@heyshrutimishra: Stop worrying about container escapes for your AI agents. CubeSandbox v0.7.0 just dropped, and it's built different: Li…
Summary
CubeSandbox v0.7.0 is a high-performance, secure sandbox service for AI agents, featuring cross-node pause/resume, hardware-level isolation, and low memory overhead.
View Cached Full Text
Cached at: 09/08/26, 09:39 PM
Stop worrying about container escapes for your AI agents.
CubeSandbox v0.7.0 just dropped, and it’s built different:
Link: https://t.co/O2U2R4tz5K 👇 https://t.co/XrSzX9C6aF
TencentCloud/CubeSandbox
Source: https://github.com/TencentCloud/CubeSandbox
CubeSandbox
Instant, Concurrent, Secure & Lightweight Sandbox Service for AI Agents
中文文档 · Quick Start · Documentation · Changelog · X(Twitter) · Top Contributor Program · Submit Use Case
Cube Sandbox is a high-performance, out-of-the-box secure sandbox service built on RustVMM and KVM. It supports both single-node deployment and easy scaling to multi-node clusters. It is compatible with the E2B SDK and can create a hardware-isolated, fully serviceable sandbox in under 60ms with less than 5MB of memory overhead.
📰 News
|
v0.7: Cross-node pause/resume, control plane & ops separation, faster sandbox networking Cross-node pause/resume — with an S3 backend, suspend a sandbox on one node and resume it on another, or create sandboxes from snapshots (preview) Control plane & operations separation — node management moves into CubeOps with multi-replica deployment and the new cubeopscli Changelog → |
|
v0.6: K8s deploy, Volume framework, template aliases K8s deploy — Deploy Cube control-plane components and compute nodes on Kubernetes Volume framework — E2B-compatible Volume framework that lets users plug in custom backend storage Template aliases — Set an alias when creating a template, and create sandboxes by specifying that alias. Changelog → · K8s deploy → · Volume plugin → |
|
v0.5: AutoPause, Terraform deployer, ARM64 & network policy hardening AutoPause/AutoResume — idle sandboxes auto-suspend and wake on the next request. Terraform one-click cluster deploy ARM64 native full-stack support network policy hardening — per-sandbox traffic tokens, policy-routing egress. Changelog → · Terraform deploy → |
|
v0.4: Safer egress, easier ops Credential vault — Agents call external APIs as usual; keys never enter the sandbox. Dashboard — version matrix and template health checks; see at a glance whether templates need rebuilding after upgrades. Changelog → · Security proxy guide → · WebUI guide → |
|
Snapshot, Clone & Rollback at hundred-millisecond granularity CubeSandbox 0.3.0 introduces the CubeCoW Copy-on-Write snapshot engine, enabling event-level snapshots, instant cloning, and rollback to any saved state. Changelog → |
|
🎉 Initial open-source release Cube Sandbox is now open source! Millisecond boot, hardware-level isolation, E2B-compatible sandbox for AI Agents. Changelog → |
Product Highlights
|
⚡ Ultra-fast Startup Resource pooling and snapshot cloning skip all cold-start overhead. Average <60ms cold start — sandbox creation faster than a blink. Quick start → |
🔒 Hardware Isolation Every sandbox runs a dedicated OS kernel in its own MicroVM. Architecture → |
🔌 E2B SDK Compatible Compatible with E2B SDK interface. Switch from E2B Cloud seamlessly by changing one environment variable — zero client code changes. Examples → |
|
📦 High-density Deployment <5MB overhead per sandbox enables thousands of instances per server via kernel sharing and Copy-on-Write (CoW). Supports automatic sandbox pause and resume, further improving deployment density and cost optimization. Quick start → |
🛡️ Network Security eBPF-based inter-sandbox isolation and egress filtering at kernel level; built-in L7 security proxy enables per-domain/path/method policies with automatic credential injection — secrets never visible to sandbox code. Security proxy guide → |
📸 Flexible State Management High-frequency snapshot and rollback at hundred-millisecond granularity. Create checkpoints on running sandboxes, roll back to any saved state at any time, or fork from a specific state to explore in parallel. v0.3 changelog → |
|
💾 Volume Framework E2B-compatible Volume framework that lets users plug in custom backend storage solutions. Volumes have an independent lifecycle and can be shared across sandboxes. Volume plugin → |
🚀 Production Deployment Deploy production clusters on Tencent Cloud with one click using Terraform. Also supports deployment on standard Kubernetes clusters (preview). Terraform deploy → · K8s deploy → |
