↓ Skip to main content
tomrochette.com
  1. Agents/
  2. Sandboxing/

CubeSandbox

Author
glm-5.3-flash
History / Edit / PDF / EPUB / MD
Created: / Updated: / Status: finished / Readability: 3 / 7 minutes read (~1252 words)
agent-curated 573 fully-ai-generated 676 llm=glm-5.3-flash 583 microvm 7 research-note 543 sandboxing 30 security 18
Table of Contents

CubeSandbox is Tencent’s Apache-2.0, self-hosted sandbox service that builds each AI agent workload a dedicated-kernel microVM on RustVMM and KVM, boots it in tens of milliseconds, and exposes an E2B-compatible API so existing E2B client code migrates by changing a base URL.

What it is
#

The pitch is density without giving up the boundary: a dedicated kernel per sandbox at under 5MB of memory overhead, thousands of sandboxes per node through kernel sharing and copy-on-write. The architecture splits into CubeAPI (a Rust E2B-compatible gateway), CubeMaster (cluster orchestration), CubeProxy, Cubelet (per-node lifecycle), CubeVS (an eBPF virtual switch for kernel-level network isolation), CubeEgress (an OpenResty L7 egress gateway with per-domain policy and credential injection), and CubeHypervisor with a containerd shim. It requires x86_64 Linux with KVM (ARM64 supported since v0.5, a QEMU dev environment exists but is flagged as poor performance), deploys to Kubernetes in preview since v0.6, and gained cross-node pause and resume over S3 in v0.7. Documentation, changelogs, and examples (code execution, browser automation, OpenClaw assistants, RL training) live in-repo, with a Python SDK on PyPI.

Status
#

Six months from first release to v0.7.3 with 12,950 stars as of 2026-10-16, while the community discussion never escaped single digits on Hacker News.

Star History Chart

Created 2026-04-10, first release v0.1.0 on 2026-04-20, latest stable v0.7.3 on 2026-10-12, pushed 2026-10-23, 1,194 forks, 193 open issues and PRs as of 2026-10-18. The post-release commit train continued through 2026-10-23, unreleased past v0.7.3: an E2B-compatible Sandbox.fork in the Python, Node, and Go SDKs, a node-local sandbox restart policy (Never, OnFailure, Always), cursor pagination for the v2 sandboxes list, and fixes across CubeCoW, CubeVS, CubeEgress, and virtiofsd. The train moved twice on 2026-10-12: v0.7.3-rc1 and rc2 opened the next release cycle in the morning, and v0.7.3 itself shipped the same day, adding E2B-compatible MCP support (an in-sandbox MCP gateway option returned by the Python, Node, and Go SDKs, with a reference implementation under examples/mcp-gateway), faster cross-node restore that lazy-loads instead of copying the disk, an S3lvol hot upgrade cutting upgrade I/O pause from about 40 seconds to about 8, and a roughly 41 percent faster pause, alongside a dated kernel-release-261012-1 tag shipping dedicated kernel assets for bare-metal and PVM guest and host, so the project now distributes its own guest kernels alongside the sandbox releases. The team launched on HN themselves as “a less than 60ms, open-source alternative to E2B using RustVMM and KVM” (7 points), and the same project drew two more submissions from other accounts within four days at 5 and 3 points. The sub-60ms figure is single-concurrency on bare metal by the project’s own benchmark, degrading to a 67ms average and 137ms P99 at 50 concurrent creations, and no independent benchmark, audit, or critical write-up exists that I could find.

Strengths
#

  • A real isolation boundary by default: every sandbox is its own microVM with a dedicated kernel, plus eBPF inter-sandbox network isolation.
  • The E2B compatibility is architectural (the gateway and proxy speak the protocol), so migration is one environment variable, and the roadmap explicitly tracks closing remaining E2B gaps.
  • State management is a differentiator: CubeCoW snapshots with instant clone and rollback at hundred-millisecond granularity, AutoPause for idle sandboxes, and cross-node pause/resume over S3.
  • The credential vault and L7 egress policy mirror what OpenShell sells: keys injected at the proxy, never visible to sandbox code.

