Security Considerations for CubeSandbox: A Defense-in-Depth Analysis

CubeSandbox implements a multi-layered security model combining hypervisor-level seccomp filters, IOMMU memory isolation, SELinux label propagation, and OAuth2 API authentication to protect host and tenant workloads from privilege escalation and unauthorized access.

CubeSandbox is a cloud-native sandbox platform developed by Tencent Cloud that merges lightweight hypervisor technology with container runtimes. Understanding the security considerations for CubeSandbox is essential for operators deploying multi-tenant workloads, as the project integrates hardware-backed isolation, mandatory access controls, and hardened kernel configurations to minimize attack surfaces.

Hypervisor Isolation and System Call Filtering

The Cloud Hypervisor component restricts guest VM capabilities through mandatory access controls at the syscall layer.

Seccomp Filters for Guest VMs

According to the TencentCloud/CubeSandbox source code, the hypervisor employs seccomp filters to restrict the system calls a guest VM can invoke against the host kernel. The default seccomp profile is documented in hypervisor/docs/seccomp.md, which defines the allowed syscall whitelist and trap behaviors.

To apply a custom seccomp profile when launching a VM, pass a JSON configuration specifying allowed syscalls:

{
  "defaultAction": "SCMP_ACT_ERRNO",
  "syscalls": [
    { "name": "read",  "action": "SCMP_ACT_ALLOW" },
    { "name": "write", "action": "SCMP_ACT_ALLOW" },
    { "name": "exit",  "action": "SCMP_ACT_ALLOW" }
  ]
}

Memory Protection via IOMMU

The IOMMU configuration documented in hypervisor/docs/iommu.md enforces address translation and isolation for DMA operations. This prevents malicious VMs from reading or writing memory outside their allocated boundaries, effectively stopping DMA-based attacks against the host or other tenants.

Device and Storage Security

CubeSandbox hardens device access and filesystem operations to prevent privilege escalation through hardware or storage vectors.

VFIO Device Isolation

The hypervisor’s VFIO implementation, detailed in hypervisor/docs/vfio.md, isolates PCI and I/O device access to prevent VMs from compromising the host through direct hardware access. This documentation explains the security implications of exposing devices and mandates strict isolation boundaries for device passthrough.

Container Storage Isolation

The Cubelet storage stack uses copy-on-write reflink pools implemented in Cubelet/storage/pool_withreflink.go to isolate container volumes. By utilizing per-sandbox mount namespaces and reflink copying, the system prevents containers from escaping via the filesystem or accessing other tenants' data through directory traversal.

SELinux Label Propagation

The virtio-fs daemon (hypervisor/virtiofsd/src/main.rs) supports SELinux security labels through the --security-label flag implemented at line 857. When enabled, the daemon transfers SELinux xattr security.selinux from the guest to the host, propagating host-side SELinux contexts to guest filesystems and preventing privilege escalation via file attributes.

Enable SELinux label forwarding when starting the virtiofsd service:

virtiofsd --security-label --socket-path=/tmp/vhostqemu \
          --source=/var/lib/guestfs

Extended Attribute Mapping

The xattr-mapping rules in hypervisor/virtiofsd/doc/xattr-mapping.md control which security.* extended attributes a guest can view or modify. This prevents accidental leakage of host-side security metadata by remapping or hiding sensitive attributes based on client policy.

To remap a guest's security.selinux xattr to a host-side trusted namespace:

virtiofsd --xattrmap=:map:security.selinux:trusted.virtiofs.: \
          --security-label --socket-path=/tmp/vhostqemu \
          --source=/var/lib/guestfs

Trusted Execution and Kernel Hardening

Hardware-backed trusted execution and minimal kernel configurations provide additional isolation layers.

Intel SGX Support

CubeSandbox supports Intel SGX as documented in hypervisor/docs/intel_sgc.md, which isolates enclave memory from the hypervisor and host OS. This protects code and data confidentiality and integrity even if the hypervisor itself is compromised.

Hardened Kernel Configurations

The repository provides hardened kernel configurations for both x86_64 and aarch64 architectures in configs/kernel-oc9.x86_64.config and configs/kernel-oc9.aarch64.config. These configurations disable insecure kernel features and reduce the attack surface available to guest workloads.

Network and API Security

Network policies and authentication mechanisms protect inter-component communications and tenant traffic.

Network Agent Isolation

Network isolation is enforced through agents defined in configs/single-node/network-agent.yaml. These agents configure iptables and kube-proxy rules to enforce egress and ingress policies, protecting inter-pod traffic from tampering and unauthorized external access.

