File: README.md Copy Chapter

CubeSandbox

Cube Sandbox is a high-performance, out-of-the-box secure sandbox service built on RustVMM and KVM. It supports both single-node deployment and easy scaling to multi-node clusters. It is compatible with the E2B SDK and can create a hardware-isolated, fully serviceable sandbox in under 60ms with less than 5MB of memory overhead.

📰 News Copy Chapter

| | v0.6: K8s deploy, Volume framework, template aliases
K8s deploy — Deploy Cube control-plane components and compute nodes on Kubernetes
Volume framework — E2B-compatible Volume framework that lets users plug in custom backend storage
Template aliases — Set an alias when creating a template, and create sandboxes by specifying that alias.
Changelog → ·
K8s deploy → ·
Volume plugin → |

| --- | --- |
| | v0.5: AutoPause, Terraform deployer, ARM64 & network policy hardening
AutoPause/AutoResume — idle sandboxes auto-suspend and wake on the next request. Terraform one-click cluster deploy ARM64 native full-stack support network policy hardening — per-sandbox traffic tokens, policy-routing egress.
Changelog → ·
Terraform deploy → |
| | v0.4: Safer egress, easier ops
Credential vault — Agents call external APIs as usual; keys never enter the sandbox. Dashboard — version matrix and template health checks; see at a glance whether templates need rebuilding after upgrades.
Changelog → ·
Security proxy guide → ·
WebUI guide → |
| | Snapshot, Clone & Rollback at hundred-millisecond granularity
CubeSandbox 0.3.0 introduces the CubeCoW Copy-on-Write snapshot engine, enabling event-level snapshots, instant cloning, and rollback to any saved state.
Changelog → |
| | 🎉 Initial open-source release
Cube Sandbox is now open source! Millisecond boot, hardware-level isolation, E2B-compatible sandbox for AI Agents.
Changelog → |

Product Highlights Copy Chapter

| ⚡ Ultra-fast Startup
Resource pooling and snapshot cloning skip all cold-start overhead. Average <60ms cold start — sandbox creation faster than a blink.
Quick start → | 🔒 Hardware Isolation
Every sandbox runs a dedicated OS kernel in its own MicroVM.
Architecture → | 🔌 E2B SDK Compatible
Compatible with E2B SDK interface. Switch from E2B Cloud seamlessly by changing one environment variable — zero client code changes.
Examples → |

| --- | --- | --- |
| 📦 High-density Deployment
<5MB overhead per sandbox enables thousands of instances per server via kernel sharing and Copy-on-Write (CoW). Supports automatic sandbox pause and resume, further improving deployment density and cost optimization.
Quick start → | 🛡️ Network Security
eBPF-based inter-sandbox isolation and egress filtering at kernel level; built-in L7 security proxy enables per-domain/path/method policies with automatic credential injection — secrets never visible to sandbox code.
Security proxy guide → | 📸 Flexible State Management
High-frequency snapshot and rollback at hundred-millisecond granularity. Create checkpoints on running sandboxes, roll back to any saved state at any time, or fork from a specific state to explore in parallel.
v0.3 changelog → |
| 💾 Volume Framework
E2B-compatible Volume framework that lets users plug in custom backend storage solutions. Volumes have an independent lifecycle and can be shared across sandboxes.
Volume plugin → | 🚀 Production Deployment
Deploy production clusters on Tencent Cloud with one click using Terraform. Also supports deployment on standard Kubernetes clusters (preview).
Terraform deploy → ·
K8s deploy → | 💪 ARM Architecture Support
Full native ARM64 support across compilation, build, and deployment workflows.
Bare-metal deploy → |

Demos Copy Chapter

Benchmarks Copy Chapter

In the context of AI Agent code execution, CubeSandbox achieves the perfect balance of security and performance:

• Cold start benchmarked on bare-metal. 60ms at single concurrency; under 50 concurrent creations, avg 67ms, P95 90ms, P99 137ms — consistently sub-150ms.
• Memory overhead measured with sandbox specs ≤ 32GB. Larger configurations may see a marginal increase.

For detailed metrics on startup latency and resource overhead, see the Core Operations Performance Benchmark Report (bare metal) and the PVM Cloud Server Benchmark Report.

(*Blue: Sandbox specifications; Orange: Base memory overhead). Note that memory consumption increases only marginally as instance sizes scale up. |  |

Quick Start Copy Chapter

Cube Sandbox requires an x86_64 Linux environment with KVM support.

