Loading...
Loading...
CubeSandbox — instant, hardware-isolated, E2B-compatible sandbox service for AI agents built on RustVMM/KVM
npx skill4agent add aradotso/trending-skills cubesandbox-ai-sandboxSkill by ara.so — Daily 2026 Skills collection.
ls /dev/kvm && echo "KVM available"git clone https://github.com/tencentcloud/CubeSandbox.git
cd CubeSandbox/dev-env
./prepare_image.sh # one-time: downloads runtime image
./run_vm.sh # start the dev VM (keep terminal open)
# In a second terminal:
./login.sh # shell into the dev VM# Global users:
curl -sL https://github.com/tencentcloud/CubeSandbox/raw/master/deploy/one-click/online-install.sh | bash
# Mainland China mirror:
curl -sL https://cnb.cool/CubeSandbox/CubeSandbox/-/git/raw/master/deploy/one-click/online-install.sh | MIRROR=cn bashcubemasterclicubemasterclicubemastercli tpl create-from-image \
--image ccr.ccs.tencentyun.com/ags-image/sandbox-code:latest \
--writable-layer-size 1G \
--expose-port 49999 \
--expose-port 49983 \
--probe 49999
# Returns a job_idcubemastercli tpl watch --job-id <job_id>
# Wait for status: READY
# Note the template_id from outputcubemastercli tpl listcubemastercli tpl delete --template-id <template_id>cubemastercli sandbox listcubemastercli sandbox kill --sandbox-id <sandbox_id># Required for SDK usage
export E2B_API_URL="http://127.0.0.1:3000" # CubeAPI endpoint
export E2B_API_KEY="dummy" # any non-empty string (auth not required locally)
export CUBE_TEMPLATE_ID="<your-template-id>" # from cubemastercli tpl watch output
export SSL_CERT_FILE="/root/.local/share/mkcert/rootCA.pem" # local CA certpip install e2b-code-interpreterimport os
from e2b_code_interpreter import Sandbox
template_id = os.environ["CUBE_TEMPLATE_ID"]
with Sandbox.create(template=template_id) as sandbox:
result = sandbox.run_code("print('Hello from CubeSandbox!')")
print(result.text)
# Output: Hello from CubeSandbox!import os
from e2b_code_interpreter import Sandbox
with Sandbox.create(template=os.environ["CUBE_TEMPLATE_ID"]) as sandbox:
result = sandbox.run_code("""
import math
data = [1, 4, 9, 16, 25]
roots = [math.sqrt(x) for x in data]
print(roots)
roots
""")
print(result.text) # stdout
print(result.results) # return value of last expressionimport os
from e2b_code_interpreter import Sandbox
with Sandbox.create(template=os.environ["CUBE_TEMPLATE_ID"]) as sandbox:
# Run shell commands
result = sandbox.run_code("import subprocess; print(subprocess.check_output(['ls', '-la', '/'], text=True))")
print(result.text)import os
from e2b_code_interpreter import Sandbox
with Sandbox.create(template=os.environ["CUBE_TEMPLATE_ID"]) as sandbox:
# Write a file
sandbox.files.write("/tmp/hello.txt", "Hello, CubeSandbox!")
# Read the file back
content = sandbox.files.read("/tmp/hello.txt")
print(content)
# List directory
entries = sandbox.files.list("/tmp")
for entry in entries:
print(entry.name, entry.type)import os
from e2b_code_interpreter import Sandbox
with Sandbox.create(template=os.environ["CUBE_TEMPLATE_ID"]) as sandbox:
# Install a package inside the sandbox
result = sandbox.run_code("import subprocess; subprocess.run(['pip', 'install', 'requests'], capture_output=True)")
# Use the installed package
result = sandbox.run_code("""
import requests
r = requests.get("https://httpbin.org/get")
print(r.status_code)
""")
print(result.text)import os
from e2b_code_interpreter import Sandbox
# Create without context manager for explicit control
sandbox = Sandbox.create(template=os.environ["CUBE_TEMPLATE_ID"])
try:
sandbox.run_code("x = 42")
result = sandbox.run_code("print(x)") # state persists within session
print(result.text) # 42
finally:
sandbox.kill()import os
import asyncio
from e2b_code_interpreter import AsyncSandbox
template_id = os.environ["CUBE_TEMPLATE_ID"]
async def run_task(task_id: int, code: str):
async with await AsyncSandbox.create(template=template_id) as sandbox:
result = await sandbox.run_code(code)
return task_id, result.text
async def main():
tasks = [
run_task(i, f"print('Task {i} result:', {i} ** 2)")
for i in range(10)
]
results = await asyncio.gather(*tasks)
for task_id, output in results:
print(f"Task {task_id}: {output.strip()}")
asyncio.run(main())# Build and push your image
docker build -t myregistry.example.com/my-sandbox:latest .
