# Cube Sandbox (CubeSandbox)

Instant, Concurrent, Secure & Lightweight Sandbox Service for AI Agents

Source: https://wheredoirunthis.com/products/cubesandbox · JSON: https://wheredoirunthis.com/api/products/cubesandbox · Read on 2026-09-25

## At a glance

- Type: Sandbox
- Kind: Open source tool
- Isolation: Kata / gVisor
- Free tier: Not documented
- Starting price: Not disclosed
- GPU: No
- Regions: Not disclosed
- Coverage: 17 of 57 assessed capabilities supported · 4 not assessed
- Agent readiness: read 7.5 of 10 signals, drive 6.5 of 9 signals

## Links

- Homepage: https://cubesandbox.com/
- Docs: https://cubesandbox.com/guide/introduction
- Repository: https://github.com/TencentCloud/CubeSandbox

## Runtime

- **GPU & accelerators**: none (roadmap: GPU Sandboxes) — "'GPU Sandboxes: Attach host GPUs to sandboxes … with GPU-aware scheduling' is listed under Coming Soon." [source](https://cubesandbox.com/guide/roadmap) (confidence: high)
- **BYOC (Bring your own cloud)**: na
- **Secrets management**: Env vars at sandbox creation, or CubeEgress-held credentials injected as headers on matching outbound requests so the sandbox never sees them (used for AgentHub LLM keys). — "'Credential injection — append static headers (typically Authorization: Bearer …) so the workload never sees the raw' key" [source](https://cubesandbox.com/guide/security-proxy) (confidence: high)
- **Storage options**: Template-derived rootfs with a writable layer (set per template); S3 Volumes (bundled MinIO, or external S3/COS/R2), a JuiceFS volume plugin (v0.7.2), host mounts, and a pluggable Volume framework. — "'The installer starts a MinIO and wires the S3 Volume plugin, credentials, and CubeMaster/Cubelet config for you.'" [source](https://cubesandbox.com/guide/s3-volume) (confidence: high)
- **Supported workloads**: LLM-generated code execution, agentic RL rollouts (SWE-bench), long-running agent processes (OpenClaw, Hermes), browser automation, Ubuntu desktop / GUI automation, service stacks (Redis, MySQL) with fast clone — "Introduction + examples + use-case pages." [source](https://cubesandbox.com/guide/introduction) (confidence: high)
- **Persistence**: Sandbox writes are ephemeral by default. Persistence comes from pause (memory + filesystem snapshot to disk; cross-node via S3, preview), S3-backed or JuiceFS Volumes with their own lifecycle, and host mounts from the compute node. — "'by default, all data written inside a sandbox is ephemeral and disappears when the sandbox is killed. Host mount is a Cube-specific extension'" [source](https://cubesandbox.com/guide/persistent-storage) (confidence: high)
- **Data jurisdiction**: na
- **Resource limits & quotas**: Set by the operator's hardware. Idle timeout per sandbox (seconds; -1 = never; on_timeout kill or pause). Nodes stop accepting new sandboxes above 80% disk (error 130597). Claims: <60 ms cold start, <5 MB memory overhead per sandbox, thousands per node; a user-reported RL density of 80–100 1-vCPU/4 GiB sandboxes on a 128-core host. — "'timeout (optional): seconds of idle time before a timeout fires … on_timeout: "kill" (default; destroy) or "pause"'. Density figures are vendor/community benchmarks." [source](https://cubesandbox.com/guide/lifecycle) (confidence: medium)
- **SDK languages**: python, go, javascript — "Official Python (PyPI cubesandbox 0.7.0), Go and Node SDKs in sdk/; the Node package @cubesandbox/sdk was not on npm at scan time. Stock E2B SDKs work against CubeAPI." [source](https://cubesandbox.com/guide/tutorials/sdk/python) (confidence: high)
- **Network & egress controls**: Per-sandbox allow_out/deny_out (IPv4/CIDR/DNS names with A-record learning) enforced in eBPF by CubeVS. Rules marked L7 route HTTP(S) to CubeEgress for domain/path/method filtering, credential injection and JSONL audit logs. Inbound public access can require a per-sandbox traffic token. — "'CubeVS … enforces per-sandbox L3/L4 allow/deny policy, DNS A-record learning for configured domains, session/NAT, TCP RST rejection, and L7 proxy routing decisions.'" [source](https://cubesandbox.com/guide/network-policy) (confidence: high)
- **Snapshots & forks**: Snapshot (memory + filesystem), clone into N independent copies, in-place rollback, create-from-snapshot; the CubeCoW engine does this at hundred-millisecond granularity. — "'Rollback: Restores a running sandbox to a previously captured snapshot state in place — the sandbox ID stays the same'" [source](https://cubesandbox.com/guide/snapshot-rollback-clone) (confidence: high)
- **Deployment methods**: api, sdk, cli, dashboard, container-image, template — "E2B-compatible REST API (CubeAPI :3000), SDKs, operator CLIs (cubemastercli etc.), the WebUI dashboard on :12088, and templates built from OCI container images." [source](https://cubesandbox.com/guide/webui) (confidence: high)
- **Isolation**: Kata / gVisor — "'Every sandbox runs a dedicated OS kernel in its own MicroVM.' CubeHypervisor (a RustVMM/KVM MicroVM monitor derived from Cloud Hypervisor) with CubeShim implementing containerd Shim v2, a Kata-Containers-style design (README credits Cloud Hypervisor and Kata Containers). Enum value covers Kata-style microVMs; it is not Firecracker. eBPF (CubeVS) adds inter-sandbox network isolation." [source](https://cubesandbox.com/architecture/overview) (confidence: high)