The guide walks you through everything in four steps — provisioning a server, installing Cube Sandbox, creating a sandbox template, and running your first agent code. No source build needed, up and running in minutes.

| 🖥 PVM · Cloud VM →

**🏆 Recommended** | 🏗 Bare Metal → | 💻 Dev-Env →
  
  
  ⚠️ **Not recommended — poor performance** |

| --- | --- | --- |

First thing after install: open the Web console Copy Section

After one-click deployment, open in your browser:

http://<control-node IP>:12088

Recommended three steps:

1. Check overview — Open Overview, confirm nodes are Ready and capacity looks healthy
2. Prepare a template — Install an official preset from Template Store; skip if you already have a READY template under Templates
3. Create a sandbox — Sandboxes → + New sandbox, pick a READY template, and view live logs on the detail page within seconds

See the full WebUI console guide.

Deep Dive Copy Chapter

• Documentation Home — complete guide navigation
• ☁️ PVM Deployment — deploy on ordinary cloud VMs without bare metal or nested virtualization
• Template Concepts — image-to-template concepts and workflows
• Example Projects — hands-on examples (code execution, browser automation, OpenClaw integration, RL training, and more)
• 🖥️ WebUI Console — visual management right after install (:12088)
• 🔐 Security Proxy & Credential Vault — CubeEgress domain filtering, injection, and auditing
• 🤖 Digital Assistant AgentHub — create and manage OpenClaw assistants (Preview)
• 💻 Development Environment (QEMU VM) — no KVM access? Try Cube Sandbox inside a disposable OpenCloudOS 9 VM

Architecture Copy Chapter

👉 For more details, please read the Architecture Design Document and CubeVS Network Model.

Community & Contributing Copy Chapter

We welcome contributions of all kinds—whether it's a bug report, feature suggestion, documentation improvement, or code submission!

• 🐞 Found a Bug or have questions? Submit an issue on GitHub Issues.
• 💡 Have an Idea? Join the conversation in GitHub Discussions.
• 🛠️ Want to Code? Check out our CONTRIBUTING.md to learn how to submit a Pull Request.
• 📝 Want to contribute docs? Submit bilingual PRs to our community doc channels: Troubleshooting, Use Cases, and Integrations. Additionally, the Cube 100 Program is now open — we're looking for the first 100 teams running AI agents in production with Cube. Limited to 100 seats. Learn more & apply →
• 💬 Want to Chat? Join our Discord.

Roadmap Copy Chapter

Coming soon — see the full roadmap for details.

Sponsors Copy Chapter

Contributors Copy Chapter

Thanks to all contributors:

License Copy Chapter

CubeSandbox is released under the Apache License 2.0.

The birth of CubeSandbox stands on the shoulders of open-source giants. Special thanks to Cloud Hypervisor, Kata Containers, virtiofsd, containerd-shim-rs, ttrpc-rust, and others. We have made tailored modifications to some components to fit the CubeSandbox execution model, and the original in-file copyright notices are preserved.

File: agent/libs/safe-path/README.md Copy Chapter

Safe Path

A library to safely handle filesystem paths, typically for container runtimes.

There are often path related attacks, such as symlink based attacks, TOCTTOU attacks. The safe-path crate
provides several functions and utility structures to protect against path resolution related attacks.

Support Copy Chapter

Operating Systems:

• Linux

Reference Copy Chapter

• filepath-securejoin: secure_join() written in Go.
• CVE-2021-30465: symlink related TOCTOU flaw in runC.

License Copy Chapter

This code is licensed under Apache-2.0.

File: agent/libs/README.md Copy Chapter

The src/libs directory hosts library crates which may be shared by multiple Kata Containers components
or published to crates.io.

Library Crates Copy Section

Currently it provides following library crates:

| Library | Description |
|-|-|-|
| logging | Facilities to setup logging subsystem based slog. |
| safe-path | Utilities to safely resolve filesystem paths. |

File: agent/README.md Copy Chapter

cube-agent

The in-VM guest agent for Cube Sandbox. It runs as PID 1 inside each MicroVM
(after cube-init execs it with wrapper_mode=on) and manages the full
container lifecycle within the sandbox.

Upstream Copy Chapter

cube-agent is derived from the kata-containers/kata-containers agent (src/agent/), originally authored by the Kata Containers community and licensed under Apache-2.0.

Cube-specific modifications include:

• Replaced the Kata runtime protocol with the Cube ttrpc API (libs/protocols/)
• Added cube/ sub-crate for Cube-specific sandbox extensions (custom device management, configuration handling)
• Adapted vsock port assignments and boot flow to match the Cube hypervisor and shim

The original Kata Containers copyright notices and license headers are preserved in all modified source files.

