Instant, Concurrent, Secure & Lightweight Sandbox Service for AI Agents
δΈζζζ‘£ Β·
Quick StartΒ·
DocumentationΒ·
ChangelogΒ·
X(Twitter)Β·
Top Contributor Program
Submit Use Case Cube Sandbox is a high-performance, out-of-the-box secure sandbox service built on RustVMM and KVM. It supports both single-node deployment and easy scaling to multi-node clusters. It is compatible with the E2B SDK and can create a hardware-isolated, fully serviceable sandbox in under 60ms with less than 5MB of memory overhead.
| |
v0.6: K8s deploy, Volume framework, template aliases****K8s deployβ Deploy Cube control-plane components and compute nodes on Kubernetes** Volume framework**β E2B-compatible Volume framework that lets users plug in custom backend storage** Template aliases**β Set an alias when creating a template, and create sandboxes by specifying that alias.Changelog βΒ·K8s deploy βΒ·Volume plugin βv0.5: Auto, Terraform deployer, ARM64 & network policy hardening****Auto/AutoResumeβ idle sandboxes auto-suspend and wake on the next request.** Terraform one-click cluster deployARM64** native full-stack supportnetwork policy hardeningβ per-sandbox traffic tokens, policy-routing egress.Changelog βΒ·Terraform deploy β**v0.4: Safer egress, easier opsCredential vault**β Agents call external APIs as usual; keys never enter the sandbox.** Dashboard**β version matrix and template health checks; see at a glance whether templates need rebuilding after upgrades.Changelog βΒ·Security proxy guide βΒ·WebUI guide βSnapshot, Clone & Rollback at hundred-millisecond granularity CubeSandbox 0.3.0 introduces the
CubeCoW Copy-on-Write snapshot engine, enabling event-level snapshots, instant cloning, and rollback to any saved state.Changelog βπ Initial open-source release Cube Sandbox is now open source! Millisecond boot, hardware-level isolation, E2B-compatible sandbox for AI Agents.
Changelog β β‘ Ultra-fast StartupResource pooling and snapshot cloning skip all cold-start overhead. Average <60ms cold start β sandbox creation faster than a blink. | π Hardware IsolationEvery sandbox runs a dedicated OS kernel in its own MicroVM. | π E2B SDK CompatibleCompatible with E2B SDK interface. Switch from E2B Cloud seamlessly by changing one environment variable β zero client code changes. | π¦ High-density Deployment<5MB overhead per sandbox enables thousands of instances per server via kernel sharing and Copy-on-Write (CoW). Supports automatic sandbox and resume, further improving deployment density and cost optimization. | π‘οΈ Network SecurityeBPF-based inter-sandbox isolation and egress filtering at kernel level; built-in L7 security proxy enables per-domain/path/method policies with automatic credential injection β secrets never visible to sandbox code. | πΈ Flexible State ManagementHigh-frequency snapshot and rollback at hundred-millisecond granularity. Create checkpoints on running sandboxes, roll back to any saved state at any time, or fork from a specific state to explore in parallel. | πΎ Volume FrameworkE2B-compatible Volume framework that lets users plug in custom backend storage solutions. Volumes have an independent lifecycle and can be shared across sandboxes. | π Production DeploymentDeploy production clusters on Tencent Cloud with one click using Terraform. Also supports deployment on standard Kubernetes clusters (preview). | πͺ ARM Architecture SupportFull native ARM64 support across compilation, build, and deployment workflows. |
1.cubesandbox.-.mp4 | #
2.cubesandbox.demo.mp4 | #
Cube-Sandbox.RL.demo.mp4 | #
5.cube.V0.3.0.-.-.mp4 | #
Installation & Demo | Performance Test | RL (SWE-Bench) | Snapshot Β· Clone Β· Rollback |
In the context of AI Agent code execution, CubeSandbox achieves the perfect balance of security and performance:
| Metric | Docker Container | Traditional VM | CubeSandbox |
|---|---|---|---|
| Isolation Level | |||
| Low (Shared Kernel Namespaces) | High (Dedicated Kernel) | Extreme (Dedicated Kernel + eBPF) | |
| Boot Speed *Full-OS boot duration | |||
| 200ms | Seconds | Sub-millisecond (<60ms) | |
| Memory Overhead | |||
| Low (Shared Kernel) | High (Full OS) | Ultra-low (Aggressively stripped, <5MB) | |
| Deployment Density | |||
| High | Low | Extreme (Thousands per node) | |
| E2B SDK Compatible | |||
| / | / | β Drop-in |
*Cold start benchmarked on bare-metal. 60ms at single concurrency; under 50 concurrent creations, avg 67ms, P95 90ms, P99 137ms β consistently sub-150ms.*Memory overhead measured with sandbox specs β€ 32GB. Larger configurations may see a marginal increase.
For detailed metrics on startup latency and resource overhead, see the Core Operations Performance Benchmark Report (bare metal) and the PVM Cloud Server Benchmark Report.
