CubeSandbox

No entries match these filters. Clear filters

1. docs update Oct 3, 2026 · issue 093

   CubeSandbox v0.5.0 adds AutoPause/AutoResume, ARM64ARM64The 64-bit instruction set architecture from ARM Holdings, used in modern mobile chips, Apple Silicon, and cloud server CPUs; tools target it to run natively on those platforms without emulation overhead. native support, Tencent Cloud Terraform one-click cluster deploy, and per-sandbox traffic tokens.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

   └──▷ USE IT
   Maximize node scheduling density on a high-throughput agent platform by fully releasing quota for paused sandboxes.
   yaml copy

   host:
     quota:
       paused_resource_release_ratio: 1

   Lock down a restricted sandbox so only callers presenting its traffic_access_token can reach it inbound — any other request gets 403.
   python copy

   sandbox = Sandbox.create(network={"allow_public_traffic": False}, lifecycle={"timeout": 300})

   Upgrade an existing single-node CubeSandbox installation to v0.5.0 in-place, preserving your .env customizations.
   copy

   $ bash create.sh --mode upgrade

   • Adds host.quota.paused_resource_release_ratio node-level config to control how much scheduling quota is released when a sandbox pauses — 0 releases nothing, 1 releases all quota to maximize node density.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠
   • Adds lifecycle as a standard parameter to Sandbox.create for AutoPause/AutoResume, aligning with E2B semantics — idle sandboxes are snapshotted to disk and shut down, then woken in tens of milliseconds by CubeProxy on the next inbound request.
   • Adds network.allow_public_traffic=false option at sandbox creation to assign a unique traffic_access_token; CubeProxy rejects any inbound request missing the token with HTTP 403.
   • Adds TENCENTCLOUD_USE_CFS=true environment variable to the Tencent Cloud Terraform deployer to enable CFS shared storage, allowing multiple cubemaster replicas to share /data/CubeMaster/storage via ReadWriteMany NFS for multi-machine failover.
   • Adds --mode upgrade flag to the one-click create.sh installer for online upgrades — performs a three-way .env config merge with fail-fast pre-checks for disk space, semver compatibility, and network CIDRCIDRA notation for a block of IP addresses, such as 10.0.0.0/24. The number after the slash says how many leading address bits identify the network. conflicts.

   +5 more show less

   • Introduces official Tencent Cloud Terraform cluster deployer (create.sh) that provisions cubemaster, cube-api, cubeproxy, and cube-webui on TKE, plus managed MySQL, Redis, and CVM/bare-metal sandbox nodes.
   • Adds native ARM64 (Arm64) platform support for CubeSandbox, rewriting the guest-to-host control channel from PIO to MMIO, reworking the boot path to use UEFIUEFIA firmware specification maintained by the UEFI Forum that replaces legacy BIOS, defining how an OS and hardware initialize at boot. Cyber tools target or hook it to inspect pre-OS execution environments. firmware, and realigning seccomp filter rules for ARM64 syscall numbers.
   • Adds outbound policy routing support via a virtual NICNICA network interface card or adapter, the hardware that connects a computer to a network. It sends and receives packets over the link. cube-router, allowing node administrators to configure per-route egress rules for scenarios such as internal/external network separation and shared public gateways.
   • Rewrites rootfs export path in native Go with concurrent prefetch, streaming extraction, and on-the-fly decompression, reducing peak memory by 39% and build time by 16%.
   • E2B-compatible SDK now supports injecting environment variables at sandbox creation time, aligning with the E2B spec.
   • Adds host.quota.paused_resource_release_ratio node-level config to control how much scheduling quota is released when a sandbox pauses — 0 releases nothing, 1 releases all quota to maximize node density.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠
   • Adds lifecycle as a standard parameter to Sandbox.create for AutoPause/AutoResume, aligning with E2B semantics — idle sandboxes are snapshotted to disk and shut down, then woken in tens of milliseconds by CubeProxy on the next inbound request.
   • Adds network.allow_public_traffic=false option at sandbox creation to assign a unique traffic_access_token; CubeProxy rejects any inbound request missing the token with HTTP 403.
   • Adds TENCENTCLOUD_USE_CFS=true environment variable to the Tencent Cloud Terraform deployer to enable CFS shared storage, allowing multiple cubemaster replicas to share /data/CubeMaster/storage via ReadWriteMany NFS for multi-machine failover.
   • Adds --mode upgrade flag to the one-click create.sh installer for online upgrades — performs a three-way .env config merge with fail-fast pre-checks for disk space, semver compatibility, and network CIDRCIDRA notation for a block of IP addresses, such as 10.0.0.0/24. The number after the slash says how many leading address bits identify the network. conflicts.

   +3 more show less

   • Introduces official Tencent Cloud Terraform cluster deployer (create.sh) that provisions cubemaster, cube-api, cubeproxy, and cube-webui on TKE, plus managed MySQL, Redis, and CVM/bare-metal sandbox nodes.
   • Adds native ARM64 (Arm64) platform support for CubeSandbox, rewriting the guest-to-host control channel from PIO to MMIO, reworking the boot path to use UEFIUEFIA firmware specification maintained by the UEFI Forum that replaces legacy BIOS, defining how an OS and hardware initialize at boot. Cyber tools target or hook it to inspect pre-OS execution environments. firmware, and realigning seccomp filter rules for ARM64 syscall numbers.
   • Adds outbound policy routing support via a virtual NICNICA network interface card or adapter, the hardware that connects a computer to a network. It sends and receives packets over the link. cube-router, allowing node administrators to configure per-route egress rules for scenarios such as internal/external network separation and shared public gateways.

   2 more in Everything

2. docs update Oct 3, 2026 · issue 093

   CubeSandbox launches: a RustVMM/KVMKVMA Linux kernel module that turns the kernel into a hypervisor, letting a process run fully isolated virtual machines using hardware virtualisation extensions. Cyber tools use it to sandbox execution environments at near-native speed. MicroVM sandbox for AI Agents with E2B SDKE2B SDKAn open-source SDK by E2B that lets a program spin up isolated cloud sandbox environments on demand, giving cyber tools a safe runtime for executing untrusted code or agents. drop-in compatibility, eBPFeBPFA Linux technology for running verified programs inside the kernel without changing its source. Tools use it to observe processes, enforce rules and process network traffic. network isolation, and ARM64ARM64The 64-bit instruction set architecture from ARM Holdings, used in modern mobile chips, Apple Silicon, and cloud server CPUs; tools target it to run natively on those platforms without emulation overhead. native support.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

   • Supports E2B SDK as a drop-in replacement — swap one environment variable to route existing E2B SDK calls to a self-hosted CubeSandbox instance with zero client code changes.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠
   • Adds eBPF kernel-level network isolation (TC_EGRESS / SECRET_SHIELD) with an L7 reverse proxy for per-domain/path auth and dynamic credential injection, keeping API keys physically invisible to sandboxed code.
   • Provides decoupled Volume storage plugin framework (SYS_STORAGE // VOLUME_BUS) with pluggable drivers for standard S3 and local Host Mount, supporting hot-plug mounting and multi-sandbox cooperative read/write.
   • Supports multi-node cluster deployment orchestrated by a CubeMaster control node for distributed compute node management and high availability.
   • Delivers sub-60 ms cold-start sandbox launch via kernel copy-on-write (CoWCoWCopy-on-write: an OS memory optimization where two processes share the same physical pages until one writes, triggering a private copy only then. It makes forking processes fast and cheap.) snapshot pooling, bypassing traditional VM and OS kernel boot overhead.

