TencentCloud/CubeSandbox

Instant, Concurrent, Secure & Lightweight Sandbox for AI Agents.

CubeSandbox

Instant, Concurrent, Secure & Lightweight Sandbox Service for AI Agents

trendshift.io/repositories/26338github.com/tencentcloud/CubeSandbox/stargazers github.com/tencentcloud/CubeSandbox/issues raw.githubusercontent.com/TencentCloud/CubeSandbox/master/LICENSE raw.githubusercontent.com/TencentCloud/CubeSandbox/master/CONTRIBUTING.md pypi.org/project/cubesandbox landscape.cncf.io中文文档 · Quick Start · Documentation · Changelog · X(Twitter)

Cube Sandbox is a high-performance, out-of-the-box secure sandbox service built on RustVMM and KVM. It supports both single-node deployment and easy scaling to multi-node clusters. It is compatible with the E2B SDK and can create a hardware-isolated, fully serviceable sandbox in under 60ms with less than 5MB of memory overhead.

📰 News

Product Highlights

Demos

Benchmarks

In the context of AI Agent code execution, CubeSandbox achieves the perfect balance of security and performance:

• Cold start benchmarked on bare-metal. 60ms at single concurrency; under 50 concurrent creations, avg 67ms, P95 90ms, P99 137ms — consistently sub-150ms.

• Memory overhead measured with sandbox specs ≤ 32GB. Larger configurations may see a marginal increase.

For detailed metrics on startup latency and resource overhead, see the Core Operations Performance Benchmark Report (bare metal) and the PVM Cloud Server Benchmark Report.

Quick Start

⚡ Millisecond-level startup — watch the fast-start flow above.

Cube Sandbox requires an x86_64 Linux environment with KVM support.

The guide walks you through everything in four steps — provisioning a server, installing Cube Sandbox, creating a sandbox template, and running your first agent code. No source build needed, up and running in minutes.

Choose your deployment path:

First thing after install: open the Web console

🖥️ Visual management — from overview to creating a sandbox and streaming logs, all in your browser.

After one-click deployment, open in your browser:

Recommended three steps:

1. Check overview — Open Overview, confirm nodes are Ready and capacity looks healthy

2. Prepare a template — Install an official preset from Template Store; skip if you already have a READY template under Templates

3. Create a sandbox — Sandboxes → + New sandbox, pick a READY template, and view live logs on the detail page within seconds

See the full WebUI console guide.

Deep Dive

• Documentation Home — complete guide navigation

• ☁️ PVM Deployment — deploy on ordinary cloud VMs without bare metal or nested virtualization

• Template Concepts — image-to-template concepts and workflows

• Example Projects — hands-on examples (code execution, browser automation, OpenClaw integration, RL training, and more)

• 🖥️ WebUI Console — visual management right after install (:12088)

• 🔐 Security Proxy & Credential Vault — CubeEgress domain filtering, injection, and auditing

• 🤖 Digital Assistant AgentHub — create and manage OpenClaw assistants (Preview)

• 💻 Development Environment (QEMU VM) — no KVM access? Try Cube Sandbox inside a disposable OpenCloudOS 9 VM

Architecture

👉 For more details, please read the Architecture Design Document and CubeVS Network Model.

Community & Contributing

We welcome contributions of all kinds—whether it's a bug report, feature suggestion, documentation improvement, or code submission!

• 🐞 Found a Bug or have questions? Submit an issue on GitHub Issues.

• 💡 Have an Idea? Join the conversation in GitHub Discussions.

• 🛠️ Want to Code? Check out our CONTRIBUTING.md to learn how to submit a Pull Request.

• 📝 Want to contribute docs? Submit bilingual PRs to our community doc channels: Troubleshooting, Use Cases, and Integrations.

• 💬 Want to Chat? Join our Discord.

Roadmap

Coming soon — see the full roadmap for details.

License

CubeSandbox is released under the Apache License 2.0.

The birth of CubeSandbox stands on the shoulders of open-source giants. Special thanks to Cloud Hypervisor, Kata Containers, virtiofsd, containerd-shim-rs, ttrpc-rust, and others. We have made tailored modifications to some components to fit the CubeSandbox execution model, and the original in-file copyright notices are preserved.

landscape.cncf.io

Cube Sandbox is listed in the CNCF Landscape.