What Programming Languages Does CubeSandbox Support? A Complete Technical Guide

CubeSandbox is a language-agnostic sandbox service that provides official SDKs for Python, Go, and Node.js, while its core runtime is implemented in Rust and can execute code written in any language that can be installed inside an OCI-compatible sandbox template.

CubeSandbox by TencentCloud is a high-performance, secure sandbox environment designed for executing untrusted code in isolation. Understanding what programming languages CubeSandbox supports requires examining both its client SDK layer and its container-based runtime architecture. While the service offers first-class libraries for three popular development languages, its underlying infrastructure enables execution of virtually any programming language through custom sandbox images.

First-Class SDK Support: Python, Go, and Node.js

CubeSandbox provides official client libraries that wrap the REST API, offering idiomatic interfaces for three major programming languages. These SDKs handle sandbox lifecycle management, code execution, file operations, and snapshot management.

Python SDK

The cubesandbox Python package offers a synchronous, context-manager-based API for creating and managing sandboxes. According to the sdk/python/README.md, this SDK supports all primary operations including the run_code() method for executing Python snippets directly and exec_command() for arbitrary shell commands. The Python SDK is the most commonly used client for data science and automation workflows.

Go SDK

The cubesandbox-go SDK mirrors the Python surface but provides Go-idiomatic error handling and concurrency patterns. As documented in sdk/go/README.md, the Go client supports sandbox lifecycle methods, PTY (pseudo-terminal) interactions, file system operations, and snapshot management (clone and rollback). This SDK is ideal for building high-performance microservices that manage sandbox instances.

Node.js SDK

The cubesandbox-node package provides an asynchronous, Promise-based API that matches the functionality of the Python and Go implementations. The sdk/node/README.md demonstrates how to use Sandbox.create() and runCode() methods within Node.js applications, making it suitable for serverless functions and web applications requiring secure code execution.

Core Runtime: Rust Implementation

While CubeSandbox supports multiple languages at the client level, its hypervisor-level runtime is implemented entirely in Rust for memory safety and performance. The core architecture consists of three primary Rust components:

• CubeAPI: The HTTP API server that powers the SDKs, implemented in CubeAPI/src/state.rs
• CubeShim: The sandbox hypervisor shim that mediates between the host and guest, with its entry point in CubeShim/shim/src/main.rs
• CubeProxy: The networking proxy component handling egress policies

These Rust components communicate directly with the KVM hypervisor, making the execution engine language-neutral regardless of the code running inside the sandbox.

Language-Agnostic Execution via OCI Images

The key to CubeSandbox's language flexibility lies in its use of OCI container images (Docker-compatible) as sandbox templates. According to the docs/zh/guide/quickstart.md, sandboxes are built from these images, meaning any language runtime that can be installed in a Linux container can execute inside CubeSandbox.

The default "Python" template ships with Python 3 and a POSIX shell, but users can create custom templates containing:

• Java (OpenJDK)
• Ruby
• C/C++ compilers
• R
• Rust (rustc)
• Any other interpreter or compiler

Once your image contains the desired runtime, you invoke it through the generic exec_command() endpoint or language-specific wrappers.

Implementation Examples by Language

Python SDK Implementation

Create a sandbox and execute Python code using the official Python SDK:

from cubesandbox import Sandbox

# Create a sandbox from the default Python template

with Sandbox() as sb:
    # Run a simple Python script inside the sandbox

    result = sb.run_code(
        code="""
import math
print("π =", math.pi)
""",
        # Optional: limit execution time (ms)

        timeout_ms=5000,
    )
    print(result.stdout)   # → π = 3.141592653589793

Source: sdk/python/README.md

Go SDK Implementation

Execute shell commands inside sandboxes using the Go client:

package main

import (
    "fmt"
    "github.com/tencentcloud/cubesandbox-go"
)

func main() {
    // Initialise the client (uses CUBE_API_URL env var)
    client := cubesandbox.NewClient()
    sb, _ := client.NewSandbox()   // default Python template
    defer sb.Close()

    // Run a bash command inside the sandbox
    res, _ := sb.ExecCommand("bash", "-c", "echo Hello from inside the sandbox!")
    fmt.Println(string(res.Stdout)) // → Hello from inside the sandbox!
}

Source: sdk/go/README.md

Node.js SDK Implementation

Control sandboxes asynchronously from JavaScript:

const { Sandbox } = require('cubesandbox-node');

(async () => {
  // Create a sandbox (defaults to the Python template)
  const sb = await Sandbox.create();

  // Run a Python snippet
  const exec = await sb.runCode({
    code: `print("👋 from Python in a Node‑controlled sandbox")`,
    timeoutMs: 3000,
  });

  console.log(exec.stdout); // → 👋 from Python in a Node‑controlled sandbox
  await sb.destroy();       // clean up
})();

Source: sdk/node/README.md

Running Arbitrary Languages

For languages not covered by the default templates, use the generic execution API with a custom image:

with Sandbox(template="my/ruby-image") as sb:
    result = sb.exec_command("ruby", "-e", 'puts "Hello from Ruby!"')
    print(result.stdout)   # → Hello from Ruby!

Source: docs/zh/guide/quickstart.md

Summary

• CubeSandbox provides official SDKs for Python, Go, and Node.js, located in sdk/python/, sdk/go/, and sdk/node/ respectively.
• The core runtime is written in Rust (CubeAPI/src/state.rs, CubeShim/shim/src/main.rs) for performance and safety, making it language-agnostic at the hypervisor level.
• Any programming language can run inside a sandbox if its runtime is included in the OCI image template used to create the sandbox.
• The default template includes Python 3, but custom templates support Java, C++, Ruby, R, and other languages via standard Linux containers.

Frequently Asked Questions

Does CubeSandbox support Java or C++?

Yes. While there is no dedicated Java or C++ SDK, you can run Java or C++ code by creating a sandbox from a custom OCI image that includes OpenJDK or GCC. Use the exec_command() method to invoke the compiler or runtime directly, or use language-specific build scripts inside the sandbox.

Why is the CubeSandbox core written in Rust?

The core components (CubeAPI, CubeShim, CubeProxy) are implemented in Rust to ensure memory safety and high performance when interacting with the KVM hypervisor. As seen in CubeAPI/src/state.rs, Rust provides the low-level control necessary for secure virtualization while preventing common vulnerabilities found in systems programming languages.

Can I use the CubeSandbox API without the official SDKs?

Yes. The SDKs are convenience wrappers around a REST API. You can interact directly with the CubeSandbox HTTP endpoints documented in the core Rust implementation (CubeAPI/src/state.rs) using any HTTP client in any language. However, the official SDKs handle authentication, retry logic, and connection pooling automatically.

How do I add a new programming language to my CubeSandbox environment?

Create a custom OCI container image that includes your language's interpreter or compiler (e.g., installing Ruby or Erlang in a Dockerfile), push it to a registry accessible to CubeSandbox, and reference it as the template when creating a sandbox. The docs/zh/guide/quickstart.md demonstrates how to specify custom templates and execute arbitrary commands within them.

{
  "mcpServers": {
    "instagit": {
      "command": "npx",
      "args": ["-y", "instagit@latest"]
    }
  }
}