CubeSandbox: Tencent Cloud's Sub-60ms MicroVM Sandbox for AI Agents
CubeSandbox is an open-source, E2B-compatible sandbox service built on RustVMM and KVM. It creates hardware-isolated microVMs for AI agent code execution in under 60ms with less than 5MB of memory overhead per sandbox.
- ⭐ 10739
- Rust
- KVM
- eBPF
- Apache-2.0
- Updated 2026-07-29
Orca: The ADE for Running Claude Code, Codex, and Cursor in Parallel • herdr: The Terminal Multiplexer Built for Running Many AI Agents at Once
What Is CubeSandbox? #
CubeSandbox solves a narrower, deeper problem than the other multi-agent tools in this roundup: not “how do I run several coding agents at once,” but “how do I let an AI agent execute arbitrary, untrusted code without it being able to touch anything it shouldn’t.” It’s Tencent Cloud’s open-source answer — a high-performance sandbox service built on RustVMM and KVM, giving every sandbox its own dedicated kernel inside a lightweight MicroVM.
🔗 GitHub: https://github.com/TencentCloud/CubeSandbox 🌐 Homepage: https://cubesandbox.com
Released by Tencent Cloud in April 2026 under Apache-2.0 (with Tencent’s copyright notice on top), CubeSandbox reached 10,700+ GitHub stars by late July 2026 and is listed in the CNCF Landscape under AI-native infrastructure.
Why a MicroVM, Not Just a Container? #
Docker containers isolate processes using shared-kernel namespaces — fast, but all sandboxes on a host still share one kernel, so a kernel-level exploit in one sandbox is a host-level problem. Traditional VMs fix that with a dedicated kernel per instance, but pay for it in boot time (seconds) and memory footprint.
CubeSandbox’s pitch is that KVM MicroVMs plus aggressive resource pooling can get VM-grade isolation without the VM-grade cost:
| Metric | Docker Container | Traditional VM | CubeSandbox |
|---|---|---|---|
| Isolation Level | Low (shared kernel namespaces) | High (dedicated kernel) | Dedicated kernel + eBPF |
| Boot Speed | ~200ms | Seconds | Sub-60ms (single concurrency) |
| Memory Overhead | Low (shared kernel) | High (full OS) | Under 5MB per sandbox (claimed) |
| Deployment Density | High | Low | Thousands per node (claimed) |
| E2B SDK Compatible | — | — | Partial drop-in |
These are the project’s own published benchmark numbers (bare-metal, documented in their performance benchmark report), not independently reproduced here.
Key Features #
| Feature | Description |
|---|---|
| Ultra-fast Startup | Resource pooling + snapshot cloning skip cold-start overhead; sub-60ms average |
| Hardware Isolation | Each sandbox gets a dedicated kernel in its own KVM MicroVM |
| E2B SDK Compatible | Swap E2B Cloud for CubeSandbox by changing one environment variable |
| High-density Deployment | Kernel sharing + Copy-on-Write keeps per-sandbox overhead under 5MB; supports pause/resume |
| Network Security | eBPF-based inter-sandbox isolation and egress filtering, plus an L7 security proxy with per-domain/path/method policy and automatic credential injection |
| Snapshot & Rollback | Hundred-millisecond-granularity checkpoints; roll back or fork a sandbox to a saved state |
| Volume Framework | E2B-compatible pluggable storage volumes with an independent lifecycle, shareable across sandboxes |
| ARM64 Support | Full native ARM64 build and deployment path alongside x86_64 |
Architecture #
| Component | Responsibility |
|---|---|
| CubeAPI | High-concurrency REST API gateway (Rust), E2B-compatible |
| CubeMaster | Cluster orchestrator — dispatches requests to Cubelets, manages scheduling and cluster state |
| CubeProxy | Reverse proxy routing E2B-protocol requests to the right sandbox instance |
| Cubelet | Per-node local scheduler managing the full lifecycle of sandboxes on that node |
| CubeVS | eBPF-based virtual switch for kernel-level network isolation |
| CubeEgress | OpenResty-based egress gateway — domain filtering, credential injection, access auditing |
| CubeHypervisor / CubeShim | Virtualization layer — CubeHypervisor manages KVM MicroVMs, CubeShim implements containerd Shim v2 to plug into standard container runtimes |
Deployment #
CubeSandbox needs an x86_64 Linux host with KVM support. The project documents three paths:
- PVM (Cloud VM) — recommended; deploy on an ordinary cloud VM without needing bare metal or nested virtualization
- Bare Metal — direct deployment, including Terraform for one-click Tencent Cloud production clusters
- Dev-Environment (QEMU VM) — for testing without KVM access; explicitly flagged by the project as not recommended for production due to poor performance
After deployment, a Web console ships out of the box:
http://<control-node IP>:12088
From there: check the Overview page for node health, install a template from the Template Store, then create a sandbox and watch its logs stream live.
