# CubeSandbox | Tencent Cloud | Knowledge Base | Instagit

Instant, Concurrent, Secure & Lightweight Sandbox for AI Agents.

GitHub Stars: 7k

Repository: https://github.com/TencentCloud/CubeSandbox

---

## Articles

### [High-Concurrency API Design Patterns in the CubeAPI REST Gateway](/TencentCloud/CubeSandbox/what-are-the-high-concurrency-api-design-patterns-used-in-the-cubeapi-rest-gateway)

Explore high-concurrency API design patterns in CubeAPI's REST Gateway. Learn how Tencent Cloud's CubeSandbox achieves millions of concurrent requests with Rust async services and advanced proxying.

- Tags: deep-dive
- Published: 2026-07-16

### [How CubeSandbox Supports Live Migration of VM States Between Hosts](/TencentCloud/CubeSandbox/how-does-cubesandbox-support-live-migration-of-vm-states-between-hosts)

CubeSandbox enables live VM migration with a coordinated control plane, hypervisor state machine, and incremental memory transfer using soft-dirty page tracking for minimal downtime.

- Tags: how-to-guide
- Published: 2026-07-16

### [How CubeSandbox Applies Seccomp Filters for System Call Filtering in MicroVM Environments](/TencentCloud/CubeSandbox/how-are-seccomp-filters-applied-for-system-call-filtering-in-microvm-environments-within-cubesandbox)

Learn how CubeSandbox uses seccomp filters to secure MicroVMs. Discover how protobuf messages are converted to OCI seccomp profiles for robust system call filtering. Explore our TencentCloud/CubeSandbox repository.

- Tags: deep-dive
- Published: 2026-07-16

### [How Soft Dirty Pages Enable Efficient Incremental Snapshots in CubeSandbox](/TencentCloud/CubeSandbox/what-is-the-role-of-soft-dirty-pages-in-cubesandbox-for-memory-tracking-and-snapshot-consistency)

Discover how CubeSandbox's soft dirty pages optimize incremental snapshots by tracking memory modifications and creating efficient deltas for enhanced performance.

- Tags: internals
- Published: 2026-07-16

### [Virtio VSOCK Device Implementation in CubeSandbox: Enabling Secure VM-Host Communication](/TencentCloud/CubeSandbox/how-is-the-virtio-vsock-device-implemented-for-vsock-communication-in-cubesandbox)

Learn how CubeSandbox implements the Virtio VSOCK device to enable secure VM-host communication, bridging guest VM sockets to host UNIX-domain sockets for efficient data transfer.

- Tags: internals
- Published: 2026-07-16

### [Sandbox Migration with Cross-Node Pause and Resume in CubeSandbox: A Complete Guide](/TencentCloud/CubeSandbox/what-is-the-process-for-sandbox-migration-with-cross-node-pause-and-resume)

Master sandbox migration with cross-node pause and resume in CubeSandbox. Learn how to serialize, stream, and resume VM states for seamless transitions. Get your complete guide now.

- Tags: migration-guide
- Published: 2026-07-16

### [How Per-Sandbox Traffic Tokens Harden Network Policies in CubeSandbox](/TencentCloud/CubeSandbox/how-are-per-sandbox-traffic-tokens-and-policy-routing-used-for-network-policy-hardening)

Discover how CubeSandbox uses per-sandbox traffic tokens and policy routing to harden network policies. Learn how CubeProxy enforces cryptographic gates for secure access.

- Tags: how-to-guide
- Published: 2026-07-16

### [Multi-Node Resource Scheduling Mechanisms in CubeMaster: Filter, Score, and Select](/TencentCloud/CubeSandbox/what-are-the-multi-node-resource-scheduling-mechanisms-in-cubemaster)

Discover CubeMaster's multi-node scheduling: filter healthy nodes, score resources via weighted averages, and select the best host with randomized selection for efficient orchestration.

- Tags: deep-dive
- Published: 2026-07-16

### [How Cubelet Manages the Local Sandbox Lifecycle in CubeSandbox](/TencentCloud/CubeSandbox/how-does-cubelet-manage-the-local-sandbox-lifecycle)

Discover how Cubelet orchestrates the local sandbox lifecycle, managing creation, execution, pausing, resuming, and cleanup with local storage pools, Redis state tracking, and lifecycle plugins.

- Tags: internals
- Published: 2026-07-16

### [How to Perform One-Click Cluster Provisioning with CubeSandbox Terraform Deployment](/TencentCloud/CubeSandbox/how-to-perform-one-click-cluster-provisioning-with-cubesandbox-terraform-deployment)

Unlock one-click cluster provisioning with CubeSandbox Terraform deployment. Automate Tencent Cloud environment setup, including VPC, TKE cluster, and workloads, via a single terraform apply command.

- Tags: how-to-guide
- Published: 2026-07-16

### [How to Achieve Native Full-Stack ARM64 Deployment with CubeSandbox](/TencentCloud/CubeSandbox/what-is-involved-in-achieving-native-full-stack-arm64-deployment-with-cubesandbox)

Achieve native full-stack ARM64 deployment with CubeSandbox v0.5.0. Run hypervisor, CubeShim, and guest agents directly on ARM bare-metal, leveraging KVM acceleration.

- Tags: how-to-guide
- Published: 2026-07-16

### [How to Convert OCI Images to CubeSandbox Templates: A Complete Guide](/TencentCloud/CubeSandbox/how-can-oci-images-be-converted-to-cubesandbox-templates-using-the-template-system)

Easily convert OCI images to CubeSandbox templates with our comprehensive guide. Learn how CubeSandbox streams, decompresses, and packages layers for efficient template creation.

- Tags: how-to-guide
- Published: 2026-07-16

### [How the Credential Vault Prevents API Keys from Entering CubeSandbox Environments](/TencentCloud/CubeSandbox/how-does-the-credential-vault-prevent-api-keys-from-entering-sandboxes-using-a-security-proxy)

Learn how CubeSandbox's Credential Vault uses a security proxy to securely inject API keys into outbound requests, keeping them out of sandbox environments.

- Tags: how-to-guide
- Published: 2026-07-16

### [CubeEgress Architecture for Domain Allowlisting and Credential Injection](/TencentCloud/CubeSandbox/what-is-the-architecture-of-cube-egress-for-domain-allowlisting-and-credential-injection)

Discover CubeEgress architecture for L7 egress firewalling. Learn how CubeEgress filters traffic with domain allowlisting and injects credentials via HTTP header manipulation before forwarding requests.

- Tags: architecture
- Published: 2026-07-16

### [How CubeSandbox Implements Kernel-Level Network Isolation with CubeVS eBPF Virtual Switch](/TencentCloud/CubeSandbox/how-is-kernel-level-network-isolation-implemented-using-cube-vs-ebpf-virtual-switch)

Discover how CubeSandbox uses CubeVS eBPF virtual switch and Linux TC subsystem for kernel-level network isolation. Enforce CIDR, DNS, and SNAT rules efficiently in kernel space.

- Tags: how-to-guide
- Published: 2026-07-16

### [How AutoPause and AutoResume Work for Idle Sandbox Suspension and Wake-on-Request in CubeSandbox](/TencentCloud/CubeSandbox/how-do-autopause-and-autoresume-work-for-idle-sandbox-suspension-and-wake-on-request)

Learn how CubeSandbox AutoPause and AutoResume suspend idle sandboxes and instantly resume them on request eliminating resource waste and maintaining availability

- Tags: internals
- Published: 2026-07-16

### [E2B SDK Compatibility Migration Path for CubeSandbox: Seamless Integration Guide](/TencentCloud/CubeSandbox/what-is-the-migration-path-for-e2b-sdk-compatibility-in-cubesandbox)

Leverage CubeSandbox's E2B SDK compatibility. Seamlessly migrate using environment variables and an adapter pattern without code changes. Integrate effortlessly.

- Tags: migration-guide
- Published: 2026-07-16

### [How CubeCoW Implements Copy-on-Write Snapshots with Hundred-Millisecond Granularity](/TencentCloud/CubeSandbox/how-does-cubecow-implement-copy-on-write-snapshots-with-hundred-millisecond-granularity)

Discover how CubeCoW implements copy-on-write snapshots with hundred-millisecond granularity using filesystem reflinks and a lightweight COW overlay for pages. Learn more.

- Tags: internals
- Published: 2026-07-16

### [Sub-60ms VM Cold Start Optimization in CubeSandbox's RustVMM](/TencentCloud/CubeSandbox/what-techniques-are-used-for-sub-60ms-vm-cold-start-optimization-in-cubesandbox-rustvmm)

Discover how CubeSandbox's RustVMM achieves sub-60ms VM cold starts by optimizing sparse snapshot files and minimizing I/O for faster VM creation.

- Tags: performance
- Published: 2026-07-16

### [CubeSandbox Containerd Shim v2 Integration Approach: Architecture and Implementation](/TencentCloud/CubeSandbox/what-is-the-integration-approach-for-containerd-shim-v2-in-cubesandbox)

Explore the CubeSandbox containerd shim v2 integration approach. Discover its Rust-based architecture, vsock communication, and ttrpc service management.

- Tags: architecture
- Published: 2026-07-16

### [How CubeSandbox Uses CubeHypervisor and KVM MicroVMs for Hardware-Level Isolation](/TencentCloud/CubeSandbox/how-does-cubesandbox-use-cubehypervisor-and-kvm-microvms-for-hardware-level-isolation)

Discover how CubeSandbox utilizes CubeHypervisor and KVM MicroVMs for robust hardware-level isolation. Learn how it protects your system from untrusted workloads.

- Tags: internals
- Published: 2026-07-16

### [Kubernetes-Native Deployment and Volume Support in CubeSandbox: Official Roadmap and Architecture](/TencentCloud/CubeSandbox/roadmap-for-kubernetes-native-deployment-and-volume-support)

Explore the CubeSandbox roadmap for Kubernetes-native deployment using CRDs and Operators. Discover persistent volume support for stateful sandbox workloads.

- Tags: architecture
- Published: 2026-07-15

### [Debugging Sandbox Startup Failures and VM Crashes in CubeSandbox: A Complete Guide](/TencentCloud/CubeSandbox/how-to-debug-sandbox-startup-failures-and-vm-crashes)

Troubleshoot CubeSandbox startup failures and VM crashes. Learn to check systemd journals, network-agent logs, and Firecracker VM logs for precise root cause analysis.

- Tags: how-to-guide
- Published: 2026-07-15

### [CubeSandbox Snapshot Health Check Notifications and App Snapshot Annotations: A Technical Guide](/TencentCloud/CubeSandbox/snapshot-health-check-notifications-and-app-snapshot-annotations)

Learn about CubeSandbox snapshot health check notifications and app snapshot annotations. Understand how CubeMaster and Cubelet manage snapshot workflows for your applications.

- Tags: technical-guide
- Published: 2026-07-15

### [CubeSandbox Terraform Deployment: One-Click Cluster Setup on Tencent Cloud](/TencentCloud/CubeSandbox/how-terraform-deployment-works-for-one-click-cubesandbox-cluster-setup)

Effortlessly deploy CubeSandbox on Tencent Cloud with Terraform. Achieve one-click cluster setup including VPC networking, databases, and TKE Kubernetes in a single command.

