How to Secure CubeSandbox with Configuration: A Comprehensive Hardening Guide

Secure CubeSandbox with configuration by hardening the Go SDK's Config structure in sdk/go/config.go, enforcing container privileges in the security_context block, and controlling network isolation through cube_network_config settings in configs/single-node/cubemaster.yaml.

CubeSandbox, TencentCloud's container-based sandbox environment, exposes critical security controls through its configuration layer rather than hardcoded defaults. By modifying the SDK configuration and CubeMaster YAML files, you can lock down the control-plane API, restrict network access for user workloads, and eliminate container privilege escalations. This guide covers the exact file paths, struct fields, and parameters needed to secure CubeSandbox with configuration changes.

Control-Plane Security Configuration

The Go SDK's Config structure in sdk/go/config.go defines how your application authenticates with and connects to the CubeSandbox API. The normalizeConfig function sanitizes input values and derives security-critical settings like ProxyScheme based on port numbers.

SDK Authentication and Endpoint Hardening

Set APIURL to an internal-only address (e.g., http://127.0.0.1:3000) and provide a cryptographically strong APIKey. The SDK reads the CUBE_API_URL and CUBE_API_KEY environment variables, falling back to the values in the instantiated Config struct. Remove external attack surfaces by setting CUBE_PROXY_NODE_IP="" to disable external proxy access for the control-plane client.

Enforcing TLS Encryption

The normalizeProxyScheme function automatically sets ProxyScheme to https when ProxyPortHTTP equals 443. Configure ProxyPortHTTP: 443 in your SDK config to force encrypted data-plane communication without manual scheme management. This prevents accidental cleartext transmission of sandbox data.

Runtime Security in CubeMaster YAML

The configs/single-node/cubemaster.yaml file controls sandbox runtime behavior through the cubelet_conf section and the cube_box_req_template field, which contains JSON defining container security contexts and network policies.

Container Privilege Restrictions

Modify the security_context object within cube_box_req_template to disable dangerous defaults. Change privileged from true to false, enable readonly_rootfs: true to prevent filesystem modifications, and ensure no_new_privs: true blocks privilege escalation via setuid binaries. These settings are defined in the pod spec JSON embedded within the YAML configuration.

Network Isolation Policies

Configure cube_network_config to control outbound traffic from sandboxes. Set allowInternetAccess: false to block external connectivity, and populate the denyOut array with private CIDR ranges (10.0.0.0/8, 100.64.0.0/10, 172.16.0.0/12, 192.168.0.0/16) to prevent sandboxed code from scanning internal networks. The CubeNet/cubevs/cubevs.go file implements the TAP networking layer that enforces these rules.

Port Exposure Limits

Restrict which ports sandboxes can expose to the host by configuring enable_exposed_port: true with a specific exposed_port_list (e.g., ["80"]). This prevents unauthorized services from binding to high-risk ports or exposing internal debugging interfaces.

Idle Timeout Configuration

Set default_timeout_insec to a positive value (e.g., 300 for 5 minutes) in the cubelet_conf section. A value of -1 disables the global timeout, leaving stale sandboxes running indefinitely and increasing your attack surface. Consider also setting create_timeout_insec to limit how long creation RPCs may hang.

Implementation Examples

Creating a Secure SDK Client

import (
    "github.com/TencentCloud/CubeSandbox/sdk/go"
)

func newSecureClient() *cubesandbox.Client {
    cfg := cubesandbox.Config{
        APIURL:        "http://127.0.0.1:3000", // Internal only
        APIKey:        "REPLACE_WITH_SECRET",   // Keep out of logs
        ProxyPortHTTP: 443,                     // Forces HTTPS
    }
    return cubesandbox.NewClient(cfg)
}

This client configuration references the Config struct defined in sdk/go/config.go and instantiated in sdk/go/client.go.

Hardened CubeMaster Configuration

cubelet_conf:
  default_timeout_insec: 300
  enable_exposed_port: true
  exposed_port_list:
    - "80"

cube_box_req_template: >-
  {
    "volumes":[{"name":"tmp","volume_source":{"empty_dir":{"medium":0}}}],
    "containers":[{
      "name":"cubebox-default",
      "envs":[{"key":"TZ","value":"Asia/Shanghai"}],
      "volume_mounts":[{"name":"tmp","container_path":"/"}],
      "security_context":{
        "privileged":false,
        "readonly_rootfs":true,
        "no_new_privs":true
      }
    }],
    "network_type":"tap",
    "cube_network_config":{
      "allowInternetAccess":false,
      "denyOut":["10.0.0.0/8","100.64.0.0/10","172.16.0.0/12","192.168.0.0/16"]
    }
  }

This YAML configuration from configs/single-node/cubemaster.yaml applies the security context and network policies processed by the network-agent defined in network-agent/internal/service/config.go.

Summary

• Control-plane security relies on sdk/go/config.go settings: bind APIURL to internal addresses, use strong APIKey values, and set ProxyPortHTTP: 443 to force HTTPS.
• Container hardening requires modifying security_context in cube_box_req_template to disable privileged mode and enable readonly_rootfs.
• Network isolation is enforced through cube_network_config fields allowInternetAccess and denyOut in the CubeMaster YAML.
• Resource limits prevent stale sandboxes by setting default_timeout_insec to a positive value in cubelet_conf.
• Port restrictions limit exposure via exposed_port_list arrays that whitelist only necessary ports.

Frequently Asked Questions

How do I completely disable internet access for all sandboxes?

Set allowInternetAccess: false inside the cube_network_config block of your configs/single-node/cubemaster.yaml file. This blocks all outbound connections from sandbox containers, while the denyOut array blocks private IP ranges even if allowInternetAccess is enabled.

What is the difference between SDK configuration and CubeMaster configuration?

The SDK configuration in sdk/go/config.go controls how your application connects to the CubeSandbox API (authentication, timeouts, TLS). The CubeMaster configuration in configs/single-node/cubemaster.yaml controls how the master node creates and manages sandboxes (container privileges, network policies, idle timeouts).

How do I enforce HTTPS for data-plane traffic without changing application code?

Set ProxyPortHTTP: 443 in the SDK Config struct. The normalizeProxyScheme function automatically derives ProxyScheme: "https" when it detects port 443, forcing all data-plane communications through TLS encryption.

Why should I avoid setting default_timeout_insec to -1?

A value of -1 disables the global idle timeout, allowing sandboxes to run indefinitely even when inactive. This increases your attack surface by leaving stale containers in memory. Set a positive value like 300 (5 minutes) to ensure automatic cleanup of idle sandboxes.

{
  "mcpServers": {
    "instagit": {
      "command": "npx",
      "args": ["-y", "instagit@latest"]
    }
  }
}