   +4 more show less

   • Isolates each sandbox in a dedicated MicroVM with its own guest OS kernel, enforcing hardware-boundary and KVM-barrier containment against privilege escalationprivilege escalationGaining permissions beyond those an account or process initially had. It can turn limited access into administrator control or access to another user's resources. and cross-tenant escape.
   • Compresses per-sandbox memory footprint to under 5 MB via kernel-space memory sharing and CoW, enabling 1,000+ concurrent sandbox instances per physical host.
   • Adds millisecond-granularity incremental snapshot checkpointing (SYS_STATE // DELTA_TREE) with bidirectional lossless rollback and parallel branch forking for agent decision-tree validation and RL training.
   • Delivers full ARM64 native support (ISA: ARM64_FULL_STACK) across the MicroVM layer, guest OS kernel, image build, and automated deployment pipeline.

   9 details in Everything

3. docs update Oct 3, 2026 · issue 093

   CubeSandbox debuts: sub-60ms MicroVM sandboxes with eBPFeBPFA Linux technology for running verified programs inside the kernel without changing its source. Tools use it to observe processes, enforce rules and process network traffic. egress, CoWCoWCopy-on-write: an OS memory optimization where two processes share the same physical pages until one writes, triggering a private copy only then. It makes forking processes fast and cheap. forking, E2B SDKE2B SDKAn open-source SDK by E2B that lets a program spin up isolated cloud sandbox environments on demand, giving cyber tools a safe runtime for executing untrusted code or agents. drop-in compatibility, and multi-node clustering for AI agents.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

   • Provides sub-60ms cold starts via pre-warmed memory pooling and Copy-on-Write micro-clones that bypass kernel boot overhead.
   • Enforces kernel-level eBPF TC egress hooks for strict inter-sandbox network isolation, with a built-in L7 security reverse proxy for route authorization and automatic credential injection.
   • Delivers hardware-level MicroVM isolation with a dedicated Linux kernel per sandbox, physically preventing container breakouts and host compromise.
   • Supports millisecond delta checkpoints and tree-style state forking, enabling rollback and divergent exploration paths for agent decision-tree validation.
   • Provides decoupled volume storage with pluggable drivers supporting S3, host mounts, and shared block volumes with hotplug.

   +3 more show less

   • Scales to multi-node cluster deployments via a centralized CubeMaster orchestrator with high availability.
   • Offers native ARM64ARM64The 64-bit instruction set architecture from ARM Holdings, used in modern mobile chips, Apple Silicon, and cloud server CPUs; tools target it to run natively on those platforms without emulation overhead. (AArch64AArch64The 64-bit execution state of the ARM architecture, defined by Arm Ltd., offering a wider register file and cleaner instruction set than 32-bit ARM; cyber tools target it to run natively on ARM-based servers, phones, and embedded devices.) support across the custom hypervisor, minimal kernel, and OCIOCIOpen Container Initiative standard, maintained by the Linux Foundation, defining the image format and runtime spec that container tools share so images built once run anywhere OCI-compliant. image execution.
   • Achieves single-digit MB per-sandbox memory overhead through shared read-only kernel structures and CoW page sharing, supporting thousands of resident instances with auto-sleep/resume.

   8 details in Everything

4. v0.7.2 Sep 24, 2026 · issue 084

   CubeSandbox v0.7.2 adds JuiceFSJuiceFSAn open-source distributed file system that stores metadata in a database and data in object storage like S3, giving cyber tools a POSIX-compatible shared filesystem without managing dedicated storage servers. volume plugin, idle guest memory reclaim, cross-node S3 restore cache, and sandbox.connect timeout parameter.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

   └──▷ GET THIS VERSION

   copy

   $ git clone --branch v0.7.2 https://github.com/TencentCloud/CubeSandbox.git
   # already have the repo? check out this version:
   $ git checkout v0.7.2

   └──▷ USE IT
   Pin guest MTU to match a constrained overlay CNI uplink so sandbox networking is not silently broken on deployment.
   yaml copy

   cubeNode:
     network:
       mtu: 1450

   Set a hard deadline on a sandbox connection so a hung connect attempt does not block automation pipelines indefinitely.
   python copy

   sandbox.connect(timeout=10)

   • Adds timeout parameter to sandbox.connect to control connection deadlines (#1352).⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠
   • Adds cubeNode.network.mtu config key to pin guest MTU when node uplink NICNICA network interface card or adapter, the hardware that connects a computer to a network. It sends and receives packets over the link. MTU cannot be auto-detected (#1674).
   • Adds hostNetworkChangeAck confirmation flag required when switching an existing cluster to host-network mode for cube-node Pods (#1815).
   • Adds JuiceFS storage plugin so sandboxes can mount a JuiceFS filesystem as a persistent volume with full POSIXPOSIXA family of standards for operating-system interfaces, including process, file and shell behavior. Software that uses these interfaces is easier to move between compatible systems. semantics.
   • Adds automatic reclaim of idle guest memory back to the host, allowing a single node to host more sandboxes.

   +5 more show less

   • Adds whole-object local S3 cache for cross-node restore reads so repeated reads and re-imports of the same snapshot hit the local cache instead of S3.
   • Enables cube-node to run on the host network by default in K8s deployments, keeping sandbox network namespaces alive across Pod restarts (#1815).
   • Allows Cubelet to configure the template install path so large templates can be moved to the data disk (#1675).
   • Extends component repository and template artifact storage to support S3, local disk, PVC, and NFS backends (#1749).
   • Enables the Python SDK run_code (E2B-compatible code-interpreter interface) to read environment variables injected at sandbox creation (#1323).
   • Adds timeout parameter to sandbox.connect to control connection deadlines (#1352).⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠
   • Adds JuiceFS storage plugin so sandboxes can mount a JuiceFS filesystem as a persistent volume with full POSIXPOSIXA family of standards for operating-system interfaces, including process, file and shell behavior. Software that uses these interfaces is easier to move between compatible systems. semantics.
   • Adds automatic reclaim of idle guest memory back to the host, allowing a single node to host more sandboxes.

