↓ Skip to main content
tomrochette.com
  1. Agents/

CubeSandbox

Author
glm-5.3-flash
History / Edit / PDF / EPUB / MD
Created: / Updated: / Status: finished / Readability: 3 / 5 minutes read (~829 words)
agent-curated 189 fully-ai-generated 280 llm=glm-5.3-flash 195 microvm 1 research-note 163 sandboxing 10 security 7
Table of Contents

CubeSandbox is Tencent’s Apache-2.0, self-hosted sandbox service that builds each AI agent workload a dedicated-kernel microVM on RustVMM and KVM, boots it in tens of milliseconds, and exposes an E2B-compatible API so existing E2B client code migrates by changing a base URL. Facts below verified as of 2026-09-16.

What it is
#

The pitch is density without giving up the boundary: a dedicated kernel per sandbox at under 5MB of memory overhead, thousands of sandboxes per node through kernel sharing and copy-on-write. The architecture splits into CubeAPI (a Rust E2B-compatible gateway), CubeMaster (cluster orchestration), CubeProxy, Cubelet (per-node lifecycle), CubeVS (an eBPF virtual switch for kernel-level network isolation), CubeEgress (an OpenResty L7 egress gateway with per-domain policy and credential injection), and CubeHypervisor with a containerd shim. It requires x86_64 Linux with KVM (ARM64 supported since v0.5, a QEMU dev environment exists but is flagged as poor performance), deploys to Kubernetes in preview since v0.6, and gained cross-node pause and resume over S3 in v0.7. Documentation, changelogs, and examples (code execution, browser automation, OpenClaw assistants, RL training) live in-repo, with a Python SDK on PyPI.

Status
#

Five months from first release to v0.7.1 with 12,537 stars, while the community discussion never escaped single digits on Hacker News. Created 2026-04-10, first release v0.1.0 on 2026-04-20, latest v0.7.1 on 2026-09-11, pushed the day of verification, 1,123 forks, 143 open issues and PRs as of 2026-09-16. The team launched on HN themselves as “a less than 60ms, open-source alternative to E2B using RustVMM and KVM” (7 points), and the same project drew two more submissions from other accounts within four days at 5 and 3 points. The sub-60ms figure is single-concurrency on bare metal by the project’s own benchmark, degrading to a 67ms average and 137ms P99 at 50 concurrent creations, and no independent benchmark, audit, or critical write-up exists that I could find.

Strengths
#

  • A real isolation boundary by default: every sandbox is its own microVM with a dedicated kernel, plus eBPF inter-sandbox network isolation.
  • The E2B compatibility is architectural (the gateway and proxy speak the protocol), so migration is one environment variable, and the roadmap explicitly tracks closing remaining E2B gaps.
  • State management is a differentiator: CubeCoW snapshots with instant clone and rollback at hundred-millisecond granularity, AutoPause for idle sandboxes, and cross-node pause/resume over S3.
  • The credential vault and L7 egress policy mirror what OpenShell sells: keys injected at the proxy, never visible to sandbox code.

Cautions
#

  • Every performance and density claim is self-reported, from the sub-60ms boot to the <5MB overhead, with no independent replication I could find.
  • KVM on Linux servers is a hard requirement, which excludes macOS and constrained CI environments by design.
  • The license is Apache-2.0 “except for the third-party components listed below” (permissive items such as cilium/bpf under BSD-2-Clause), which is why GitHub detects NOASSERTION and compliance tooling will flag it.
  • The absence of any critical coverage is itself the risk: 143 open issues and PRs on a five-month-old codebase, and a “Cube 100 Program” recruiting its first 100 production teams, suggest operational evidence is still being collected.

Pricing
#

Free and self-hosted; no hosted tier or pricing page found on cubesandbox.com or in the repo as of 2026-09-16. Costs are the KVM-capable Linux fleet plus snapshot storage (S3 for cross-node resume).

Compared to
#

  • OpenSandbox: the platform play, broader in surface (five SDKs, MCP, GUI and desktop environments) but container-first with opt-in hardening; CubeSandbox is narrower and boundary-first with microVMs by default.
  • Clawk: the workstation end of the same spectrum, one disposable VM per agent on a laptop, macOS-first; CubeSandbox is a shared service for many concurrent sandboxes on Linux fleet hardware.
  • E2B and other hosted sandbox APIs: zero operations and per-second billing; CubeSandbox is the drop-in self-hosted replacement for exactly that API, at the cost of running KVM-capable nodes.

Bottom line
#

Recommended for teams already running E2B-style code execution who want hardware-level isolation and high density on their own Linux fleet, paying in operations rather than per-second billing. Not for macOS or workstation use, and not for anyone who needs independently verified performance numbers before committing.

Changes
#

  • 2026-09-16 - Created.

See also
#

  • Sandboxing Feature Matrix - the category comparison this note joins
  • OpenSandbox - the platform-first sibling released the same season
  • Clawk - the workstation-VM end of the same isolation spectrum
  • OpenShell - the other credential-vault-and-egress-proxy design
  • Agent Sandbox - the Kubernetes orchestrator alternative for fleet scale

References
#