TencentCloud/CubeSandbox
Tencent Cloud open-sourced a KVM microVM sandbox for agent code execution: sub-60ms cold starts, under 5MB overhead per instance, and E2B SDK compatibility as a self-hostable drop-in.
**The gist** Tencent Cloud's CubeSandbox is an Apache 2.0 microVM sandbox for running agent code, built on **RustVMM/KVM**. It claims **sub-60ms** cold starts with under **5MB** memory overhead per instance, thousands of sandboxes per node, and an **E2B SDK-compatible** REST API pitched as drop-in migration from the hosted service.
**Why it matters** If you pay for hosted sandboxes to execute agent-generated code, this is a self-hostable alternative with hardware-level isolation instead of containers — plus agent-specific guardrails: a **credential vault** that keeps keys out of sandboxed code, **egress allowlists** with traffic auditing, and **snapshot/clone/rollback** at sub-second granularity for restoring state.
**The gist** Tencent Cloud's CubeSandbox is an Apache 2.0 microVM sandbox for running agent code, built on **RustVMM/KVM**. It claims **sub-60ms** cold starts with under **5MB** memory overhead per instance, thousands of sandboxes per node, and an **E2B SDK-compatible** REST API pitched as drop-in migration from the hosted service. **Why it matters** If you pay for hosted sandboxes to execute agent-generated code, this is a self-hostable alternative with hardware-level isolation instead of containers — plus agent-specific guardrails: a **credential vault** that keeps keys out of sandboxed code, **egress allowlists** with traffic auditing, and **snapshot/clone/rollback** at sub-second granularity for restoring state. **Watch out** It needs a Linux host with **KVM**, so no local-Mac runs, and the E2B compatibility layer has acknowledged **API gaps**. **Kubernetes-native** deployment and volume support are still roadmap items, and the performance figures are the project's own benchmarks.