How CubeSandbox Works
CubeSandbox is a high-performance sandbox service designed for AI agents, built on RustVMM and KVM to provide hardware-isolated execution environments. It achieves millisecond-level startup times by combining resource pooling, snapshot cloning, and Copy-on-Write (CoW) memory management. Each sandbox runs in a dedicated MicroVM with its own Linux kernel, ensuring extreme isolation and security. The architecture separates the control plane from compute operations, enabling seamless scaling across single-node and multi-node clusters.
The system leverages a modular design with key components including CubeAPI (a high-concurrency REST API Gateway compatible with the E2B SDK), CubeMaster (cluster orchestrator), CubeProxy (reverse proxy for E2B protocol routing), Cubelet (local compute node scheduler), CubeVS (eBPF-based virtual switch for network isolation), and CubeEgress (L7 security proxy for domain filtering and credential injection). These components work together to deliver deterministic, secure, and efficient sandbox execution.
CubeSandbox supports ARM64 architecture natively, ensuring compatibility across diverse hardware environments. It also integrates with Kubernetes for production deployments, offering flexibility in deployment strategies. The system’s lightweight design—with less than 5MB memory overhead per sandbox—enables high-density deployment, making it suitable for large-scale AI agent workloads.
Ultra-Fast Startup and Resource Efficiency
CubeSandbox eliminates cold-start overhead through resource pooling and snapshot cloning, achieving sub-60ms cold starts. This performance is critical for AI agents requiring rapid, deterministic execution. The system’s memory efficiency is further enhanced by shared read-only kernel structures, reducing per-sandbox overhead to single-digit MBs. This allows thousands of sandboxes to coexist on a single server, optimizing resource utilization and cost.
Hardware-Level Isolation and Security
Every sandbox operates within a dedicated MicroVM, isolating it from the host and other sandboxes. This hardware-level isolation prevents container breakouts and malicious host compromise, a critical requirement for secure AI agent operations. Network security is enforced at the kernel level using eBPF-based inter-sandbox isolation and egress filtering. The built-in L7 security proxy, CubeEgress, manages route authorization and credential injection without exposing secrets to sandbox code.
Flexible State Management and Snapshots
CubeSandbox introduces CubeCoW, a Copy-on-Write snapshot engine that enables event-level snapshots, instant cloning, and rollback to any saved state at hundred-millisecond granularity. This feature allows users to create checkpoints on running sandboxes, roll back to previous states, or fork divergent execution paths for complex decision-tree validation. Snapshots are stored independently of sandbox instances, supporting seamless hotplug and lifecycle management.
Compatibility and Deployment Flexibility
CubeSandbox is fully compatible with the E2B SDK, allowing seamless migration from E2B Cloud by simply changing an environment variable—no client code modifications are required. The system supports deployment on Tencent Cloud via Terraform or on standard Kubernetes clusters, with native ARM64 support across compilation, build, and deployment workflows.
Production-Grade Features
Recent updates, such as cross-node pause/resume functionality, enable sandboxes to be suspended on one node and resumed on another or created from snapshots. The separation of control plane and operations improves scalability and operational efficiency. Additional features include auto-pause/resume for idle sandboxes, credential vaults for secure API access, and a dashboard for monitoring template health and version compatibility.
Use Cases for AI Agents
CubeSandbox is tailored for AI agents requiring secure, isolated, and high-performance execution environments. Its low-latency startup and hardware isolation make it ideal for applications where rapid, deterministic responses are critical.
Secure Code Execution for AI Agents
AI agents often interact with untrusted code or external APIs, making isolation and security paramount. The combination of MicroVM isolation and eBPF-based network policies ensures that malicious or flawed code cannot escape its sandbox, protecting both the agent and the underlying infrastructure.
Browser Automation and Web Scraping
AI agents frequently automate browser interactions or scrape web data, tasks that require dynamic and potentially untrusted environments. CubeSandbox’s ability to create isolated MicroVMs with full OS-level capabilities allows agents to perform these tasks securely. The snapshot and rollback features enable agents to revert to a clean state after each task, mitigating risks from malicious or unstable web content.
Reinforcement Learning (RL) Training
RL training involves iterative experimentation, often requiring agents to explore multiple divergent paths simultaneously. CubeSandbox’s snapshot and fork capabilities allow agents to capture and replay specific states, enabling efficient exploration of decision trees.
Multi-Tenant AI Workloads
In multi-tenant environments, such as shared AI platforms or cloud-based agent services, ensuring isolation between users is essential. CubeSandbox’s hardware-level isolation and resource pooling allow providers to host thousands of concurrent sandboxes with minimal overhead. The auto-pause/resume feature further optimizes resource usage, reducing costs while maintaining performance.
Compliance and Regulatory Requirements
CubeSandbox’s hardware isolation and audit-ready security features—such as egress filtering and credential injection—help meet these requirements.
Key Features and Capabilities
- Sub-60ms Cold Start: Achieves millisecond-level sandbox instantiation through resource pooling and snapshot cloning, eliminating cold-start delays.
- Hardware-Level Isolation: Each sandbox runs in a dedicated MicroVM with its own Linux kernel, preventing container breakouts and host compromise.
- E2B SDK Compatibility: Seamlessly integrates with existing E2B-based workflows by changing a single environment variable, requiring no client-side modifications.
- High-Density Deployment: Less than 5MB memory overhead per sandbox enables thousands of concurrent instances on a single server, optimized further by auto-pause/resume for idle sandboxes.
- Kernel-Level Network Security: Uses eBPF-based inter-sandbox isolation and CubeEgress for L7 domain filtering, credential injection, and access auditing without exposing secrets.
- Flexible State Management: CubeCoW snapshot engine supports event-level snapshots, instant cloning, and rollback at hundred-millisecond granularity, enabling complex workflow validation.
- Pluggable Volume Framework: Supports custom backend storage solutions (e.g., S3, JuiceFS, local mounts) with independent lifecycles, allowing shared volumes across sandboxes.
- Production Deployment Options: One-click Terraform deployment on Tencent Cloud or Kubernetes clusters, with native ARM64 support for diverse hardware environments.
- Cross-Node Resilience: Sandboxes can be paused on one node and resumed on another, or created from snapshots, improving fault tolerance and scalability.
- Credential Vault and Security Proxy: Agents interact with external APIs securely, with keys never entering the sandbox, and traffic is inspected at the kernel level.
- ARM64 and Bare-Metal Support: Full native support for ARM64 architectures and bare-metal deployments, ensuring compatibility across modern and legacy systems.