# How CubeSandbox Achieves Sub-60ms Cold Start Times: Architecture Deep Dive

> Discover how CubeSandbox achieves sub-60ms cold start times using Rust-VMM, CubeCoW, and optimized guest OS images. Dive into the architecture and see how it eliminates traditional container boot overhead.

- Repository: [Tencent Cloud/CubeSandbox](https://github.com/TencentCloud/CubeSandbox)
- Tags: architecture
- Published: 2026-07-08

---

**CubeSandbox achieves sub-60 millisecond cold start times by combining Rust-VMM micro-virtualization, the CubeCoW copy-on-write snapshot engine, and aggressively stripped guest OS images that eliminate traditional container boot overhead.**

TencentCloud's CubeSandbox delivers serverless sandbox performance with cold start latency under 60 milliseconds—a fraction of traditional container startup times. This article examines the specific architectural decisions in the `TencentCloud/CubeSandbox` repository that enable these low cold start times, from hypervisor-level optimizations to snapshot-based cloning strategies documented in [`docs/architecture/overview.md`](https://github.com/TencentCloud/CubeSandbox/blob/main/docs/architecture/overview.md).

## Micro-Virtualization with Rust-VMM and KVM

CubeSandbox builds on the **Rust-VMM** hypervisor and **KVM** to spin up micro-virtual machines (micro-VMs) rather than traditional containers. Unlike full container runtimes that rely on heavyweight Docker or OCI layers, micro-VMs launch directly on hardware with a minimal kernel and init process. This architecture eliminates the substantial boot surface associated with standard containerd shims, reducing the critical path to VM instantiation.

## The CubeCoW Snapshot Engine

The **CubeCoW** (Copy-on-Write) engine, implemented in [`CubeMaster/pkg/templatecenter/image/engine.go`](https://github.com/TencentCloud/CubeSandbox/blob/main/CubeMaster/pkg/templatecenter/image/engine.go), creates event-level snapshots that can be cloned instantly. When a sandbox is created, the engine clones an existing snapshot rather than booting a fresh OS. This transforms what would be a multi-second image unpack into a sub-millisecond memory operation, directly contributing to the sub-60ms startup guarantee.

## Aggressive Guest OS Stripping

CubeSandbox aggressively strips the guest operating system to reduce image size to **under 5 MB** per instance. By removing unneeded packages, drivers, and userspace utilities, the system minimizes memory mappings and page faults during boot. This stripped-down approach, documented in the [`README.md`](https://github.com/TencentCloud/CubeSandbox/blob/main/README.md) benchmark table, ensures that only essential kernel components load during the cold start sequence.

## Intelligent Image Caching and Fast-Path Orchestration

The control plane optimizes repeat launches through node-level caching in [`Cubelet/storage/local.go`](https://github.com/TencentCloud/CubeSandbox/blob/main/Cubelet/storage/local.go), which tracks cached base images and falls back to cold starts only when entries are missing. The fast path bypasses intermediate containerd shim steps entirely; the `CubeMaster` pushes create requests that directly invoke the hypervisor's `run` API. Additionally, the system tolerates occasional cache misses gracefully—[`CubeMaster/pkg/nodemeta/service.go`](https://github.com/TencentCloud/CubeSandbox/blob/main/CubeMaster/pkg/nodemeta/service.go) lines 509-511 handle missing in-process entries during cold start, allowing self-healing on the next reload without impacting the fast path's reliability.

## Optimized Boot Sequence with Virtio-fs

The final optimization layer involves a streamlined boot sequence using a **tiny init** (systemd-lite) and a pre-configured **virtio-fs** rootfs. This combination completes the Linux boot process in milliseconds by avoiding slow userspace initialization scripts. According to the benchmark table in [`README.md`](https://github.com/TencentCloud/CubeSandbox/blob/main/README.md), this architecture delivers the advertised "Sub-60ms boot" performance while maintaining hardware-level isolation.

## Code Examples

The following examples demonstrate the low-latency path using the Python E2B SDK and internal Rust APIs.

Create a sandbox from a pre-built template using instant clone:

```python
import e2b

# The template ID points to a CubeSandbox image that has already been cached.

template_id = "cubesandbox/fast-start:latest"

# The create call triggers CubeCoW to clone the snapshot – the request returns in < 60 ms.

sandbox = e2b.Sandbox.create(template_id=template_id)

print(f"Sandbox ID: {sandbox.id}")

# → Sandbox ID: sbx-5a8c9d3e...

```

Run a short command within the same sub-60ms window:

```python
result = sandbox.run("python - <<'PY'\nprint('hello')\nPY")
print(result.stdout)   # hello

```

Using the low-level Rust API for direct hypervisor interaction:

```rust
use cubesandbox::hypervisor::Hypervisor;

let hv = Hypervisor::new();
let vm = hv.create_vm_from_snapshot("template_snapshot_id")?;
hv.start(vm)?;

```

## Summary

- **Rust-VMM and KVM micro-VMs** provide hardware-level isolation without the overhead of traditional containers.
- **CubeCoW snapshot engine** in [`CubeMaster/pkg/templatecenter/image/engine.go`](https://github.com/TencentCloud/CubeSandbox/blob/main/CubeMaster/pkg/templatecenter/image/engine.go) enables instant cloning of pre-built images.
- **Aggressive OS stripping** reduces guest images to under 5 MB, minimizing boot time page faults.
- **Node-level caching** via [`Cubelet/storage/local.go`](https://github.com/TencentCloud/CubeSandbox/blob/main/Cubelet/storage/local.go) and direct hypervisor API calls eliminate containerd shim latency.
- **Optimized boot sequence** with virtio-fs and minimal init completes the startup in sub-60 milliseconds.

## Frequently Asked Questions

### How does CubeSandbox's cold start time compare to traditional containers?

Traditional containers often require 1-2 seconds to start due to OCI layer unpacking and containerd shim initialization. CubeSandbox achieves sub-60 millisecond cold starts by using micro-VM snapshots that clone pre-validated memory states rather than unpacking image layers, resulting in startup times 15-30x faster than standard Docker containers.

### What is the CubeCoW engine and how does it reduce startup latency?

The **CubeCoW** (Copy-on-Write) engine is implemented in [`CubeMaster/pkg/templatecenter/image/engine.go`](https://github.com/TencentCloud/CubeSandbox/blob/main/CubeMaster/pkg/templatecenter/image/engine.go) and creates event-level snapshots of sandbox states. Instead of booting a fresh operating system, CubeSandbox clones these existing snapshots in memory, reducing image initialization from seconds to microseconds and enabling the sub-60ms startup performance.

### Why does CubeSandbox use micro-VMs instead of containers for isolation?

CubeSandbox uses **Rust-VMM** and **KVM** micro-VMs to provide hardware-level isolation without the security boundary limitations of container namespaces. Micro-VMs launch directly on hardware with a minimal kernel surface, eliminating the need for heavyweight container runtimes while maintaining stronger security guarantees than process-level isolation.

### How does CubeSandbox handle cache misses during cold start operations?

When a requested image is not present in the node cache, [`Cubelet/storage/local.go`](https://github.com/TencentCloud/CubeSandbox/blob/main/Cubelet/storage/local.go) triggers a fallback to a full cold start. The system handles these occasional misses gracefully—[`CubeMaster/pkg/nodemeta/service.go`](https://github.com/TencentCloud/CubeSandbox/blob/main/CubeMaster/pkg/nodemeta/service.go) lines 509-511 explicitly manage missing in-process entries by self-healing on the next reload, ensuring that cache misses do not destabilize the fast path or impact subsequent sandbox creation requests.