TencentCloud/CubeSandbox
Instant, Concurrent, Secure & Lightweight Sandbox for AI Agents.
What it solves
AI agents often need to execute code generated by LLMs, which poses significant security risks if that code is run on host systems. CubeSandbox provides a secure, isolated environment to run this untrusted code without risking the underlying infrastructure.
How it works
Built on RustVMM and KVM, the service creates hardware-isolated MicroVMs that boot in under 60ms with minimal memory overhead. It uses a specialized architecture including a REST API gateway, a cluster orchestrator, and an eBPF-based virtual switch for kernel-level network isolation. It also features a credential vault to keep API keys out of the sandbox and a Copy-on-Write engine for instant snapshots and rollbacks.
Who it’s for
Developers building AI agents that require code execution capabilities, as well as platform engineers needing a scalable, high-density sandbox infrastructure for agentic workloads.
Highlights
- Extreme Isolation: Provides hardware-level isolation with a dedicated Guest OS kernel for every sandbox.
- High Performance: Sub-60ms cold start times and ultra-low memory overhead (<5MB per instance).
- E2B Compatible: Offers seamless migration via native E2B SDK compatibility.
- Advanced State Management: Supports hundred-millisecond granularity for snapshots, cloning, and rollbacks.
- Secure Egress: Includes domain allowlisting and auditing to prevent unauthorized network access from sandboxes.