   7 more in Everything

   └──▷ BREAKING ON UPGRADE

   • !cube-node now runs on the host network by default in K8s deployments; switching an existing cluster requires draining compute nodes and passing explicit hostNetworkChangeAck confirmation — without this, the migration cannot proceed.
5. v0.7.1 Sep 11, 2026 · issue 071

   CubeSandbox v0.7.1 adds HA control-plane, S3-backed templates, K8s S3 volumes, external PostgreSQL, and virtiofsdvirtiofsdA userspace daemon, maintained by the virtio project, that shares a host directory with a virtual machine over the virtio-fs protocol, giving VMs fast, POSIX-compliant access to host filesystems without network overhead. hardening.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

   └──▷ GET THIS VERSION

   copy

   $ git clone --branch v0.7.1 https://github.com/TencentCloud/CubeSandbox.git
   # already have the repo? check out this version:
   $ git checkout v0.7.1

   └──▷ USE IT
   Opt the S3 backend back in after upgrading a node that previously relied on it without an explicit config.
   ini copy

   [cow.s3]
   enable = true

   Isolate logical Redis databases per cluster when multiple CubeSandbox clusters share one Redis instance.
   yaml copy

   redis:
     db: 2

   • Enables CUBE_DATABASE_DRIVER to select MySQL or PostgreSQL and connect one-click deployments to a self-managed database instance.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠
   • Adds [cow.s3] enable = true config key (or ONE_CLICK_ENABLE_S3LVOL=1 env var) to opt in to the CubeS3lvol S3 backend for cross-node pause/resume and snapshots; disabled by default.
   • Adds new top-level redis.db Helm config key applied to CubeMaster, CubeProxy, and CLM so multiple clusters sharing one Redis instance can isolate logical databases per cluster.
   • Adds tpl delete subcommand to cubemastercli accepting multiple template IDs in a single batch deletion call.
   • Introduces standalone CubeTemplateCenter service that splits template build, delete, and reclaim out of CubeMaster into an independently scalable multi-replica service, persisting build artifacts to S3/MinIO (AWS S3-compatibleS3-compatibleAn object-storage API that mirrors Amazon S3's HTTP interface, so any client or cyber tool written for AWS S3 works unchanged against any compliant storage backend. storage).

   +6 more show less

   • Adds CubeS3lvol support on Kubernetes for cross-node pause/resume and snapshots in K8s deployments.
   • Adds snapshot support (snapshot, restore, rollback, and clone) for sandboxes with Host Mount and Volume Plugin external mounts.
   • Enables same-bucket cross-node snapshot restore via object-storage server-side copy, adding snapshot cancellation and improved delayed-delete reclamation.
   • Adds virtiofsd hardening that rejects root-directory mutation operations and forged readdirplus requests after a directory whitelist is configured.
   • Supports active/standby disaster recovery for the lifecycle management service (CLM).
   • Allows deleting a still-referenced snapshot immediately, with underlying storage reclaimed after the last reference is released.
   • Enables CUBE_DATABASE_DRIVER to select MySQL or PostgreSQL and connect one-click deployments to a self-managed database instance.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠
   • Adds [cow.s3] enable = true config key (or ONE_CLICK_ENABLE_S3LVOL=1 env var) to opt in to the CubeS3lvol S3 backend for cross-node pause/resume and snapshots; disabled by default.
   • Adds new top-level redis.db Helm config key applied to CubeMaster, CubeProxy, and CLM so multiple clusters sharing one Redis instance can isolate logical databases per cluster.
   • Introduces standalone CubeTemplateCenter service that splits template build, delete, and reclaim out of CubeMaster into an independently scalable multi-replica service, persisting build artifacts to S3/MinIO (AWS S3-compatibleS3-compatibleAn object-storage API that mirrors Amazon S3's HTTP interface, so any client or cyber tool written for AWS S3 works unchanged against any compliant storage backend. storage).
   • Adds CubeS3lvol support on Kubernetes for cross-node pause/resume and snapshots in K8s deployments.

   6 more in Everything

   └──▷ BREAKING ON UPGRADE

   • !Nodes that were using the S3 backend without an explicit setting must set [cow.s3] enable = true (or ONE_CLICK_ENABLE_S3LVOL=1) after upgrading, or the S3 volume will be disabled.
6. v0.7.0 Aug 28, 2026 · issue 058

   CubeSandbox v0.7.0 adds cross-node pause/resume, component multi-versioning, a network subsystem refactor, and a new CubeOps control plane split

   └──▷ GET THIS VERSION

   copy

   $ git clone --branch v0.7.0 https://github.com/TencentCloud/CubeSandbox.git
   # already have the repo? check out this version:
   $ git checkout v0.7.0

   └──▷ USE IT
   Pin a Python SDK sandbox to a specific zone or set of nodes to control placement in multi-region or compliance-sensitive deployments.
   python copy

   sandbox = Sandbox.create(distribution_scope='zone-us-east-1')

   Set a Node SDK sandbox to never time out for long-running interactive sessions.
   javascript copy

   await sandbox.setTimeout(Sandbox.NEVER_TIMEOUT);

   • Adds CubeProxy support for a custom management port and the gRPCgRPCAn open-source remote procedure call framework from Google that uses HTTP/2 and Protocol Buffers to let services call each other's functions across a network, giving tools low-latency, strongly typed inter-process communication. protocol.
   • Adds Files.ForUser to the Go SDK to isolate file access by user identity.
   • Adds Sandbox.setTimeout(timeout) to the Node SDK with support for NEVER_TIMEOUT.
   • Adds Sandbox.create(distribution_scope=...) to the Python SDK to explicitly specify the nodes/zones a sandbox can be placed on.
   • Adds Volume CRUDCRUDThe four basic database operations — Create, Read, Update, Delete — used as shorthand for any system that manages persistent data records, giving cyber tools a standard model for interacting with stored information. and volumeMounts to the Go and Node SDKs, bringing all three languages to parity with Python.

