A self-hosted sandbox service for isolating untrusted LLM-generated code using dedicated Guest OS kernels. It boots in under 60ms with low memory overhead and is designed for x86_64 Linux environments with KVM support.
Project overview
A self-hosted sandbox service for isolating untrusted LLM-generated code using dedicated Guest OS kernels. It boots in under 60ms with low memory overhead and is designed for x86_64 Linux environments with KVM support.
Project type
AI Agent · Infrastructure
Use cases
Coding & Development · Automation
Deployment
Refer to project documentation
License
License pending
Best for
Operations teams and AI engineers who need to securely isolate agent-generated code on x86_64 Linux or ARM64 infrastructure with KVM support.
Key capabilities
Assigns a dedicated Guest OS kernel to each sandbox to prevent shared-kernel escapes and enable the execution of untrusted code.
Provides a visual management console accessible in the browser to configure sandboxes, templates, nodes, and the version matrix.
Automatically suspends idle sandboxes and wakes them upon the next request to optimize resource usage.
Limitations and risks
Requires an x86_64 Linux environment with KVM support to avoid poor performance in non-KVM development environments.
Running untrusted code remains inherently risky; the tool mitigates this through dedicated Guest OS kernels but requires strict operational adherence to isolation boundaries.
Getting started
Provision a server via PVM or Bare Metal, install the service, create a sandbox template from an OCI image, and run agent code or access the web console at port 12088.
Evidence and sources
GitHub project description: Instant, Concurrent, Secure & Lightweight Sandbox for AI Agents.
README: CubeAPI | High-concurrency REST API Gateway (Rust), compatible with E2B.
README: ⚡ Sub-60ms boot · High density · Auto pause/resume
README: CubeEgress | OpenResty-based egress security gateway: L7 domain filtering, credential injection, and access auditing; works with CubeVS kernel policies so sandbox traffic cannot b…