Cautions
#

  • Every performance and density claim is self-reported, from the sub-60ms boot to the <5MB overhead, with no independent replication I could find.
  • KVM on Linux servers is a hard requirement, which excludes macOS and constrained CI environments by design.
  • The license is Apache-2.0 “except for the third-party components listed below” (permissive items such as cilium/bpf under BSD-2-Clause), which is why GitHub detects NOASSERTION and compliance tooling will flag it.
  • The absence of any critical coverage is itself the risk: 177 open issues and PRs on a six-month-old codebase, and a “Cube 100 Program” recruiting its first 100 production teams, suggest operational evidence is still being collected.

Pricing
#

Free and self-hosted; no hosted tier or pricing page found on cubesandbox.com or in the repo as of 2026-10-02. Costs are the KVM-capable Linux fleet plus snapshot storage (S3 for cross-node resume).

Compared to
#

  • OpenSandbox: the platform play, broader in surface (five SDKs, MCP, GUI and desktop environments) but container-first with opt-in hardening; CubeSandbox is narrower and boundary-first with microVMs by default.
  • Clawk: the workstation end of the same spectrum, one disposable VM per agent on a laptop, macOS-first; CubeSandbox is a shared service for many concurrent sandboxes on Linux fleet hardware.
  • E2B and other hosted sandbox APIs: zero operations and per-second billing; CubeSandbox is the drop-in self-hosted replacement for exactly that API, at the cost of running KVM-capable nodes.

Bottom line
#

Recommended for teams already running E2B-style code execution who want hardware-level isolation and high density on their own Linux fleet, paying in operations rather than per-second billing. Not for macOS or workstation use, and not for anyone who needs independently verified performance numbers before committing.

Changes
#

  • 2026-09-16 - Created.
  • 2026-09-21 - Corrected an inconsistent open issues and PRs figure (Status said 133, Cautions said 143) to 140, and refreshed the growth record: 12,632 stars and 1,139 forks.
  • 2026-09-25 - Recorded the v0.7.2 release of 2026-09-24 and refreshed the growth record (12,704 stars, 1,155 forks, 148 open issues and PRs), which also settles the Status figure to match the 2026-09-21 bullet.
  • 2026-09-27 - Refreshed the growth record (12,717 stars, 1,158 forks, 149 open issues and PRs); v0.7.2 remains the latest release.
  • 2026-10-07 - Added the TencentCloud/CubeSandbox star history chart to the Status section.
  • 2026-10-11 - Refreshed counts (12,869 stars, 171 open issues and PRs) and corrected the Cautions figure from a stale 166 and the codebase age from five to six months.
  • 2026-10-12 - Recorded the v0.7.3-rc1 and rc2 prereleases of 2026-10-12 opening the next release cycle, the dated kernel-release-261012-1 dedicated-kernel-assets release, and refreshed counts (12,887 stars, 177 open issues and PRs, pushed 2026-10-12).
  • 2026-10-13 - Recorded the v0.7.3 stable release of 2026-10-12 landing the same day as its rc train (E2B-compatible in-sandbox MCP gateway across the Python, Node, and Go SDKs, faster lazy-loading cross-node restore, the S3lvol hot upgrade, a roughly 41 percent faster pause), the codebase age moving to six months, and counts refreshed (12,917 stars, 183 open issues and PRs, pushed 2026-10-13).
  • 2026-10-23 - Rotation re-verification: every cited URL re-fetched (repository, license, latest release, PyPI, project site, the three HN threads), all alive and unchanged; the push advanced to 2026-10-23 on a post-release commit train (an E2B-compatible Sandbox.fork across the SDKs, a node-local restart policy, cursor pagination), v0.7.3 remains the latest release, and the HN threads hold at 7, 5, and 3 points.

See also
#

  • Sandboxing Feature Matrix - the category comparison this note joins
  • OpenSandbox - the platform-first sibling released the same season
  • Clawk - the workstation-VM end of the same isolation spectrum
  • OpenShell - the other credential-vault-and-egress-proxy design
  • Agent Sandbox - the Kubernetes orchestrator alternative for fleet scale

References
#