DEVOURED
Cube Sandbox (GitHub Repo)
Cube Sandbox is a Rust-based, hardware-isolated sandbox for AI agents that boots in under 60ms with minimal memory overhead.
What: Built on RustVMM and KVM, Cube Sandbox offers extreme density, allowing thousands of agents per node. It provides copy-on-write snapshots, egress control via eBPF, and native compatibility with the E2B SDK.
Why it matters: This is an attempt to solve the security-versus-speed trade-off in AI agent code execution by moving beyond shared-kernel containerization toward lightweight micro-VMs.
Takeaway: If you are running E2B, you can migrate to Cube Sandbox by simply swapping the URL environment variable to test its performance.
Deep dive
- Uses RustVMM and KVM for hardware-level kernel isolation.
- Supports Copy-on-Write (CoW) snapshots for millisecond-level cloning and state rollback.
- Network policies are enforced at the kernel level using eBPF.
- Supports both single-node and multi-node clusters with auto-pause/resume capabilities.
Decoder
- RustVMM: A collection of crates for building virtual machine monitors in Rust.
- KVM: Kernel-based Virtual Machine, a Linux module that turns the kernel into a hypervisor.
- eBPF: Extended Berkeley Packet Filter, a technology for running sandboxed programs in the Linux kernel for networking and security.
Original article
CubeSandbox
Instant, Concurrent, Secure & Lightweight Sandbox Service for AI Agents
Cube Sandbox is a high-performance, out-of-the-box secure sandbox service built on RustVMM and KVM. It supports both single-node deployment and easy scaling to multi-node clusters. It is compatible with the E2B SDK and can create a hardware-isolated, fully serviceable sandbox in under 60ms with less than 5MB of memory overhead.
📰 News
- v0.5: AutoPause, Terraform deployer, ARM64 & network policy hardening
AutoPause/AutoResume — idle sandboxes auto-suspend and wake on the next request. Terraform one-click cluster deploy. ARM64 native full-stack support. Network policy hardening — per-sandbox traffic tokens, policy-routing egress. - v0.4: Safer egress, easier ops
Credential vault — Agents call external APIs as usual; keys never enter the sandbox. Dashboard — version matrix and template health checks; see at a glance whether templates need rebuilding after upgrades. - Snapshot, Clone & Rollback at hundred-millisecond granularity
CubeSandbox 0.3.0 introduces the CubeCoW Copy-on-Write snapshot engine, enabling event-level snapshots, instant cloning, and rollback to any saved state. - Initial open-source release
Cube Sandbox is now open source! Millisecond boot, hardware-level isolation, E2B-compatible sandbox for AI Agents.
Product Highlights
- Sub-60ms boot · High density · Auto pause/resume: Average <60ms cold start, <5MB overhead per instance — run thousands of Agents on one node. Supports automatic sandbox pause and resume for cost optimization.
- Hardware-level isolation: Each sandbox gets its own Guest OS kernel — no Docker shared-kernel escapes; run untrusted LLM-generated code safely.
- Seamless E2B migration: Native E2B SDK compatibility — swap one URL env var, zero business code changes.
- Web console: Manage sandboxes, templates, nodes, and version matrix in the browser.
- Credential vault: Agents call LLMs and external APIs as usual — keys never enter the sandbox, model context, or logs.
- Egress control: Domain allowlists, instant block on unauthorized egress, full audit logs for compliance.
- Snapshot · Clone · Rollback: Hundred-millisecond checkpoints on running sandboxes — roll back or fork from any saved state.
- Template system: Turn OCI images into templates in one step, install official presets from the Template Store, auto-distribute across nodes.
Benchmarks
In the context of AI Agent code execution, CubeSandbox achieves the perfect balance of security and performance:
| Metric | Docker Container | Traditional VM | CubeSandbox |
|---|---|---|---|
| Isolation Level | Low (Shared Kernel Namespaces) | High (Dedicated Kernel) | Extreme (Dedicated Kernel + eBPF) |
| Boot Speed | 200ms | Seconds | Sub-millisecond (<60ms) |
| Memory Overhead | Low (Shared Kernel) | High (Full OS) | Ultra-low (Aggressively stripped, <5MB) |
| Deployment Density | High | Low | Extreme (Thousands per node) |
Quick Start
Cube Sandbox requires an x86_64 Linux environment with KVM support.
The guide walks you through everything in four steps — provisioning a server, installing Cube Sandbox, creating a sandbox template, and running your first agent code.
First thing after install: open the Web console
After one-click deployment, open in your browser: http://<control-node IP>:12088
Architecture
| Component | Responsibility |
|---|---|
| CubeAPI | High-concurrency REST API Gateway (Rust), compatible with E2B. |
| CubeMaster | Cluster orchestrator. Receives API requests and dispatches them to corresponding Cubelets. |
| CubeProxy | Reverse proxy, compatible with the E2B protocol. |
| Cubelet | Compute node local scheduling component. Manages the complete lifecycle of all sandbox instances. |
| CubeVS | eBPF-based virtual switch, providing kernel-level network isolation. |
| CubeEgress | OpenResty-based egress security gateway: L7 domain filtering, credential injection, and auditing. |
Roadmap
| Feature | Description |
|---|---|
| Kubernetes-Native Deployment | Deploy and operate CubeSandbox entirely within a K8s cluster using CRDs. |
| Volume Support | Persistent and shared volume support compatible with the E2B volume protocol. |
| Cross-Node Pause & Resume | Suspend a sandbox on one node and resume it on another with state preserved. |
License
CubeSandbox is released under the Apache License 2.0.
Explore all 56 articles in today's digest
Fresh dev news, AI-digested daily. Never miss a trend at devoured.fyi