🔥 TencentCloud/CubeSandbox：面向AI智能体的即时、并发、安全、轻量沙箱服务

面向 AI 智能体的即时、并发、安全、轻量沙箱服务

中文文档 · 快速开始 · 文档 · 更新日志 · X(Twitter)

---

Cube Sandbox 是一个基于 RustVMM 和 KVM 构建的高性能、开箱即用的安全沙箱服务。它支持单节点部署，并可轻松扩展至多节点集群。Cube Sandbox 兼容 E2B SDK，能在 60 毫秒内创建一个硬件级隔离、功能完备的沙箱，内存开销低于 5MB。

| v0.5：自动暂停、Terraform 部署器、ARM64 及网络策略加固
自动暂停/自动恢复 — 空闲沙箱自动挂起，并在下次请求时唤醒。 Terraform 一键集群部署 ARM64 全栈原生支持 网络策略加固 — 每沙箱流量令牌、策略路由出口。
更新日志 → · Terraform 部署 →
---|---
| v0.4：更安全的出口，更轻松的运维
凭证保险柜 — 智能体像往常一样调用外部 API；密钥绝不会进入沙箱。 面板 — 版本矩阵和模板健康检查；一目了然地查看模板在升级后是否需要重建。
更新日志 → · 安全代理指南 → · WebUI 指南 →
| 百毫秒级快照、克隆与回滚
CubeSandbox 0.3.0 引入了 CubeCoW 写时复制快照引擎，支持事件级快照、即时克隆以及回滚到任意已保存的状态。 更新日志 →
| 🎉 首次开源发布
Cube Sandbox 现已开源！毫秒级启动、硬件级隔离、兼容 E2B 的 AI 智能体沙箱。 更新日志 →
⚡ <60ms 启动 · 高密度 · 自动暂停/恢复

平均冷启动时间低于 60ms，每实例额外内存开销低于 5MB —— 单节点可运行数千个智能体。支持自动沙箱暂停与恢复，优化成本。

快速开始 → | 🔒 硬件级隔离

每个沙箱拥有独立的 Guest OS 内核 —— 没有 Docker 共享内核逃逸问题；安全地运行不受信任的 LLM 生成的代码。

架构 → | 🔌 无缝 E2B 迁移

原生 E2B SDK 兼容 —— 只需更换一个 URL 环境变量，无需修改业务代码。

示例 →
---|---|---
🖥️ Web 控制台

在浏览器中管理沙箱、模板、节点和版本矩阵 —— 安装后直接打开 :12088 即可。

WebUI 指南 → | 🔐 凭证保险柜

智能体如常调用 LLM 和外部 API —— 密钥绝不会进入沙箱、模型上下文或日志。

安全代理指南 → | 🛡️ 出口控制

域名白名单、即时拦截未授权的出口流量、完整的审计日志以满足合规要求。

安全代理指南 →
📸 快照 · 克隆 · 回滚

对运行中的沙箱进行百毫秒级检查点保存 —— 可从任意状态回滚或派生。

v0.3 更新日志 → | 📦 模板系统

一键将 OCI 镜像转换为模板，从模板商店安装官方预设，并在节点间自动分发。

模板指南 → | 🤖 AgentHub 数字助手

一键启动 OpenClaw 助手 —— 支持快照、回滚以及助手模板发布。

数字助手 →

1.cubesandbox.-.mp4	2.cubesandbox.demo.mp4	Cube-Sandbox.RL.demo.mp4	5.cube.V0.3.0.-.-.mp4
安装与演示	性能测试	RL (SWE-Bench)	快照 · 克隆 · 回滚

在 AI 智能体代码执行的场景下，CubeSandbox 实现了安全与性能的完美平衡：

指标	Docker 容器	传统虚拟机	CubeSandbox
隔离级别	低（共享内核命名空间）	高（独立内核）	极高（独立内核 + eBPF）
启动速度
完整系统启动耗时	200ms	秒级	亚毫秒级（<60ms）
内存开销	低（共享内核）	高（完整 OS）	超低（激进裁剪，<5MB）
部署密度	高	低	极高（每节点数千个）
E2B SDK 兼容	/	/	✅ 直接替换

• 冷启动在裸金属上测得。单并发下 60ms；50 并发创建场景下，平均 67ms，P95 90ms，P99 137ms —— 始终低于 150ms。
• 内存开销在沙箱规格 ≤ 32GB 时测得。更大配置可能会有微小增加。