## Capabilities

### AI & agents

| Capability | Status | Evidence |
| --- | --- | --- |
| Agent skills | Partially supported | "Configure the OpenClaw skill so agents can execute code in isolated MicroVMs." [source](https://github.com/TencentCloud/CubeSandbox/tree/master/examples/openclaw-integration) |
| AI app builder | Not supported | "Cube Sandbox is infrastructure built for AI Agents" [source](https://cubesandbox.com/guide/introduction) |
| Autonomous QA agent | Not supported | "Cube Sandbox is infrastructure built for AI Agents" [source](https://cubesandbox.com/guide/introduction) |
| Built-in coding agent | Not supported | "The Digital Assistant (AgentHub) uses Cube Sandbox to create and manage OpenClaw assistants." [source](https://cubesandbox.com/guide/digital-assistant) |
| BYOK for LLMs | Partially supported | "Before creating a digital assistant, configure the LLM API key (and provider, base URL, model) on the AgentHub settings page in the WebUI." [source](https://cubesandbox.com/guide/digital-assistant) |
| Credential-injection proxy | Supported | "Credential injection — append static headers (typically Authorization: Bearer …) so the workload never sees the raw" [source](https://cubesandbox.com/guide/security-proxy) |
| LLM gateway | Not supported | "CubeEgress injects the Authorization header for the configured LLM Base URL on outbound requests" [source](https://cubesandbox.com/guide/digital-assistant) |
| MCP client | Not supported | "MCP- or SDK-based sandboxing depends on the agent *choosing* a sandbox tool" [source](https://cubesandbox.com/guide/integrations/claude-code) |
| MCP-server hosting | Not supported | "(no MCP hosting guide or example)" [source](https://cubesandbox.com/llms.txt) |
| MCP server | Not supported | "(no Model Context Protocol server listed in llms.txt, docs or repo tree)" [source](https://cubesandbox.com/llms.txt) |
| Model inference API (first-party) | Not supported | "Cube Sandbox is infrastructure built for AI Agents" [source](https://cubesandbox.com/guide/introduction) |
| Preinstalled coding agent | Not assessed |  |

### Networking & delivery

| Capability | Status | Evidence |
| --- | --- | --- |
| Automatic HTTPS | Partially supported | "TLS configuration only affects how clients reach CubeProxy." [source](https://cubesandbox.com/guide/https-and-domain) |
| Custom domains | Partially supported | "For production deployments, use your own domain and configure a wildcard DNS record: *.your.domain.com → <IP of the node running CubeProxy>" [source](https://cubesandbox.com/guide/https-and-domain) |
| Direct public IPv6 | Not supported | "IPv4 A records are the learned target today" [source](https://cubesandbox.com/guide/network-policy) |
| Edge KV store | Not applicable | "(sandbox runtime)" [source](https://github.com/TencentCloud/CubeSandbox) |
| Egress controls | Supported | "allow_out \| Explicitly allowed IPv4 addresses, CIDRs, or DNS names." [source](https://cubesandbox.com/guide/network-policy) |
| Email send / receive | Not supported | "Sandboxes can host long-running Agent processes (e.g. OpenClaw assistants via AgentHub), complete service stacks (Redis, MySQL, browsers, dev environments), or one-shot code execution" [source](https://cubesandbox.com/guide/introduction) |
| Public preview URLs | Supported | "49983-1aa1fae8fb364edaa8203a7481995b4d.cube.app" [source](https://cubesandbox.com/guide/https-and-domain) |
| Private networking | Not supported | "CubeVS \| Runs in the host eBPF data plane. It enforces per-sandbox L3/L4 allow/deny policy" [source](https://cubesandbox.com/guide/network-policy) |
| Built-in reverse proxy | Supported | "<sandbox-service-port>-<sandboxId>.<domain>" [source](https://cubesandbox.com/guide/https-and-domain) |