Configure a network policy to block all egress traffic:

apiVersion: networking.k8s.io/v1
kind: NetworkPolicy
metadata:
  name: deny-egress
spec:
  podSelector: {}
  policyTypes:
  - Egress

OAuth2 API Authentication

The OpenAPI specification in openapi.yml (line 1143) defines OAuth2 security schemes for securing API calls between Cubelet, CubeMaster, and the lifecycle manager. This ensures that only authenticated and authorized components can trigger lifecycle operations or modify sandbox configurations.

Secret Handling

Sensitive configuration data is managed through cube-lifecycle-manager/internal/config/config.go, which reads Kubernetes Secret objects. Credentials are never persisted in plain text, ensuring that secret-related configuration fields remain protected at rest and in transit.

Development and Release Security

Security extends to the development workflow and vulnerability disclosure processes.

CI Security Checks

The continuous integration pipeline enforces security through static analysis and formatting checks defined in .github/workflows/fmt-check.yml. These automated checks prevent code with potential security anti-patterns from merging into the main branch.

Seccomp for Development Tools

The dev-CLI shell script (hypervisor/scripts/dev_cli.sh, lines 420-620) adds --security-opt seccomp=unconfined only when explicitly requested, ensuring that auxiliary development tools do not inadvertently bypass syscall restrictions during routine operations.

Security Advisory Process

CubeSandbox manages vulnerability disclosures through the process outlined in hypervisor/docs/releases.md. Security issues are published through GitHub's advisory process, ensuring timely fixes for discovered vulnerabilities and transparent communication with downstream users.

Summary

• Hypervisor isolation uses seccomp filters (hypervisor/docs/seccomp.md) and IOMMU (hypervisor/docs/iommu.md) to restrict guest syscalls and memory access.
• Storage security combines SELinux label propagation (hypervisor/virtiofsd/src/main.rs), xattr mapping (hypervisor/virtiofsd/doc/xattr-mapping.md), and copy-on-write pools (Cubelet/storage/pool_withreflink.go) to prevent filesystem escapes.
• Hardware protection includes Intel SGX support (hypervisor/docs/intel_sgc.md) and hardened kernel configs (configs/kernel-oc9.x86_64.config).
• Network security enforces policies via network agents (configs/single-node/network-agent.yaml) and Kubernetes NetworkPolicy resources.
• API security relies on OAuth2 authentication (openapi.yml) and Kubernetes Secrets (cube-lifecycle-manager/internal/config/config.go).
• Release security is maintained through CI checks (.github/workflows/fmt-check.yml) and documented advisory processes (hypervisor/docs/releases.md).

Frequently Asked Questions

How does CubeSandbox prevent guest VMs from compromising the host kernel?

CubeSandbox implements seccomp filters that restrict the system calls a guest VM can invoke, as documented in hypervisor/docs/seccomp.md. Additionally, the IOMMU configuration (hypervisor/docs/iommu.md) enforces DMA isolation, preventing malicious VMs from accessing host memory or other tenants' memory spaces through direct memory access attacks.

What protections exist against container filesystem escape?

The platform uses copy-on-write reflink pools implemented in Cubelet/storage/pool_withreflink.go to isolate container storage with per-sandbox mount namespaces. The virtiofsd daemon (hypervisor/virtiofsd/src/main.rs) supports SELinux label propagation and xattr mapping (hypervisor/virtiofsd/doc/xattr-mapping.md) to prevent privilege escalation through extended attributes while keeping host security metadata confidential.

How are API communications secured between CubeSandbox components?

The OpenAPI specification at openapi.yml (line 1143) defines OAuth2 security schemes that authenticate requests between Cubelet, CubeMaster, and the lifecycle manager. Sensitive configuration is handled via Kubernetes Secret objects processed through cube-lifecycle-manager/internal/config/config.go, ensuring credentials are never stored in plain text.

Does CubeSandbox support hardware-backed trusted execution?

Yes, CubeSandbox supports Intel SGX as documented in hypervisor/docs/intel_sgc.md, which creates encrypted enclaves that isolate sensitive code and data from the hypervisor and host operating system. This provides cryptographic guarantees of confidentiality and integrity even when the underlying infrastructure is compromised.

{
  "mcpServers": {
    "instagit": {
      "command": "npx",
      "args": ["-y", "instagit@latest"]
    }
  }
}