# TencentCloud/CubeSandbox

Source: [GitHub](https://github.com/TencentCloud/CubeSandbox)  
Feed7 permalink: https://feed7.dev/p/cubesandbox-1d2cg1q  
Published: Unknown  
Trust: Needs Review (needs_review)

## Why Included

Tencent Cloud open-sourced a KVM microVM sandbox for agent code execution: sub-60ms cold starts, under 5MB overhead per instance, and E2B SDK compatibility as a self-hostable drop-in.

## Source Summary

**The gist** Tencent Cloud's CubeSandbox is an Apache 2.0 microVM sandbox for running agent code, built on **RustVMM/KVM**. It claims **sub-60ms** cold starts with under **5MB** memory overhead per instance, thousands of sandboxes per node, and an **E2B SDK-compatible** REST API pitched as drop-in migration from the hosted service.

## Practical Implication

**Why it matters** If you pay for hosted sandboxes to execute agent-generated code, this is a self-hostable alternative with hardware-level isolation instead of containers — plus agent-specific guardrails: a **credential vault** that keeps keys out of sandboxed code, **egress allowlists** with traffic auditing, and **snapshot/clone/rollback** at sub-second granularity for restoring state.

## Agent-Ready Context

**The gist** Tencent Cloud's CubeSandbox is an Apache 2.0 microVM sandbox for running agent code, built on **RustVMM/KVM**. It claims **sub-60ms** cold starts with under **5MB** memory overhead per instance, thousands of sandboxes per node, and an **E2B SDK-compatible** REST API pitched as drop-in migration from the hosted service.

**Why it matters** If you pay for hosted sandboxes to execute agent-generated code, this is a self-hostable alternative with hardware-level isolation instead of containers — plus agent-specific guardrails: a **credential vault** that keeps keys out of sandboxed code, **egress allowlists** with traffic auditing, and **snapshot/clone/rollback** at sub-second granularity for restoring state.

**Watch out** It needs a Linux host with **KVM**, so no local-Mac runs, and the E2B compatibility layer has acknowledged **API gaps**. **Kubernetes-native** deployment and volume support are still roadmap items, and the performance figures are the project's own benchmarks.

## Context Map

- Layer: infra
- Domains: coding
- Topics: sandboxing

## Uncertainty

- It needs a Linux host with **KVM**, so no local-Mac runs, and the E2B compatibility layer has acknowledged **API gaps**. **Kubernetes-native** deployment and volume support are still roadmap items, and the performance figures are the project's own benchmarks.

## Agent Instruction

Use this item as source-backed context. Do not invent claims beyond the linked source. If this item conflicts with another source, call out the conflict.