   +15 more show less

   • Adds full template alias support (build-time aliases and alias management for existing templates) across Go, Node, and Python SDKs.
   • Adds configurable log rotation policy for Cubelet via the configuration file.
   • Introduces cross-node pause/resume and snapshot cloning with an S3 backend (preview), backed by the new CubeS3lvol COWCOWCopy-on-write: an OS memory optimization where two processes share the same physical pages until one writes, triggering a private copy only then. It makes forking processes fast and cheap. engine for remote snapshot storage on S3 object storage.
   • Introduces component multi-versioning so that templates and snapshots record their component dependency versions, allowing historical templates and snapshots to remain usable after compute-node component upgrades.
   • Introduces CubeOps module with multi-replica deployment support, taking over node management from CubeMaster; ships the cubeopscli tool for node management, replacing the cubemastercli node subcommands.
   • Merges NetworkAgent fully into Cubelet, reducing inter-process RPCRPCRemote Procedure Call, a protocol that lets a program execute a function on another machine as if it were local, giving cyber tools a structured way to communicate across processes or hosts without managing raw sockets. calls during sandbox creation and preventing network rules from leaking across sandboxes.
   • Optimizes the eBPFeBPFA Linux technology for running verified programs inside the kernel without changing its source. Tools use it to observe processes, enforce rules and process network traffic. network policy provisioning path to significantly reduce sandbox creation latency for sandboxes with network rules.
   • Supports dynamically updating network policies for running sandboxes.
   • Adds support for CubeEgress L7 forwarding rules with custom ports.
   • Adds CubeVS MAC addressMAC addressA hardware-address identifier used on a local network, such as Ethernet or Wi-Fi. It identifies a network interface for delivery on that link, rather than routing across the internet. learning within the same subnet to avoid black-holed traffic in non-hairpin networks.
   • Supports pulling images from HTTP (private) image registries to build templates.
   • Deploys MinIO by default as the S3 backend for the volume feature and cross-node pause/resume, with the option to specify a custom S3 backend.
   • Adds node deletion support so a node can be removed from the cluster and excluded from scheduling.
   • Adds node isolation/unisolation and node operation history viewing to the Web UI.
   • Publishes kernel and guest images as separate artifacts under dedicated kernel-release-* and guest-image-* releases.

   20 details in Everything

   └──▷ BREAKING ON UPGRADE

   • !Node management subcommands previously in cubemastercli are replaced by cubeopscli; existing scripts using cubemastercli node subcommands will break.
7. v0.6.0 Jul 24, 2026 · issue 024

   CubeSandbox v0.6.0 adds Kubernetes deployment, E2B-compatible volumes, template aliases, configurable Host headers, and node isolation.

   └──▷ GET THIS VERSION

   copy

   $ git clone --branch v0.6.0 https://github.com/TencentCloud/CubeSandbox.git
   # already have the repo? check out this version:
   $ git checkout v0.6.0

   └──▷ TRY IT
   Isolate a compute node before maintenance so no new sandboxes are scheduled to it while existing ones keep running.
   copy

   $ cubemastercli node isolate <node-id>

   Lift isolation on a node after maintenance is complete to allow new sandbox scheduling to resume.
   copy

   $ cubemastercli node unisolate <node-id>

   • Deploy CubeSandbox control-plane and compute nodes on TKE, standard Kubernetes, or k3s via Helm Chart, with support for rolling upgrades and canary releases.
   • New E2B-compatible Volume framework lets operators plug in custom backend storage via Binary or RPCRPCRemote Procedure Call, a protocol that lets a program execute a function on another machine as if it were local, giving cyber tools a structured way to communicate across processes or hosts without managing raw sockets. plugins, with Create/Destroy/Attach/Detach lifecycle hooks and sandbox–Volume binding APIs.
   • Template aliases can be set at creation time, allowing sandboxes to be launched by alias name instead of template ID.
   • New network.maskRequestHost parameter lets operators configure the Host header forwarded into a sandbox (e.g. localhost:${PORT}), improving compatibility with Host-based routing inside sandboxes.
   • New compute node isolation commands (cubemastercli node isolate / unisolate) let operators drain a node for maintenance without disturbing running sandboxes.

   +9 more show less

   • CubeOps is now a standalone service decoupled from CubeAPI, making the control-plane API layer lighter and more extensible.
   • CubeMaster DAO layer now supports PostgreSQL as a metadata backend.
   • New CUBE_AUTO_MIGRATION environment variable allows skipping automatic DB schema migration at startup for controlled upgrade workflows.
   • Support deleting sandboxes that are in the paused state.
   • In-sandbox cgroup switches from v1 to v2.
   • CubeEgress MITM now writes subjectAltName on leaf certificates for broader TLS verification compatibility.
   • New cubemastercli volume-related subcommands added alongside Volume framework support.
   • Templates can now enable the ivshmem device.
   • Cubelet state tmpfs supports dynamic expansion.

   14 details in Everything

8. v0.5.1 Jul 11, 2026 · issue 014

   CubeSandbox v0.5.1 adds a standalone lifecycle manager, three-value timeout semantics, host-mount allowlisting, and a Node.js SDK preview.

   └──▷ GET THIS VERSION

   copy

   $ git clone --branch v0.5.1 https://github.com/TencentCloud/CubeSandbox.git
   # already have the repo? check out this version:
   $ git checkout v0.5.1

   └──▷ USE IT
   Pin a long-running sandbox so it is never reclaimed by the idle sweeper — useful for persistent dev environments or always-on agent workloads.
   python copy

   # Python SDK
   sandbox = await client.create(options=CreateOptions(timeout=NEVER_TIMEOUT))
   
   # Adjust an already-running sandbox
   await sandbox.set_timeout(NEVER_TIMEOUT)

   Restrict which host directories sandboxes may bind-mount to prevent arbitrary host path exposure in a multi-tenant cluster.
   yaml copy

   # cubemaster config (yaml)
   host_mount:
     allowed_prefixes:
       - /data/shared/
       - /data/project-a/
     # '/' is explicitly forbidden and will be rejected at admission

   Scale CubeProxy horizontally with CLM coordinating auto-pause across replicas, configured via Terraform.
   hcl copy

   # terraform.tfvars
   TENcentCLOUD_CUBE_PROXY_REPLICAS = 3
   cube_lifecycle_manager_replicas  = 1
   cube_lifecycle_manager_discovery_refresh_interval = 30

   • Introduces cube-lifecycle-manager (CLM), a standalone control-plane service extracted from the CubeProxy sidecar, enabling CubeProxy to scale horizontally with Redis-based replica discovery and coordinated auto-pause/resume.
   • Adds three-value timeout semantics: omitted inherits cluster default, NEVER_TIMEOUT (-1) disables idle reclaim, 0 triggers immediate reclaim, and N>0 sets an idle TTLTTLTime to live, a limit on how long data remains valid or how far a packet can travel. Caches use a time limit; IP packets use a hop limit. in seconds — with server-side defaults in CubeMaster.
   • Adds set_timeout() / SetTimeout() to Python and Go SDKs (including NEVER_TIMEOUT sentinel) and exposes timeout on sandbox create in the Web UI.
   • Adds host-mount path allowlisting: bind-mounts are restricted to configurable prefixes (default /data/shared/) with filepath.Clean traversal neutralization; / is explicitly forbidden.
   • Adds Node.js / TypeScript SDK preview (@cubesandbox/sdk) aligned with the Python and Go surface.

