CubeSandbox: Tencent's Open-Source Hardware-Isolated Sandbox for AI Agents — Sub-60ms Boot, E2B Compatible

The Problem: AI Agents Need Safe Spaces to Run

AI agents are everywhere. From coding assistants to data processors, from research tools to automation pipelines, developers are building agents that need to execute code, access files, and interact with systems.

But here's the catch: AI-generated code is unpredictable. Your agent might hallucinate a command that wipes a directory, or worse, escape its container and compromise your infrastructure.

Traditional solutions fall short:

• Docker containers share the host kernel — one vulnerability breaks isolation
• Full virtual machines take seconds to boot and consume gigabytes of RAM
• Cloud sandboxes add latency and cost

What if you could get hardware-level isolation with container-level speed?

Enter CubeSandbox: The Perfect Balance

CubeSandbox is Tencent Cloud's answer to the AI agent isolation problem. It's an open-source, high-performance sandbox service that combines the security of dedicated virtual machines with the speed of containers.

Built on RustVMM (a Rust-based Virtual Machine Monitor) and KVM (Kernel-based Virtual Machine), CubeSandbox provides true hardware-level isolation without the traditional VM overhead.

What Makes It Special?

⚡ Sub-60ms Cold Start
CubeSandbox boots isolated environments in under 60 milliseconds on average. Under load (50 concurrent creations), it stays sub-150ms even at P99. That's faster than most Docker containers.

🔒 Hardware-Level Isolation
Each sandbox gets its own guest OS kernel. No shared-kernel namespace escapes. If your AI agent tries to exploit a vulnerability, it's trapped in its own VM — it can't reach the host or other sandboxes.

📦 Ultra-Low Overhead
Each instance consumes less than 5MB of memory. You can run thousands of sandboxes on a single node. Compare that to traditional VMs that need gigabytes each.

🔌 E2B SDK Compatible
Already using E2B? CubeSandbox is a drop-in replacement. Change one environment variable (the API endpoint), and your existing code works without modifications.

How CubeSandbox Works

Architecture Overview

CubeSandbox uses a two-tier design:

1. Control Node: Manages sandbox lifecycle, templates, and orchestration
2. Compute Nodes: Run the actual sandboxes using KVM virtualization

When you request a new sandbox:

• The control node allocates resources and selects a compute node
• The compute node boots a lightweight VM using RustVMM
• Your code runs in complete isolation with its own kernel
• All I/O goes through a security proxy that enforces policies

The Security Layer

Credential Vault
Your agents need API keys to call LLMs and external services. CubeSandbox's security proxy injects credentials at runtime — they never enter the sandbox, the model context, or logs. Your keys stay safe even if the agent is compromised.

Egress Control
Define domain allowlists. Unauthorized outbound connections are blocked instantly. Full audit logs for compliance. Want your agent to only talk to your API? Easy.

Snapshot & Rollback
Take hundred-millisecond checkpoints of running sandboxes. Roll back to a known-good state, or fork from any checkpoint. Perfect for reproducible experiments and debugging failed runs.

Real-World Example: Building a Code Review Agent

Let's say you're building an AI agent that reviews pull requests. It needs to:

1. Clone a repository
2. Run tests
3. Execute arbitrary code to analyze patterns
4. Generate a report

Without isolation, you'd risk:

• The agent accidentally (or intentionally) running rm -rf /
• Test failures affecting your host system
• Secrets leaking into logs

With CubeSandbox:

from cubesandbox import Sandbox

# Create a sandbox with Python 3.11 template
sandbox = Sandbox.create(template="python-3.11", timeout=300)

# Upload the PR code
sandbox.upload("./pr-code/", "/workspace/")

# Run tests (isolated)
result = sandbox.execute("cd /workspace && pytest")
print(result.stdout)

# Let the agent explore (safely)
agent_code = """
import ast
import os

# Analyze code patterns
for root, dirs, files in os.walk('/workspace'):
    for file in files:
        if file.endswith('.py'):
            with open(os.path.join(root, file)) as f:
                tree = ast.parse(f.read())
                # Agent does its analysis...
"""

analysis = sandbox.execute(agent_code)

# Extract results
report = sandbox.download("/workspace/report.md")

# Clean up
sandbox.shutdown()

If the agent tries something malicious, it's contained. If tests fail, your host is unaffected. If you need to debug, you can snapshot the state and inspect it later.