- Tags: how-to-guide
- Published: 2026-07-15

### [ARM64 Support Limitations and Requirements for CubeSandbox: A Technical Guide](/TencentCloud/CubeSandbox/arm64-support-limitations-and-requirements-for-cubesandbox)

Discover ARM64 support limitations and requirements for CubeSandbox v0.5.0. Learn about KVM, Docker buildx, and UEFI needs for seamless operation.

- Tags: how-to-guide
- Published: 2026-07-15

### [How to Use the CubeSandbox WebUI Console at Port 12088 for Sandbox Management](/TencentCloud/CubeSandbox/how-to-use-cubesandbox-webui-console-for-sandbox-management)

Learn to manage CubeSandbox environments using the WebUI console at port 12088. Access and control container sandboxes easily through your browser.

- Tags: how-to-guide
- Published: 2026-07-15

### [How E2B SDK Compatibility Works with CubeSandbox and What API Gaps Remain](/TencentCloud/CubeSandbox/how-e2b-sdk-compatibility-works-with-cubesandbox-api-gaps)

Discover how CubeSandbox ensures E2B SDK compatibility by translating E2B requests to its JSON schema. Learn about remaining API gaps and integrate seamlessly.

- Tags: deep-dive
- Published: 2026-07-15

### [How to Achieve High-Density Deployment with CubeSandbox: Running Thousands of Sandboxes Per Node](/TencentCloud/CubeSandbox/best-practices-for-high-density-deployment-with-cubesandbox)

Learn to achieve high-density deployment with CubeSandbox, running thousands of sandboxes per node. Discover best practices for efficient resource utilization and minimal overhead.

- Tags: best-practices
- Published: 2026-07-15

### [How to Use Extra Kernel Cmdline Parameters for VM Customization in CubeSandbox](/TencentCloud/CubeSandbox/how-to-use-extra-kernel-cmdline-parameters-for-vm-customization)

Customize your VM with extra kernel cmdline parameters in CubeSandbox. Learn how to inject JSON arguments into the KVM micro-VM command line for advanced control.

- Tags: how-to-guide
- Published: 2026-07-15

### [Persistent Memory (Pmem) vs. Regular Disk Configurations in CubeSandbox](/TencentCloud/CubeSandbox/difference-between-persistent-memory-and-regular-disk-configurations)

Understand Persistent Memory (Pmem) vs. regular disk in CubeSandbox. Discover Pmem's microsecond I/O latency with DAX capabilities for superior performance.

- Tags: performance
- Published: 2026-07-15

### [How to Implement Route-Aware Egress with Policy Routing in CubeSandbox](/TencentCloud/CubeSandbox/how-to-implement-route-aware-egress-with-policy-routing)

Implement route-aware egress in CubeSandbox using policy routing. Configure network-agent parameters to direct sandbox traffic via specific interfaces, bypassing default NAT for enhanced control.

- Tags: how-to-guide
- Published: 2026-07-15

### [Virtio-FS and Rate Limiting Configuration in CubeSandbox: A Complete Guide](/TencentCloud/CubeSandbox/configuration-options-for-virtiofs-and-rate-limiting)

Explore virtio-fs and rate limiting config options in CubeSandbox using the --fs flag. Optimize I/O and bandwidth with token-bucket settings. Get the full guide.

- Tags: how-to-guide
- Published: 2026-07-15

### [How CubeSandbox Handles Cross-Node Distribution: Template Replication Deep Dive](/TencentCloud/CubeSandbox/how-cubesandbox-template-system-handles-cross-node-distribution)

Learn how CubeSandbox achieves cross node distribution with its template replication system. Discover the three stage pipeline for reliable artifact distribution and metadata persistence.

- Tags: deep-dive
- Published: 2026-07-15

### [CubeSandbox Hardware-Level Isolation vs Docker Shared-Kernel: Security Implications Explained](/TencentCloud/CubeSandbox/security-implications-hardware-isolation-vs-docker-sharedkernel)

Discover CubeSandbox hardware isolation vs Docker shared kernel security. Protect your host from kernel exploits with KVM micro-VMs for robust AI agent security.

- Tags: deep-dive
- Published: 2026-07-15

### [How AutoPause and AutoResume Work for Idle Sandbox Cost Optimization in CubeSandbox](/TencentCloud/CubeSandbox/how-autopause-and-autoresume-work-for-idle-sandbox-cost-optimization)

Discover how CubeSandbox AutoPause and AutoResume optimize costs by pausing idle sandboxes and resuming them instantly with frozen snapshots. Learn more!

- Tags: internals
- Published: 2026-07-15

### [How to Convert OCI Images into Reusable CubeSandbox Templates](/TencentCloud/CubeSandbox/how-to-convert-oci-images-into-reusable-cubesandbox-templates)

Learn to convert OCI images into reusable CubeSandbox templates. Stream image layers to an ext4 artifact without Docker. Simplify your workflow with CubeSandbox.

- Tags: how-to-guide
- Published: 2026-07-15

### [How CubeEgress Implements Domain Allowlisting and Egress Traffic Inspection in TencentCloud/CubeSandbox](/TencentCloud/CubeSandbox/how-cubeeegress-implements-domain-allowlisting-and-egress-traffic-inspection)

Learn how CubeEgress implements robust domain allowlisting and egress traffic inspection in TencentCloud CubeSandbox using a first-match-wins rule engine for secure outbound connections.

- Tags: how-to-guide
- Published: 2026-07-15

### [How the Credential Vault Prevents API Keys from Entering the Sandbox](/TencentCloud/CubeSandbox/how-credential-vault-prevents-api-keys-from-entering-sandbox)

Discover how the CubeSandbox credential vault prevents API keys from entering the sandbox. Secrets stay on the host, injected securely at the proxy layer, keeping your keys safe.

- Tags: internals
- Published: 2026-07-15

### [CubeVS eBPF Virtual Switch vs Traditional Container Networking: Architecture and Performance Differences](/TencentCloud/CubeSandbox/differences-between-cubevs-and-traditional-container-networking)

Explore CubeVS eBPF virtual switch vs traditional container networking. Discover how eBPF offers O(1) lookups, per-sandbox isolation, and lower latency for superior performance.

- Tags: architecture
- Published: 2026-07-15

### [How CubeSandbox Achieves Sub-60ms Cold Start and Ultra-Low Memory Overhead](/TencentCloud/CubeSandbox/how-cubesandbox-achieves-sub-60ms-cold-start-and-ultra-low-memory-overhead)

Discover how CubeSandbox achieves sub-60ms cold starts and ultra-low memory overhead. Learn about its innovative VM templates, reflink cloning, and direct memory restoration techniques.

- Tags: performance
- Published: 2026-07-15

### [How the CubeCoW Copy-on-Write Snapshot Engine Enables Event-Level Snapshots and Instant Cloning](/TencentCloud/CubeSandbox/how-cubecow-copynwrit-snapshot-engine-enables-event-level-snapshots-and-instant-cloning)

Discover how the CubeCoW snapshot engine uses XFS reflinks for O(1) operations enabling event-level snapshots and instant cloning without data duplication.

- Tags: internals
- Published: 2026-07-15

### [CubeHypervisor Architecture: How It Manages KVM MicroVMs in CubeSandbox](/TencentCloud/CubeSandbox/architecture-of-cubehypervisor-and-kvm-microms-management)

Explore CubeHypervisor architecture and how it manages KVM microVMs. Discover its thin, hypervisor-agnostic abstraction layer for unified control over lightweight VMs in CubeSandbox.

- Tags: architecture
- Published: 2026-07-15

### [How CubeShim Integrates with containerd Shim v2 API for Sandbox Lifecycle Management](/TencentCloud/CubeSandbox/how-cubeshim-integrates-with-containerd-shim-v2-api-for-sandbox-lifecycle-management)

Discover how CubeShim integrates with containerd Shim v2 API to manage sandbox lifecycles. Learn about RPC translation and hypervisor delegation for efficient VM operations.

- Tags: internals
- Published: 2026-07-15

### [How CubeSandbox Handles Sandboxing: Container Isolation Architecture](/TencentCloud/CubeSandbox/how-does-cubesandbox-handle-sandboxing)

Discover how CubeSandbox handles sandboxing using container isolation. Explore Linux namespaces, overlay filesystems, virtual networking, and cgroup limits for secure workload execution.

- Tags: architecture
- Published: 2026-07-14

### [Is CubeSandbox a Docker Alternative? A Deep Dive into MicroVM Architecture](/TencentCloud/CubeSandbox/is-cubesandbox-a-docker-alternative)

CubeSandbox leverages MicroVMs for hardware-level isolation, offering a unique sandbox-as-a-service for AI agents. Discover how it differs from Docker.

- Tags: deep-dive
- Published: 2026-07-14

### [Can CubeSandbox Run Arbitrary Code? A Deep Dive into Secure Execution](/TencentCloud/CubeSandbox/can-cubesandbox-run-arbitrary-code)

CubeSandbox runs arbitrary code in secure micro-VMs. Discover how it prevents host access, network connections, and secret exposure for safe execution.

- Tags: deep-dive
- Published: 2026-07-14

### [Differences Between CubeSandbox Versions: Complete v0.1.0 to v0.5.0 Evolution Guide](/TencentCloud/CubeSandbox/differences-between-cubesandbox-versions)

Explore the evolution of CubeSandbox from v0.1.0 to v0.5.0. Discover ARM64 support, copy-on-write snapshots, and hardened security features in this comprehensive guide.

- Tags: version-comparison
- Published: 2026-07-14

### [CubeSandbox Community Support: Architecture, Contributing, and Getting Help](/TencentCloud/CubeSandbox/cubesandbox-community-support)

Explore CubeSandbox community support via GitHub Issues and Discord. Learn how to contribute and get help with this open-source AI agent sandbox platform.

- Tags: community-support
- Published: 2026-07-14

### [How to Report Bugs in CubeSandbox: A Complete Guide for Contributors](/TencentCloud/CubeSandbox/how-to-report-bugs-in-cubesandbox)

Learn how to report bugs in CubeSandbox effectively. This guide details opening GitHub Issues with steps to reproduce, environment details, and component specifics for swift resolution.

- Tags: how-to-guide
- Published: 2026-07-14

### [CubeSandbox License: Apache 2.0 and Third-Party Compliance Guide](/TencentCloud/CubeSandbox/what-is-the-license-for-cubesandbox)

Discover the CubeSandbox license, primarily Apache 2.0. Understand third-party compliance with virtiofsd, Kata Containers, and Cloud Hypervisor licenses.

- Tags: license-information
- Published: 2026-07-14

### [How to Troubleshoot CubeSandbox Issues: Complete Diagnostic Guide](/TencentCloud/CubeSandbox/how-to-troubleshoot-cubesandbox-issues)

Troubleshoot CubeSandbox issues by diagnosing XFS, network CIDR, cgroup v2, host-mount permissions, or egress policies. This guide pinpoints common failure points for quick resolution.

- Tags: how-to-guide
- Published: 2026-07-14

### [CubeSandbox Performance Benchmarks: Cold-Start Latency and Throughput Analysis](/TencentCloud/CubeSandbox/cubesandbox-performance-benchmarks)

Explore CubeSandbox performance benchmarks. Discover sub-60ms cold-start latency and low memory overhead enabling thousands of concurrent instances. Analyze official Go benchmark results.

- Tags: performance
- Published: 2026-07-14

### [How to Configure CubeSandbox: Complete Development Environment Setup](/TencentCloud/CubeSandbox/how-to-configure-cubesandbox)

Configure CubeSandbox for a quick development environment setup. This guide helps you set up a disposable OpenCloudOS 9 VM with automated scripts for cloud images, port forwarding, and core services.

