Differences Between CubeSandbox Versions: Complete v0.1.0 to v0.5.0 Evolution Guide

CubeSandbox has evolved from a baseline RustVMM micro-VM stack in v0.1.0 to a multi-architecture, AutoPause-enabled platform in v0.5.0, adding ARM64 support, copy-on-write snapshots, and hardened egress security.

The differences between CubeSandbox versions reflect a rapid evolution from a basic KVM-based sandbox to a production-ready isolation platform. Since its open-source debut in April 2026, TencentCloud's CubeSandbox has maintained its core promise of sub-60 ms startup times and hardware-level isolation while layering in sophisticated lifecycle management, security proxies, and multi-architecture support.

Architectural Evolution by Version

v0.1.0: The RustVMM Foundation

The initial release established the baseline architecture using RustVMM with a minimal KVM micro-VM stack. In hypervisor/vmm/src/api/mod.rs, the codebase defines SNAPSHOT_VERSION = "1.0.3", establishing the snapshot protocol that persists through subsequent releases. This version provided E2B-compatible APIs but lacked the sophisticated snapshot and security features of later releases.

v0.3.0: CubeCoW Snapshot Engine

Version 0.3.0 introduced the CubeCoW (Copy-on-Write) snapshot engine, fundamentally changing how sandboxes are cloned and restored. This implementation uses reflink-based volumes for instant block-level clones and soft-dirty memory tracking to capture only changed pages after the first full snapshot. The release also delivered the first Web UI and the initial Go SDK, shifting CubeSandbox from a command-line tool to a managed platform.

v0.4.0: CubeEgress Security Proxy

The v0.4.0 release added CubeEgress, an OpenResty-based L7 egress gateway sitting between the guest-side TAP device and the host network stack. This component enforces per-sandbox policies including credential injection, domain allow-lists, and audit logging. Also introduced was the version-matrix reporting system (CubeMaster/pkg/nodemeta/versionmatrix.go), which collects component versions across nodes for visibility in the Web UI (web/src/pages/Versions.tsx).

v0.5.0: ARM64 Native Support and AutoPause

Version 0.5.0 represents the most significant architectural expansion, introducing ARM64 (aarch64) native support across the entire stack. Key changes include MMIO-based SysCtrl device handling in hypervisor/vmm/src/vmm/src/sys_ctrl.rs and BPF target selection using -target $GOARCH. This release also implements AutoPause/AutoResume lifecycle management via the sidecar in CubeProxy/sidecar/main.go, which watches sandbox activity, writes pause snapshots, and shuts down micro-VMs when idle, dramatically reducing resource consumption.

Feature and Security Comparison

Security and Network Capabilities

Capability	v0.3.0	v0.4.0	v0.5.0
CubeVS (eBPF virtual switch)	Basic	SYN-filter hardened	ARM64-aware
CubeEgress proxy	—	OpenResty + Lua	Fail-closed bootstrap, per-sandbox tokens
Network hardening	—	BPF → TPROXY	TCP checksum fixes, route-aware egress

The CubeEgress implementation in CubeEgress/scripts/cube-proxy-iptables-init.sh sets up TPROXY rules that enforce per-sandbox egress policies. Version 0.5.0 adds per-sandbox traffic-access tokens, providing cryptographic identity for outbound connections.

Developer Experience Enhancements

Feature	v0.3.0	v0.4.0	v0.5.0
Web UI	Basic management	Version matrix, log forwarding	Token status, expanded controls
Go SDK	First release	Filesystem API, E2B alignment	Snapshot locking, ARM64 support
Python SDK	Basic sandbox	Security proxy config	Full filesystem & PTY APIs
Deployment	Docker Compose	Systemd services	Terraform one-click cluster

Version 0.5.0 introduced a pure-Go rootfs export pipeline in CubeMaster/pkg/templatecenter/image/image_job_runner.go, replacing the Docker-/skopeo-/umoci-based export path and reducing memory pressure during snapshot creation.

Performance Characteristics

Startup latency remains consistently sub-60 ms across all versions, maintained through the RustVMM micro-VM architecture. Network latency improved significantly between v0.3.0 and v0.4.0, dropping from 35% to 23% P50 overhead, with further gains in v0.5.0 through BPF checksum optimizations. Memory footprint stays under 5 MiB per sandbox, with v0.5.0's pure-Go export pipeline reducing peak memory use during snapshot operations.

