CubeSandbox

CubeSandbox by TencentCloud is a high-performance, open-source secure sandbox service built on RustVMM and KVM for AI agents. It creates hardware-isolated, fully serviceable sandboxes in under 60ms with less than 5MB of memory overhead.

Key features:

• Sub-60ms cold start, <5MB overhead per instance, run thousands of agents on one node
• Hardware-level isolation (each sandbox gets its own Guest OS kernel — no Docker shared-kernel escapes)
• E2B SDK compatible — swap one URL env var, zero business code changes
• AutoPause/AutoResume — idle sandboxes auto-suspend and wake on next request
• Snapshot/Clone/Rollback at hundred-millisecond granularity (CubeCoW Copy-on-Write engine)
• Credential vault — keys never enter sandbox, model context, or logs
• Egress control with domain allowlists and audit logs
• Web console at :12088
• Terraform one-click cluster deploy
• ARM64 native full-stack support
• v0.5.0 released July 2026

Source: https://github.com/TencentCloud/CubeSandbox (⭐10,106)