Use Cases #
1. Running Untrusted Agent-Generated Code Safely #
Give each AI coding agent’s generated code its own MicroVM instead of a shared-kernel container, so a compromised sandbox can’t reach the host or other sandboxes.
2. High-Density Multi-Tenant Agent Platforms #
The sub-5MB overhead and pause/resume support are aimed at platforms running many agent sessions per physical node cost-effectively.
3. Migrating Off E2B Cloud #
Point existing E2B SDK code at a self-hosted CubeSandbox cluster instead of E2B’s hosted service, for cost or data-residency reasons.
4. RL Training Environments #
The project’s own demo reel includes an SWE-Bench reinforcement-learning use case, using fast snapshot/clone/rollback to reset agent environments between training episodes.
What’s Still On the Roadmap #
Per the project’s published roadmap, several things are not yet complete: full E2B API parity (currently partial), Kubernetes-native CRD/Operator-based deployment (currently Helm-based), cross-node pause/resume, and automatic fault recovery for crashed VMs or stuck shims. Worth checking before betting production infrastructure on any of these specifically.
Related Repositories #
| Repository | Purpose |
|---|---|
| E2B | The sandbox SDK/protocol CubeSandbox targets compatibility with |
| firecracker-microvm | AWS’s MicroVM technology, a similar KVM-based isolation approach used elsewhere in the industry |
Related Articles #
- Orca: The ADE for Running Claude Code, Codex, and Cursor in Parallel — orchestrating multiple agents, a different layer of the same “safer, more scalable agent infrastructure” problem
- herdr: The Terminal Multiplexer Built for Running Many AI Agents at Once — terminal-layer multi-agent management
Conclusion #
CubeSandbox is Tencent Cloud’s bet that AI agent code execution needs VM-grade isolation without VM-grade cost — dedicated kernels via KVM MicroVMs, sub-60ms starts, and under 5MB of overhead per sandbox, wrapped in an E2B-compatible API. It’s infrastructure-grade rather than a laptop toy: it needs real KVM access and is aimed at teams running agent code execution at scale, not solo developers trying it over lunch.
Best for: Teams building AI agent platforms that need to run untrusted, agent-generated code with strong isolation, at high density, without paying full traditional-VM overhead.
GitHub: https://github.com/TencentCloud/CubeSandbox
Recommended Infrastructure for Self-Hosting #
CubeSandbox specifically needs KVM-capable hardware — not every VPS tier supports nested virtualization:
- DigitalOcean — $200 free credit for 60 days across 14+ global regions; check the droplet size supports KVM/nested virtualization before deploying CubeSandbox.
- HTStack — Hong Kong VPS with low-latency access from mainland China. This is the same IDC that hosts dibi8.com — battle-tested in production.
Affiliate links — they don’t cost you extra and they help keep dibi8.com running.
Last updated: 2026-07-29
💬 Discussion