# Security Considerations for CubeSandbox: A Defense-in-Depth Analysis

> Explore CubeSandbox security considerations with a defense-in-depth analysis. Learn how hypervisor seccomp, IOMMU, SELinux, and OAuth2 protect workloads from threats.

- Repository: [Tencent Cloud/CubeSandbox](https://github.com/TencentCloud/CubeSandbox)
- Tags: deep-dive
- Published: 2026-07-14

---

**CubeSandbox implements a multi-layered security model combining hypervisor-level seccomp filters, IOMMU memory isolation, SELinux label propagation, and OAuth2 API authentication to protect host and tenant workloads from privilege escalation and unauthorized access.**

CubeSandbox is a cloud-native sandbox platform developed by Tencent Cloud that merges lightweight hypervisor technology with container runtimes. Understanding the security considerations for CubeSandbox is essential for operators deploying multi-tenant workloads, as the project integrates hardware-backed isolation, mandatory access controls, and hardened kernel configurations to minimize attack surfaces.

## Hypervisor Isolation and System Call Filtering

The Cloud Hypervisor component restricts guest VM capabilities through mandatory access controls at the syscall layer.

### Seccomp Filters for Guest VMs

According to the TencentCloud/CubeSandbox source code, the hypervisor employs **seccomp** filters to restrict the system calls a guest VM can invoke against the host kernel. The default seccomp profile is documented in [`hypervisor/docs/seccomp.md`](https://github.com/TencentCloud/CubeSandbox/blob/main/hypervisor/docs/seccomp.md), which defines the allowed syscall whitelist and trap behaviors.

To apply a custom seccomp profile when launching a VM, pass a JSON configuration specifying allowed syscalls:

```json
{
  "defaultAction": "SCMP_ACT_ERRNO",
  "syscalls": [
    { "name": "read",  "action": "SCMP_ACT_ALLOW" },
    { "name": "write", "action": "SCMP_ACT_ALLOW" },
    { "name": "exit",  "action": "SCMP_ACT_ALLOW" }
  ]
}

```

### Memory Protection via IOMMU

The **IOMMU** configuration documented in [`hypervisor/docs/iommu.md`](https://github.com/TencentCloud/CubeSandbox/blob/main/hypervisor/docs/iommu.md) enforces address translation and isolation for DMA operations. This prevents malicious VMs from reading or writing memory outside their allocated boundaries, effectively stopping DMA-based attacks against the host or other tenants.

## Device and Storage Security

CubeSandbox hardens device access and filesystem operations to prevent privilege escalation through hardware or storage vectors.

### VFIO Device Isolation

The hypervisor’s **VFIO** implementation, detailed in [`hypervisor/docs/vfio.md`](https://github.com/TencentCloud/CubeSandbox/blob/main/hypervisor/docs/vfio.md), isolates PCI and I/O device access to prevent VMs from compromising the host through direct hardware access. This documentation explains the security implications of exposing devices and mandates strict isolation boundaries for device passthrough.

### Container Storage Isolation

The Cubelet storage stack uses **copy-on-write** reflink pools implemented in [`Cubelet/storage/pool_withreflink.go`](https://github.com/TencentCloud/CubeSandbox/blob/main/Cubelet/storage/pool_withreflink.go) to isolate container volumes. By utilizing per-sandbox mount namespaces and reflink copying, the system prevents containers from escaping via the filesystem or accessing other tenants' data through directory traversal.

### SELinux Label Propagation

The virtio-fs daemon ([`hypervisor/virtiofsd/src/main.rs`](https://github.com/TencentCloud/CubeSandbox/blob/main/hypervisor/virtiofsd/src/main.rs)) supports SELinux security labels through the `--security-label` flag implemented at line 857. When enabled, the daemon transfers SELinux xattr `security.selinux` from the guest to the host, propagating host-side SELinux contexts to guest filesystems and preventing privilege escalation via file attributes.

Enable SELinux label forwarding when starting the virtiofsd service:

```bash
virtiofsd --security-label --socket-path=/tmp/vhostqemu \
          --source=/var/lib/guestfs

```

### Extended Attribute Mapping

The xattr-mapping rules in [`hypervisor/virtiofsd/doc/xattr-mapping.md`](https://github.com/TencentCloud/CubeSandbox/blob/main/hypervisor/virtiofsd/doc/xattr-mapping.md) control which `security.*` extended attributes a guest can view or modify. This prevents accidental leakage of host-side security metadata by remapping or hiding sensitive attributes based on client policy.

