CubeSandbox Hit 10k Stars Giving Each Agent Its Own 60ms Hardware Sandbox

Tencent Cloud open-sourced CubeSandbox, and it just crossed 10.6k GitHub stars, most of them in weeks. It boots a hardware-isolated sandbox in under 60ms with under 5MB of memory overhead per instance. Apache 2.0, built on RustVMM and KVM.

The number is the whole point. Running agents in production means running code the agent wrote — untrusted by definition, because the model generated it against a prompt you don't fully control. A shared container isn't a real boundary; one bad tool call or a poisoned dependency can reach the host, the network, or the next tenant's data. A microVM is a real boundary. The reason nobody ran one per task is that microVMs were historically too slow and too heavy to spin up on every call.

Sub-60ms cold start and 5MB overhead change that math. Isolation stops being the thing you provision once and share; it becomes something you hand each task, then throw away. CubeSandbox even pushes the network boundary into the kernel — an eBPF virtual switch enforces inter-sandbox isolation and egress filtering below the app.

That's the seam we keep hitting. The gap between a demo agent and one you can delegate to is what happens when it runs something you didn't write. Isolation you can afford per task is exactly that discipline.

See how we ship it →