Running untrusted code generated by LLMs is a significant security nightmare for developers. While running untrusted code safely is a known challenge, the industry has long struggled to balance high-speed execution with true hardware isolation.
Traditional Docker containers offer speed but suffer from shared-kernel vulnerabilities. Conversely, traditional Virtual Machines provide security but are far too slow for real-time agentic workflows. We need a third way.
The Breakthrough: Hardware Isolation at Sub-60ms Speeds
Enter the official CubeSandbox repository, a high-performance, out-of-the-box secure sandbox service built on RustVMM and KVM. It provides the security of a dedicated kernel with the agility of a lightweight container.
CubeSandbox is engineered for extreme density. You can achieve an average cold start of under 60ms with less than 5MB of memory overhead per instance. This allows you to run thousands of independent agents on a single node without breaking the bank.
Seamless Migration and Architecture
The most compelling feature for existing developers is its native E2B SDK compatibility. You can migrate your entire agent infrastructure by simply updating a single environment variable, requiring zero changes to your core business logic.
// Seamlessly point your existing E2B logic to CubeSandbox
const sandbox = new Sandbox({
apiToken: process.env.E2B_API_KEY,
url: 'http://your-cubesandbox-endpoint:8080'
});The Core Components
To understand how CubeSandbox achieves this, we must look at its highly optimized architectural stack:
- CubeAPI: A high-concurrency REST API Gateway written in Rust.
- CubeMaster: The cluster orchestrator managing resource scheduling and state.
- Cubelet: The compute node component managing the local sandbox lifecycle.
- CubeVS & CubeEgress: eBPF-based virtual switching and OpenResty-based egress security for strict domain allowlisting.
- CubeHypervisor: The virtualization layer utilizing KVM MicroVMs.
Performance Benchmarks: Comparing the Alternatives
When evaluating your infrastructure, CubeSandbox offers a unique middle ground that outperforms both legacy methods in deployment density and boot speed.
| Metric | Docker Container | Traditional VM | CubeSandbox |
|---|---|---|---|
| Isolation Level | Low (Shared Kernel) | High (Dedicated Kernel) | Extreme (KVM + eBPF) |
| Boot Speed | ~200ms | Seconds | <60ms |
| Memory Overhead | Low | High | Ultra-low (<5MB) |
| Deployment Density | High | Low | Extreme (Thousands/node) |
Advanced Orchestration and Security Features
Beyond simple execution, CubeSandbox provides a full suite of production-ready tools. For those ready to dive into the technical implementation, setting up your development environment is straightforward and highly documented.
Key features include:
- Credential Vault: Ensures API keys never enter the sandbox or logs.
- Snapshot & Rollback: Perform hundred-millisecond checkpoints on running sandboxes.
- Template System: Turn OCI images into templates to distribute official presets across nodes.
- Egress Control: Full audit logs and instant blocking of unauthorized outbound traffic.
For a complete overview of the system capabilities, refer to the comprehensive documentation index.
Ready to secure your agents? Clone the repository today and start deploying hardware-isolated sandboxes in milliseconds.