Role in the System Copy Chapter

Host
┌────────────────────────────────┐
│  containerd-shim-cube-rs       │
│  pmem0 = guest OS (cube-init)  │
│  pmem1 = cube-agent.ext4       │
│       │  ttrpc over vsock      │
└───────┼────────────────────────┘
        │  (vsock channel)
   MicroVM boundary
        │
┌───────▼────────────────────────┐
│  cube-init (/sbin/init)        │
│    mounts /dev/pmem1 →         │
│      /run/support (ext4,ro,dax)│
│    exec /run/support/cube-agent│
│       │                        │
│  cube-agent (PID 1, wrapper)   │
│  ┌────▼──────────────────────┐ │
│  │  container workload       │ │
│  └───────────────────────────┘ │
└────────────────────────────────┘

cube-agent is packaged as an independent cube-agent.ext4 plane file
(containing only /cube-agent). CubeShim injects it as virtio-pmem1. Guest
Image contains lightweight cube-init as /sbin/init, which mounts pmem1 and
execs the agent with wrapper_mode=on so the agent skips duplicate
general_mount.

When the MicroVM boots, the agent:

1. Skips init mounts when wrapper_mode=on — cube-init already prepared /proc, /sys, /run, etc.
2. Notifies shim via SysCtrl — writes VsockServerReady (x86 PIO 0x680 / aarch64 MMIO 0x0903_0000). This is not the template SysStart handshake; open-source cube-init does not perform snapshot-mode SysCtrl handshake.
3. Listens for ttrpc commands — exposes the Cube agent API over a vsock channel; the shim (containerd-shim-cube-rs) connects to this channel to drive the agent.
4. Manages container lifecycle — handles CreateContainer / StartContainer / ExecProcess / SignalProcess / RemoveContainer requests, delegating to rustjail for OCI-compliant container execution.
5. Forwards I/O — proxies container stdio streams back to the shim over vsock.
6. Exposes metrics — exports Prometheus-compatible metrics for guest CPU, memory, and container health.

Repository Layout Copy Chapter

agent/
├── src/             # Agent binary (main entry point, ttrpc server, sandbox/container state)
│   ├── main.rs      # Startup, vsock listener, ttrpc server init
│   ├── rpc.rs       # ttrpc service handlers (implements the Cube agent API)
│   ├── sandbox.rs   # Sandbox state management
│   ├── mount.rs     # Filesystem mount handling
│   ├── network.rs   # Guest network configuration
│   └── ...
├── rustjail/        # OCI container runtime primitives (namespaces, cgroups, seccomp)
├── cube/            # Cube-specific extensions (device model, config)
├── libs/
│   ├── protocols/   # ttrpc API definitions (protobuf) and generated Rust bindings
│   ├── oci/         # OCI spec types
│   ├── logging/     # slog-based logging setup
│   └── safe-path/   # Safe filesystem path utilities
├── vsock-exporter/  # Prometheus metrics exporter over vsock
├── bootstrap.sh     # One-time musl toolchain setup
└── build.sh         # Release build script (musl static binary)

See also ../guest-init/ for the lightweight Guest PID 1 (cube-init).

Build Copy Chapter

cube-agent is built as a statically linked musl binary, then packaged into
cube-agent.ext4 by deploy/one-click/build-agent-ext4.sh.

Prerequisites Copy Section

# Install the musl target and bootstrap system dependencies (run once)
arch=$(uname -m)
rustup target add "${arch}-unknown-linux-musl"
sudo ln -s /usr/bin/g++ /bin/musl-g++
sudo bash bootstrap.sh

Compile Copy Section

bash build.sh

The output binary is placed at target/<arch>-unknown-linux-musl/release/cube-agent.

Build via Docker (recommended for CI) Copy Section

make all-docker
# or from repo root:
make agent

Package cube-agent.ext4 via root Makefile (recommended) Copy Section

# From repo root — builds musl-static cube-agent inside the builder image,
# then packages _output/cube-agent/{cube-agent.ext4,version}:
make agent-ext4
# aliases:
make cube-agent-ext4
# with guest PID1 as well:
make pmem-assets

Or call the script directly after a prebuilt binary is available:

OUTPUT_DIR=/tmp/cube-agent ./deploy/one-click/build-agent-ext4.sh

API Copy Chapter

cube-agent exposes a ttrpc API over vsock. The protocol is defined in protobuf files under libs/protocols/protos/ and is shared with the Cube runtime (CubeShim).