To remap a guest's `security.selinux` xattr to a host-side trusted namespace:

```bash
virtiofsd --xattrmap=:map:security.selinux:trusted.virtiofs.: \
          --security-label --socket-path=/tmp/vhostqemu \
          --source=/var/lib/guestfs

```

## Trusted Execution and Kernel Hardening

Hardware-backed trusted execution and minimal kernel configurations provide additional isolation layers.

### Intel SGX Support

CubeSandbox supports **Intel SGX** as documented in [`hypervisor/docs/intel_sgc.md`](https://github.com/TencentCloud/CubeSandbox/blob/main/hypervisor/docs/intel_sgc.md), which isolates enclave memory from the hypervisor and host OS. This protects code and data confidentiality and integrity even if the hypervisor itself is compromised.

### Hardened Kernel Configurations

The repository provides hardened kernel configurations for both x86_64 and aarch64 architectures in `configs/kernel-oc9.x86_64.config` and `configs/kernel-oc9.aarch64.config`. These configurations disable insecure kernel features and reduce the attack surface available to guest workloads.

## Network and API Security

Network policies and authentication mechanisms protect inter-component communications and tenant traffic.

### Network Agent Isolation

Network isolation is enforced through agents defined in [`configs/single-node/network-agent.yaml`](https://github.com/TencentCloud/CubeSandbox/blob/main/configs/single-node/network-agent.yaml). These agents configure **iptables** and kube-proxy rules to enforce egress and ingress policies, protecting inter-pod traffic from tampering and unauthorized external access.

Configure a network policy to block all egress traffic:

```yaml
apiVersion: networking.k8s.io/v1
kind: NetworkPolicy
metadata:
  name: deny-egress
spec:
  podSelector: {}
  policyTypes:
  - Egress

```

### OAuth2 API Authentication

The OpenAPI specification in [`openapi.yml`](https://github.com/TencentCloud/CubeSandbox/blob/main/openapi.yml) (line 1143) defines **OAuth2** security schemes for securing API calls between Cubelet, CubeMaster, and the lifecycle manager. This ensures that only authenticated and authorized components can trigger lifecycle operations or modify sandbox configurations.

### Secret Handling

Sensitive configuration data is managed through [`cube-lifecycle-manager/internal/config/config.go`](https://github.com/TencentCloud/CubeSandbox/blob/main/cube-lifecycle-manager/internal/config/config.go), which reads Kubernetes `Secret` objects. Credentials are never persisted in plain text, ensuring that secret-related configuration fields remain protected at rest and in transit.

## Development and Release Security

Security extends to the development workflow and vulnerability disclosure processes.

### CI Security Checks

The continuous integration pipeline enforces security through static analysis and formatting checks defined in [`.github/workflows/fmt-check.yml`](https://github.com/TencentCloud/CubeSandbox/blob/main/.github/workflows/fmt-check.yml). These automated checks prevent code with potential security anti-patterns from merging into the main branch.

### Seccomp for Development Tools

The dev-CLI shell script ([`hypervisor/scripts/dev_cli.sh`](https://github.com/TencentCloud/CubeSandbox/blob/main/hypervisor/scripts/dev_cli.sh), lines 420-620) adds `--security-opt seccomp=unconfined` only when explicitly requested, ensuring that auxiliary development tools do not inadvertently bypass syscall restrictions during routine operations.

### Security Advisory Process

CubeSandbox manages vulnerability disclosures through the process outlined in [`hypervisor/docs/releases.md`](https://github.com/TencentCloud/CubeSandbox/blob/main/hypervisor/docs/releases.md). Security issues are published through GitHub's advisory process, ensuring timely fixes for discovered vulnerabilities and transparent communication with downstream users.

