TencentCubeSandbox is a self-hosted sandbox service for running AI agent code in isolated environments. Each sandbox is a MicroVM with its own Linux kernel, built on RustVMM and KVM, so code from one agent cannot reach the host or another sandbox through a shared kernel. Resource pooling and Copy-on-Write snapshot cloning let it create a sandbox in under 60 ms with less than 5 MB of memory overhead, which allows thousands of sandboxes per server.
The API follows the E2B SDK interface, so clients written for E2B Cloud can switch to a CubeSandbox deployment by changing the endpoint, without code changes. It runs on a single node or scales out to a multi-node cluster, and deploys to bare metal, ordinary cloud VMs, standard Kubernetes (preview), or Tencent Cloud through Terraform. A web console covers cluster overview, templates, sandbox creation, and live logs. Example projects include code execution, browser automation, OpenClaw integration, and reinforcement-learning training on SWE-Bench.
| Metric | Docker container | Traditional VM | CubeSandbox |
|---|---|---|---|
| Isolation | Shared kernel namespaces | Dedicated kernel | Dedicated kernel plus eBPF |
| Boot time | 200 ms | Seconds | Under 60 ms |
| Memory overhead | Low | High (full OS) | Under 5 MB |
| Density | High | Low | Thousands per node |
| E2B SDK compatible | No | No | Yes |
Cold start was measured on bare metal: 60 ms at single concurrency, and under 50 concurrent creations an average of 67 ms, P95 of 90 ms, and P99 of 137 ms.
| Component | Role |
|---|---|
| CubeAPI | E2B-compatible REST API gateway written in Rust |
| CubeMaster | Cluster orchestrator that schedules requests onto nodes |
| CubeProxy | E2B-protocol reverse proxy that routes to sandbox instances |
| Cubelet | Per-node component managing sandbox lifecycles |
| CubeVS | eBPF virtual switch for network isolation and policy |
| CubeEgress | Egress gateway with L7 domain filtering, credential injection, and auditing |
| CubeHypervisor and CubeShim | KVM MicroVM management and a containerd Shim v2 integration |
Features
- Hardware isolation: every sandbox runs a dedicated OS kernel inside its own MicroVM
- Fast startup: pre-warmed pools and snapshot clones skip kernel boot, giving sub-60 ms creation
- E2B SDK compatibility: E2B clients point at CubeSandbox instead of E2B Cloud with no client code changes
- High density: kernel sharing and Copy-on-Write memory keep per-sandbox overhead under 5 MB, with automatic pause and resume of idle sandboxes
- Network security: eBPF inter-sandbox isolation and egress filtering, plus an L7 proxy with per-domain, path, and method policies
- Credential vault: agents call external APIs while keys are injected at the proxy and never enter the sandbox
- Snapshots and rollback: checkpoints at hundred-millisecond granularity, rollback to any saved state, and forking to explore in parallel
- Cross-node pause and resume: with an S3 backend, a sandbox suspended on one node can resume on another
- Volume framework: E2B-compatible volumes with pluggable backends (S3, host mounts, shared block volumes) and their own lifecycle
- Cluster deployment: single node or multi-node, on bare metal, cloud VMs, Kubernetes, or Tencent Cloud via Terraform, with native ARM64 support
- Web console: node overview, a template store, sandbox creation, and live log streaming