- Tags: tutorial
- Published: 2026-07-14

### [Security Considerations for CubeSandbox: A Defense-in-Depth Analysis](/TencentCloud/CubeSandbox/what-are-security-considerations-for-cubesandbox)

Explore CubeSandbox security considerations with a defense-in-depth analysis. Learn how hypervisor seccomp, IOMMU, SELinux, and OAuth2 protect workloads from threats.

- Tags: deep-dive
- Published: 2026-07-14

### [How to Integrate CubeSandbox into Your Project: A Complete Developer Guide](/TencentCloud/CubeSandbox/how-to-integrate-cubesandbox-into-my-project)

Integrate CubeSandbox into your project easily by setting E2B_API_URL. Enable hardware-isolated sandbox execution without code changes. Get the complete developer guide.

- Tags: how-to-guide
- Published: 2026-07-14

### [How to Use CubeSandbox for Code Execution: A Complete Guide to Secure Sandboxing](/TencentCloud/CubeSandbox/how-to-use-cubesandbox-for-code-execution)

Learn how to use CubeSandbox for secure code execution. This guide covers provisioning hosts, creating OCI templates, and running code in dedicated micro VMs with its E2B-compatible REST API.

- Tags: how-to-guide
- Published: 2026-07-14

### [How to Set Up the CubeSandbox Environment: Complete Development VM Guide](/TencentCloud/CubeSandbox/how-to-set-up-cubesandbox-environment)

Easily set up your CubeSandbox development environment. Get a disposable OpenCloudOS 9 VM with automated setup for cloud images, ports, and services. Start coding faster today!

- Tags: getting-started
- Published: 2026-07-14

### [System Requirements for CubeSandbox: Complete Hardware and Software Prerequisites](/TencentCloud/CubeSandbox/what-are-system-requirements-for-cubesandbox)

Discover CubeSandbox system requirements. Deploy micro-VMs on x86_64 or ARM64 Linux with KVM, root, Docker, 8GB RAM, and 50GB disk. Get started with TencentCloud.

- Tags: architecture
- Published: 2026-07-14

### [How to Install CubeSandbox on Linux: A Complete Setup Guide](/TencentCloud/CubeSandbox/how-to-install-cubesandbox)

Install CubeSandbox on Linux with our guide. Learn to prepare your KVM host, set up XFS, and run the one-click installer for a complete control and data plane stack.

- Tags: how-to-guide
- Published: 2026-07-14

### [What Programming Languages Does CubeSandbox Support? A Complete Technical Guide](/TencentCloud/CubeSandbox/what-programming-languages-does-cubesandbox-support)

Discover the programming languages supported by CubeSandbox. Explore official SDKs for Python, Go, Node.js, and Rust, with flexible OCI template compatibility for any language.

- Tags: how-to-guide
- Published: 2026-07-14

### [Main Features of CubeSandbox: AI-Native Sandboxes with Sub-60ms Cold Start and E2B Compatibility](/TencentCloud/CubeSandbox/what-are-main-features-of-cubesandbox)

Explore CubeSandbox AI-Native sandboxes featuring sub-60ms cold starts hardware isolation and E2B SDK compatibility for instant secure AI agent execution.

- Tags: getting-started
- Published: 2026-07-14

### [What Is CubeSandbox by Tencent Cloud? A Complete Technical Overview](/TencentCloud/CubeSandbox/what-is-cubesandbox-by-tencent-cloud)

Discover CubeSandbox by Tencent Cloud, a powerful sandbox-as-a-service offering hardware-level isolation for AI workloads. Experience sub-60ms cold starts with minimal memory overhead.

- Tags: getting-started
- Published: 2026-07-14

### [How to Integrate CubeSandbox with External Services via Configuration](/TencentCloud/CubeSandbox/integrate-cubesandbox-external-services-config)

Learn how to integrate CubeSandbox with external services using its two-layer YAML configuration. Securely manage credentials with the Credential Vault and Egress Gateway for seamless integration.

- Tags: how-to-guide
- Published: 2026-07-13

### [CubeSandbox Configuration Logging Options: A Complete Guide to CLI and Programmatic Control](/TencentCloud/CubeSandbox/cubesandbox-configuration-logging-options)

Master CubeSandbox configuration logging with our guide. Learn CLI and programmatic control for rotating files, log levels, and automatic rotation to streamline your operations.

- Tags: how-to-guide
- Published: 2026-07-13

### [How to Enable or Disable Features in CubeSandbox via Config: A Complete Guide](/TencentCloud/CubeSandbox/enable-disable-features-cubesandbox-config)

Learn how to enable or disable features in CubeSandbox by editing boolean fields in YAML config files and restarting services. A complete guide for TencentCloud CubeSandbox.

- Tags: how-to-guide
- Published: 2026-07-13

### [Restoring CubeSandbox Configuration from a Backup: Complete Disaster Recovery Guide](/TencentCloud/CubeSandbox/restore-cubesandbox-configuration-backup)

Restore CubeSandbox configuration from backup by extracting archives, copying YAML files, importing MySQL dumps, and restarting services. Follow this complete disaster recovery guide.

- Tags: how-to-guide
- Published: 2026-07-13

### [How to Backup CubeSandbox Configuration: Complete Guide for TencentCloud/CubeSandbox](/TencentCloud/CubeSandbox/backup-cubesandbox-configuration)

Learn how to backup CubeSandbox configuration on TencentCloud. Follow this guide to copy YAML files, preserve .env, export MySQL, and snapshot Redis for complete data protection.

- Tags: how-to-guide
- Published: 2026-07-13

### [Troubleshooting CubeSandbox Configuration Errors: A Complete Guide](/TencentCloud/CubeSandbox/troubleshooting-cubesandbox-configuration-errors)

Resolve CubeSandbox configuration errors with this expert guide. Learn to fix invalid CLI flags, socket path mismatches, and missing kernel modules for seamless operation.

- Tags: how-to-guide
- Published: 2026-07-13

### [How to Secure CubeSandbox with Configuration: A Comprehensive Hardening Guide](/TencentCloud/CubeSandbox/secure-cubesandbox-configuration)

Learn how to secure CubeSandbox with configuration by hardening SDK settings, enforcing container privileges, and controlling network isolation for robust security.

- Tags: how-to-guide
- Published: 2026-07-13

### [CubeSandbox Configuration for Storage Options: TOML Settings, Architecture, and Backend Setup](/TencentCloud/CubeSandbox/cubesandbox-configuration-storage-options)

Learn to configure CubeSandbox storage options using TOML. Explore cubecow engine, pool types, paths, and logging settings for robust backend setup.

- Tags: how-to-guide
- Published: 2026-07-13

### [How to Configure CubeSandbox Using Environment Variables: Complete Component Guide](/TencentCloud/CubeSandbox/cubesandbox-environment-variables-configuration)

Configure TencentCloud CubeSandbox components using environment variables. Control CubeMaster, CubeProxy, Cubelet, and more without editing config files. Streamline your setup today.

- Tags: how-to-guide
- Published: 2026-07-13

### [CubeSandbox Default Configuration Settings: Complete Single-Node Setup Guide](/TencentCloud/CubeSandbox/cubesandbox-default-configuration-settings)

Explore CubeSandbox default configuration settings for single-node setup. Learn about cubemaster and cubelet YAML files, ports, and environment variables for seamless deployment.

- Tags: getting-started
- Published: 2026-07-13

### [How to Customize CubeSandbox Behavior Through Configuration](/TencentCloud/CubeSandbox/customize-cubesandbox-behavior-configuration)

Customize CubeSandbox behavior by editing YAML files and setting environment variables. Control API endpoints, resource quotas, scheduling, and auto-pause/resume easily.

- Tags: how-to-guide
- Published: 2026-07-13

### [CubeSandbox Lifecycle States and State Transition Rules Explained](/TencentCloud/CubeSandbox/cubesandbox-lifecycle-states-transition-rules)

Understand CubeSandbox lifecycle states running pausing paused and resuming Master state transition rules and failure rollback mechanisms for robust sandbox orchestration.

- Tags: internals
- Published: 2026-07-12

### [How to Configure HTTPS and Custom Domains for Cube Sandbox Access](/TencentCloud/CubeSandbox/configure-https-custom-domains-sandbox-access)

Learn how to configure HTTPS and custom domains for Cube Sandbox access. Secure your sandbox environment with custom domains and SSL certificates efficiently.

- Tags: how-to-guide
- Published: 2026-07-12

### [How CubeMaster Performs Resource-Aware Scheduling Across Nodes in CubeSandbox](/TencentCloud/CubeSandbox/how-cubemaster-perform-resource-aware-scheduling-nodes)

CubeMaster optimizes sandbox placement with resource-aware scheduling. Learn how it filters and scores nodes by CPU, memory, disk, and NIC for efficient resource utilization in CubeSandbox.

- Tags: internals
- Published: 2026-07-12

### [How the CubeSandbox Credential Vault Prevents Secrets from Entering Sandbox Memory](/TencentCloud/CubeSandbox/credential-vault-prevent-secrets-sandbox-memory)

Learn how the CubeSandbox credential vault safeguards secrets by injecting them at the L7 proxy layer, preventing sandbox memory exposure. Secure your sensitive data.

- Tags: internals
- Published: 2026-07-12

### [How to Implement Snapshot and Rollback in AI Agent Retry Workflows](/TencentCloud/CubeSandbox/implement-snapshot-rollback-ai-agent-retry-workflows)

Implement snapshot and rollback in AI agent retry workflows with CubeSandbox SDK. Reliably revert sandboxes to known good states before retrying failed operations.

- Tags: how-to-guide
- Published: 2026-07-12

### [KVM MicroVM Isolation vs Docker Shared-Kernel Security: A Technical Comparison in CubeSandbox](/TencentCloud/CubeSandbox/kvm-microvm-isolation-vs-docker-shared-kernel-security)

Explore KVM MicroVM's hardware-assisted isolation versus Docker's shared-kernel security. Understand the technical differences in CubeSandbox for enhanced cloud native security.

- Tags: comparison
- Published: 2026-07-12

### [CubeEgress JSONL Audit Logs: Complete Field Reference and Schema](/TencentCloud/CubeSandbox/cubeegress-jsonl-audit-logs-information)

Explore CubeEgress JSONL audit logs. This guide details every field and schema, capturing HTTP HTTPS requests, timestamps, IDs, TLS metadata, policy decisions, and security events from TencentCloud CubeSandbox.

- Tags: api-reference
- Published: 2026-07-12

### [How to Debug Sandbox Network Connectivity Issues with CubeVS: A Complete Guide](/TencentCloud/CubeSandbox/debug-sandbox-network-connectivity-cubevs)

Troubleshoot CubeVS network connectivity problems. Learn to debug by checking network agents, socket responses, TAP devices, and sandbox routing with this complete guide.

- Tags: how-to-guide
- Published: 2026-07-12

### [CubeSandbox Performance Benchmarks for Concurrent Sandbox Creation at Scale](/TencentCloud/CubeSandbox/performance-benchmarks-concurrent-sandbox-creation-scale)

Discover CubeSandbox performance benchmarks for concurrent sandbox creation at scale. Achieve 181 sandboxes/sec and 5.5 ms latency with optimal concurrency.

