Over the past few months, as we scaled our internal AI Agents, we hit a dead end: Running LLM-generated arbitrary code in Docker is basically running naked on security due to container escape risks. But using full traditional VMs takes minutes to boot and eats too much memory to support high-density concurrency. We loved the developer experience of SaaS sandboxes on the market, but they are closed-source, expensive, and have too high a barrier to entry for self-hosting.So, our team decided to build our own. After months of grinding, using RustVMM and KVM, we built a blazing-fast, ultra-lightweight secure sandbox service from the ground up: CubeSandbox. Today, we are officially open-sourcing it.To balance security and performance, we stripped the underlying OS to the absolute extreme. Here’s what it can do right now:1. 2. 3. Massive concurrency scheduling: Capable of spinning up hundreds of thousands of instances in minutes.4. True kernel-level isolation: Every Agent gets its own dedica...