   +7 more show less

   • Supports CubeEgress credential injection against plain HTTP upstreams (not only TLS).
   • Adds minimum TTL clamping (≥300s) for DNS-learned egress allow entries to prevent reconnect denials on short DNS TTLs.
   • Skips egress policy re-evaluation for established TCPTCPA network protocol that delivers a reliable, ordered stream of bytes between two endpoints. It detects lost data and retransmits it. sessions in CubeVS, preventing DNS expiry from breaking live connections.
   • Publishes pre-built multi-arch CubeProxy images to TCR with MIRROR=cn|int selection and airgap local-cache fallback, eliminating on-host builds.
   • Decouples RPCRPCRemote Procedure Call, a protocol that lets a program execute a function on another machine as if it were local, giving cyber tools a structured way to communicate across processes or hosts without managing raw sockets. scheduling deadline (create_timeout_insec, default 300s) from sandbox idle TTL in CubeMaster.
   • Adds TencentCloud Terraform support for multi-replica CubeProxy (TENCENTCLOUD_CUBE_PROXY_REPLICAS) with CLM replica count, discovery refresh interval, and admin token configuration.
   • Adds optional dnsmasq fallback in one-click installer for environments where systemd-resolved and NetworkManager's dnsmasq plugin are absent, restoring cube.app resolution.

   12 details in Everything

   └──▷ BREAKING ON UPGRADE

   • !Host-mount paths are now restricted to configurable prefixes (default /data/shared/); previously any absolute path was accepted, so existing sandboxes using host bind-mounts outside the allowed prefix will be rejected.
   • !Go and Python SDK CreateOptions.Timeout (and equivalent fields) are now optional pointers; code that relied on the SDK injecting a hard-coded default timeout will no longer receive that default — the cluster default_timeout_insec is used instead, or never-timeout if unset.
   • !The cube-proxy-sidecar in-image AutoPause coordinator has been extracted into a standalone cube-lifecycle-manager service; deployments that relied on the sidecar for AutoPause coordination must now deploy the separate CLM service.
   • !CubeEgress transparent-proxy listen address is no longer hard-coded to 192.168.0.1; it is now derived from CUBE_SANDBOX_NETWORK_CIDR, so deployments using custom sandbox network CIDRs will get a different TPROXY/OpenResty listen address.
   • !Go SDK envd RPCs (commands, files, filesystem, PTY) now route to port 49983 instead of port 49999; integrations that hard-coded port 49999 for these operations will break.
9. v0.5.0 Jul 3, 2026 · release notes

   CubeSandbox v0.5.0 adds AutoPause/AutoResume lifecycle automation, native ARM64ARM64The 64-bit instruction set architecture from ARM Holdings, used in modern mobile chips, Apple Silicon, and cloud server CPUs; tools target it to run natively on those platforms without emulation overhead. support, Terraform TencentCloud deployer, and network security hardening.

   └──▷ GET THIS VERSION

   copy

   $ git clone --branch v0.5.0 https://github.com/TencentCloud/CubeSandbox.git
   # already have the repo? check out this version:
   $ git checkout v0.5.0

   └──▷ TRY IT
   Lock down a sandbox so only callers presenting the issued traffic_access_token can reach it inbound.
   copy

   $ curl -X POST https://<cube-api>/cube/sandbox \
     -H 'Content-Type: application/json' \
     -d '{"network": {"allow_public_traffic": false}}'
   # Response includes traffic_access_token; pass it on subsequent dataplane calls:
   curl https://<cube-proxy>/<sandbox-id>/... \
     -H 'cube-traffic-access-token: <token>'

   Use the one-click upgrade mode to safely migrate an existing installation to v0.5.0 with config preserved.
   copy

   $ bash install.sh --mode=upgrade

   • Adds AutoPause/AutoResume: platform-level sweeper automatically snapshots idle sandbox VM state to disk and resumes on the next dataplane request, with concurrent resumes coalesced via singleflight and cross-replica coordination via Redis SETNX.
   • New host.quota.paused_resource_release_ratio config (float 0–1) controls how much CPUCPUThe main general-purpose processor in a computer. It runs application instructions and coordinates work with memory and other hardware./memory quota paused sandboxes release back to the scheduler, enabling tunable node density vs. guaranteed-resume tradeoffs.
   • New per-sandbox traffic_access_token (UUIDUUIDA universally unique identifier, usually a 128-bit value used to identify an object across systems. It is designed to make independently generated identifiers unlikely to collide. v4): CubeProxy enforces it on every inbound request when network.allow_public_traffic=false, returning HTTP 403 for missing or mismatched tokens; values are redacted from all logs.
   • New POST /cube/sandbox/timeout and POST /cube/sandbox/refresh APIs expose end_at for deterministic sandbox lifecycle management; CubeProxy gate returns 410 Gone for killing/killed sandboxes.
   • Adds native ARM64 (aarch64) support across the full stack: hypervisor (MMIO SysCtrl device), guest agent, CubeShim, CubeNet BPFBPFA Linux kernel virtual machine that lets programs attach small, sandboxed bytecode filters to kernel hooks — syscalls, network events, tracepoints — so cyber tools can observe or redirect kernel behaviour without writing a kernel module., multi-arch Docker images, and CI/CD with per-architecture release artifacts.