- Tags: performance
- Published: 2026-07-12

### [Redis in CubeSandbox's Stateless Control Plane: Architecture and Implementation](/TencentCloud/CubeSandbox/redis-role-cubesandbox-stateless-control-plane)

Discover how Redis acts as the single source of truth in CubeSandbox's stateless control plane, managing metadata, events, locks, and routing for scalable, fault-tolerant operations.

- Tags: architecture
- Published: 2026-07-12

### [How to Extend CubeEgress with Custom Lua Modules: 3 Methods Explained](/TencentCloud/CubeSandbox/extend-cubeegress-custom-lua-modules)

Extend CubeEgress with custom Lua modules using three methods: adding Lua files, hooking worker initialization code, or registering custom policy action modules. Explore CubeSandbox enhancements today.

- Tags: how-to-guide
- Published: 2026-07-12

### [How the CubeSandbox Lifecycle Manager Coordinates Auto‑Pause and Auto‑Resume Across Nodes](/TencentCloud/CubeSandbox/lifecycle-manager-coordinate-auto-pause-resume-nodes)

Learn how the CubeSandbox Lifecycle Manager coordinates auto-pause and auto-resume across nodes using a Redis event stream for consistent state management.

- Tags: internals
- Published: 2026-07-12

### [How to Configure Per-Sandbox Network Policies with CubeVS](/TencentCloud/CubeSandbox/configure-per-sandbox-network-policies-cubevs)

Learn to configure per-sandbox network policies with CubeVS. Enforce Layer 7 egress rules per sandbox using eBPF maps for robust network security.

- Tags: how-to-guide
- Published: 2026-07-12

### [How CubeEgress Performs Transparent HTTPS MITM Inspection in CubeSandbox](/TencentCloud/CubeSandbox/how-cubeegress-perform-transparent-https-mitm-inspection)

Discover how CubeEgress achieves transparent HTTPS MITM inspection within CubeSandbox. Learn about dynamic certificate generation, SNI interception, and full payload policy enforcement for secure outbound traffic.

- Tags: deep-dive
- Published: 2026-07-12

### [CubeSandbox Multi-Node Deployment Architecture and Requirements](/TencentCloud/CubeSandbox/cubesandbox-multi-node-deployment-architecture-requirements)

Explore the CubeSandbox multi-node deployment architecture. Learn about control and compute node roles and essential requirements for a distributed cluster setup.

- Tags: architecture
- Published: 2026-07-12

### [How TencentCloud CubeSandbox Converts OCI Images into Deployable Sandboxes](/TencentCloud/CubeSandbox/template-system-oci-images-to-sandboxes)

Learn how TencentCloud CubeSandbox transforms OCI images into deployable sandboxes. Discover the three-stage pipeline used for efficient image conversion and sandbox instantiation.

- Tags: how-to-guide
- Published: 2026-07-12

### [CubeShim: Implementing the containerd Shim v2 Interface in Cube Sandbox](/TencentCloud/CubeSandbox/cubeshim-role-containerd-shim-v2-interface)

Discover CubeShim, the Rust-based containerd shim that translates container commands into MicroVM operations for Cube Sandbox. Explore this key component for efficient container management.

- Tags: internals
- Published: 2026-07-12

### [How to Configure Credential Injection to Protect API Keys from Sandbox Access](/TencentCloud/CubeSandbox/configure-credential-injection-protect-api-keys)

Learn how to configure credential injection in CubeSandbox to protect API keys from sandbox access. Securely inject secrets server-side for enhanced API key protection.

- Tags: how-to-guide
- Published: 2026-07-12

### [How Auto-Pause and Auto-Resume Work in CubeSandbox: Architecture and Implementation](/TencentCloud/CubeSandbox/cubesandbox-auto-pause-and-auto-resume-explained)

Discover how CubeSandbox's auto-pause and auto-resume features conserve resources using Sweeper and CubeMaster components. Learn about the architecture and implementation details.

- Tags: architecture
- Published: 2026-07-12

### [How to Migrate from E2B to CubeSandbox: Step-by-Step Guide](/TencentCloud/CubeSandbox/migrate-e2b-to-cubesandbox-process)

Migrate from E2B to CubeSandbox easily. This guide offers a step-by-step process to replace E2B with CubeSandbox using simple environment variable changes. Keep your existing business logic intact.

- Tags: migration-guide
- Published: 2026-07-12

### [How CubeCoW Enables O(1) Snapshots and Clones Using FICLONE in CubeSandbox](/TencentCloud/CubeSandbox/how-cubecow-enable-o1-snapshots-clones-ficlone)

CubeCoW uses FICLONE for O(1) snapshots and clones, updating only metadata for instant file copies without data duplication. Learn how.

- Tags: internals
- Published: 2026-07-12

### [How CubeVS Achieves Kernel-Level Isolation with eBPF-Based Network Virtualization](/TencentCloud/CubeSandbox/how-cubevs-ebpf-network-virtualization-provide-kernel-level-isolation)

Discover how CubeVS eBPF-based network virtualization provides kernel-level isolation. Learn how its unique approach guarantees secure, independent sandbox operation without userspace overhead.

- Tags: internals
- Published: 2026-07-12

### [How CubeSandbox Achieves Sub-60ms Boot Times with KVM MicroVMs](/TencentCloud/CubeSandbox/how-cubesandbox-achieve-sub-60ms-boot-times-kvm-microvms)

Discover how CubeSandbox leverages KVM MicroVMs and copy-on-write snapshots for blazing fast sub-60ms boot times. Learn about their innovative approach to instant application deployment.

- Tags: performance
- Published: 2026-07-12

### [Troubleshooting Steps for Common CubeSandbox Creation and Startup Failures](/TencentCloud/CubeSandbox/troubleshooting-sandbox-creation-startup-failures)

Resolve CubeSandbox creation and startup failures with expert troubleshooting steps. Debug template validation, network conflicts, and host mount permissions efficiently.

- Tags: how-to-guide
- Published: 2026-07-11

### [How CubeSandbox Implements Per-Instance DNS Configuration and Network Isolation](/TencentCloud/CubeSandbox/sandbox-dns-configuration-network-isolation-per-instance)

CubeSandbox uses TAP network namespaces, eBPF, and CoreDNS sidecars to implement per-instance DNS configuration and network isolation. Learn how it works.

- Tags: internals
- Published: 2026-07-11

### [CubeAPI Gateway Architecture for High-Concurrency REST API Handling](/TencentCloud/CubeSandbox/cubesandbox-api-gateway-architecture-high-concurrency)

Discover the CubeAPI gateway architecture built with Rust. Handle millions of concurrent REST requests with low latency and per-key rate limiting. Explore the four-layer design for high-performance API management.

- Tags: architecture
- Published: 2026-07-11

### [How CubeSandbox E2B SDK Compatibility Works for Seamless Migration](/TencentCloud/CubeSandbox/how-e2b-sdk-compatibility-works-for-migration)

Discover how CubeSandbox E2B SDK compatibility ensures seamless migration. It supports legacy variables and converts network policies, letting your E2B SDK code run without modification.

- Tags: migration-guide
- Published: 2026-07-11

### [ARM64 Support Considerations and Limitations in CubeSandbox v0.5](/TencentCloud/CubeSandbox/arm64-support-considerations-limitations-in-cubesandbox-v0.5)

Explore ARM64 support considerations and limitations in CubeSandbox v0.5. Learn about vO.S, hardware needs like GIC v3, and experimental feature status.

- Tags: deep-dive
- Published: 2026-07-11

### [How the CubeSandbox Web Console Provides Visual Sandbox Management on Port 5173](/TencentCloud/CubeSandbox/cubesandbox-web-console-port-12088-management)

Manage sandboxes visually with the CubeSandbox web console on port 5173. Get real-time insights and interactive controls for your sandboxes.

- Tags: how-to-guide
- Published: 2026-07-11

### [How to Deploy CubeSandbox on Cloud VMs (PVM) vs Bare Metal: A Complete Guide](/TencentCloud/CubeSandbox/deploying-cubesandbox-on-cloud-vms-vs-bare-metal)

Learn how to deploy CubeSandbox on cloud VMs (PVM) or bare metal. This guide covers KVM-like isolation on cloud and native KVM on bare metal for your TencentCloud/CubeSandbox project.

- Tags: comparison
- Published: 2026-07-11

### [CubeSandbox Network Policies and Route-Aware Egress Configuration Options](/TencentCloud/CubeSandbox/configuration-options-for-network-policies-route-aware-egress)

Configure CubeSandbox network policies and route-aware egress using CubeNetworkConfig and CubeRouter. Control sandbox traffic precisely via Go SDK or TOML files.

- Tags: how-to-guide
- Published: 2026-07-11

### [How CubeSandbox Handles Egress Traffic Inspection and Auditing via the Security Proxy](/TencentCloud/CubeSandbox/how-security-proxy-handles-egress-traffic-inspection-auditing)

Learn how CubeSandbox's security proxy inspects egress traffic using eBPF for fine-grained policy enforcement and provides structured audit logs via the admin API for compliance.

- Tags: how-to-guide
- Published: 2026-07-11

### [CubeSandbox Fork/Clone Mechanism: Creating New Sandboxes from Snapshots](/TencentCloud/CubeSandbox/fork-clone-mechanism-for-creating-sandboxes-from-snapshots)

Learn how CubeSandbox fork/clone creates new sandboxes from snapshots. Discover the three-step process for efficient sandbox management and guaranteed cleanup.

- Tags: internals
- Published: 2026-07-11

### [How the Rollback Feature Restores Sandbox State to Any Previous Checkpoint in CubeSandbox](/TencentCloud/CubeSandbox/how-rollback-feature-restores-sandbox-state)

Discover how CubeSandbox's rollback feature restores sandbox state instantly. Clone checkpoints and atomically swap to a previous VM state with ease. Learn more now.

- Tags: internals
- Published: 2026-07-11

### [CubeSandbox Performance Characteristics: Sub-60ms Cold Start and <5MB Memory Overhead](/TencentCloud/CubeSandbox/cubesandbox-performance-characteristics-cold-start-memory-overhead)

Discover CubeSandbox performance: achieve sub-60ms cold start and <5MB memory overhead with snapshot pools, RustVMM, and overlayfs cloning.

- Tags: performance
- Published: 2026-07-11

### [How Cubelet Manages the Lifecycle of Sandbox Instances on a Node](/TencentCloud/CubeSandbox/how-cubelet-manages-sandbox-instance-lifecycle)

Discover how Cubelet, a containerd plugin, effectively manages sandbox instance lifecycles. It handles creation, destruction, and monitoring with a workflow engine and event-driven reconciliation.

- Tags: internals
- Published: 2026-07-11

### [CubeMaster Cluster Orchestration and Resource Scheduling Architecture: A Multi-Stage Pipeline Deep Dive](/TencentCloud/CubeSandbox/architecture-of-cubemaster-for-cluster-orchestration)

Explore CubeMaster's multi-stage pipeline architecture for Kubernetes-like cluster orchestration and resource scheduling, optimized for sandbox workloads. Learn about its six distinct scheduling phases.

- Tags: architecture
- Published: 2026-07-11

### [How CubeProxy Routes Requests to Sandbox Instances with E2B Protocol Compatibility](/TencentCloud/CubeSandbox/how-cubeproxy-routes-requests-to-sandboxes-e2b-protocol)

Learn how CubeProxy routes requests to sandbox instances using Nginx and Lua. It parses requests, verifies tokens with Redis, and forwards traffic via E2B protocol compatibility. Explore the TencentCloud/CubeSandbox repository ...

