# CubeSandbox License: Apache 2.0 and Third-Party Compliance Guide > Discover the CubeSandbox license, primarily Apache 2.0. Understand third-party compliance with virtiofsd, Kata Containers, and Cloud Hypervisor licenses. - Repository: [Tencent Cloud/CubeSandbox](https://github.com/TencentCloud/CubeSandbox) - Tags: license-information - Published: 2026-07-14 --- **CubeSandbox is released under the Apache License 2.0**, though it bundles several third-party components—including virtiofsd, Kata Containers, and Cloud Hypervisor—that retain their original BSD-2-Clause, BSD-3-Clause, or Apache-2.0 licenses. CubeSandbox is TencentCloud's open-source sandboxed container runtime designed for secure, isolated workloads. Before integrating this project into commercial or internal systems, you must understand both the primary Apache 2.0 terms governing the core codebase and the specific licensing obligations for bundled dependencies. ## Primary License: Apache 2.0 The top-level `LICENSE` file in the TencentCloud/CubeSandbox repository explicitly states that the project is licensed under Apache License 2.0, except for third-party components listed in the "Dependencies and Licenses" section. According to the source code, CubeSandbox follows standard Apache 2.0 requirements: - **Patent grant**: Contributors provide express patent licenses to users - **Trademark neutrality**: The license does not grant trademark rights - **Redistribution terms**: You may distribute derivative works under different terms, provided you preserve the original Apache 2.0 license and copyright notices The full license text resides in the repository root at [`LICENSE`](https://github.com/TencentCloud/CubeSandbox/blob/master/LICENSE). ## Third-Party Component Licenses CubeSandbox incorporates hypervisor and virtualization technologies that carry their own licensing terms. As documented in the `LICENSE` file, these components require separate compliance attention: ### Hypervisor Components The `hypervisor/` directory contains dual-licensed materials: - **`hypervisor/LICENSE-APACHE`**: Apache 2.0 terms for the hypervisor module - **`hypervisor/LICENSE-BSD-3-Clause`**: BSD 3-Clause provisions for specific hypervisor implementations ### Virtiofsd Integration The virtiofsd component, located in `hypervisor/virtiofsd/`, is also dual-licensed: - **`hypervisor/virtiofsd/LICENSE-APACHE`**: Standard Apache 2.0 license - **`hypervisor/virtiofsd/LICENSE-BSD-3-Clause`**: BSD 3-Clause alternative ### Kata Containers and Cloud Hypervisor The project bundles elements from **Kata Containers** and **Cloud Hypervisor**, each subject to their respective Apache 2.0 or BSD license variants. These dependencies are explicitly itemized in the main `LICENSE` file under third-party attributions. ## License Compliance Requirements When using or redistributing CubeSandbox, you must satisfy obligations across multiple license types: 1. **Apache 2.0 Compliance**: Include a copy of the Apache 2.0 license and retain all copyright notices, patent attribution, and disclaimer statements 2. **BSD License Respect**: For components under BSD-2-Clause or BSD-3-Clause (such as those in `hypervisor/virtiofsd/`), preserve the original copyright notices and permission notices 3. **NOTICE File Handling**: If a `NOTICE` file exists in the distribution, include its contents in your redistribution package ## Practical Examples for Compliance ### Adding License Headers to New Source Files When contributing to CubeSandbox or creating derivative works, prepend Apache 2.0 headers to new Go source files: ```go // Copyright (C) 2026 Tencent. All rights reserved. // Licensed under the Apache License, Version 2.0 (the "License"); // you may not use this file except in compliance with the License. // You may obtain a copy of the License at // // http://www.apache.org/licenses/LICENSE-2.0 // ``` ### Verifying License Compliance in Binaries After building CubeSandbox, verify license detection in your binaries using automated tooling: ```bash # Using the license checker tool go install github.com/google/licensechecker@latest licensechecker -path ./build/cube-sandbox ``` ### Packaging for Distribution When creating distribution archives, include all required license files to ensure compliance: ```bash tar czf cube-sandbox.tar.gz \ --transform 's,^,cube-sandbox/,' \ ./bin/cube-sandbox \ ./LICENSE \ ./NOTICE # if present ``` This command ensures the primary `LICENSE` file and any existing `NOTICE` file travel with the binary distribution, satisfying Apache 2.0 redistribution requirements. ## Summary - **CubeSandbox license** is Apache License 2.0 for the core project - **Third-party components** in `hypervisor/virtiofsd/` and related modules carry BSD-2-Clause, BSD-3-Clause, or Apache 2.0 licenses - **Compliance requires** retaining copyright notices, providing license copies, and respecting individual component terms - **Key files** include the root `LICENSE`, `hypervisor/LICENSE-APACHE`, `hypervisor/LICENSE-BSD-3-Clause`, and corresponding files in the `virtiofsd` subdirectory ## Frequently Asked Questions ### Is CubeSandbox free for commercial use? Yes. The **Apache License 2.0** permits commercial use, modification, and private distribution. You may use CubeSandbox in proprietary products provided you include the license text and attribute the original Tencent copyright. However, verify that any third-party components (such as those under BSD licenses in the `hypervisor/` directory) also permit your intended commercial use. ### What are the obligations when redistributing CubeSandbox binaries? You must include a copy of the **Apache 2.0 license** and preserve copyright notices. If the distribution includes components from `hypervisor/virtiofsd/` or other third-party modules, you must also include the applicable **BSD-2-Clause** or **BSD-3-Clause** license texts. Additionally, include any `NOTICE` file contents if present in the source distribution. ### Can I modify CubeSandbox and keep my changes private? Yes. The Apache License 2.0 is **permissive** and does not impose copyleft requirements. You may modify CubeSandbox for internal use without publishing your changes, provided you do not remove existing copyright notices or license headers from the source files you distribute internally. ### How do I handle the dual-licensed components in the hypervisor directory? Components such as those in `hypervisor/virtiofsd/` are available under both **Apache 2.0** and **BSD-3-Clause** licenses. You may choose which license terms to apply when using or redistributing these specific components, selecting the terms that best fit your compliance strategy, provided you fully comply with the chosen license's requirements.