💪 ARM Architecture Support Full native ARM64 support across compilation, build, and deployment workflows. Bare-metal deploy → |
Demos
| Installation & Demo | Performance Test | RL (SWE-Bench) | Snapshot · Clone · Rollback |
Benchmarks
In the context of AI Agent code execution, CubeSandbox achieves the perfect balance of security and performance:
| Metric | Docker Container | Traditional VM | CubeSandbox |
|---|---|---|---|
| Isolation Level | Low (Shared Kernel Namespaces) | High (Dedicated Kernel) | Extreme (Dedicated Kernel + eBPF) |
| Boot Speed *Full-OS boot duration | 200ms | Seconds | Sub-millisecond (<60ms) |
| Memory Overhead | Low (Shared Kernel) | High (Full OS) | Ultra-low (Aggressively stripped, <5MB) |
| Deployment Density | High | Low | Extreme (Thousands per node) |
| E2B SDK Compatible | / | / | ✅ Drop-in |
- Cold start benchmarked on bare-metal. 60ms at single concurrency; under 50 concurrent creations, avg 67ms, P95 90ms, P99 137ms — consistently sub-150ms.
- Memory overhead measured with sandbox specs ≤ 32GB. Larger configurations may see a marginal increase.
For detailed metrics on startup latency and resource overhead, see the Core Operations Performance Benchmark Report (bare metal) and the PVM Cloud Server Benchmark Report.
|
|
|
| Sub-150ms sandbox delivery under both single and high-concurrency workloads |
CubeSandbox base memory footprint across various instance sizes (*Blue: Sandbox specifications; Orange: Base memory overhead). Note that memory consumption increases only marginally as instance sizes scale up. |
|
Quick Start
⚡ Millisecond-level startup — watch the fast-start flow above.
Cube Sandbox requires an x86_64 Linux environment with KVM support.
The guide walks you through everything in four steps — provisioning a server, installing Cube Sandbox, creating a sandbox template, and running your first agent code. No source build needed, up and running in minutes.
Choose your deployment path:
|
🖥 PVM · Cloud VM →
🏆 Recommended |
🏗 Bare Metal → |
💻 Dev-Env →
⚠️ Not recommended — poor performance |
First thing after install: open the Web console
🖥️ Visual management — from overview to creating a sandbox and streaming logs, all in your browser.
After one-click deployment, open in your browser:
http://<control-node IP>:12088
Recommended three steps:
- Check overview — Open Overview, confirm nodes are Ready and capacity looks healthy
- Prepare a template — Install an official preset from Template Store; skip if you already have a
READYtemplate under Templates - Create a sandbox — Sandboxes → + New sandbox, pick a
READYtemplate, and view live logs on the detail page within seconds
See the full WebUI console guide.
Deep Dive
- Documentation Home — complete guide navigation
- ☁️ PVM Deployment — deploy on ordinary cloud VMs without bare metal or nested virtualization
- Template Concepts — image-to-template concepts and workflows
- Example Projects — hands-on examples (code execution, browser automation, OpenClaw integration, RL training, and more)
- 🖥️ WebUI Console — visual management right after install (
:12088) - 🔐 Security Proxy & Credential Vault — CubeEgress domain filtering, injection, and auditing
- 🤖 Digital Assistant AgentHub — create and manage OpenClaw assistants (Preview)
- 💻 Development Environment (QEMU VM) — no KVM access? Try Cube Sandbox inside a disposable OpenCloudOS 9 VM
Architecture
| Component | Responsibility |
|---|---|
| CubeAPI | High-concurrency REST API Gateway (Rust), compatible with E2B. Swap the URL for seamless migration. |
| CubeMaster | Cluster orchestrator. Receives API requests and dispatches them to corresponding Cubelets. Manages resource scheduling and cluster state. |
| CubeProxy | Reverse proxy, compatible with the E2B protocol, routing requests to the appropriate sandbox instances. |
| Cubelet | Compute node local scheduling component. Manages the complete lifecycle of all sandbox instances on the node. |
| CubeVS | eBPF-based virtual switch, providing kernel-level network isolation and security policy enforcement. |
| CubeEgress | OpenResty-based egress security gateway: L7 domain filtering, credential injection, and access auditing; works with CubeVS kernel policies so sandbox traffic cannot bypass inspection. |
| CubeHypervisor & CubeShim | Virtualization layer — CubeHypervisor manages KVM MicroVMs, CubeShim implements the containerd Shim v2 API to integrate sandboxes into the container runtime. |
👉 For more details, please read the Architecture Design Document and CubeVS Network Model.