- Tags: how-to-guide
- Published: 2026-07-11

### [How CubeSandbox AutoPause/AutoResume Works for Idle Sandbox Cost Optimization](/TencentCloud/CubeSandbox/how-autopause-autoresume-feature-works-for-cost-optimization)

CubeSandbox AutoPause AutoResume saves costs by snapshotting idle sandboxes to disk. It reduces CPU memory costs to zero and transparently restores state for new requests.

- Tags: internals
- Published: 2026-07-11

### [How to Create Templates from OCI Images in CubeSandbox](/TencentCloud/CubeSandbox/process-for-creating-templates-from-oci-images)

Learn how to create templates from OCI images in CubeSandbox. Discover the ten-stage pipeline that converts container images into reusable templates.

- Tags: how-to-guide
- Published: 2026-07-11

### [How CubeEgress Implements L7 Domain Filtering and Credential Injection](/TencentCloud/CubeSandbox/how-cubeegress-implements-l7-domain-filtering-credential-injection)

Discover how CubeEgress implements L7 domain filtering and credential injection through ordered rules and secure HTTP header forwarding, enhancing outbound policy enforcement.

- Tags: how-to-guide
- Published: 2026-07-11

### [How the CubeSandbox Credential Vault Prevents API Keys from Entering the Sandbox Environment](/TencentCloud/CubeSandbox/how-credential-vault-prevents-api-keys-in-sandbox)

Discover how the CubeSandbox credential vault protects API keys by keeping them on the host and injecting them via the CubeEgress proxy, preventing sandbox exposure.

- Tags: how-to-guide
- Published: 2026-07-11

### [CubeVS eBPF Virtual Switch Architecture for Kernel-Level Network Isolation](/TencentCloud/CubeSandbox/architecture-of-cube_vs-ebpf-virtual-switch)

Explore the CubeVS eBPF virtual switch architecture for kernel-level network isolation. Achieve sub-microsecond latency and per-sandbox isolation with this high-performance solution.

- Tags: architecture
- Published: 2026-07-11

### [How CubeHypervisor Manages KVM MicroVMs for Hardware-Level Isolation](/TencentCloud/CubeSandbox/how-cubehypervisor-manages-kvm-microvms)

Discover how CubeHypervisor uses KVM MicroVMs to achieve hardware-level isolation. Learn about efficient CPU virtualization for minimal resource overhead. Explore the TencentCloud CubeSandbox.

- Tags: internals
- Published: 2026-07-11

### [CubeCoW Snapshot Engine: Enabling Event-Level Snapshots with Copy-on-Write in CubeSandbox](/TencentCloud/CubeSandbox/what-is-cubecow-snapshot-engine-and-copy-on-write)

Discover the CubeCoW snapshot engine, a copy-on-write storage layer that creates O(1) event-level snapshots using XFS reflinks, enabling hundreds of checkpoints per second with minimal overhead.

- Tags: internals
- Published: 2026-07-11

### [How CubeShim Integrates with containerd's Shim v2 API for Sandbox Lifecycle Management](/TencentCloud/CubeSandbox/how-cubeshim-integrates-with-containerd-shim-v2-api)

Discover how CubeShim integrates with containerd's Shim v2 API for seamless sandbox lifecycle management. Learn about VM operations and hypervisor boundary control.

- Tags: how-to-guide
- Published: 2026-07-11

### [How CubeSandbox Integrates with containerd and Ensures OCI Specification Compliance](/TencentCloud/CubeSandbox/how-does-cubesandbox-integrate-with-the-containerd-runtime-and-ensure-oci-specification-compliance)

Discover how CubeSandbox integrates with containerd using its Go client and OCI compliance features for seamless container execution. Learn about its custom storage plugin registration and specification construction.

- Tags: deep-dive
- Published: 2026-07-10

### [How CubeSandbox Handles Multi-Node Cluster Scaling and State Distribution](/TencentCloud/CubeSandbox/how-does-cubesandbox-handle-multi-node-cluster-scaling-and-state-distribution)

Discover how CubeSandbox handles multi-node cluster scaling and state distribution. Learn about its separation of control plane and agents with a distributed KV store for consistency.

- Tags: architecture
- Published: 2026-07-10

### [CubeSandbox Memory Overhead per Sandbox Instance: Baseline, Benchmarks, and Configuration](/TencentCloud/CubeSandbox/what-is-the-memory-overhead-per-sandbox-instance-in-cubesandbox)

Discover CubeSandbox memory overhead per sandbox instance. Learn about baseline, benchmarks, and configuration for efficient resource management, achieving <5 MiB static overhead.

- Tags: performance
- Published: 2026-07-10

### [CubeSandbox Security Isolation Guarantees Against Malicious LLM-Generated Code](/TencentCloud/CubeSandbox/what-are-the-security-isolation-guarantees-provided-by-cubesandbox-against-malicious-llm-generated-code)

Explore CubeSandbox security isolation. Learn how CubeSandbox uses KVM MicroVMs, eBPF, and seccomp to defend against malicious LLM-generated code protecting your applications.

- Tags: deep-dive
- Published: 2026-07-10

### [How AgentHub Manages and Deploys Digital Assistant Templates in CubeSandbox](/TencentCloud/CubeSandbox/how-does-agenthub-manage-and-deploy-digital-assistant-templates)

AgentHub simplifies digital assistant template management in CubeSandbox using REST endpoints for listing, updating, deleting, and instantiating. Explore template deployment with AgentHub.

- Tags: how-to-guide
- Published: 2026-07-10

### [CubeSandbox WebUI Console Architecture: React 18 SPA with TypeScript and Vite](/TencentCloud/CubeSandbox/what-is-the-architecture-of-the-cubesandbox-webui-console-accessible-at-port-12088)

Explore the CubeSandbox WebUI console architecture. Discover this React 18 SPA built with Vite, featuring Radix UI, Tailwind CSS, Zustand, and React Query for efficient API integration.

- Tags: architecture
- Published: 2026-07-10

### [Security Differences Between Hardware-Level Isolation and Docker's Shared Kernel](/TencentCloud/CubeSandbox/what-are-the-security-differences-between-hardware-level-isolation-and-docker-s-shared-kernel)

Explore security differences between hardware-level isolation and Docker's shared kernel. Understand how dedicated kernels prevent container escapes and enhance security.

- Tags: deep-dive
- Published: 2026-07-10

### [How Network Policies Are Hardened Using Per-Sandbox Traffic Tokens](/TencentCloud/CubeSandbox/how-are-network-policies-hardened-using-per-sandbox-traffic-tokens)

CubeSandbox hardens network policies with unique traffic tokens for enhanced security. Learn how per-sandbox tokens prevent unauthorized access in this technical deep dive.

- Tags: architecture
- Published: 2026-07-10

### [One-Click Cluster Deployment with Terraform for CubeSandbox](/TencentCloud/CubeSandbox/how-to-perform-a-one-click-cluster-deployment-with-terraform-for-cubesandbox)

Deploy a full Tencent Cloud environment for CubeSandbox effortlessly with a single terraform apply command. Get VPC, TKE cluster, and workloads deployed in one click using our Terraform module.

- Tags: how-to-guide
- Published: 2026-07-10

### [CubeSandbox ARM64 Native Support: architectural Details and Build Requirements](/TencentCloud/CubeSandbox/what-are-the-architectural-details-and-build-requirements-for-arm64-native-support)

Explore ARM64 native support in CubeSandbox 0.5.0. Discover architectural details like MMIO device signaling and updated seccomp filters. Learn build requirements for native ARM64 compilation.

- Tags: architecture
- Published: 2026-07-10

### [Lifecycle Management of the Cubelet Local Scheduling Component in CubeSandbox](/TencentCloud/CubeSandbox/what-is-the-lifecycle-management-of-the-cubelet-local-scheduling-component)

Discover Cubelet's lifecycle management for sandbox instances in CubeSandbox. Learn how it handles creation, execution, pause, resume, snapshot, and destruction with containerd integration.

- Tags: internals
- Published: 2026-07-10

### [How CubeProxy Handles Reverse Proxy Request Routing and Load Balancing](/TencentCloud/CubeSandbox/how-does-cubeproxy-handle-reverse-proxy-request-routing-and-load-balancing)

See how CubeProxy achieves reverse proxy request routing and load balancing. Learn about its Redis-backed service discovery, metadata broadcasting, and SETNX-based state gate for efficient traffic management. Optimize your requ...

- Tags: how-to-guide
- Published: 2026-07-10

### [Strategies for High-Density Deployment of Thousands of CubeSandbox Instances](/TencentCloud/CubeSandbox/what-are-the-strategies-for-high-density-deployment-of-thousands-of-sandbox-instances)

Discover strategies for high-density CubeSandbox deployment using MicroVMs, Copy-on-Write, and kernel page sharing. Achieve low memory overhead for thousands of instances per host.

- Tags: performance
- Published: 2026-07-10

### [How CubeEgress Domain Allowlist Filtering Works for Egress Traffic](/TencentCloud/CubeSandbox/how-does-cubeegress-domain-allowlist-filtering-work-for-egress-traffic)

Learn how CubeEgress domain allowlist filtering secures egress traffic by enforcing default deny and first match wins rules to permit only specified outbound connections.

- Tags: internals
- Published: 2026-07-10

### [How AutoPause and AutoResume Suspend Idle Sandboxes in TencentCloud CubeSandbox](/TencentCloud/CubeSandbox/how-is-the-autopause-and-autore-sume-feature-implemented-for-idle-sandbox-suspension)

Learn how TencentCloud CubeSandbox uses AutoPause and AutoResume with Nginx and Lua to suspend and reactivate idle sandbox containers automatically without manual intervention.

- Tags: internals
- Published: 2026-07-10

### [How to Convert OCI Images to Sandbox Templates in CubeSandbox: A Three-Phase Workflow](/TencentCloud/CubeSandbox/what-is-the-workflow-for-converting-oci-images-to-sandbox-templates-in-the-cubesandbox-template-system)

Learn the three-phase workflow for converting OCI images to CubeSandbox templates. Discover how CubeSandbox pulls layers, boots a MicroVM, and distributes artifacts for efficient sandbox management.

- Tags: how-to-guide
- Published: 2026-07-10

### [CubeMaster Cluster Orchestration and Resource Scheduling Algorithms: A Deep Dive into the Multi-Stage Pipeline](/TencentCloud/CubeSandbox/what-are-the-cluster-orchestration-and-resource-scheduling-algorithms-used-by-cubemaster)

Explore CubeMaster's multi-stage scheduling pipeline: pre-filter, predicate, and scoring. Learn how this cluster orchestration and resource scheduling system efficiently allocates resources.

- Tags: deep-dive
- Published: 2026-07-10

### [CubeSandbox Go SDK: E2B SDK Drop-In Compatibility and API Endpoint Mapping](/TencentCloud/CubeSandbox/what-is-the-implementation-for-e2b-sdk-drop-in-compatibility-and-api-endpoint-mapping)

Discover how the CubeSandbox Go SDK ensures E2B SDK drop-in compatibility through internal environment variable mapping and config normalization for seamless control-plane API integration.

