CubeSandbox

tom@tomrochette.com (Tom Rochette) — Wed, 16 Sep 2026 00:00:00 +0000

CubeSandbox is Tencent’s Apache-2.0, self-hosted sandbox service that builds each AI agent workload a dedicated-kernel microVM on RustVMM and KVM, boots it in tens of milliseconds, and exposes an E2B-compatible API so existing E2B client code migrates by changing a base URL. Facts below verified as of 2026-09-16.

What it is
#

The pitch is density without giving up the boundary: a dedicated kernel per sandbox at under 5MB of memory overhead, thousands of sandboxes per node through kernel sharing and copy-on-write. The architecture splits into CubeAPI (a Rust E2B-compatible gateway), CubeMaster (cluster orchestration), CubeProxy, Cubelet (per-node lifecycle), CubeVS (an eBPF virtual switch for kernel-level network isolation), CubeEgress (an OpenResty L7 egress gateway with per-domain policy and credential injection), and CubeHypervisor with a containerd shim. It requires x86_64 Linux with KVM (ARM64 supported since v0.5, a QEMU dev environment exists but is flagged as poor performance), deploys to Kubernetes in preview since v0.6, and gained cross-node pause and resume over S3 in v0.7. Documentation, changelogs, and examples (code execution, browser automation, OpenClaw assistants, RL training) live in-repo, with a Python SDK on PyPI.

Status
#

Five months from first release to v0.7.1 with 12,537 stars, while the community discussion never escaped single digits on Hacker News. Created 2026-04-10, first release v0.1.0 on 2026-04-20, latest v0.7.1 on 2026-09-11, pushed the day of verification, 1,123 forks, 143 open issues and PRs as of 2026-09-16. The team launched on HN themselves as “a less than 60ms, open-source alternative to E2B using RustVMM and KVM” (7 points), and the same project drew two more submissions from other accounts within four days at 5 and 3 points. The sub-60ms figure is single-concurrency on bare metal by the project’s own benchmark, degrading to a 67ms average and 137ms P99 at 50 concurrent creations, and no independent benchmark, audit, or critical write-up exists that I could find.

Strengths
#

A real isolation boundary by default: every sandbox is its own microVM with a dedicated kernel, plus eBPF inter-sandbox network isolation.
The E2B compatibility is architectural (the gateway and proxy speak the protocol), so migration is one environment variable, and the roadmap explicitly tracks closing remaining E2B gaps.
State management is a differentiator: CubeCoW snapshots with instant clone and rollback at hundred-millisecond granularity, AutoPause for idle sandboxes, and cross-node pause/resume over S3.
The credential vault and L7 egress policy mirror what OpenShell sells: keys injected at the proxy, never visible to sandbox code.

Cautions
#

Every performance and density claim is self-reported, from the sub-60ms boot to the <5MB overhead, with no independent replication I could find.
KVM on Linux servers is a hard requirement, which excludes macOS and constrained CI environments by design.
The license is Apache-2.0 “except for the third-party components listed below” (permissive items such as cilium/bpf under BSD-2-Clause), which is why GitHub detects NOASSERTION and compliance tooling will flag it.
The absence of any critical coverage is itself the risk: 143 open issues and PRs on a five-month-old codebase, and a “Cube 100 Program” recruiting its first 100 production teams, suggest operational evidence is still being collected.

Pricing
#

Free and self-hosted; no hosted tier or pricing page found on cubesandbox.com or in the repo as of 2026-09-16. Costs are the KVM-capable Linux fleet plus snapshot storage (S3 for cross-node resume).

Compared to
#

OpenSandbox: the platform play, broader in surface (five SDKs, MCP, GUI and desktop environments) but container-first with opt-in hardening; CubeSandbox is narrower and boundary-first with microVMs by default.
Clawk: the workstation end of the same spectrum, one disposable VM per agent on a laptop, macOS-first; CubeSandbox is a shared service for many concurrent sandboxes on Linux fleet hardware.
E2B and other hosted sandbox APIs: zero operations and per-second billing; CubeSandbox is the drop-in self-hosted replacement for exactly that API, at the cost of running KVM-capable nodes.

Bottom line
#

Recommended for teams already running E2B-style code execution who want hardware-level isolation and high density on their own Linux fleet, paying in operations rather than per-second billing. Not for macOS or workstation use, and not for anyone who needs independently verified performance numbers before committing.

Changes
#

2026-09-16 - Created.

References
#

https://github.com/TencentCloud/CubeSandbox - repository README: architecture, component table, benchmarks, roadmap, community programs
https://api.github.com/repos/TencentCloud/CubeSandbox - stars, forks, license detection, creation and push dates as of 2026-09-16
https://api.github.com/repos/TencentCloud/CubeSandbox/license - the LICENSE text: Apache-2.0 plus the listed third-party component licenses
https://api.github.com/repos/TencentCloud/CubeSandbox/releases/latest - the v0.7.1 release of 2026-09-11
https://pypi.org/pypi/cubesandbox/json - the Python SDK on PyPI (0.7.0 at verification)
https://cubesandbox.com - the live project site
https://hn.algolia.com/api/v1/items/47863430 - the team’s 7-point Show HN launch and the confirming team comment
https://hn.algolia.com/api/v1/items/47879216 - the 5-point second submission one day later
https://hn.algolia.com/api/v1/items/47848628 - the 3-point third submission, one day earlier

microvm on tomrochette.com

CubeSandbox

What it is
#

Status
#

Strengths
#

Cautions
#

Pricing
#

Compared to
#

Bottom line
#

Changes
#

See also
#

References
#

microvm on tomrochette.com

CubeSandbox

What it is #

Status #

Strengths #

Cautions #

Pricing #

Compared to #

Bottom line #

Changes #

See also #

References #

What it is
#

Status
#

Strengths
#

Cautions
#

Pricing
#

Compared to
#

Bottom line
#

Changes
#

See also
#

References
#