### Organisation & security

| Capability | Status | Evidence |
| --- | --- | --- |
| Built-in auth | Partially supported | "authenticate with a per-sandbox token before any request reaches the" [source](https://cubesandbox.com/guide/restrict-public-access) |
| BYOC | Not applicable | "(self-host only)" [source](https://github.com/TencentCloud/CubeSandbox) |
| Deploy into customers' VPCs | Not assessed |  |
| Secrets management | Partially supported | "append static headers (typically Authorization: Bearer …) so the workload never sees the raw" [source](https://cubesandbox.com/guide/security-proxy) |
| Self-host / OSS core | Supported | "Cube Sandbox is licensed under the Apache-2.0 except for the third-party components listed below." [source](https://github.com/TencentCloud/CubeSandbox/blob/master/LICENSE) |
| Sharing | Supported | "By default a Cube Sandbox's public URL is" [source](https://cubesandbox.com/guide/restrict-public-access) |
| SSO / SAML | Not supported | "The Cube Sandbox Dashboard is a built-in web console" [source](https://cubesandbox.com/guide/webui) |
| Teams | Not supported | "You only ever need to open 12088 from your browser." [source](https://cubesandbox.com/guide/webui) |
| Workload identity | Not assessed |  |

### Developer access

| Capability | Status | Evidence |
| --- | --- | --- |
| CLI | Supported | "CubeSandbox ships several host-side command-line tools for operations and debugging." [source](https://cubesandbox.com/guide/cli-tools) |
| E2B-compatible API | Supported | "Native E2B SDK compatibility — swap one URL environment variable, zero business code changes." [source](https://cubesandbox.com/guide/introduction) |
| Filesystem API | Supported | "Go and Python SDKs now implement the full E2B filesystem API surface: list, stat, exists, remove, rename, mkdir, and watch." [source](https://cubesandbox.com/changelog/v0.5.0) |
| Git deploy | Not supported | "It contains not only the root filesystem derived from an OCI image, but also the sandbox configuration and a pre-warmed MicroVM snapshot." [source](https://cubesandbox.com/guide/templates) |
| HTTP data API | Not applicable | "(sandbox runtime)" [source](https://github.com/TencentCloud/CubeSandbox) |
| OpenAPI spec | Supported | "openapi: 3.1.0" [source](https://github.com/TencentCloud/CubeSandbox/blob/master/openapi.yml) |
| Private container registry | Partially supported | "CubeAPI POST /templates and Python/Go SDKs now expose DNS, egress CIDRs, registry auth" [source](https://cubesandbox.com/changelog/v0.4.0) |
| Public API | Supported | "title: CubeAPI description: E2B-compatible sandbox API server." [source](https://github.com/TencentCloud/CubeSandbox/blob/master/openapi.yml) |
| SDK | Supported | "cubesandbox 0.7.0" [source](https://pypi.org/project/cubesandbox/) |
| SSH access | Partially supported | "Python SDK PTY APIs (250d248a): Complete PTY (pseudo-terminal) interface added" [source](https://cubesandbox.com/changelog/v0.5.0) |