Performance Benchmarks

CubeSandbox doesn't just promise performance — it delivers. Here's how it compares:

Metric	Docker	Traditional VM	CubeSandbox
Isolation	Low (shared kernel)	High (dedicated kernel)	Extreme (dedicated kernel + eBPF)
Boot Time	~200ms	Seconds	<60ms
Memory Overhead	Low (shared)	High (full OS)	<5MB
Density	High	Low	Extreme (1000s per node)
E2B Compatible	❌	❌	✅

Under concurrent load (50 sandboxes simultaneously):

• Average: 67ms
• P95: 90ms
• P99: 137ms

Still sub-150ms. That's production-ready.

Key Benefits

✅ Run untrusted AI code safely — hardware isolation prevents escapes

✅ Scale to thousands — ultra-low overhead means high density on existing hardware

✅ Zero downtime — if one sandbox fails, others keep running

✅ Drop-in E2B replacement — migrate in minutes, not weeks

✅ Built-in security — credential vault, egress control, audit logs

✅ Snapshot & rollback — reproducible experiments and debugging

✅ Web console — manage everything from your browser (port 12088)

✅ Open source — self-host, extend, and customize as needed

Getting Started

Requirements

• x86_64 Linux with KVM support
• Docker and Docker Compose
• At least 4GB RAM (more for high concurrency)

Quick Install

# Clone the repository
git clone https://github.com/TencentCloud/CubeSandbox.git
cd CubeSandbox

# Deploy with Docker Compose
docker-compose up -d

# Access the web console
# Open http://localhost:12088 in your browser

Create Your First Sandbox

from cubesandbox import Sandbox

# Create a sandbox
sandbox = Sandbox.create(
    template="ubuntu-22.04",
    timeout=600  # 10 minutes
)

# Execute code
result = sandbox.execute("echo 'Hello from isolated sandbox!'")
print(result.stdout)

# Clean up
sandbox.shutdown()

That's it. You're running isolated AI agents in production.

FAQ

Q: Is CubeSandbox really free?
A: Yes, it's fully open source under Apache 2.0 license. Self-host it on your own infrastructure at no cost.

Q: Can I use it with my existing E2B code?
A: Absolutely. CubeSandbox is E2B SDK compatible. Just change the endpoint URL in your environment variables, and your existing code works without changes.

Q: What happens if my agent tries to escape the sandbox?
A: It can't. Each sandbox has its own kernel and is isolated at the hardware level. Even if the agent exploits a vulnerability in the guest OS, it can't reach the host or other sandboxes.

Q: How many sandboxes can I run on one node?
A: With <5MB overhead per instance, you can run thousands on a typical server. The exact number depends on your hardware and the resources each sandbox needs (CPU, memory, storage).

Q: Does it support GPU workloads?
A: Yes, you can configure templates with GPU passthrough for AI/ML workloads that need hardware acceleration.

Q: What languages and frameworks are supported?
A: CubeSandbox is language-agnostic. Use any language or framework that runs on Linux. Official templates include Python, Node.js, Go, Rust, Java, and more.

Q: Can I use it on cloud VMs without bare metal?
A: Yes. CubeSandbox supports PVM (Paravirtualized Machine) deployment on ordinary cloud VMs without requiring bare metal or nested virtualization.

Q: What if I need help or run into issues?
A: Check the documentation, open an issue on GitHub, or follow @CubeSandbox_AI on X for updates.

Conclusion

AI agents are powerful, but they need guardrails. CubeSandbox gives you the best of both worlds: the security of hardware isolation and the speed of containers.

Whether you're building a code review bot, a data processing pipeline, or an autonomous research assistant, CubeSandbox lets you run untrusted code safely at scale.

Ready to sandbox your AI agents?

• ⭐ Star on GitHub
• 📖 Read the docs
• 🚀 Quick start guide