β‘ Millisecond-level startup β watch the fast-start flow above.
Cube Sandbox requires an x86_64 Linux environment with KVM support.
The guide walks you through everything in four steps β provisioning a server, installing Cube Sandbox, creating a sandbox template, and running your first agent code. No source build needed, up and running in minutes.
Choose your deployment path:
| π Recommended |
π Bare Metal βπ» Dev-Env ββ οΈ Not recommended β poor performance π₯οΈ Visual management β from overview to creating a sandbox and streaming logs, all in your browser.
After one-click deployment, open in your browser:
http://<control-node IP>:12088
Recommended three steps:
Check overviewβ Open** Overview**, confirm nodes are Ready and capacity looks healthy** Prepare a template**β Install an official preset from** Template Store**; skip if you already have aREADY
template underTemplates****Create a sandboxβ** Sandboxes β + New sandbox**, pick aREADY
template, and view live logs on the detail page within seconds
See the full WebUI console guide.
Documentation Homeβ complete guide navigation- βοΈ
PVM Deploymentβ deploy on ordinary cloud VMs without bare metal or nested virtualization Template Conceptsβ image-to-template concepts and workflowsExample Projectsβ hands-on examples (code execution, browser automation, OpenClaw integration, RL training, and more)- π₯οΈ
WebUI Consoleβ visual management right after install (:12088
) - π Security Proxy & Credential Vaultβ CubeEgress domain filtering, injection, and auditing - π€ Digital Assistant AgentHubβ create and manage OpenClaw assistants (Preview) - π» Development Environment (QEMU VM)β no KVM access? Try Cube Sandbox inside a disposable OpenCloudOS 9 VM
| Component | Responsibility |
|---|---|
| CubeAPI | |
| High-concurrency REST API Gateway (Rust), compatible with E2B. Swap the URL for seamless migration. | |
| CubeMaster | |
| Cluster orchestrator. Receives API requests and dispatches them to corresponding Cubelets. Manages resource scheduling and cluster state. | |
| CubeProxy | |
| Reverse proxy, compatible with the E2B protocol, routing requests to the appropriate sandbox instances. | |
| Cubelet | |
| Compute node local scheduling component. Manages the complete lifecycle of all sandbox instances on the node. | |
| CubeVS | |
| eBPF-based virtual switch, providing kernel-level network isolation and security policy enforcement. | |
| CubeEgress | |
| OpenResty-based egress security gateway: L7 domain filtering, credential injection, and access auditing; works with CubeVS kernel policies so sandbox traffic cannot bypass inspection. | |
| CubeHypervisor & CubeShim | |
| Virtualization layer β CubeHypervisor manages KVM MicroVMs, CubeShim implements the containerd Shim v2 API to integrate sandboxes into the container runtime. |
π For more details, please read the Architecture Design Document and CubeVS Network Model.
We welcome contributions of all kindsβwhether it's a bug report, feature suggestion, documentation improvement, or code submission!
- π Found a Bug or have questions? Submit an issue onGitHub Issues. - π‘ Have an Idea? Join the conversation inGitHub Discussions. - π οΈ Want to Code? Check out ourCONTRIBUTING.mdto learn how to submit a Pull Request. - π Want to contribute docs? Submit bilingual PRs to our community doc channels:Troubleshooting,Use Cases, andIntegrations. Additionally, theCube 100 Program is now open β we're looking for the first 100 teams running AI agents in production with Cube. Limited to 100 seats.Learn more & apply β - π¬ Want to Chat? Join ourDiscord.
Coming soon β see the full roadmap for details.
| Feature | Description |
|---|---|
| Kubernetes-Native Deployment | |
| Evolve from Helm-based deployment toward CRD- and Operator-centric native management, with smooth upgrade capabilities | |
| Cross-Node & Resume | |
| Suspend a sandbox on one node and resume it on another with full memory and filesystem state preserved | |
| E2B API Compatibility | |
| Close remaining gaps with the E2B specification for full drop-in compatibility | |
| Control Plane / Data Plane Separation | |
| Decouple the control plane from the data plane so control plane upgrades or failures never affect sandboxes already in flight | |
| Sandbox Fault Recovery | |
| Automatic detection and recovery of crashed VMs, stuck shim processes, and network partitions with configurable recovery policies | |
| Scheduling & Operations Enhancements | |
| Resource-aware placement, affinity rules, live rebalancing, and node drain with sandbox migration |
CubeSandbox is released under the Apache License 2.0.
The birth of CubeSandbox stands on the shoulders of open-source giants. Special thanks to Cloud Hypervisor, Kata Containers, virtiofsd, containerd-shim-rs, ttrpc-rust, and others. We have made tailored modifications to some components to fit the CubeSandbox execution model, and the original in-file copyright notices are preserved.
Cube Sandbox is listed in the CNCF Landscape.