### Compute & storage

| Capability | Status | Evidence |
| --- | --- | --- |
| Cloud-init / ignition config | Not supported | "The container image must start an HTTP server on a fixed port and provide a readiness endpoint that returns 2xx." [source](https://cubesandbox.com/guide/templates) |
| Desktop / computer-use sandbox | Partially supported | "Run a full Ubuntu 22.04 GNOME desktop inside a Cube sandbox and open it in your browser." [source](https://cubesandbox.com/guide/integrations/ubuntu-desktop) |
| GPU compute | Not supported | "GPU Sandboxes: Attach host GPUs to sandboxes so Agent and inference workloads can run CUDA inside the isolated VM" [source](https://cubesandbox.com/guide/roadmap) |
| Live-state (memory) snapshots | Supported | "Snapshot: Persists the complete state (memory + filesystem) of a running sandbox as a reusable image." [source](https://cubesandbox.com/guide/snapshot-rollback-clone) |
| Multi-region | Not supported | "The control node runs the full stack: orchestration (CubeMaster), node management (CubeOps), API gateway (cube-api), proxy (CubeProxy + CoreDNS), databases (MySQL + Redis)" [source](https://cubesandbox.com/guide/multi-node-deploy) |
| Object storage | Not supported | "The backend is any S3-compatible object store (AWS S3, Tencent Cloud COS, Cloudflare R2, MinIO, …)" [source](https://cubesandbox.com/guide/s3-volume) |
| Persistent disk | Supported | "Give a sandbox storage that survives its lifecycle: create a Volume → mount it in a sandbox → read/write → destroy the sandbox, the data stays → remount it next time." [source](https://cubesandbox.com/guide/s3-volume) |
| Sandbox templates / custom images | Supported | "A template is a reusable runtime environment from which CubeSandbox creates sandboxes." [source](https://cubesandbox.com/guide/templates) |
| Scale to zero | Supported | "paused \| Snapshot persisted to disk. **Zero** CPU/memory cost. Full state preserved." [source](https://cubesandbox.com/guide/lifecycle) |
| Selectable isolation runtime | Not assessed |  |
| Snapshots / forking | Supported | "Clone: Calls clone() on a running sandbox to immediately derive N fully independent copies. Each copy starts from the source sandbox's current state and runs in isolation." [source](https://cubesandbox.com/guide/snapshot-rollback-clone) |

### Data

| Capability | Status | Evidence |
| --- | --- | --- |
| Database branching | Not applicable | "(sandbox runtime)" [source](https://github.com/TencentCloud/CubeSandbox) |
| Ephemeral instant DB (no-signup) | Not applicable | "(sandbox runtime)" [source](https://github.com/TencentCloud/CubeSandbox) |
| First-party database | Not supported | "databases (MySQL + Redis)" [source](https://cubesandbox.com/guide/multi-node-deploy) |
| Vector search | Not applicable | "(sandbox runtime)" [source](https://github.com/TencentCloud/CubeSandbox) |

### Platform & operations

| Capability | Status | Evidence |
| --- | --- | --- |
| Managed CI/CD runners | Not applicable | "(self-host only)" [source](https://github.com/TencentCloud/CubeSandbox) |
| Built-in observability | Partially supported | "Cubelet exposes CPU and memory metrics for running Cube sandboxes." [source](https://cubesandbox.com/guide/resource-metrics) |
| Preview environments | Not supported | "(no per-branch / per-PR environment feature)" [source](https://cubesandbox.com/guide/templates) |
| Scheduled tasks | Not supported | "timeout (optional): seconds of idle time before a timeout fires" [source](https://cubesandbox.com/guide/lifecycle) |
| Project template marketplace | Not supported | "Install an official preset from Template Store" [source](https://cubesandbox.com/guide/webui) |
| Durable workflows | Not supported | "create() → running → paused → resumed → terminated" [source](https://cubesandbox.com/guide/lifecycle) |

## Agent readiness

### Read: 7.5 of 10 signals present

7.5/10 signals (6 full, 3 partial; 1 na): full llms.txt + llms-full.txt, a real sitemap and markdown twins of every page; no JSON-LD or OG tags

- Llms txt: pass — "https://cubesandbox.com/llms.txt: 46 KB, links every guide, architecture page, blog post and changelog in English and Chinese."
- Llms full txt: pass — "https://cubesandbox.com/llms-full.txt: 2.6 MB full-docs dump (saved as a POINTER stub)."
- Robots AI policy: partial — "robots.txt: 'User-agent: * / Allow: / / Disallow: /404.html'. Generic allow-all; no AI UA named."
- JSON LD: fail — "No application/ld+json in the homepage HTML."
- Sitemap: pass — "sitemap.xml lists 256 absolute URLs and is referenced from robots.txt."
- Meta quality: partial — "<title>CubeSandbox</title> and a descriptive meta description, but no og:/twitter: tags."
- Markdown negotiation: partial — "Every docs page has a .md twin served as text/markdown (e.g. /guide/quickstart.md), but Accept: text/markdown on /guide/quickstart returns text/html."
- Content efficiency: pass — "~4.8 KB readable text / 75.6 KB HTML ≈ 6.3%, server-rendered VitePress."
- Docs discoverable: pass — "Header nav: Home · Guide · Architecture · Developer · Roadmap … reachable without JS."
- Pricing machine readable: na — "No pricing: free Apache-2.0 self-host tool with no commercial tier on this domain."
- Anti bot: pass — "Static GitHub Pages behind Fastly; no challenge on any path fetched."

