CubeSandbox License: Apache 2.0 and Third-Party Compliance Guide

CubeSandbox is released under the Apache License 2.0, though it bundles several third-party components—including virtiofsd, Kata Containers, and Cloud Hypervisor—that retain their original BSD-2-Clause, BSD-3-Clause, or Apache-2.0 licenses.

CubeSandbox is TencentCloud's open-source sandboxed container runtime designed for secure, isolated workloads. Before integrating this project into commercial or internal systems, you must understand both the primary Apache 2.0 terms governing the core codebase and the specific licensing obligations for bundled dependencies.

Primary License: Apache 2.0

The top-level LICENSE file in the TencentCloud/CubeSandbox repository explicitly states that the project is licensed under Apache License 2.0, except for third-party components listed in the "Dependencies and Licenses" section.

According to the source code, CubeSandbox follows standard Apache 2.0 requirements:

• Patent grant: Contributors provide express patent licenses to users
• Trademark neutrality: The license does not grant trademark rights
• Redistribution terms: You may distribute derivative works under different terms, provided you preserve the original Apache 2.0 license and copyright notices

The full license text resides in the repository root at LICENSE.

Third-Party Component Licenses

CubeSandbox incorporates hypervisor and virtualization technologies that carry their own licensing terms. As documented in the LICENSE file, these components require separate compliance attention:

Hypervisor Components

The hypervisor/ directory contains dual-licensed materials:

• hypervisor/LICENSE-APACHE: Apache 2.0 terms for the hypervisor module
• hypervisor/LICENSE-BSD-3-Clause: BSD 3-Clause provisions for specific hypervisor implementations

Virtiofsd Integration

The virtiofsd component, located in hypervisor/virtiofsd/, is also dual-licensed:

• hypervisor/virtiofsd/LICENSE-APACHE: Standard Apache 2.0 license
• hypervisor/virtiofsd/LICENSE-BSD-3-Clause: BSD 3-Clause alternative

Kata Containers and Cloud Hypervisor

The project bundles elements from Kata Containers and Cloud Hypervisor, each subject to their respective Apache 2.0 or BSD license variants. These dependencies are explicitly itemized in the main LICENSE file under third-party attributions.

License Compliance Requirements

When using or redistributing CubeSandbox, you must satisfy obligations across multiple license types:

1. Apache 2.0 Compliance: Include a copy of the Apache 2.0 license and retain all copyright notices, patent attribution, and disclaimer statements
2. BSD License Respect: For components under BSD-2-Clause or BSD-3-Clause (such as those in hypervisor/virtiofsd/), preserve the original copyright notices and permission notices
3. NOTICE File Handling: If a NOTICE file exists in the distribution, include its contents in your redistribution package

Practical Examples for Compliance

Adding License Headers to New Source Files

When contributing to CubeSandbox or creating derivative works, prepend Apache 2.0 headers to new Go source files:

// Copyright (C) 2026 Tencent. All rights reserved.
// Licensed under the Apache License, Version 2.0 (the "License");
// you may not use this file except in compliance with the License.
// You may obtain a copy of the License at
//
//     http://www.apache.org/licenses/LICENSE-2.0
//

Verifying License Compliance in Binaries

After building CubeSandbox, verify license detection in your binaries using automated tooling:

# Using the license checker tool

go install github.com/google/licensechecker@latest
licensechecker -path ./build/cube-sandbox

Packaging for Distribution

When creating distribution archives, include all required license files to ensure compliance:

tar czf cube-sandbox.tar.gz \
    --transform 's,^,cube-sandbox/,' \
    ./bin/cube-sandbox \
    ./LICENSE \
    ./NOTICE   # if present

This command ensures the primary LICENSE file and any existing NOTICE file travel with the binary distribution, satisfying Apache 2.0 redistribution requirements.

Summary

• CubeSandbox license is Apache License 2.0 for the core project
• Third-party components in hypervisor/virtiofsd/ and related modules carry BSD-2-Clause, BSD-3-Clause, or Apache 2.0 licenses
• Compliance requires retaining copyright notices, providing license copies, and respecting individual component terms
• Key files include the root LICENSE, hypervisor/LICENSE-APACHE, hypervisor/LICENSE-BSD-3-Clause, and corresponding files in the virtiofsd subdirectory

Frequently Asked Questions

Is CubeSandbox free for commercial use?

Yes. The Apache License 2.0 permits commercial use, modification, and private distribution. You may use CubeSandbox in proprietary products provided you include the license text and attribute the original Tencent copyright. However, verify that any third-party components (such as those under BSD licenses in the hypervisor/ directory) also permit your intended commercial use.

What are the obligations when redistributing CubeSandbox binaries?

You must include a copy of the Apache 2.0 license and preserve copyright notices. If the distribution includes components from hypervisor/virtiofsd/ or other third-party modules, you must also include the applicable BSD-2-Clause or BSD-3-Clause license texts. Additionally, include any NOTICE file contents if present in the source distribution.

Can I modify CubeSandbox and keep my changes private?

Yes. The Apache License 2.0 is permissive and does not impose copyleft requirements. You may modify CubeSandbox for internal use without publishing your changes, provided you do not remove existing copyright notices or license headers from the source files you distribute internally.

How do I handle the dual-licensed components in the hypervisor directory?

Components such as those in hypervisor/virtiofsd/ are available under both Apache 2.0 and BSD-3-Clause licenses. You may choose which license terms to apply when using or redistributing these specific components, selecting the terms that best fit your compliance strategy, provided you fully comply with the chosen license's requirements.

{
  "mcpServers": {
    "instagit": {
      "command": "npx",
      "args": ["-y", "instagit@latest"]
    }
  }
}