## Summary

- **Hypervisor isolation** uses seccomp filters ([`hypervisor/docs/seccomp.md`](https://github.com/TencentCloud/CubeSandbox/blob/main/hypervisor/docs/seccomp.md)) and IOMMU ([`hypervisor/docs/iommu.md`](https://github.com/TencentCloud/CubeSandbox/blob/main/hypervisor/docs/iommu.md)) to restrict guest syscalls and memory access.
- **Storage security** combines SELinux label propagation ([`hypervisor/virtiofsd/src/main.rs`](https://github.com/TencentCloud/CubeSandbox/blob/main/hypervisor/virtiofsd/src/main.rs)), xattr mapping ([`hypervisor/virtiofsd/doc/xattr-mapping.md`](https://github.com/TencentCloud/CubeSandbox/blob/main/hypervisor/virtiofsd/doc/xattr-mapping.md)), and copy-on-write pools ([`Cubelet/storage/pool_withreflink.go`](https://github.com/TencentCloud/CubeSandbox/blob/main/Cubelet/storage/pool_withreflink.go)) to prevent filesystem escapes.
- **Hardware protection** includes Intel SGX support ([`hypervisor/docs/intel_sgc.md`](https://github.com/TencentCloud/CubeSandbox/blob/main/hypervisor/docs/intel_sgc.md)) and hardened kernel configs (`configs/kernel-oc9.x86_64.config`).
- **Network security** enforces policies via network agents ([`configs/single-node/network-agent.yaml`](https://github.com/TencentCloud/CubeSandbox/blob/main/configs/single-node/network-agent.yaml)) and Kubernetes NetworkPolicy resources.
- **API security** relies on OAuth2 authentication ([`openapi.yml`](https://github.com/TencentCloud/CubeSandbox/blob/main/openapi.yml)) and Kubernetes Secrets ([`cube-lifecycle-manager/internal/config/config.go`](https://github.com/TencentCloud/CubeSandbox/blob/main/cube-lifecycle-manager/internal/config/config.go)).
- **Release security** is maintained through CI checks ([`.github/workflows/fmt-check.yml`](https://github.com/TencentCloud/CubeSandbox/blob/main/.github/workflows/fmt-check.yml)) and documented advisory processes ([`hypervisor/docs/releases.md`](https://github.com/TencentCloud/CubeSandbox/blob/main/hypervisor/docs/releases.md)).

## Frequently Asked Questions

### How does CubeSandbox prevent guest VMs from compromising the host kernel?

CubeSandbox implements **seccomp** filters that restrict the system calls a guest VM can invoke, as documented in [`hypervisor/docs/seccomp.md`](https://github.com/TencentCloud/CubeSandbox/blob/main/hypervisor/docs/seccomp.md). Additionally, the **IOMMU** configuration ([`hypervisor/docs/iommu.md`](https://github.com/TencentCloud/CubeSandbox/blob/main/hypervisor/docs/iommu.md)) enforces DMA isolation, preventing malicious VMs from accessing host memory or other tenants' memory spaces through direct memory access attacks.

### What protections exist against container filesystem escape?

The platform uses **copy-on-write reflink pools** implemented in [`Cubelet/storage/pool_withreflink.go`](https://github.com/TencentCloud/CubeSandbox/blob/main/Cubelet/storage/pool_withreflink.go) to isolate container storage with per-sandbox mount namespaces. The **virtiofsd** daemon ([`hypervisor/virtiofsd/src/main.rs`](https://github.com/TencentCloud/CubeSandbox/blob/main/hypervisor/virtiofsd/src/main.rs)) supports SELinux label propagation and xattr mapping ([`hypervisor/virtiofsd/doc/xattr-mapping.md`](https://github.com/TencentCloud/CubeSandbox/blob/main/hypervisor/virtiofsd/doc/xattr-mapping.md)) to prevent privilege escalation through extended attributes while keeping host security metadata confidential.

### How are API communications secured between CubeSandbox components?

The **OpenAPI specification** at [`openapi.yml`](https://github.com/TencentCloud/CubeSandbox/blob/main/openapi.yml) (line 1143) defines **OAuth2** security schemes that authenticate requests between Cubelet, CubeMaster, and the lifecycle manager. Sensitive configuration is handled via Kubernetes `Secret` objects processed through [`cube-lifecycle-manager/internal/config/config.go`](https://github.com/TencentCloud/CubeSandbox/blob/main/cube-lifecycle-manager/internal/config/config.go), ensuring credentials are never stored in plain text.

### Does CubeSandbox support hardware-backed trusted execution?

Yes, CubeSandbox supports **Intel SGX** as documented in [`hypervisor/docs/intel_sgc.md`](https://github.com/TencentCloud/CubeSandbox/blob/main/hypervisor/docs/intel_sgc.md), which creates encrypted enclaves that isolate sensitive code and data from the hypervisor and host operating system. This provides cryptographic guarantees of confidentiality and integrity even when the underlying infrastructure is compromised.