Cube Sandbox - Tencent Cloud's open-source AI Agent sandbox execution environment foundation

What is Cube Sandbox

Cube Sandbox is Tencent Cloud's open-source AI Agent sandbox execution environment foundation. Built on RustVMM and KVM, it combines hardware-level security isolation with sub-100-millisecond startup speed. Each Agent runs in an independent kernel, with memory overhead per instance below 5MB, and a single machine can run thousands of instances concurrently. Cube Sandbox is natively compatible with the E2B SDK, supports zero-cost migration of Agent applications, and has already supported the stable operation of hundreds-of-millions-scale products such as Tencent Yuanbao.

Cube Sandbox's main features

• Ultra-fast sandbox startup: Based on resource pooling presetting and snapshot cloning technology, it achieves cold startup readiness within 60 milliseconds for a sandbox with a complete kernel, supporting high-frequency Agent invocation scenarios.
• Hardware-level security isolation: Each sandbox runs on top of an independent Guest OS kernel, combined with an eBPF network isolation mechanism, completely avoiding container escape risks and securely executing arbitrary LLM-generated code.
• E2B interface compatibility: Natively compatible with the E2B SDK standard, Agent applications only need to modify environment variables for seamless migration, with no need to change existing business code.
• High-density concurrent deployment: Through underlying rewriting in Rust, CoW memory reuse, and reflink disk sharing, memory overhead per instance is below 5MB, and a single machine can run 2000+ sandbox instances simultaneously.
• Full-cycle Agent support: Supports single code execution and tool invocation, and can continuously carry the Agent's "think-execute-feedback" loop, covering the complete scenario from application running to RL training.
• Fine-grained network control: Through CubeVS, it implements network isolation between sandboxes and outbound traffic filtering, and developers can customize the Agent's access whitelist and blacklist.
• One-click cluster deployment: Supports rapid startup of a single node and multi-node cluster expansion, providing one-click deployment capability from development environment to production environment.

Cube Sandbox's technical principles

• Core virtualization architecture: Built on RustVMM and KVM, each sandbox runs on top of an independent Guest OS kernel, fundamentally avoiding the escape risks brought by Docker containers sharing the kernel Namespace, and achieving true hardware-level isolation.
• Ultra-fast startup mechanism: Through resource pooling presetting, snapshot cloning, and underlying lock optimization, it skips the lengthy initialization process of traditional virtual machines and compresses the cold startup of a sandbox with a complete kernel to within 60 milliseconds.
• Extreme resource optimization: Uses Rust to rewrite the Hypervisor core, combines CoW (Copy-on-Write) memory reuse and reflink disk sharing technology, compresses the Hypervisor's own memory overhead to below 5MB, and achieves high-density deployment of 2000+ instances per machine.
• Kernel-level network isolation: Through the eBPF-driven CubeVS component, it implements strict network isolation between sandboxes and fine-grained outbound traffic filtering in the data plane, replacing the traditional shared network stack.
• Distributed control architecture: The control plane consists of CubeAPI, CubeMaster, and Cubelet, responsible for sandbox lifecycle and template management; the data plane proxies traffic through CubeProxy, supporting seamless expansion from a single node to a multi-node cluster.

How to use Cube Sandbox

• Prepare the KVM environment: On an x86_64 Linux physical machine, cloud bare metal server, or WSL2 (requires Windows 11 22H2+ and nested virtualization enabled), clone the repository and execute prepare_image.sh and run_vm.sh to initialize the runtime environment; domestic users can clone from the cnb.cool mirror for acceleration.
• One-click service deployment: Run the online installation script in the target environment: domestic users use the MIRROR=cn parameter to use the mirror source, and run curl -sL .../online-install.sh | MIRROR=cn bash to complete server-side deployment.
• Create a sandbox template: Use cubemastercli tpl create-from-image to create a code interpreter template based on a preset image (such as sandbox-code:latest), configure the writable layer size and exposed ports, monitor the build progress via tpl watch , wait for the status to become READY , and record the template ID.
• Configure and run Agent code: Install the e2b-code-interpreter Python SDK, set E2B_API_URL(pointing to the local or cluster server),E2B_API_KEY、CUBE_TEMPLATE_ID , and the SSL certificate path, create a sandbox and execute code through the standard E2B interface. The GitHub examples/ directory provides example scenarios such as Shell commands, browser automation, and OpenClaw integration.

Key information and usage requirements for Cube Sandbox

• Product positioning: Tencent Cloud's open-source AI Agent sandbox execution environment foundation, the industry's first open-source sandbox service that combines hardware-level isolation with sub-100-millisecond startup.
• Core performance: Cold start < 60 milliseconds (average 67 milliseconds at 50 concurrent), single-instance memory overhead < 5MB, and a single 96-core server can run 2000+ sandbox instances concurrently.
• Security architecture: Based on RustVMM + KVM, each sandbox has an independent Guest OS kernel, and with the eBPF-driven CubeVS it achieves kernel-level network isolation, completely eliminating the risk of container escape.
• Ecosystem compatibility: Natively compatible with the E2B SDK interface standard; Agent applications only need to modify environment variables to migrate at zero cost from overseas closed-source solutions such as Manus and OpenAI Agents SDK.
• Production validation: Born from Tencent Cloud's Serverless system, it has handled tens of billions of calls, supports Tencent Yuanbao and other products with hundreds of millions of users, and supports MiniMax in scheduling hundreds of thousands of instances within minutes during Agentic RL training.

Core advantages of Cube Sandbox

• Both security and speed: It breaks through the traditional virtual machine paradox that "more secure means slower," achieving a 60-millisecond cold start under the premise of independent-kernel hardware isolation, 2.5 to 50 times faster than the industry average.
• Ultimate resource efficiency: Single-instance memory overhead is less than 5MB, and a single machine can run 2000+ sandboxes simultaneously, reducing the unit cost of large-scale Agent deployment to the lowest level in the industry.
• Zero migration cost: Natively compatible with the E2B SDK; existing Agent applications only need to modify one environment variable to smoothly switch from overseas closed-source solutions, with no need to change any business code.
• Production-grade reliability: Validated by tens of billions of calls in Tencent Cloud's Serverless system, it supports the stable operation of Tencent Yuanbao and other products with hundreds of millions of users, and has withstood the extreme test of MiniMax scheduling hundreds of thousands of instances within minutes.
• Kernel-level network isolation: Through the eBPF-driven CubeVS, it achieves strict network isolation between sandboxes and fine-grained outbound control, completely eliminating the risks of container escape and lateral attacks.

Cube Sandbox project address

• GitHub repository：https://github.com/TencentCloud/CubeSandbox

Comparison of Cube Sandbox with similar competitors

Application Scenarios of Cube Sandbox

• AI Agent Code Execution: Provides a secure runtime environment with hardware-level isolation for Python, Shell, and other code generated by LLMs, preventing malicious or erroneous code from affecting the host machine.
• Agent Tool Invocation Chain: Supports the Agent's "think—execute—feedback" loop (Harness Loop), continuously completing multi-step tool invocations and state iterations.
• Agentic Reinforcement Learning Training: Supports minute-level scheduling of large-scale concurrent sandbox instances, meeting the extreme demands of RL training for high-concurrency, low-cost execution environments.
• Enterprise-grade AI Programming Assistant: Serves as the underlying execution foundation to support AI programming scenarios; for example, after Tencent Yuanbao migrated, resource core-hour consumption was reduced by 95.8%.
• Browser Automation Operations: Browser instances can run within the sandbox, supporting Agents in completing automated tasks such as web browsing, data collection, and form filling.