### Drive: 6.5 of 9 signals present

6.5/9 signals (6 full, 1 partial; 2 na): an E2B-compatible REST API with a real OpenAPI spec, SDKs, auth docs and operator CLIs; no MCP server or webhooks

- Public API: pass — "E2B-compatible REST API (CubeAPI) documented by openapi.yml and the SDK guides."
- Openapi spec: pass — "https://github.com/TencentCloud/CubeSandbox/blob/master/openapi.yml: valid OpenAPI 3.1.0, 26 paths."
- MCP server: fail — "No Model Context Protocol server in docs, llms.txt or the repo tree; /.well-known/mcp → 404."
- SDK packages: pass — "Python (PyPI cubesandbox 0.7.0), Go and Node SDKs + stock E2B SDKs."
- Auth docs: pass — "https://cubesandbox.com/guide/authentication: Bearer / X-API-Key credentials, callback request format, method+path validation warning, error codes."
- Agent self serve creds: na — "Self-hosted: API keys are whatever the operator's auth callback accepts; there is no issuing service."
- Webhooks: fail — "No webhook/event-callback feature documented for sandbox lifecycle events."
- CLI tool: pass — "https://cubesandbox.com/guide/cli-tools: cubemastercli, cubeopscli, cubecli, cube-runtime."
- Error model: pass — "openapi.yml responses reference components/schemas/ApiError; the v0.6.0 release post notes 'Network and security proxy aligned with E2B error code semantics'."
- Rate limit docs: na — "Self-hosted API with no documented rate limiting; capacity is the operator's hardware."
- Agent config: partial — "An OpenClaw SKILL.md (examples/openclaw-integration/skills/cube-sandbox) for agents that use Cube. The repo's AGENTS.md and .claude/ directory are contributor tooling, not product agent config; no /.well-known/agent."

## Coding harnesses

- Claude Code (Anthropic) — "This guide shows how to keep Claude Code running on your host while transparently redirecting every Bash command it runs into an isolated CubeSandbox MicroVM, using a PreToolUse hook." [source](https://cubesandbox.com/guide/integrations/claude-code)
- OpenCode (opencode) — "Run OpenCode on your host, but execute every bash command it issues inside an isolated CubeSandbox MicroVM." [source](https://cubesandbox.com/guide/integrations/opencode-plugin)
- Pi (earendil-works) — "Run the Pi coding agent — a terminal-native AI coding agent — inside CubeSandbox MicroVMs." [source](https://cubesandbox.com/guide/integrations/pi-agent)
- OpenClaw (Peter Steinberger) — "The Digital Assistant (AgentHub) uses Cube Sandbox to create and manage OpenClaw assistants." [source](https://cubesandbox.com/guide/digital-assistant)
- Hermes Agent (Nous Research) — "Hermes Agent: Running a Resident Agent Platform in CubeSandbox" [source](https://cubesandbox.com/guide/usecases/hermes-agent)

## Open source

- Repository: https://github.com/TencentCloud/CubeSandbox
- License: Apache-2.0
- Stars: 12708
- Forks: 1156
- Self-host methods: binary, kubernetes, helm, terraform, source-build
- Self-host dependencies: kvm, redis, mysql, object-storage, containerd, coredns

## Company & presence

- Headquarters: Shenzhen, China (Tencent)
- Founded: 2023 (internal); open-sourced 2026-04-20
- GitHub: https://github.com/TencentCloud/CubeSandbox
- X (Twitter): https://x.com/CubeSandbox_AI
- Discord: https://discord.gg/kkapzDXShb
- GitHub Discussions: https://github.com/TencentCloud/CubeSandbox/discussions
- PyPI: https://pypi.org/project/cubesandbox/
- CNCF Landscape: https://landscape.cncf.io/?landscape=observability-and-analysis&group=ai-native&item=ai-native-infra--workload-runtime--cubesandbox

## Nearby in the atlas

- [Agent Safehouse](/products/agent-safehouse.md)
- [Agent Sandbox](/products/agent-sandbox.md)
- [Agent Substrate](/products/agent-substrate.md)
- [Agent37](/products/agent37.md)
- [AgentNest](/products/agentnest.md)
- [Anthropic Sandbox Runtime (srt)](/products/sandbox-runtime.md)

## Method

Facts come from the product's own public pages. Each claim carries its evidence: a quote and the page it came from. We count capabilities rather than grade products, and "Not assessed" means we have not checked, never that the product lacks it.