- Tags: how-to-guide
- Published: 2026-07-10

### [How the Credential Vault Security Proxy Handles API Key Injection in CubeSandbox](/TencentCloud/CubeSandbox/how-does-the-credential-vault-security-proxy-handle-api-key-injection)

Discover how CubeSandbox secures API keys with its credential vault security proxy. Learn how CubeEgress injects keys into outbound requests, keeping secrets safe outside the sandbox.

- Tags: internals
- Published: 2026-07-10

### [CubeCoW Copy-on-Write Snapshot Engine: Internal Mechanisms and Performance Analysis](/TencentCloud/CubeSandbox/what-are-the-internal-mechanisms-and-performance-of-the-cubecow-copy-on-write-snapshot-engine)

Explore CubeCoW snapshot engine's O(1) creation via filesystem reflink. Understand its self-describing layout and performance analysis from TencentCloud CubeSandbox. Learn how it eliminates journals.

- Tags: internals
- Published: 2026-07-10

### [How CubeShim Bridges containerd Shim v2 and the KVM Virtualization Layer](/TencentCloud/CubeSandbox/how-does-cubeshim-integrate-with-containerd-shim-v2-and-the-kvm-virtualization-layer)

Learn how CubeShim connects containerd Shim v2 with KVM MicroVMs. This Rust-based service translates container operations into hardware virtualization commands for seamless integration.

- Tags: internals
- Published: 2026-07-10

### [CubeVS eBPF Virtual Switch Architecture: Kernel-Level Network Isolation in CubeSandbox](/TencentCloud/CubeSandbox/what-is-the-architecture-of-the-cube-vs-ebpf-virtual-switch-for-network-isolation)

Explore the CubeVS eBPF virtual switch architecture for kernel-level network isolation in CubeSandbox. Learn how eBPF programs and LPM-Trie maps achieve sub-microsecond latency for sandboxed workloads.

- Tags: architecture
- Published: 2026-07-10

### [How CubeSandbox Achieves Sub-60ms Sandbox Startup Using KVM MicroVMs](/TencentCloud/CubeSandbox/how-does-cubesandbox-achieve-sub-60ms-sandbox-startup-using-kvm-micromvms)

Discover how CubeSandbox uses KVM MicroVMs to achieve sub-60ms sandbox startup by restoring memory snapshots, bypassing slow boot sequences and BIOS initialization.

- Tags: internals
- Published: 2026-07-10

### [How to Use the CubeSandbox WebUI Console at Port 12088 for Sandbox Management](/TencentCloud/CubeSandbox/how-to-use-cubesandbox-webui-console-at-port-12088-for-sandbox-management)

Master sandbox management with the CubeSandbox WebUI console on port 12088. Easily create, monitor, snapshot, and terminate instances via an intuitive browser interface.

- Tags: how-to-guide
- Published: 2026-07-09

### [How to Achieve Sub-60ms Cold Start Performance in CubeSandbox](/TencentCloud/CubeSandbox/how-to-achieve-sub-60ms-cold-start-performance-with-low-overhead)

Achieve sub-60ms cold start performance in CubeSandbox with low overhead. Learn how pre-snapshotted templates and reflink-based COW cloning deliver lightning-fast VM restores.

- Tags: performance
- Published: 2026-07-09

### [How CubeSandbox Security Proxy Performs Credential Injection: A Deep Dive into CubeProxy](/TencentCloud/CubeSandbox/how-cubesandbox-security-proxy-performs-credential-injection)

Learn how CubeSandbox security proxy injects credentials dynamically by intercepting outbound HTTP requests, matching egress policies, and injecting secrets as headers before forwarding traffic.

- Tags: deep-dive
- Published: 2026-07-09

### [How to Deploy CubeSandbox Using Terraform on Cloud VMs or Bare Metal](/TencentCloud/CubeSandbox/how-to-deploy-cubesandbox-using-terraform-on-cloud-vms-or-bare-metal)

Deploy CubeSandbox with Terraform on cloud VMs or bare metal. Provision infrastructure, bootstrap containers, and launch services seamlessly. Discover the easy setup.

- Tags: how-to-guide
- Published: 2026-07-09

### [How CubeSandbox Snapshot, Clone, and Rollback Work at Hundred-Millisecond Granularity](/TencentCloud/CubeSandbox/how-snapshot-clone-and-rollback-work-at-hundred-millisecond-granularity)

Discover how CubeSandbox achieves sub-second snapshot clone and rollback operations using a copy-on-write engine for lightning-fast VM state management.

- Tags: internals
- Published: 2026-07-09

### [How CubeMaster Orchestrates Multi-Node Cluster Scheduling: Plugin Pipeline Deep Dive](/TencentCloud/CubeSandbox/how-cubemaster-orchestrates-multi-node-cluster-scheduling)

Learn how CubeMaster orchestrates multi-node cluster scheduling using its five-stage plugin pipeline for optimized sandbox placement across heterogeneous clusters.

- Tags: deep-dive
- Published: 2026-07-09

### [How CubeHypervisor Manages KVM MicroVM Lifecycle: A Complete Technical Guide](/TencentCloud/CubeSandbox/how-cubehypervisor-manages-kvm-microvm-lifecycle)

Discover how CubeHypervisor expertly manages KVM MicroVM lifecycle in a six-phase process. Learn about detection, instantiation, configuration, execution, pausing, and cleanup.

- Tags: deep-dive
- Published: 2026-07-09

### [How CubeShim Implements the containerd Shim v2 API for Micro-VM Integration](/TencentCloud/CubeSandbox/how-cubeshim-implements-containerd-shim-v2-api-for-sandbox-integration)

Discover how CubeShim integrates with containerd's Shim v2 API. Learn how its Rust gRPC service manages Micro-VM lifecycle commands for seamless sandbox integration.

- Tags: internals
- Published: 2026-07-09

### [How CubeVS eBPF Virtual Switch Provides Kernel-Level Network Isolation](/TencentCloud/CubeSandbox/how-cubevs-ebpf-virtual-switch-provides-kernel-level-network-isolation)

Discover how CubeVS eBPF virtual switch provides kernel-level network isolation. Learn how eBPF and BPF maps enforce policies, filter DNS, and manage SNAT rules in kernel space.

- Tags: how-to-guide
- Published: 2026-07-09

### [How to Configure Network Policies with Per-Sandbox Traffic Tokens in CubeSandbox](/TencentCloud/CubeSandbox/how-to-configure-network-policies-with-per-sandbox-traffic-tokens)

Configure network policies and per-sandbox traffic tokens in CubeSandbox. Restrict egress traffic and public URL access simultaneously for enhanced security.

- Tags: how-to-guide
- Published: 2026-07-09

### [How the CubeSandbox Template System Converts OCI Images to Ready-to-Use Templates](/TencentCloud/CubeSandbox/how-cubesandbox-template-system-converts-oci-images-to-ready-to-use-templates)

Learn how CubeSandbox converts OCI images to ready templates. Discover its efficient streaming and snapshotting process for sandboxed containers.

- Tags: how-to-guide
- Published: 2026-07-09

### [How AutoResume Works for Idle Sandbox Optimization in CubeSandbox](/TencentCloud/CubeSandbox/how-autoresume-works-for-idle-sandbox-optimization)

Discover how AutoResume optimizes idle sandboxes in CubeSandbox. Learn how it intercepts requests, locks operations, and restores VMs to prevent duplicate work and boost performance.

- Tags: internals
- Published: 2026-07-09

### [How the CubeSandbox Credential Vault Prevents API Keys from Entering the Sandbox](/TencentCloud/CubeSandbox/how-cubesandbox-credential-vault-prevents-api-keys-from-entering-sandbox)

Discover how the CubeSandbox credential vault protects API keys by storing them in the egress proxy policy layer and injecting them at the network edge, keeping them out of your sandbox.

- Tags: internals
- Published: 2026-07-09

### [How CubeSandbox Avoids iptables and OVS for Networking: A Pure eBPF Architecture](/TencentCloud/CubeSandbox/how-does-cubesandbox-avoid-using-iptables-or-ovs-for-networking)

Discover how CubeSandbox eliminates iptables and OVS with a pure eBPF networking stack. Learn how CubeVS handles NAT, session tracking, and policy enforcement in kernel space.

- Tags: internals
- Published: 2026-07-08

### [Purpose of cube-agent Inside the MicroVM: Architecture and Role Explained](/TencentCloud/CubeSandbox/what-is-the-purpose-of-cube-agent-inside-the-microvm)

Discover the purpose of cube-agent as the MicroVM's init process. Learn how it handles initialization, exposes APIs, and manages container lifecycles within Cube Sandbox.

- Tags: architecture
- Published: 2026-07-08

### [How to Create, Rollback, and Clone Snapshots in CubeSandbox](/TencentCloud/CubeSandbox/how-to-create-rollback-and-clone-snapshots-in-cubesandbox)

Learn to create, rollback, and clone snapshots in CubeSandbox using its Go SDK or REST endpoints. Master sub-second checkpointing and in-place restoration.

- Tags: how-to-guide
- Published: 2026-07-08

### [Request Lifecycle in CubeSandbox: A Complete Technical Guide](/TencentCloud/CubeSandbox/what-is-the-request-lifecycle-in-cubesandbox)

Explore the CubeSandbox request lifecycle from API to execution. Understand how CubeMaster and Cubelet interact through nine stages for efficient sandbox management. Detailed technical guide.

- Tags: deep-dive
- Published: 2026-07-08

### [How CubeEgress Handles TLS Inspection in CubeSandbox: MITM Re-Signing and Root CA Baking](/TencentCloud/CubeSandbox/how-is-tls-inspection-handled-by-cubeegress)

CubeEgress inspects TLS traffic with MITM re-signing and root CA baking. Learn how it terminates, re-signs, and forwards decrypted payloads while preserving TLS semantics.

- Tags: internals
- Published: 2026-07-08

### [How CubeEgress Secures Outbound Traffic in CubeSandbox: A Four-Stage Defense](/TencentCloud/CubeSandbox/how-does-cubeegress-secure-outbound-traffic)

Discover how CubeEgress secures outbound traffic using a four-stage defense. Learn about kernel-level eBPF filtering, TPROXY redirection, and an OpenResty L7 proxy for robust security in CubeSandbox.

- Tags: deep-dive
- Published: 2026-07-08

### [How CubeVS Provides eBPF-Based Networking for Secure Sandbox Isolation](/TencentCloud/CubeSandbox/how-does-cubevs-provide-ebpf-based-networking)

Discover how CubeVS uses eBPF networking for secure sandbox isolation. Learn about kernel-level traffic interception, ACL enforcement, and iptables-free NAT.

- Tags: how-to-guide
- Published: 2026-07-08

### [CubeCoW Snapshot Model Explained: How Flat Snapshots Work in CubeSandbox](/TencentCloud/CubeSandbox/what-is-the-snapshot-model-used-by-cubecow)

Explore the CubeCoW snapshot model. Discover how its flat snapshot design ensures safe deletion and O(1) clone creation in CubeSandbox, streamlining data management.

- Tags: internals
- Published: 2026-07-08

### [How CubeCoW Enables O(1) Snapshots Using XFS Reflink in CubeSandbox](/TencentCloud/CubeSandbox/how-does-cubecow-enable-o-1-snapshots-using-xfs-reflink)

Discover how CubeCoW uses XFS reflink to achieve O(1) snapshots. Learn how this technique clones file metadata for instant snapshots without data duplication.

