CubeSandbox

CubeSandbox sits in the narrow but growing category of sandbox runtime rather than sandbox API service, and the design choices reflect that. The isolation story is unambiguous: every sandbox gets a dedicated Linux kernel inside a MicroVM boundary, so the failure mode you're defending against — agent-generated code escaping a container into a shared host kernel — is designed out rather than mitigated. eBPF TC hooks drop inter-VM traffic by default, and the CubeEgress L7 reverse proxy handles per-domain, path, and method authorization while injecting credentials outside the sandbox, so a token never lands in code the agent can read. That's a stronger default posture than most container sandboxes ship with, and it matters most for the browser-automation and untrusted-code use cases where an agent is doing things you did not write. The performance claims are specific and checkable in the project's own benchmarks: sub-60ms cold start, single-digit-MB per-VM overhead (the site shows 3.2MB/VM in its density diagram against a "<5MB" headline), a 2,048 instance-per-node cap with 1000+ resident instances, and 500ms AutoPause/AutoResume to reclaim idle capacity. Those numbers come from pre-warmed memory pooling and Copy-on-Write micro-clones rather than a faster boot path, which is the right architecture for the problem. The part that separates CubeSandbox from a generic Firecracker-style setup is the delta-tree state engine: millisecond checkpoints capture runtime deltas, so you can revert a sandbox after a failed agent action or fork it into parallel branches for decision-tree validation and RL rollout comparison. Teams doing evaluation work should weigh that heavily, because re-running trajectories from scratch is the expensive default everywhere else. Where it demands honesty is operations. This is self-hosted infrastructure: you build from source, run KVM hosts, choose S3 or host-mount or shared-block volume backends, and if you go multi-node you run a central CubeMaster cluster. Kubernetes deployment is documented by third parties rather than being the product's native shape — openFuyao's Agent Sandbox SIG published a production practice write-up in September 2026 splitting responsibilities so K8s manages nodes and CubeSandbox manages sandboxes, which is a sensible pattern but one you have to adopt deliberately. The project is also genuinely young: v0.1.0 landed 2026-04-20 and v0.7.2 on 2026-09-23, so the ecosystem, third-party integrations, and community troubleshooting depth are all still maturing, even with 12,000+ GitHub stars and active hiring behind it. Real adopters are already shaping it — Huajiao Live's infrastructure and CTO teams contributed a Go SDK and treat sandbox as a per-agent configurable option rather than a default, and the CubeSandbox team has published OpenClaw and DeepSeek Harness walkthroughs on v0.7.0 Kubernetes clusters. If your team can own hypervisors and clusters, the isolation-plus-forking combination is hard to match