Run AI agent code in hardware-isolated sandboxes that start in under 60ms
When you worry that agent-generated code might break your server, you want to run it in an isolated space but hate waiting seconds for it to start. CubeSandbox is a service that creates hardware-isolated sandboxes in 60 milliseconds. It is compatible with the E2B SDK, so you can move to this environment with almost no changes to your existing code.
v0.7: Cross-node pause and operational separation
The recent v0.7 version added cross-node pause and resume capabilities. With an S3 backend, you can pause a sandbox on one node and resume it on another. Node management has also been separated into CubeOps to make operations easier, and sandbox network speed has been improved.
Hardware isolation and fast startup
Each sandbox runs in a micro VM with a dedicated OS kernel, providing hardware-level isolation. Resource pooling and snapshot cloning reduce cold start overhead, allowing sandboxes to start in under 60 milliseconds on average. Memory overhead per sandbox is less than 5 megabytes, enabling dense placement of thousands of instances on a single server.
Security and state management features
It provides kernel-level inter-sandbox network isolation and egress filtering based on eBPF. An L7 security proxy allows you to set policies by domain, path, and method, and automatically injects credentials to prevent secrets from being exposed to sandbox code. It supports high-frequency snapshots and rollbacks in 100-millisecond increments, letting you create checkpoints for running sandboxes or revert them to a specific state.
Deployment environment and requirements
It requires an x86_64 Linux environment and KVM support. On Tencent Cloud, you can deploy a production cluster with one click using Terraform, and standard Kubernetes cluster deployment is also supported. Native support for the ARM64 architecture is provided. After installation, you can manage node status, templates, sandbox creation, and logs from a web console in your browser.
Considerations before adoption
This tool is optimized for running AI agent code. If you are already using the E2B SDK, you can switch by changing only environment variables, which is a significant advantage. However, x86_64 Linux and KVM hardware are mandatory, so it cannot be used on ARM-based servers or environments without virtualization support. The memory overhead figures are measured on configurations of 32GB or less, so they may increase slightly on larger setups. It is distributed under the Apache License 2.0, allowing commercial use.