- Tags: internals
- Published: 2026-07-08

### [CubeHypervisor and Its Relation to RustVMM: A Technical Deep Dive](/TencentCloud/CubeSandbox/what-is-cubehypervisor-and-its-relation-to-rustvmm)

Explore CubeHypervisor and its link to RustVMM. Discover how CubeHypervisor manages KVM MicroVMs within CubeSandbox, leveraging RustVMM for virtualization.

- Tags: deep-dive
- Published: 2026-07-08

### [How CubeShim Implements the containerd Shim v2 API: A Deep Dive into the Rust Implementation](/TencentCloud/CubeSandbox/how-does-cubeshim-implement-the-containerd-shim-v2-api)

Discover how CubeShim implements the containerd Shim v2 API. This Rust deep dive explores its ttrpc server bridging gRPC calls to Micro-VM operations using the containerd_shim crate. Learn more about the Tencent Cloud CubeSandbox.

- Tags: deep-dive
- Published: 2026-07-08

### [What Is Cubelet's Function in CubeSandbox: Node-Level Daemon Explained](/TencentCloud/CubeSandbox/what-is-cubelet-s-function-in-cubesandbox)

Understand Cubelet's function in CubeSandbox. This node-level daemon manages MicroVM lifecycles, storage, networking, and health on compute nodes.

- Tags: internals
- Published: 2026-07-08

### [How to Use the CubeSandbox WebUI: Complete Dashboard Management Guide](/TencentCloud/CubeSandbox/how-to-use-the-cubesandbox-webui)

Master the CubeSandbox WebUI for complete dashboard management. Visually control clusters, sandboxes, and templates via automatic proxying to CubeAPI. Simplify your workflow today.

- Tags: how-to-guide
- Published: 2026-07-08

### [What Is the Role of CubeMaster in CubeSandbox? Central Control Plane Explained](/TencentCloud/CubeSandbox/what-is-the-role-of-cubemaster-in-cubesandbox)

Discover CubeMaster's role as the central control plane in CubeSandbox. Learn how this HTTP service manages sandbox state and orchestration for lifecycle management, node registration, and garbage collection.

- Tags: internals
- Published: 2026-07-08

### [How CubeAPI Works in CubeSandbox: Architecture and Implementation Guide](/TencentCloud/CubeSandbox/how-does-cubeapi-work-in-cubesandbox)

Understand how CubeAPI works within CubeSandbox. Learn about its stateless REST API, E2B compatibility, and how it communicates with the Cubelet daemon for sandbox operations.

- Tags: architecture
- Published: 2026-07-08

### [CubeSandbox Data Plane Components: Architecture and Implementation](/TencentCloud/CubeSandbox/what-are-the-components-of-the-cubesandbox-data-plane)

Explore the CubeSandbox data plane's seven components: Cubelet, CubeShim, CubeHypervisor, CubeCoW, CubeVS, CubeEgress, and CubeProxy. Learn how they manage VMs, networking, storage, and traffic.

- Tags: architecture
- Published: 2026-07-08

### [CubeSandbox Control Plane Components: Architecture and Core Services](/TencentCloud/CubeSandbox/what-are-the-components-of-the-cubesandbox-control-plane)

Discover the CubeSandbox control plane components including CubeAPI, CubeMaster, CubeProxy, WebUI, and Redis. Learn how these services manage requests, scheduling, and coordination.

- Tags: architecture
- Published: 2026-07-08

### [Is CubeSandbox Compatible with E2B? Complete Migration Guide](/TencentCloud/CubeSandbox/is-cubesandbox-compatible-with-e2b-environments)

CubeSandbox is fully compatible with E2B environments, offering a simple drop-in replacement. Migrate existing code easily with this complete guide and just one environment variable change.

- Tags: migration-guide
- Published: 2026-07-08

### [CubeSandbox Memory Overhead Per Instance: A Technical Breakdown](/TencentCloud/CubeSandbox/what-is-cubesandbox-memory-overhead-per-instance)

Discover CubeSandbox memory overhead per instance. Understand the hypervisor overhead and total host memory footprint for Kubernetes environments.

- Tags: deep-dive
- Published: 2026-07-08

### [How CubeSandbox Achieves Sub-60ms Cold Start Times: Architecture Deep Dive](/TencentCloud/CubeSandbox/how-does-cubesandbox-achieve-low-cold-start-times)

Discover how CubeSandbox achieves sub-60ms cold start times using Rust-VMM, CubeCoW, and optimized guest OS images. Dive into the architecture and see how it eliminates traditional container boot overhead.

- Tags: architecture
- Published: 2026-07-08

### [Performance Benefits of CubeSandbox: Bare-Metal Speed for AI Agents](/TencentCloud/CubeSandbox/what-are-the-performance-benefits-of-cubesandbox)

Discover CubeSandbox performance benefits: bare-metal speed, sub-60ms cold starts, low memory overhead, and high throughput. Optimize your AI agents with RustVMM+KVM.

- Tags: performance
- Published: 2026-07-08

### [How to Set Up CubeSandbox for AI Agents: Complete Configuration Guide](/TencentCloud/CubeSandbox/how-to-set-up-cubesandbox-for-ai-agents)

Learn how to set up CubeSandbox for AI agents. This guide covers configuration for a high-performance, secure sandbox environment with sub-60ms cold starts.

- Tags: how-to-guide
- Published: 2026-07-08

### [TTRPC Protocol Protobuf Definitions in CubeSandbox: A Complete Guide](/TencentCloud/CubeSandbox/what-are-the-main-protobuf-definitions-for-the-ttrpc-protocol-in-cubesandbox)

Explore the main ttrpc protocol Protobuf definitions in CubeSandbox. Understand network management service, agent metrics, health checks, and OCI metadata specifications.

- Tags: api-reference
- Published: 2026-07-05

### [How to Build CubeSandbox from Source: Complete Build Guide](/TencentCloud/CubeSandbox/how-to-build-cubesandbox-from-source)

Build CubeSandbox from source with this complete guide. Learn how to compile Rust and Go components using Docker via simple make commands. Start your secure container journey today.

- Tags: how-to-guide
- Published: 2026-07-05

### [Cube-Agent Configuration Options: Complete Guide for MicroVM Tuning](/TencentCloud/CubeSandbox/what-configuration-options-are-available-for-the-cube-agent)

Explore cube agent configuration options for MicroVM tuning. Learn about kernel command-line, TOML, and environment variables with this complete guide.

- Tags: how-to-guide
- Published: 2026-07-05

### [How to Configure containerd to Use CubeSandbox: Complete Integration Guide](/TencentCloud/CubeSandbox/how-to-configure-containerd-to-use-cubesandbox)

Integrate CubeSandbox with containerd. Learn how to configure containerd to use CubeSandbox by installing CubeShim, registering the custom runtime, and updating Cubelet for enhanced container security.

- Tags: how-to-guide
- Published: 2026-07-05

### [CubeSandbox Performance Characteristics for AI Agent Workloads: Latency, Density, and Throughput Benchmarks](/TencentCloud/CubeSandbox/what-are-the-performance-characteristics-of-cubesandbox-for-ai-agent-workloads)

Discover CubeSandbox performance for AI agents. Achieve sub-50ms cold starts, 180 sandbox creations/sec, and minimal memory overhead. Accelerate your AI agent workloads with efficient sandboxing.

- Tags: performance
- Published: 2026-07-05

### [How CubeSandbox Establishes Host-to-Guest Communication: Architecture and Implementation](/TencentCloud/CubeSandbox/how-is-communication-established-between-the-host-and-guest-in-cubesandbox)

Discover how CubeSandbox achieves host-to-guest communication using AF_VSOCK sockets and tap devices for efficient, low-latency coordination between Cube Master and Cubelet.

- Tags: architecture
- Published: 2026-07-05

### [How CubeSandbox Ensures OCI Compatibility: Runtime, Image, and Networking Layers](/TencentCloud/CubeSandbox/how-does-cubesandbox-ensure-oci-compatibility)

Discover how CubeSandbox ensures OCI compatibility across runtime, image, and networking layers. Learn about its integration with umoci and OCI specifications for seamless container operations.

- Tags: deep-dive
- Published: 2026-07-05

### [What Is the Role of Seccomp in CubeSandbox's Security Model?](/TencentCloud/CubeSandbox/what-is-the-role-of-seccomp-in-cubesandbox-s-security-model)

Seccomp secures CubeSandbox by whitelisting Linux syscalls, blocking unauthorized actions, and reducing kernel attack surface on the host.

- Tags: internals
- Published: 2026-07-05

### [How CubeSandbox Implements Resource Limits Using cgroups: A Deep Dive](/TencentCloud/CubeSandbox/how-does-cubesandbox-implement-resource-limits-using-cgroups)

Discover how CubeSandbox uses cgroups and rustjail to implement robust resource limits for CPU, memory, PIDs, and I/O. Learn about cgroup v1 and v2 abstraction.

- Tags: deep-dive
- Published: 2026-07-05

### [How CubeSandbox Uses Namespaces for Process Isolation](/TencentCloud/CubeSandbox/how-does-cubesandbox-use-namespaces-for-process-isolation)

Discover how CubeSandbox leverages Linux namespaces for robust process isolation. Learn about global mount namespaces and per-sandbox containerd namespaces for secure request contexts.

- Tags: internals
- Published: 2026-07-05

### [What is rustjail? Core Container Runtime Primitives for CubeSandbox](/TencentCloud/CubeSandbox/what-is-rustjail-and-what-functionalities-does-it-provide)

Discover rustjail, a Rust library for OCI-compatible container runtime primitives. It offers namespace, cgroup, process, and seccomp control for CubeSandbox.

- Tags: deep-dive
- Published: 2026-07-05

### [How Cube-Agent Forwards I/O Streams in TencentCloud CubeSandbox](/TencentCloud/CubeSandbox/how-does-cube-agent-forward-i-o-streams)

Learn how Cube-agent forwards I/O streams in CubeSandbox using ttrpc, vsock channels, and async copiers for seamless host-guest communication.

- Tags: internals
- Published: 2026-07-05

### [How Cube-Agent Initializes the Guest Environment in CubeSandbox MicroVMs](/TencentCloud/CubeSandbox/how-does-cube-agent-initialize-the-guest-environment)

Discover how cube-agent initializes the guest environment in CubeSandbox MicroVMs. Learn about mounted filesystems, cgroup config, PTY setup, hostname setting, and ttrpc server startup.

- Tags: internals
- Published: 2026-07-05

### [How ttrpc Differs from Standard gRPC in CubeSandbox: Architecture and Implementation](/TencentCloud/CubeSandbox/how-is-ttrpc-different-from-standard-grpc-in-cubesandbox)

Discover how CubeSandbox uses ttrpc for efficient internal communication and gRPC for external APIs. Learn their architectural differences for low-latency and streaming support.

- Tags: architecture
- Published: 2026-07-05

### [What Communication Protocol Is Used Between CubeShim and Cube-Agent?](/TencentCloud/CubeSandbox/what-communication-protocol-is-used-between-cubeshim-and-cube-agent)

CubeShim and cube-agent communicate using ttrpc, leveraging containerd Shim v2 UpdateContainer RPC and request annotations for efficient action dispatching.