   +7 more show less

   • New TencentCloud Terraform cluster deployer (deploy/one-click/terraform/tencentcloud/) provisions a full CubeSandbox cluster — VPCVPCA logically isolated virtual network inside a public cloud provider's infrastructure, letting tools deploy resources with private addressing, controlled routing, and firewall rules without managing physical hardware., NAT, TKE, MySQL, Redis, CFS, TCR — from a single create.sh entry point.
   • New one-click upgrade mode (install.sh --mode=upgrade) performs three-way .env config merge, fail-fast preflight checks, and backs up configuration before any destructive change.
   • Supports external MySQL and Redis via CUBE_EXTERNAL_MYSQL_* / CUBE_EXTERNAL_REDIS_* variables, bypassing local Docker containers for production deployments.
   • CubeEgress now fails closed during bootstrap: returns HTTP 403 for all non-audit outbound traffic until L7 policies are fully loaded from CubeMaster, eliminating the previous fail-open restart window.
   • New optional cube-router kernel dummy device routes sandbox outbound traffic through any routable host interface (eth0, eth1, GREGREA tunneling protocol that wraps one network packet inside another, letting tools carry arbitrary traffic across IP networks without modifying the payload, useful for traffic capture and network emulation., VXLANVXLANA network encapsulation protocol that wraps Layer 2 Ethernet frames inside UDP packets, extending virtual LANs across Layer 3 networks. Cyber tools use it to simulate or inspect traffic across large-scale virtualized and cloud environments., WireGuardWireGuardA modern VPN protocol and Linux kernel module, maintained as an open-source project, that establishes encrypted tunnels using minimal code and fast cryptography, giving cyber tools a lightweight, high-performance transport layer.) instead of hard-redirecting to the primary NICNICA network interface card or adapter, the hardware that connects a computer to a network. It sends and receives packets over the link..
   • Adds pure-Go native rootfs export pipeline that bypasses Docker, skopeo, and umoci entirely.
   • E2B SDKE2B SDKAn open-source SDK by E2B that lets a program spin up isolated cloud sandbox environments on demand, giving cyber tools a safe runtime for executing untrusted code or agents. alignment: adds complete filesystem and PTY APIs.

   12 details in Everything

   └──▷ BREAKING ON UPGRADE

   • !CUBE_PROXY_HOST_PORT is deprecated and split into CUBE_PROXY_HTTP_PORT and CUBE_PROXY_HTTPS_PORT — existing configs using CUBE_PROXY_HOST_PORT will need to be updated.
   • !BPF object files are no longer prebuilt and committed to git; they are regenerated at build time and require clang ≥ 14 in the build environment.
   • !ARM64 deployments require bare-metal hosts with native KVMKVMA Linux kernel module that turns the kernel into a hypervisor, letting a process run fully isolated virtual machines using hardware virtualisation extensions. Cyber tools use it to sandbox execution environments at near-native speed.; PVM (nested KVM) is x86_64-only and live migration is x86_64-only.
10. v0.4.0 Jun 15, 2026 · release notes

    CubeSandbox v0.4.0 adds CubeEgress security proxy, container log forwarding, node version matrix, and daemonless image builds.

    └──▷ GET THIS VERSION

    copy

    $ git clone --branch v0.4.0 https://github.com/TencentCloud/CubeSandbox.git
    # already have the repo? check out this version:
    $ git checkout v0.4.0

    └──▷ TRY IT
    Read the last 100 lines of a sandboxed container's stderr from outside the sandbox for rapid incident triage.
    copy

    $ cubecli cubebox logs --tail 100 --stderr <id>

    Set a conservative disk-space safety margin so template image builds fail fast when the store directory is nearly full.
    copy

    $ CUBEMASTER_DISK_SPACE_SAFETY_MARGIN=2.0 cubemaster serve

    • Adds CubeEgress, an OpenResty-based egress security proxy that enforces L7 policy via TPROXY, supporting credential injection, domain filtering, and structured access auditing for sandbox outbound traffic.
    • Adds per-sandbox credential injection at the proxy layer via EgressRule.inject, so user code inside the sandbox never handles raw credentials; credential material is redacted as ***REDACTED*** in safe-log output.
    • Adds policy-driven domain allow/deny filtering for sandbox egress, evaluated first-match-wins against L7 requests, with DNS queries permitted even when domain-based allow-out rules are set.
    • Adds structured JSON egress access logs with optional body redaction via a redactor Lua module for downstream compliance review.
    • Adds container log forwarding: init-process stdout/stderr is streamed from the agent to the shim via a dedicated vsock connection and appended to host-side log files.

    +14 more show less

    • Adds cubecli cubebox logs subcommand to read container stdout/stderr from outside the sandbox, with --tail N, --head N, --all, and --stderr flags.
    • Adds a node component version matrix that gives operators cluster-wide visibility of component versions (guest-image, cube-agent, kernel, control-plane) with version-skew surfacing via CubeAPI and a new Web UI Versions page.
    • Adds standardized build-time version metadata injection (version, commit, build time) to all Go and Rust binaries via ldflags/build.rs, plus a machine-readable release-manifest.json in release bundles.
    • Adds template replica compatibility checking: component versions bound to a template are compared against what each node reports, with results exposed via /templates/compat and /templates/compat/{id} endpoints and per-replica compatibility badges in the Web UI.
    • Adds a daemonless template image build pipeline using skopeo/umoci, reducing peak disk usage by 72% (from ~4.2× to ~1.2× image size), with fallback to Docker for backward compatibility.
    • Adds CUBEMASTER_DISK_SPACE_SAFETY_MARGIN configurable safety margin for a fail-fast disk-space pre-check before template image builds.
    • Adds CUBEMASTER_LOOP_MOUNT_EXT4_ENABLED flag (default false) to enable a loop-mount streaming ext4 build phase with CAP_SYS_ADMINCAP_SYS_ADMINA Linux capability that grants a process a broad set of privileged operations — mounting filesystems, managing namespaces, and more — without full root, letting cyber tools perform system-level tasks under tighter privilege boundaries. detection.
    • Adds a three-tier GetTapFile strategy (fast/hot/recovery paths) delivering 35% faster network P50 (35.3→23.1 ms) and 41% faster P99 (86.6→51.2 ms), plus 8% higher throughput.
    • Adds a --pprof-listen flag to the network agent for on-demand pprof profiling.
    • Adds CubeEgress /admin/v1/health endpoint extension and integrates CubeEgress version reporting into the node component version matrix.
    • Adds CubeAPI POST /templates and Python/Go SDK support for DNS, egress CIDRs, registry auth, command/args, network type, and node scope options, matching the full cubemastercli template create-from-image option set.
    • Adds SYN-only packet rejection in the CubeVS port-mapping BPFBPFA Linux kernel virtual machine that lets programs attach small, sandboxed bytecode filters to kernel hooks — syscalls, network events, tracepoints — so cyber tools can observe or redirect kernel behaviour without writing a kernel module. fast path to prevent guest-initiated connections from bypassing egress policy.
    • Enables TX checksum/TSO offload and tx-tcp-mangleid-segmentation on TAP devices so redirected packets skip GSO before reaching the guest.
    • Supports CubeEgress deployment on kernel v5.4+, expanding deployment coverage.

    19 details in Everything

    └──▷ BREAKING ON UPGRADE

    • !The CubeNetworkConfig protobuf message is renamed from CubeVSContext; any integration referencing the old message name will break.
11. v0.3.1 Jun 4, 2026 · release notes

    CubeSandbox v0.3.1 adds custom network CIDRCIDRA notation for a block of IP addresses, such as 10.0.0.0/24. The number after the slash says how many leading address bits identify the network. config, glibc/PVM preflight checks, and snapshot/rollback API routes in AgentHub.