Key Source Files and Implementation Details

Understanding the differences between CubeSandbox versions requires examining specific source files:

• hypervisor/src/main.rs: Uses env!("BUILT_VERSION") to inject the version string displayed in API responses and CLI output.
• CubeProxy/sidecar/main.go: Implements the AutoPause/AutoResume logic with Redis-based distributed locking and single-flight resume RPCs.
• CubeMaster/pkg/templatecenter/compat.go: Contains the snapshot runtime locking refactor that eliminated high-concurrency deadlocks in v0.5.0.
• hypervisor/vmm/src/vmm/src/sys_ctrl.rs: Houses the MMIO-based SysCtrl device implementation enabling ARM64 support.
• CubeEgress/scripts/cube-proxy-iptables-init.sh: Configures TPROXY rules for the security proxy introduced in v0.4.0.

Practical Code Examples

Querying Version Information

cubecli version                # Shows binary version (e.g., v0.5.0)

cubemastercli version          # Shows CubeMaster version

Creating a Sandbox with AutoPause (v0.5.0)

import (
    "github.com/tencentcloud/cubesandbox/sdk/go"
)

func main() {
    client, _ := cubesandbox.NewClient("http://localhost:3000")
    sandbox, _ := client.CreateSandbox(
        cubesandbox.SandboxConfig{
            TemplateID: "tpl-abc123",
            Lifecycle: &cubesandbox.Lifecycle{
                IdleTimeoutSeconds: 300,  // AutoPause after 300s
                OnTimeout:          "pause",
            },
        },
    )
    fmt.Println("Sandbox started:", sandbox.ID)
}

Listing Snapshots with Python SDK (v0.4.0+)

from cubesandbox import CubeSandbox

cs = CubeSandbox(api_url="http://localhost:3000")
snapshots = cs.list_snapshots(sandbox_id="sand-xyz")
for s in snapshots:
    print(f"{s.id}: created={s.created_at}, size={s.size_bytes}")

Deploying with Terraform (v0.5.0)

cd CubeSandbox/deploy/one-click/terraform/tencentcloud
terraform init
terraform apply -var="region=ap-beijing-1" -var="master_replica_count=2"

Summary

• v0.5.0 delivers ARM64 native support, AutoPause/AutoResume lifecycle management, and hardened security with per-sandbox traffic tokens.
• v0.4.0 introduced the CubeEgress security proxy, version-matrix visibility, and daemonless template pipelines.
• v0.3.0 established the CubeCoW snapshot engine with reflink volumes and soft-dirty memory tracking.
• v0.1.0 provided the foundational RustVMM + KVM micro-VM stack with sub-60 ms startup and E2B-compatible APIs.

Frequently Asked Questions

What is the main difference between CubeSandbox v0.4.0 and v0.5.0?

Version 0.5.0 adds ARM64 architecture support and AutoPause/AutoResume capabilities, whereas v0.4.0 focused on the CubeEgress security proxy and version-matrix reporting. The v0.5.0 release also replaces the Docker-based rootfs export with a pure-Go pipeline, reducing memory pressure during snapshot creation.

Does CubeSandbox support ARM64 servers?

Yes, but only from v0.5.0 onward. The ARM64 porting includes hypervisor device changes, MMIO-based SysCtrl signaling in hypervisor/vmm/src/vmm/src/sys_ctrl.rs, and BPF target selection using -target $GOARCH. Earlier versions (v0.1.0–v0.4.0) are x86_64 only.

How does AutoPause work in CubeSandbox?

The AutoPause feature in v0.5.0 uses a sidecar in CubeProxy/sidecar/main.go that monitors sandbox activity via Redis-backed distributed locks. When a sandbox exceeds its IdleTimeoutSeconds, the sidecar writes a pause snapshot and shuts down the micro-VM, resuming it on the next request through a single-flight RPC mechanism.

Which version introduced the CubeCoW snapshot engine?

The CubeCoW (Copy-on-Write) snapshot engine debuted in v0.3.0, enabling instant snapshots using reflink volumes and soft-dirty memory tracking. Version 0.4.0 added snapshot runtime locking to eliminate deadlocks, and v0.5.0 further hardened this with locking refactors in CubeMaster/pkg/templatecenter/compat.go.

{
  "mcpServers": {
    "instagit": {
      "command": "npx",
      "args": ["-y", "instagit@latest"]
    }
  }
}