Side quest comparison (2026-07). CubeSandbox = Tencent open-source E2B-class microVM platform. Sandy = Decision Labs RLM-native sandbox runtime.
Sources: TencentCloud/CubeSandbox, Sandy repo + open PRs.
Persistence / keep-alive work lives on feature branches (not main yet):
- Branch:
feature/persistence-tier-a— PR #21 - Follow-ups on top:
feature/persistence-tier-a-followups— PR #22 (targets the branch above)
| Capability | CubeSandbox | Sandy |
|---|---|---|
| Isolation | MicroVM / KVM (default) | Docker default; forkd Firecracker works for recursion (SANDY_SPAWN_BACKEND=forkd); intent = make that the default |
| Cold start / density | Claims <60ms, CoW, <5MB overhead | Docker cold start; forkd warm BRANCH on a KVM host |
| E2B-shaped SDK | Python / Go / Node | Python |
| Snapshot / clone / rollback | CubeCoW product (v0.3+) | forkd can BRANCH recursion children today; checkpoint a running session, pause/resume, roll back, or restore after kill is not built yet |
| Keep sandbox alive across turns | AutoPause/AutoResume (v0.5) | On feature branch: multi-turn keep-alive + 24h idle / 7d hard reaper — see branches above. Not on main, not deployed. |
| Egress / secret vault | eBPF isolation + L7 proxy; keys never in guest | Open egress; credentials can reach guest |
| Volumes / templates | Volume plugin + template aliases | Basic image / template |
| Multi-node / K8s / Terraform / ARM | Production-oriented | Hetzner / on-prem scripts; single-node oriented |
| Dashboard / ops | Cluster WebUI | Portal SaaS shell (auth, keys, billing) |
RLM / llm_query broker |
Not a product focus | Core — broker, rlm_query recursion, depth/concurrency, call-tree JSONL |
| RLM multi-turn persistence protocol | Generic sandbox lifecycle | On feature branch (PRs above): SupportsPersistence-style keep-alive for SandyIsolatedREPL |
| Billing / plans | Self-host infra product | Stripe metering + plan gating |
- Already merged earlier: shim, BRANCH spawn, netns/DNAT, demos, call-tree
spawn_kind=forkd_branch - Opt-in:
SANDY_SPAWN_BACKEND=forkd(needs a KVM host — not Hetzner Cloud nested VMs) - Intent: make forkd the default path
On feature/persistence-tier-a (+ follow-ups):
- Sandbox stays up across RLM turns instead of cold-restarting
- Context / history APIs for multi-turn sessions
- Reaper won’t kill an active persistent box on the short idle timer; abandoned ones still die (24h idle, 7d hard max)
- Follow-ups: only advertise persistence when asked; require explicit
persistent: truecreate flag; clearer user docs; portal/docsgenerated fromdocs/api.md
Not on that branch (and not built): survive VM kill/restart via snapshot, fork-from-checkpoint explore/rollback, or Cube-style AutoPause product.
- Default isolation — Docker still default; forkd isn’t every create
- Egress deny + secret proxy — Cube ships L7 credential vault; we don’t
- Session snapshot / CoW product — BRANCH ≠ pause/checkpoint/rollback/volumes
- Density / cold-start ops — no Cube-class pooling / auto-suspend surface
- Multi-node / K8s — not near-term for Sandy
- Merge + deploy the persistence feature branch (
#22→#21→main, then runtime host) - Snapshot / restore after restart — still missing vs Cube’s state story
- Live smoke on a real host (multi-turn + abandoned reap)
- Stable public runtime URL — Cloudflare tunnel is ephemeral (#8)
- Cap abuse of long-lived sandboxes — any API key can still request
persistent: true
- RLM broker + recursion + provenance
- Multi-turn keep-alive protocol — implemented on the feature branch (links above)
- forkd recursion path exists; gap is default + snapshot depth
- Merge PR #22 →
feature/persistence-tier-a→main - Deploy runtime (KVM / Hetzner) with current idle/hard ceilings
- Smoke: multi-turn keep-alive + abandoned reap
- Railway portal only if you want the regenerated
/docslive
- Default spawn = forkd on KVM hosts; Docker fallback for CI/laptop
- Deny-by-default egress (and/or gVisor on Docker) until forkd is universal
- Secret / egress proxy — keys never in guest
- Meter or plan-gate long-lived sandboxes
- Stable ingress for staging runtime
- Checkpoint running workspace to forkd (survive kill/restart)
- In-guest snapshot / restore / branch for explore-and-backtrack
- Robustness / live multi-turn suite against real agentd + forkd
- In docs, map Cube names → ours when we have them (AutoPause ≈ hibernate, CubeCoW ≈ forkd checkpoint, etc.)
- Full K8s / Terraform one-click like Tencent’s packaging
- Go/Node SDKs before Python + RLM path is production-hard
- Matching Cube’s marketing cold-start numbers before default forkd + snapshots land
Cube = secure dense microVM substrate. Sandy = RLM-native recursion runtime on (increasingly) the same class of substrate. Win the RLM segment; close isolation/egress/snapshot so the substrate isn’t a liability.