有关启动延迟和资源开销的详细指标，请参阅核心运维性能基准报告（裸金属）和 PVM 云服务器基准报告。

在单并发和高并发负载下，沙箱交付均低于 150ms	不同实例规格下 CubeSandbox 的基础内存占用
(蓝色：沙箱规格；橙色：基础内存开销)。注意，随着实例规格扩大，内存消耗仅略微增加。

⚡ 毫秒级启动 —— 观察上方快速启动流程。

Cube Sandbox 需要 x86_64 Linux 环境并支持 KVM。

本指南通过 四步 带你完成全部流程 —— 配置服务器、安装 Cube Sandbox、创建沙箱模板并运行你的第一个智能体代码。无需源码构建，几分钟内即可启动。

选择你的部署方式：

安装后第一件事：打开 Web 控制台

🖥️ 可视化管理 —— 从概览到创建沙箱并流式传输日志，一切都在浏览器中完成。

一键部署后，在浏览器中打开：

http://<control-node IP>:12088

推荐三步：

1. 查看概览 — 打开 概览，确认节点状态为 Ready 且容量正常
2. 准备模板 — 从 模板商店 安装官方预设；如果在 模板 下已有 READY 模板，则可跳过
3. 创建沙箱 — 沙箱 → + 新建沙箱，选择

Instant, Concurrent, Secure & Lightweight Sandbox Service for AI Agents

中文文档 · Quick Start · Documentation · Changelog · X(Twitter)

---

Cube Sandbox is a high-performance, out-of-the-box secure sandbox service built on RustVMM and KVM. It supports both single-node deployment and easy scaling to multi-node clusters. It is compatible with the E2B SDK and can create a hardware-isolated, fully serviceable sandbox in under 60ms with less than 5MB of memory overhead.

| v0.5: AutoPause, Terraform deployer, ARM64 & network policy hardening
AutoPause/AutoResume — idle sandboxes auto-suspend and wake on the next request. Terraform one-click cluster deploy ARM64 native full-stack support network policy hardening — per-sandbox traffic tokens, policy-routing egress.
Changelog → · Terraform deploy →
---|---
| v0.4: Safer egress, easier ops
Credential vault — Agents call external APIs as usual; keys never enter the sandbox. Dashboard — version matrix and template health checks; see at a glance whether templates need rebuilding after upgrades.
Changelog → · Security proxy guide → · WebUI guide →
| Snapshot, Clone & Rollback at hundred-millisecond granularity
CubeSandbox 0.3.0 introduces the CubeCoW Copy-on-Write snapshot engine, enabling event-level snapshots, instant cloning, and rollback to any saved state. Changelog →
| 🎉 Initial open-source release
Cube Sandbox is now open source! Millisecond boot, hardware-level isolation, E2B-compatible sandbox for AI Agents. Changelog →
⚡ Sub-60ms boot · High density · Auto pause/resume

Average <60ms cold start, <5MB overhead per instance — run thousands of Agents on one node. Supports automatic sandbox pause and resume for cost optimization

Quick start → | 🔒 Hardware-level isolation

Each sandbox gets its own Guest OS kernel — no Docker shared-kernel escapes; run untrusted LLM-generated code safely

Architecture → | 🔌 Seamless E2B migration

Native E2B SDK compatibility — swap one URL env var, zero business code changes

Examples →
---|---|---
🖥️ Web console

Manage sandboxes, templates, nodes, and version matrix in the browser — open :12088 right after install

WebUI guide → | 🔐 Credential vault

Agents call LLMs and external APIs as usual — keys never enter the sandbox, model context, or logs

Security proxy guide → | 🛡️ Egress control

Domain allowlists, instant block on unauthorized egress, full audit logs for compliance

Security proxy guide →
📸 Snapshot · Clone · Rollback

Hundred-millisecond checkpoints on running sandboxes — roll back or fork from any saved state

v0.3 changelog → | 📦 Template system

Turn OCI images into templates in one step, install official presets from the Template Store, auto-distribute across nodes

Templates guide → | 🤖 AgentHub digital assistants

Spin up OpenClaw assistants in one click — snapshots, rollback, and assistant template publishing

Digital assistant →

1.cubesandbox.-.mp4	2.cubesandbox.demo.mp4	Cube-Sandbox.RL.demo.mp4	5.cube.V0.3.0.-.-.mp4
Installation & Demo	Performance Test	RL (SWE-Bench)	Snapshot · Clone · Rollback

In the context of AI Agent code execution, CubeSandbox achieves the perfect balance of security and performance:

Metric	Docker Container	Traditional VM	CubeSandbox
Isolation Level	Low (Shared Kernel Namespaces)	High (Dedicated Kernel)	Extreme (Dedicated Kernel + eBPF)
Boot Speed
*Full-OS boot duration	200ms	Seconds	Sub-millisecond ( <60ms)
Memory Overhead	Low (Shared Kernel)	High (Full OS)	Ultra-low (Aggressively stripped, <5MB)
Deployment Density	High	Low	Extreme (Thousands per node)
E2B SDK Compatible	/	/	✅ Drop-in

• Cold start benchmarked on bare-metal. 60ms at single concurrency; under 50 concurrent creations, avg 67ms, P95 90ms, P99 137ms — consistently sub-150ms.
• Memory overhead measured with sandbox specs ≤ 32GB. Larger configurations may see a marginal increase.

For detailed metrics on startup latency and resource overhead, see the Core Operations Performance Benchmark Report (bare metal) and the PVM Cloud Server Benchmark Report.

Sub-150ms sandbox delivery under both single and high-concurrency workloads	CubeSandbox base memory footprint across various instance sizes
(*Blue: Sandbox specifications; Orange: Base memory overhead). Note that memory consumption increases only marginally as instance sizes scale up.

⚡ Millisecond-level startup — watch the fast-start flow above.

Cube Sandbox requires an x86_64 Linux environment with KVM support.

The guide walks you through everything in four steps — provisioning a server, installing Cube Sandbox, creating a sandbox template, and running your first agent code. No source build needed, up and running in minutes.

Choose your deployment path:

First thing after install: open the Web console

🖥️ Visual management — from overview to creating a sandbox and streaming logs, all in your browser.

After one-click deployment, open in your browser:

http://<control-node IP>:12088

Recommended three steps:

1. Check overview — Open Overview , confirm nodes are Ready and capacity looks healthy
2. Prepare a template — Install an official preset from Template Store ; skip if you already have a READY template under Templates
3. Create a sandbox — Sandboxes → + New sandbox , pick a READY template, and view live logs on the detail page within seconds

See the full WebUI console guide.

Component	Responsibility
CubeAPI	High-concurrency REST API Gateway (Rust), compatible with E2B. Swap the URL for seamless migration.
CubeMaster	Cluster orchestrator. Receives API requests and dispatches them to corresponding Cubelets. Manages resource scheduling and cluster state.
CubeProxy	Reverse proxy, compatible with the E2B protocol, routing requests to the appropriate sandbox instances.
Cubelet	Compute node local scheduling component. Manages the complete lifecycle of all sandbox instances on the node.
CubeVS	eBPF-based virtual switch, providing kernel-level network isolation and security policy enforcement.
CubeEgress	OpenResty-based egress security gateway: L7 domain filtering, credential injection, and access auditing; works with CubeVS kernel policies so sandbox traffic cannot bypass inspection.
CubeHypervisor & CubeShim	Virtualization layer — CubeHypervisor manages KVM MicroVMs, CubeShim implements the containerd Shim v2 API to integrate sandboxes into the container runtime.

👉 For more details, please read the Architecture Design Document and CubeVS Network Model.

Community & Contributing

We welcome contributions of all kinds—whether it's a bug report, feature suggestion, documentation improvement, or code submission!

Coming soon — see the full roadmap for details.

Feature	Description
Kubernetes-Native Deployment	Deploy and operate CubeSandbox entirely within a K8s cluster using CRDs, operators, and native scheduling — no out-of-band orchestration
Volume Support	Persistent and shared volume support compatible with the E2B volume protocol
Cross-Node Pause & Resume	Suspend a sandbox on one node and resume it on another with full memory and filesystem state preserved
E2B API Compatibility	Close remaining gaps with the E2B specification for full drop-in compatibility
Control Plane / Data Plane Separation	Decouple the control plane from the data plane so control plane upgrades or failures never affect sandboxes already in flight
Sandbox Fault Recovery	Automatic detection and recovery of crashed VMs, stuck shim processes, and network partitions with configurable recovery policies
Scheduling & Operations Enhancements	Resource-aware placement, affinity rules, live rebalancing, and node drain with sandbox migration

CubeSandbox is released under the Apache License 2.0.

The birth of CubeSandbox stands on the shoulders of open-source giants. Special thanks to Cloud Hypervisor, Kata Containers, virtiofsd, containerd-shim-rs, ttrpc-rust, and others. We have made tailored modifications to some components to fit the CubeSandbox execution model, and the original in-file copyright notices are preserved.

---

Cube Sandbox is listed in the CNCF Landscape.