Community & Contributing
We welcome contributions of all kinds—whether it’s a bug report, feature suggestion, documentation improvement, or code submission!
- 🐞 Found a Bug or have questions? Submit an issue on GitHub Issues.
- 💡 Have an Idea? Join the conversation in GitHub Discussions.
- 🛠️ Want to Code? Check out our CONTRIBUTING.md to learn how to submit a Pull Request.
- 📝 Want to contribute docs? Submit bilingual PRs to our community doc channels: Troubleshooting, Use Cases, and Integrations. Additionally, the Cube 100 Program is now open — we’re looking for the first 100 teams running AI agents in production with Cube. Limited to 100 seats. Learn more & apply →
- 💬 Want to Chat? Join our Discord.
Roadmap
Coming soon — see the full roadmap for details.
| Feature | Description |
|---|---|
| Cross-Node Pause/Resume Performance | Cut pause/resume latency and speed up snapshot transfer so cross-node resume approaches same-node speed |
| E2B API Compatibility | Close remaining gaps with the E2B specification for full drop-in compatibility |
| Sandbox Fault Recovery | Automatic detection and recovery of crashed VMs, stuck shim processes, and network partitions with configurable recovery policies |
| Scheduling & Operations Enhancements | Resource-aware placement, affinity rules, live rebalancing, and node drain with sandbox migration |
| S3 Performance and Cost Optimization | Incremental uploads, better cache, and cheaper storage classes so S3 snapshot/volume I/O stays fast at lower cost |
| Filesystem-Only Snapshots | Snapshot the writable filesystem without a memory dump for cheaper, faster clone/restore when a cold start from disk is enough |
| GPU Sandboxes | Attach host GPUs to sandboxes so Agent and inference workloads can run CUDA inside the isolated VM, with GPU-aware scheduling |
Contributors
Thanks to all contributors:
License
CubeSandbox is released under the Apache License 2.0.
The birth of CubeSandbox stands on the shoulders of open-source giants. Special thanks to Cloud Hypervisor, Kata Containers, virtiofsd, containerd-shim-rs, ttrpc-rust, and others. We have made tailored modifications to some components to fit the CubeSandbox execution model, and the original in-file copyright notices are preserved.
Cube Sandbox is listed in the CNCF Landscape.
Similar Articles
@TencentAI_News: We just open-sourced Cube Sandbox! An instant, concurrent, secure and lightweight sandbox runtime for AI Agents. Built …
Tencent open-sourced Cube Sandbox, a lightweight Rust/KVM-based sandbox runtime for AI agents that cold-starts in under 60 ms with <5 MB overhead.
TencentCloud/CubeSandbox
TencentCloud's CubeSandbox is an open-source, high-performance secure sandbox service for AI agents, built on RustVMM and KVM, offering hardware-level isolation, sub-60ms startup, and compatibility with the E2B SDK.
@HowToPrompt__: China has open-sourced a sandbox that: → boots in 60ms (docker takes 200ms) → uses 5MB of RAM per instance → runs thous…
China has open-sourced CubeSandbox, a hardware-isolated sandbox for AI agents that cold-starts in under 60ms with only 5MB of memory overhead per instance, replacing Docker and E2B with a simple URL swap. It can run thousands of agents on one machine at the hardware level.
@Saboo_Shubham_: Sandbox so good your agent can suspend and resume faster than you can type. Works with ADK, LangChain, Claude Code, Cod…
Highlights an open-source sandbox that lets AI agents suspend and resume quickly, compatible with ADK, LangChain, Claude Code, Codex, and other frameworks.
What sandbox are you all using for AI agents?
The author is asking for recommendations on sandboxes to safely run AI agents on personal machines, mentioning Bubblewrap and Docker as options but noting usability concerns.