Repolode
Submit
TencentCloud

TencentCloud/CubeSandbox

Open-source sandbox service for AI agents that runs each workload in a hardware-isolated MicroVM, with E2B SDK compatibility and sub-60ms startup.

Open-source alternative to:E2B

View on GitHubWebsite
Stars
13,031
Forks
1,178
Open issues
201
Last commit
2 days ago

What is it?

CubeSandbox is a sandbox service for running AI agent code. It is built on RustVMM and KVM, and each sandbox gets its own dedicated OS kernel inside a MicroVM. It can run on a single node or scale out to a multi-node cluster.

The project targets fast, dense sandbox creation. According to its documentation, cold start averages under 60ms with less than 5MB of memory overhead per sandbox. It uses resource pooling and snapshot cloning, supports automatic pause and resume of idle sandboxes, and offers snapshot, clone and rollback for running sandboxes.

CubeSandbox exposes an E2B-compatible REST API, so existing E2B SDK clients can switch by changing an environment variable. Network isolation is enforced with eBPF through CubeVS, and CubeEgress provides L7 domain filtering and credential injection so secrets stay out of sandbox code. It includes a WebUI console and supports deployment via Terraform, Kubernetes, or bare metal on x86_64 Linux with KVM, and ARM64.

Key features

  • 01Hardware-isolated MicroVM per sandbox with a dedicated kernel
  • 02E2B SDK compatible API, switchable via an environment variable
  • 03Sub-60ms cold start with resource pooling and snapshot cloning
  • 04Snapshot, clone and rollback of running sandboxes
  • 05eBPF-based network isolation and L7 egress filtering with credential injection
  • 06Deployment via Terraform, Kubernetes or bare metal, with a WebUI console

Use cases

  • Running untrusted code generated by LLM agents in isolated environments
  • Reinforcement learning and SWE-bench style evaluation loops that need many parallel sandboxes
  • Migrating an existing E2B-based agent workload to self-hosted infrastructure
  • Browser automation or tool execution where API keys must stay outside the sandbox

Things to know

  • The README excerpt ends before any install or run commands, so no quick start steps could be confirmed.
  • It is built on RustVMM and KVM, so it needs a host with KVM support and is aimed at bare-metal or cloud server deployments.
  • Several features are still at version 0.x, and some are marked preview, such as cross-node snapshot resume and Kubernetes deployment.
  • The metadata license is NOASSERTION, so the license should be checked directly in the repository before use.

In collections

Open-source AI agent frameworks & apps

Topics

#sandbox#ai-agents#microvm#kvm#e2b#code-execution#ebpf#kubernetes#agents#container

FAQ

What is CubeSandbox?
Open-source sandbox service for AI agents that runs each workload in a hardware-isolated MicroVM, with E2B SDK compatibility and sub-60ms startup. CubeSandbox is a sandbox service for running AI agent code. It is built on RustVMM and KVM, and each sandbox gets its own dedicated OS kernel inside a MicroVM. It can run on a single node or scale out to a multi-node cluster.
Is CubeSandbox free to use? What license does it have?
CubeSandbox is open source under the Other license. Check the license terms before using it in commercial products.
Is CubeSandbox still maintained?
Actively maintained. The last commit to CubeSandbox was on Oct 23, 2026.
What can I use CubeSandbox for?
Running untrusted code generated by LLM agents in isolated environments Reinforcement learning and SWE-bench style evaluation loops that need many parallel sandboxes Migrating an existing E2B-based agent workload to self-hosted infrastructure Browser automation or tool execution where API keys must stay outside the sandbox
Where can I get CubeSandbox?
The source code and installation instructions are on GitHub: https://github.com/TencentCloud/CubeSandbox

Summary generated by AI from the project's README. GitHub stats refresh daily.

Related projects