- Tags: internals
- Published: 2026-07-05

### [How Containerd Interacts with CubeSandbox: The Shim v2 Architecture Explained](/TencentCloud/CubeSandbox/how-does-containerd-interact-with-cubesandbox)

Discover how containerd interacts with CubeSandbox via the Shim v2 architecture. Learn how CubeShim bridges OCI containers and KVM microVMs for seamless orchestration.

- Tags: internals
- Published: 2026-07-05

### [The Role of cube-agent in the CubeSandbox Architecture: In-VM Guest Agent Deep Dive](/TencentCloud/CubeSandbox/what-is-the-role-of-cube-agent-in-the-cubesandbox-architecture)

Discover how cube-agent functions as the essential in-VM guest agent within the CubeSandbox architecture. Learn how it bridges host-side orchestration with guest-side containers via its ttrpc over vsock interface.

- Tags: deep-dive
- Published: 2026-07-05

### [CubeShim in the CubeSandbox Architecture: The containerd Shim v2 Bridge to MicroVMs](/TencentCloud/CubeSandbox/what-is-the-role-of-cubeshim-in-the-cubesandbox-architecture)

CubeShim bridges containerd and MicroVMs in CubeSandbox. Discover how this Rust implementation enables hardware-isolated workloads using standard container APIs.

- Tags: architecture
- Published: 2026-07-05

### [What Technologies Does CubeSandbox Use for Sandboxing?](/TencentCloud/CubeSandbox/what-technologies-are-used-by-cubesandbox-for-sandboxing)

Discover the technologies behind CubeSandbox's advanced sandboxing. Learn how it leverages Linux namespaces, cgroups, seccomp filters, and Cloud Hypervisor for robust security.

- Tags: deep-dive
- Published: 2026-07-05

### [Memory Overhead of a CubeSandbox Instance: Host Resource Requirements Explained](/TencentCloud/CubeSandbox/what-is-the-memory-overhead-of-a-cubesandbox-instance)

Understand CubeSandbox instance memory overhead. Discover host resource requirements, including guest RAM plus approximately 40 MiB of fixed hypervisor overhead.

- Tags: deep-dive
- Published: 2026-07-05

### [CubeSandbox Startup Time: Sub‑100 ms Cold‑Start Performance Explained](/TencentCloud/CubeSandbox/what-is-the-startup-time-for-a-cubesandbox-sandbox)

Discover CubeSandbox startup time: sub-100ms cold-start performance explained. Learn how CubeSandbox achieves lightning-fast sandboxing on bare-metal hardware and with parallel instance creation.

- Tags: performance
- Published: 2026-07-05

### [How CubeSandbox Provides Hardware-Level Isolation for Untrusted Code](/TencentCloud/CubeSandbox/how-does-cubesandbox-provide-hardware-level-isolation-for-untrusted-code)

CubeSandbox delivers hardware-level isolation for untrusted code using Linux namespaces, cgroups, seccomp, and KVM virtualization for robust security.

- Tags: how-to-guide
- Published: 2026-07-05

### [How to Perform Multi-Node Cluster Deployment with the CubeMaster Orchestrator in CubeSandbox](/TencentCloud/CubeSandbox/how-perform-multi-node-cluster-deployment-cubemaster-orchestrator)

Learn to deploy a multi-node CubeSandbox cluster using the CubeMaster orchestrator. Configure compute nodes and install CubeMaster for seamless cluster management. Get started today.

- Tags: how-to-guide
- Published: 2026-07-03

### [How to Configure Resource Quotas and cgroup for Sandboxed Workloads in CubeSandbox](/TencentCloud/CubeSandbox/how-configure-resource-quotas-cgroup-sandboxed-workloads)

Learn how to configure resource quotas and cgroup for sandboxed workloads in CubeSandbox. Enforce CPU and memory limits for Firecracker MicroVMs using Linux cgroups v2.

- Tags: how-to-guide
- Published: 2026-07-03

### [How to Implement Custom Device Management in CubeShim for Specialized Hardware Passthrough](/TencentCloud/CubeSandbox/how-implement-custom-device-management-cubeshim-specialized-hardware-passthrough)

Learn to implement custom device management in CubeShim for specialized hardware passthrough. Extend VFIO parsing, add device structs, and mount devices efficiently.

- Tags: how-to-guide
- Published: 2026-07-03

### [How to Optimize Memory Overhead for Large-Scale CubeSandbox Deployments](/TencentCloud/CubeSandbox/how-optimize-memory-overhead-large-scale-sandbox-deployments)

Optimize memory overhead for large-scale CubeSandbox deployments using cubecow. This reflink-based COW engine shares file blocks, avoiding duplicate RAM images for thousands of sandbox volumes.

- Tags: performance
- Published: 2026-07-03

### [Security Isolation Comparison: Docker vs MicroVM vs Traditional VMs in CubeSandbox](/TencentCloud/CubeSandbox/what-is-security-isolation-comparison-docker-microvm-traditional-vms)

Compare security isolation of Docker, MicroVM, and traditional VMs. CubeSandbox's MicroVM offers hardware-level isolation with fast startup, eliminating Docker's shared-kernel risks.

- Tags: comparative-analysis
- Published: 2026-07-03

### [Programmatic Sandbox Management Alternatives Using the CubeSandbox WebUI Console API](/TencentCloud/CubeSandbox/what-are-programmatic-sandbox-management-alternatives-webui-console-api)

Explore programmatic sandbox management alternatives using the CubeSandbox WebUI console API. Replace dashboard actions with direct HTTP calls, SDKs, or OpenAPI clients for enhanced control.

- Tags: api-reference
- Published: 2026-07-03

### [How to Integrate CubeSandbox with Existing Container Orchestration Systems: A Kubernetes CRI Guide](/TencentCloud/CubeSandbox/how-integrate-cubesandbox-existing-container-orchestration-systems)

Integrate CubeSandbox with Kubernetes by deploying Cubelet as a CRI runtime plugin. Schedule hardware-isolated micro-VMs for enhanced security and performance.

- Tags: how-to-guide
- Published: 2026-07-03

### [High-Density Deployment of Thousands of CubeSandbox Sandboxes on a Single Node: A Complete Guide](/TencentCloud/CubeSandbox/what-are-considerations-high-density-deployment-thousands-sandboxes-single-node)

Learn how to deploy thousands of CubeSandbox sandboxes on a single node. Optimize kernel merging, scale TAP devices, and use fractional vCPUs for efficient high-density deployment. Get the complete guide.

- Tags: how-to-guide
- Published: 2026-07-03

### [How ttrpc Protocol Over vsock Enables Shim-to-Agent Communication in CubeSandbox](/TencentCloud/CubeSandbox/how-does-ttrpc-protocol-vsock-work-shim-to-agent-communication)

Discover how CubeSandbox uses ttrpc over vsock for efficient shim-to-agent communication. Learn about low-latency, kernel-mediated control channels in this technical deep dive.

- Tags: internals
- Published: 2026-07-03

### [CubeHypervisor KVM MicroVM Configuration and Management Internals](/TencentCloud/CubeSandbox/what-are-cubehypervisor-kvm-microvm-configuration-management-internals)

Explore CubeHypervisor KVM microVM configuration and management internals. Learn how CubeSandbox uses a hypervisor-agnostic architecture for secure, lightweight micro virtual machines.

- Tags: internals
- Published: 2026-07-03

### [Cubelet Node-Level Sandbox Scheduling and Lifecycle Management](/TencentCloud/CubeSandbox/what-is-cubelet-node-level-sandbox-scheduling-lifecycle-management)

Discover Cubelet node-level sandbox scheduling and lifecycle management. Learn how Cubelet handles storage and network provisioning with automatic rollback for efficient container orchestration.

- Tags: architecture
- Published: 2026-07-03

### [E2B SDK Migration Path for CubeSandbox: Endpoint Configuration Guide](/TencentCloud/CubeSandbox/what-is-migration-path-e2b-sdk-swap-endpoints-cubesandbox-compatibility)

Easily migrate the E2B SDK for CubeSandbox compatibility. Learn how to swap endpoints with simple environment variable changes, no code modifications needed. Configure your API URL and template ID now.

- Tags: migration-guide
- Published: 2026-07-03

### [How to Convert OCI Images to Templates in CubeSandbox: A Complete Guide](/TencentCloud/CubeSandbox/how-convert-oci-images-templates-cubesandbox-template-system)

Learn to convert OCI images to templates in CubeSandbox. This guide details pulling image layers, extracting root filesystems, and storing templates using cubemastercli template create-from-image.

- Tags: how-to-guide
- Published: 2026-07-03

### [How to Configure CubeEgress Domain Allowlists and Egress Security Policies in CubeSandbox](/TencentCloud/CubeSandbox/how-configure-cubeegress-domain-allowlists-egress-security-policies)

Learn how to configure CubeEgress domain allowlists and egress security policies with CubeSandbox. Master L7 domain-based rules for enhanced network security.

- Tags: how-to-guide
- Published: 2026-07-03

### [How to Implement a Credential Vault in CubeSandbox to Prevent API Key Exposure](/TencentCloud/CubeSandbox/how-implement-credential-vault-prevent-api-keys-entering-sandboxes)

Learn how to implement a credential vault in CubeSandbox to prevent API key exposure. Securely inject credentials at runtime using CubeEgress and keep secrets out of your sandbox.

- Tags: how-to-guide
- Published: 2026-07-03

### [CubeCoW Snapshot Engine Architecture: Instant Cloning and Rollback in CubeSandbox](/TencentCloud/CubeSandbox/what-is-architecture-cubecow-snapshot-engine-instant-cloning-rollback)

Explore the CubeCoW snapshot engine architecture for instant cloning and rollback in CubeSandbox. Discover its lightweight Copy-on-Write mechanism for sub-100ms operations.

- Tags: architecture
- Published: 2026-07-03

### [CubeVS eBPF Virtual Switch Implementation: Kernel-Level Network Isolation in CubeSandbox](/TencentCloud/CubeSandbox/what-is-cubevs-ebpf-virtual-switch-implementation-kernel-network-isolation)

Explore CubeVS, a high-performance eBPF virtual switch implementation enabling kernel-level network isolation for sandboxed workloads with fine-grained policy enforcement.

- Tags: deep-dive
- Published: 2026-07-03

### [How cube-agent Manages Container Lifecycle Inside MicroVMs as PID 1](/TencentCloud/CubeSandbox/how-cube-agent-manage-container-lifecycle-microvm-pid-1)

Discover how cube-agent, as PID 1 in CubeSandbox MicroVMs, manages container lifecycles by translating host commands into containerd-shim operations.

- Tags: internals
- Published: 2026-07-03

### [CubeShim Containerd Shim v2 Architecture: How CubeSandbox Bridges Containers and MicroVMs](/TencentCloud/CubeSandbox/what-is-architecture-cubeshim-containerd-shim-v2-implementation)

Discover the CubeShim containerd shim v2 architecture. Learn how CubeSandbox bridges containers and microVMs using Rust and ttrpc for efficient communication.

- Tags: architecture
- Published: 2026-07-03

### [How CubeSandbox Achieves Sub-6ms Startup Latency with MicroVM Isolation](/TencentCloud/CubeSandbox/how-cubesandbox-achieve-sub-60ms-startup-latency-microvm-isolation)

Discover how CubeSandbox achieves sub-6ms startup latency using MicroVM isolation. Learn about its Firecracker architecture, copy-on-write images, lazy DMA, and dedicated TAP networking for fast execution.

- Tags: internals
- Published: 2026-07-03