Cube Sandbox is a purpose-built, production-hardened infrastructure service designed specifically to host AI Agents, stateful services, and untrusted code execution. Developed by the Tencent Cloud IaaS Frontier Technology Team, it provides high-concurrency, hardware-isolated MicroVM environments that offer performance levels suitable for large-scale production deployments. The architecture is built on RustVMM and KVM, allowing each sandbox to boot in under 60ms with an ultra-low memory footprint of less than 5MB per instance. This design facilitates extreme deployment density, enabling thousands of concurrent AI Agent instances to run on a single physical node.

The system functionality centers on providing a lifecycle-managed runtime that supports long-running agent processes, developer environments, and tool-calling execution. It leverages advanced kernel-level features such as eBPF for network isolation and security, and CubeCoW—a proprietary storage engine using the FICLONE ioctl—to deliver near-instant, zero-copy snapshots, cloning, and rollbacks. By combining these primitives, Cube Sandbox allows for efficient state management, enabling agents to fork, pause, resume, and revert their execution environments in milliseconds, effectively turning complex service management into a lightweight and nearly instantaneous operation.

Some of the key features are:

• Ultra-fast Startup: Achieves sub-60ms cold starts through pre-snapshotted templates and optimized restore paths.
• Hardware-Level Isolation: Runs every sandbox in its own dedicated MicroVM with a private kernel to prevent shared-kernel vulnerabilities.
• High-Density Execution: Enables running thousands of instances per server due to minimal memory overhead and efficient kernel sharing.
• Snapshot, Rollback, & Clone: Provides sub-second checkpoint and branch capabilities through incremental Copy-on-Write storage management.
• E2B SDK Compatibility: Offers seamless migration from E2B Cloud with drop-in compatibility requiring only environment variable changes.
• Auto-Pause & Resume: Automatically manages idle sandboxes by snapshotting them to storage and resuming transparently on request.
• Egress Governance: Implements a kernel-level L7 security proxy that provides domain filtering, credential injection, and detailed access auditing.
• ARM Architecture Support: Includes full native ARM64 support for all build, compilation, and deployment pipelines.

The system operates via a decoupled control and data plane. The control plane, which includes CubeAPI, CubeMaster, and Redis, is entirely stateless, ensuring high availability and trivial horizontal scalability. The data plane is node-local, utilizing Cubelet, CubeShim, and CubeHypervisor to manage individual VM lifecycles and resource allocation on each physical host. Requests are routed through the CubeProxy, which integrates with lifecycle managers to orchestrate the auto-pause and auto-resume behaviors. All network traffic is handled by CubeVS, an eBPF-based virtual switch that performs stateful connection tracking and policy enforcement at wire speed without relying on traditional iptables rules.

Some common use cases include:

• AI Agent Hosting: Running persistent, stateful agent processes like OpenClaw that require long-lived environments with fast recovery capabilities.
• Tool Execution Sandboxes: Providing secure, isolated environments for LLMs to execute untrusted code or interact with external APIs safely.
• Reinforcement Learning Training: Utilizing rapid cloning and snapshotting to run multiple parallel RL exploration branches from a single saved state.
• Development Environments: Delivering instant, disposable, and programmable dev environments for web services or databases that can be snapshotted for reproducibility.