docker push myregistry.example.com/my-sandbox:latest
# Create CubeSandbox template
cubemastercli tpl create-from-image \
--image myregistry.example.com/my-sandbox:latest \
--writable-layer-size 2G \
--expose-port 49999 \
--expose-port 8080 \
--probe 49999
# Watch until READY
cubemastercli tpl watch --job-id <job_id>cubemastercli tpl create-from-image \
--image ccr.ccs.tencentyun.com/ags-image/sandbox-code:latest \
--writable-layer-size 1G \
--expose-port 49999 \ # code interpreter
--expose-port 49983 \ # file server
--expose-port 3000 \ # custom app port
--probe 49999 # health check port# Create a sandbox
curl -s -X POST http://127.0.0.1:3000/sandboxes \
-H "Content-Type: application/json" \
-H "X-API-Key: dummy" \
-d "{\"templateID\": \"$CUBE_TEMPLATE_ID\"}"
# List sandboxes
curl -s http://127.0.0.1:3000/sandboxes \
-H "X-API-Key: dummy"
# Delete a sandbox
curl -s -X DELETE "http://127.0.0.1:3000/sandboxes/<sandbox_id>" \
-H "X-API-Key: dummy"| Component | Role |
|---|---|
| CubeAPI | Rust REST gateway, E2B-compatible, port 3000 |
| CubeMaster | Cluster orchestrator, dispatches to Cubelets, manages scheduling |
| Cubelet | Per-node agent, manages local microVM lifecycle |
| CubeVS | eBPF-powered virtual switch for inter-sandbox network isolation |
| CubeProxy | Reverse proxy routing external traffic to correct sandbox instances |
import os
from e2b_code_interpreter import Sandbox
def run_agent_code(llm_generated_code: str) -> dict:
"""Safely execute LLM-generated code in an isolated VM."""
with Sandbox.create(template=os.environ["CUBE_TEMPLATE_ID"]) as sandbox:
result = sandbox.run_code(llm_generated_code)
return {
"stdout": result.text,
"results": [str(r) for r in result.results],
"error": result.error.traceback if result.error else None,
}
# Example agent loop
code_snippets = [
"import sys; print(sys.version)",
"2 + 2",
"raise ValueError('test error')",
]
for code in code_snippets:
output = run_agent_code(code)
print("stdout:", output["stdout"])
print("error: ", output["error"])
print("---")import os
from e2b_code_interpreter import Sandbox
# Keep sandbox alive across multiple turns
with Sandbox.create(template=os.environ["CUBE_TEMPLATE_ID"]) as sandbox:
turns = [
"import pandas as pd\ndf = pd.DataFrame({'a': [1,2,3], 'b': [4,5,6]})",
"df['c'] = df['a'] + df['b']",
"print(df.to_string())",
]
for turn in turns:
result = sandbox.run_code(turn)
if result.text:
print(result.text)
if result.error:
print("ERROR:", result.error.value)
break# Before (E2B cloud):
export E2B_API_KEY="your_e2b_key"
# After (CubeSandbox — only env var changes):
export E2B_API_URL="http://your-cubesandbox-host:3000"
export E2B_API_KEY="dummy"
export SSL_CERT_FILE="/root/.local/share/mkcert/rootCA.pem"# Check KVM support
ls /dev/kvm
# If missing on WSL2, enable in Windows:
# System Properties → Advanced → Performance → Enable virtualization in BIOS/WSL# Check logs
cubemastercli tpl watch --job-id <job_id>
# If image pull fails, verify registry accessibility from the host
curl -I https://ccr.ccs.tencentyun.com# Check service health
curl http://127.0.0.1:3000/health
# Check available resources
free -h
df -h /
# Restart the service if needed
systemctl restart cubemaster # or the relevant service unit# Ensure the CA cert is exported
export SSL_CERT_FILE="/root/.local/share/mkcert/rootCA.pem"
# Verify the file exists
ls -la $SSL_CERT_FILE# Check what's on port 3000
ss -tlnp | grep 3000
# CubeAPI default port; reconfigure if needed before install# List all running sandboxes and kill idle ones
cubemastercli sandbox list
cubemastercli sandbox kill --sandbox-id <sandbox_id>examples/code-execution/shell-commands/file-operations/browser-automation/network-policies/pause-resume/openclaw/rl-training/# Browse examples
ls examples/./docs/guide/quickstart.md./docs/guide/templates.md./docs/changelog.md