAPI — a high-concurrency Rust REST gateway compatible with the E2B protocol
• CubeMaster — cluster orchestrator that dispatches requests to compute nodes (Cubelets)
• CubeProxy — reverse proxy routing requests to the correct sandbox instances
• CubeVS — eBPF-based virtual switch providing kernel-level network isolation and security policy enforcement
• CubeEgress — OpenResty-based egress security gateway with L7 domain filtering, credential injection, and audit logging
• CubeHypervisor & CubeShim — the virtualization layer managing KVM MicroVMs and integrating with the containerd Shim v2 API

This layered design means sandbox traffic cannot bypass egress inspection even at the kernel level.

Performance Benchmarks

The README documents cold-start benchmarks on bare metal: single-concurrency average under 60ms; under 50 concurrent sandbox creations, average 67ms, P95 90ms, P99 137ms — consistently sub-150ms. Memory overhead per instance is under 5MB for sandbox specs up to 32GB. Compared to Docker containers (which offer low isolation via shared kernel namespaces) and traditional VMs (which take seconds to boot), CubeSandbox claims to combine extreme isolation with near-container startup speed.

Key Capabilities

• AutoPause/AutoResume — idle sandboxes auto-suspend and wake on the next request for cost optimization
• CubeCoW snapshot engine — hundred-millisecond Copy-on-Write checkpoints on running sandboxes, enabling instant cloning and rollback to any saved state
• Credential vault — API keys and secrets never enter the sandbox, model context, or logs; agents call external APIs through a secure proxy
• Template system — OCI images convert to sandbox templates in one step, with an official Template Store and auto-distribution across nodes
• Web console — browser-based management at port 12088 for sandboxes, templates, nodes, and version matrix
• Egress control — domain allowlists, instant block on unauthorized egress, and full audit logs for compliance

Deployment Model

CubeSandbox requires an x86_64 Linux environment with KVM support. The README recommends deploying on cloud VMs using the PVM (Paravirtual Machine) path, which avoids the need for bare metal or nested virtualization. A Terraform one-click cluster deployer was added in v0.5.0. ARM64 native support was also introduced in v0.5.0. A development environment path using QEMU is available but explicitly flagged as offering poor performance. The Python SDK is published on PyPI (cubesandbox).

Update: v0.5.0

The latest release (v0.5.0, published July 3, 2026) adds AutoPause/AutoResume for idle sandbox cost optimization, a Terraform one-click cluster deployer for TencentCloud, ARM64 native full-stack support, and network policy hardening with per-sandbox traffic tokens and policy-routing egress. Earlier notable releases include v0.4.0 (credential vault, dashboard with version matrix and template health checks) and v0.3.0 (CubeCoW Copy-on-Write snapshot engine for event-level snapshots, cloning, and rollback). The project was initially open-sourced in v0.1.0 on April 20, 2026.