    └──▷ GET THIS VERSION

    copy

    $ git clone --branch v0.3.1 https://github.com/TencentCloud/CubeSandbox.git
    # already have the repo? check out this version:
    $ git checkout v0.3.1

    └──▷ TRY IT
    Avoid CIDR conflicts with your existing host network when deploying CubeSandbox in environments with non-default subnets.
    copy

    $ CUBE_SANDBOX_NETWORK_CIDR=10.200.0.0/16 bash one-click-install.sh

    Skip the CIDR conflict check when deploying in an advanced network topology where overlaps are intentional.
    copy

    $ CUBE_SANDBOX_NETWORK_CIDR=192.168.100.0/24 CUBE_SANDBOX_NETWORK_CIDR_SKIP_CONFLICT_CHECK=1 bash one-click-install.sh

    Skip the PVM pre-check when you have kvm_pvm loaded but need to override the installer's enforcement (e.g., controlled migration scenario).
    copy

    $ ONE_CLICK_SKIP_PVM_CHECK=1 bash one-click-install.sh

    • Supports CUBE_SANDBOX_NETWORK_CIDR at install time to specify a custom sandbox network CIDR, with format validation, host interface/route overlap detection, and an optional conflict-check bypass flag.
    • Adds glibc >= 2.34 preflight check during installation to fail fast on unsupported distributions before cubelet/cubecli binaries crash at runtime.
    • Adds PVM consistency pre-check: when kvm_pvm is loaded, the installer verifies CUBE_PVM_ENABLE=1 is set, preventing silent installation of the wrong guest kernel.
    • Adds snapshot creation and rollback API endpoints to AgentHub, enabling the digital assistant console to manage sandbox checkpoints.
    • New preview button and sandbox open logic in the AgentHub WebUI, with template store defaults corrected.

    5 details in Everything

12. v0.3.0 Jun 2, 2026 · release notes

    CubeSandbox v0.3.0 ships CubeCoW snapshot engine, AgentHub console, Web UI, and a new Go SDK for sandbox management.

    └──▷ GET THIS VERSION

    copy

    $ git clone --branch v0.3.0 https://github.com/TencentCloud/CubeSandbox.git
    # already have the repo? check out this version:
    $ git checkout v0.3.0

    └──▷ HOW TO FIND IT
    Use the AgentHub snapshot timeline to create a visual checkpoint and roll back an AI agent sandbox to a known-good state.
    📍In the AgentHub console, open the target assistant → Snapshot Timeline → Create Checkpoint, then select a prior checkpoint and click Rollback.
    • Adds CubeCoW Copy-on-Write snapshot engine with reflink-based volume snapshots for lightweight, space-efficient checkpoints of AI Agent sandboxes.
    • Adds soft-dirty incremental memory snapshots that capture only dirty pages after the first full snapshot, dramatically reducing snapshot time and storage.
    • Adds AgentHub digital assistant console (Preview) with snapshot timelines, visual checkpoint creation and rollback, parallel clone environments, template actions, and WeCom notification configuration.
    • Adds browser-accessible Web UI management dashboard for sandboxes, templates, and cluster nodes — including a template store for deploying pre-built images.
    • Adds initial Go SDK providing typed API bindings for sandbox lifecycle management (create, manage, destroy).

    +9 more show less

    • Adds Python SDK template creation API for programmatic sandbox template creation without shell commands.
    • Adds systemd-based one-click deployment with service supervision and automatic restart on failure.
    • Adds check.sh and collect-logs.sh health check and diagnostic scripts for one-click deployment environments.
    • Adds cgroup v2 CPUCPUThe main general-purpose processor in a computer. It runs application instructions and coordinates work with memory and other hardware. controller preflight check in the installer with actionable guidance when support is missing.
    • Adds Prometheus scheduler metrics exposed as gauges on /v1/metrics via Cubelet for real-time monitoring.
    • Adds node resource reporting (CPU, memory, disk) from Cubelet to CubeMaster for cluster-wide resource awareness.
    • Adds path-based sandbox routing and shared backend resolution in CubeProxy.
    • Adds centralized database schema migration via goose in CubeMaster for versioned, automated schema management.
    • Adds early network connectivity and disk space validation in the online installer before downloading begins.

    14 details in Everything

13. v0.2.2 May 18, 2026 · release notes

    CubeSandbox v0.2.2 adds configurable storage timeouts, richer ext4 diagnostics, E2B-compatible default port, and AI-powered PR review automation.

    └──▷ GET THIS VERSION

    copy

    $ git clone --branch v0.2.2 https://github.com/TencentCloud/CubeSandbox.git
    # already have the repo? check out this version:
    $ git checkout v0.2.2

    └──▷ TRY IT
    Override MySQL and Redis ports for a non-default deployment without hand-editing cubemaster.yaml.
    copy

    $ # In your .env file, set the desired ports before running install.sh:
    CUBE_SANDBOX_MYSQL_PORT=3307
    CUBE_SANDBOX_REDIS_PORT=6380
    
    bash install.sh

    • Changes the default sandbox exposed port to 49983 to match the E2B sandbox protocol, with CubeMaster as the single authoritative source of default exposed ports.
    • Adds an optional cmd_timeout field in the storage plugin TOML config so operators can raise the cubelet command timeout beyond the previous hardcoded 3 s limit without recompiling.
    • Adds richer failure diagnostics for newExt4RawByReflinkCopy, including elapsed time, target/base file sizes, and free space in structured log output.
    • Adds __CUBE_SANDBOX_MYSQL_PORT__ and __CUBE_SANDBOX_REDIS_PORT__ placeholders to cubemaster.yaml, substituted by install.sh from .env to support non-default MySQL/Redis ports.
    • Introduces five AI reviewer agents (code quality, performance, security, test coverage, documentation accuracy) with automated PR review, duplicate issue detection, and issue label triage workflows.

    +3 more show less

    • Adds comment-issue subcommand to gh.sh for posting issue comments via stdin heredoc.
    • Documents network port allocation ranges (10000–19999, 20000–29999, 30000–65535) in docs/architecture/network.md (EN & ZH).
    • Adds new bilingual community doc sections for troubleshooting, use-cases, and integrations in VitePress, with a GitHub ActionsGitHub ActionsGitHub's built-in CI/CD system that runs automated workflows triggered by repository events, letting cyber tools automate testing, building, and releasing without managing separate pipeline infrastructure. workflow enforcing bilingual parity.

