CubeSandbox: Instant, Concurrent, and Secure Sandbox for AI Agents

Summary

CubeSandbox, developed by TencentCloud, is a high-performance, secure sandbox service built on RustVMM and KVM, designed specifically for AI agents. It offers ultra-fast startup times, hardware-level isolation, and high-density deployment, making it ideal for scalable and secure agent execution environments. The service is also fully compatible with the E2B SDK for seamless integration.

Use at your own risk

OSRepos shares public repositories for knowledge and discovery only. Any installation, execution, configuration, or use of code from these repositories is the user's own responsibility. Always review the repository, source code, dependencies, licenses, and security implications before running or installing anything. OSRepos is not responsible for issues, damages, or losses resulting from third-party repositories.

Introduction

CubeSandbox, developed by TencentCloud, is a cutting-edge, high-performance, and secure sandbox service specifically engineered for AI agents. Built on RustVMM and KVM, it provides an instant, concurrent, and lightweight environment for executing agent code. With an average cold start time of less than 60ms and a minimal memory overhead of under 5MB per sandbox, CubeSandbox ensures efficient and scalable operations. It is fully compatible with the E2B SDK, allowing for seamless integration and migration.

Installation

Getting started with CubeSandbox requires an x86_64 Linux environment with KVM support. The quick start guide outlines a straightforward four-step process: provisioning a server, installing CubeSandbox, creating a sandbox template, and running your first agent code.

You can choose your preferred deployment path:

PVM · Cloud VM (Recommended)
Bare Metal
Dev-Env (Not recommended for performance)

After installation, access the Web console at http://<control-node IP>:12088 for visual management, template preparation, and sandbox creation.

Examples

CubeSandbox provides various examples to help users understand its capabilities and integrate it into their workflows. These include practical demonstrations of code execution, browser automation, integration with OpenClaw, and applications in reinforcement learning (RL) training. For detailed guides and hands-on examples, refer to the official documentation.

Example Projects

Why Use CubeSandbox?

CubeSandbox stands out with its unique combination of features designed for the demanding requirements of AI agent execution:

Ultra-fast Startup: Achieves less than 60ms cold start times through resource pooling and snapshot cloning, eliminating cold-start overhead.
Hardware Isolation: Each sandbox runs a dedicated OS kernel within its own MicroVM, ensuring robust security.
E2B SDK Compatible: Offers a drop-in replacement for E2B Cloud, requiring minimal changes to existing client code.
High-density Deployment: Supports thousands of instances per server with less than 5MB overhead per sandbox, thanks to kernel sharing and Copy-on-Write (CoW). It also features automatic sandbox pause and resume for optimized resource utilization.
Network Security: Implements eBPF-based inter-sandbox isolation and kernel-level egress filtering. A built-in L7 security proxy provides domain/path/method policies and automatic credential injection, keeping secrets secure.
Flexible State Management: Enables high-frequency snapshot and rollback at hundred-millisecond granularity, allowing for instant cloning and recovery to any saved state.
Volume Framework: An E2B-compatible volume framework allows users to plug in custom backend storage solutions, with volumes having independent lifecycles and shareability across sandboxes.
Production Deployment: Facilitates one-click cluster deployment on Tencent Cloud using Terraform and supports deployment on standard Kubernetes clusters (preview).
ARM Architecture Support: Provides full native ARM64 support across compilation, build, and deployment.

Benchmarks show CubeSandbox offering extreme isolation, sub-millisecond boot speeds (under 60ms), ultra-low memory overhead (less than 5MB), and extreme deployment density, surpassing traditional VMs and Docker containers in key metrics for AI agent workloads.