    8 details in Everything

    └──▷ BREAKING ON UPGRADE

    • !The default sandbox exposed port is changed from 8080/32000 to 49983; any client or firewall rule targeting the old default ports will stop working after upgrade.
14. v0.2.1 May 14, 2026 · release notes

    CubeSandbox v0.2.1 ships a first-party Python SDK, faster startup via skipped SHA256SHA256A cryptographic hash function that turns data into a fixed 256-bit fingerprint. It is used to check integrity; hashing does not encrypt the original data. checks, and improved template-watch CLI output.

    └──▷ GET THIS VERSION

    copy

    $ git clone --branch v0.2.1 https://github.com/TencentCloud/CubeSandbox.git
    # already have the repo? check out this version:
    $ git checkout v0.2.1

    • Adds official Python SDK (cubesandbox v0.1.0) with full sandbox lifecycle methods (create, connect, pause, kill, list, health), streaming code execution via run_code(), and filesystem access via files.read().
    • Supports allow_internet_access and explicit allow/deny network policy lists as first-class parameters in the Python SDK.
    • Supports CUBE_PROXY_NODE_IP for TCPTCPA network protocol that delivers a reliable, ordered stream of bytes between two endpoints. It detects lost data and retransmits it. direct-connect transport via IPOverrideTransport, bypassing DNS in the Python SDK.
    • New EnsureKernelFilePresent (copy-if-missing fast path) and RefreshKernelFile (force-refresh with verification) split in Cubelet dramatically reduces startup latency on hosts with many templates by skipping per-boot SHA256 checks.
    • Skips redundant docker pull in CubeMaster when the source image already exists locally, removing unnecessary registry round-trips during template builds.

    +5 more show less

    • New cubemastercli tpl watch phase-oriented output replaces full-status dumps with concise [N/7] PHASE progress=… distribution=… lines, also applied to the redo watch path.
    • Adds 12 worked examples and a benchmark.py for concurrent create/delete performance testing in the Python SDK.
    • Promotes cube-bench to a standalone Go module at examples/cube-bench with its own Makefile.
    • Adds DCO check CI workflow that blocks PR merges on missing Signed-off-by trailers.
    • Adds GitHub ARC (Actions Runner Controller) support for kernel and package build workflows.

    10 details in Everything

15. v0.2.0 May 7, 2026 · release notes

    CubeSandbox v0.2.0 adds a Web Management Console and PVM deployment mode so sandboxes run on ordinary cloud servers.

    └──▷ GET THIS VERSION

    copy

    $ git clone --branch v0.2.0 https://github.com/TencentCloud/CubeSandbox.git
    # already have the repo? check out this version:
    $ git checkout v0.2.0

    └──▷ HOW TO FIND IT
    Access the new Dashboard to monitor sandbox/node status and manage API keys without touching the CLI.
    📍In the CubeAPI web UI, navigate to the Dashboard to view cluster overview, manage templates, and configure API keys under the API Key Management section.
    • New Web Management Console (Dashboard) with cluster overview, node/sandbox status, template management, and API key management, backed by new CubeAPI web endpoints.
    • New PVM (Pagetable-based Virtual Machine) deployment mode lets ordinary cloud servers run CubeSandbox without bare-metal or nested virtualization.
    • Adds --dns flag to cubemastercli template for specifying a custom DNS server address when creating a template image.

    3 details in Everything

16. v0.1.1 Apr 24, 2026 · release notes

    CubeSandbox v0.1.1 adds a base container image, QEMUQEMUAn open-source machine emulator and virtualizer that lets software run a guest OS or CPU architecture on a different host, giving cyber tools an isolated, inspectable execution environment without dedicated hardware. dev environment, CubeProxy HTTP/HTTPSHTTPSHTTP carried over an encrypted TLS connection. It protects traffic in transit and lets a browser verify the server's certificate. port forwarding, and a cubebox destroy CLI tool.

    └──▷ GET THIS VERSION

    copy

    $ git clone --branch v0.1.1 https://github.com/TencentCloud/CubeSandbox.git
    # already have the repo? check out this version:
    $ git checkout v0.1.1

    • Adds CubeSandbox base image and entrypoint script for containerized sandbox deployments.
    • Adds QEMU-based development environment for OpenCloudOS 9, enabling local sandbox development without cloud infrastructure.
    • Adds CubeProxy HTTP/HTTPS port forwarding with a dev-sidecar example for proxying traffic into sandboxes.
    • Adds cubebox destroy CLI tool to the cubemaster for tearing down sandbox instances.
    • Adds China mainland CDNCDNA content delivery network, servers distributed across locations that cache and serve content near readers. It can reduce loading time and traffic to the original server. mirror support for faster binary downloads in mainland China regions.

    +2 more show less

    • Adds dev-environment scripts for syncing binaries, collecting logs, and managing autostart.
    • Adds OpenAI Agents SDK integration examples demonstrating CubeSandbox as a code execution backend.

    7 details in Everything

17. v0.1.0 Apr 20, 2026 · release notes

    CubeSandbox open-sources a KVMKVMA Linux kernel module that turns the kernel into a hypervisor, letting a process run fully isolated virtual machines using hardware virtualisation extensions. Cyber tools use it to sandbox execution environments at near-native speed./RustVMM-backed AI agent sandbox with <60ms cold start and E2B SDKE2B SDKAn open-source SDK by E2B that lets a program spin up isolated cloud sandbox environments on demand, giving cyber tools a safe runtime for executing untrusted code or agents. compatibility.

    └──▷ GET THIS VERSION

    copy

    $ git clone --branch v0.1.0 https://github.com/TencentCloud/CubeSandbox.git
    # already have the repo? check out this version:
    $ git checkout v0.1.0

    • New sandbox service built on RustVMM and KVM delivering hardware-level kernel isolation per agent, eliminating container escape risks for LLMLLMA large language model, a neural network trained on large amounts of text to recognize patterns and generate language. Applications use it for tasks such as answering, summarizing and writing code.-generated code execution.
    • Supports sub-60ms cold starts via resource pool pre-provisioning and snapshot cloning technology.
    • Achieves under 5MB per-instance memory overhead through Copy-on-Write memory reuse, enabling thousands of concurrent agents on a single node.
    • Drop-in E2B SDK compatibility: swap a single URL environment variable to migrate existing E2B workloads to Cube Sandbox with no business logic changes.
    • CubeVS, an eBPFeBPFA Linux technology for running verified programs inside the kernel without changing its source. Tools use it to observe processes, enforce rules and process network traffic.-powered network subsystem, enforces kernel-level inter-sandbox network isolation with fine-grained egress traffic filtering policies.

    +1 more show less

    • Supports single-node deployment and horizontal scale-out to multi-node clusters.

    6 details in Everything