To regenerate protocol bindings after changing .proto files:

# Rust bindings (auto-generated at build time by build.rs)
cargo build

# Go bindings (used by the Cube runtime side)
make generate-protocols   # requires protoc in $PATH

To install protoc:

# Debian/Ubuntu
sudo apt-get install -y protobuf-compiler

# Fedora/CentOS/RHEL
sudo dnf install -y protobuf-compiler

License Copy Chapter

Apache-2.0 — see LICENSE for details.

This component incorporates code from the Kata Containers project, © The Kata Containers Authors, licensed under Apache-2.0.

File: cube-lifecycle-manager/README.md Copy Chapter

cube-lifecycle-manager

Standalone service that owns sandbox auto-pause / auto-resume coordination
between CubeMaster, CubeProxy and Redis.

• Consumes lifecycle events from cube:v1:shared:sandbox:lifecycle:events
• Discovers every live CubeProxy replica in real time via
  cube:v1:shared:cube_proxy:{registry,heartbeat} and broadcasts sandbox
  metadata + state through their /admin/* endpoints
• Handles the synchronous /internal/resume callback CubeProxy invokes when
  a paused sandbox receives a request

Local development Copy Chapter

make test    # go test ./...
make build   # local image, tag: cube-lifecycle-manager:v0.6.0-<arch>

Publishing images Copy Chapter

Multi-arch release flow (mirrors CubeEgress/Makefile). Runs against both
cube-sandbox-int.tencentcloudcr.com and cube-sandbox-cn.tencentcloudcr.com.

# On an amd64 host:
make build push ARCH=amd64

# On an arm64 host:
make build push ARCH=arm64

# On either host (both arch-specific images must already be pushed):
make manifest

Overrides:

• IMAGE_TAG=<tag> — override the release tag (default v0.6.0)
• V=1 — verbose docker commands

Configuration Copy Chapter

All configuration is via environment variables (prefix CUBE_LCM_); see
internal/config/config.go for the authoritative list.

File: CubeAPI/examples/readme.md Copy Chapter

Examples

See the top-level examples/ directory for standalone, runnable examples:

• host-mount — mount host directories into a sandbox
• network-policy — control outbound network access
• browser-sandbox — Playwright browser automation via CDP
• code-sandbox-quickstart — basic sandbox operations

File: cubecow/README.md Copy Chapter

cubecow

A Copy-On-Write storage engine built on xfs-reflink (FICLONE), shipped as a Rust library crate that provides thin-provisioned volume management and O(1) snapshot/clone capabilities.

Overview Copy Chapter

cubecow is a library crate that exposes a uniform interface through the Engine trait. It currently ships with a single backend:

• xfs-reflink (ReflinkEngine) — uses regular files as volumes and snapshots inside a directory on a FICLONE-capable filesystem (XFS with reflink=1 / Btrfs / OCFS2 / …), and relies on the kernel FICLONE ioctl for O(1) metadata snapshots.

Key Features Copy Chapter

Architecture Copy Chapter

┌──────────────────────────────────────────────────────────┐
│                Public API layer (lib.rs)                  │
│   Engine trait + Volume / Snapshot / VolumeBlockInfo /   │
│           initialize / initialize_without_logging       │
├──────────────────────────────────────────────────────────┤
│                C FFI layer (ffi.rs)                       │
│   #[no_mangle] extern "C" fn cubecow_*(...)              │
│   → header file include/cubecow.h                         │
├──────────────────────────────────────────────────────────┤
│              Backend implementation (engine/)             │
│   engine::reflink::ReflinkEngine                          │
│       ├── name_index: RwLock<HashMap<String, VolumeInfo>> │
│       ├── volumes_dir: <root_dir>/volumes/                │
│       └── direct FICLONE / unlink / fsync_dir calls       │
├──────────────────────────────────────────────────────────┤
│              Infrastructure (pkg/)                        │
│   errors / logger / metrics                               │
└──────────────────────────────────────────────────────────┘

On-disk layout for volumes and snapshots Copy Chapter

<root_dir>/                         # AppConfig.backend.reflink.root_dir
└── volumes/
    ├── <vol-A>/
    │   ├── <vol-A>          # main volume file, FICLONE source
    │   ├── <snap-A1>        # snapshot derived from vol-A
    │   └── <snap-A2>        # snapshot derived from vol-A
    └── <vol-B>/
        ├── <vol-B>
        └── <snap-B1>

Every snapshot is "flattened" into the directory of its ultimate origin volume; deleting a snapshot is a single unlink and never touches any other snapshot's extents.

Build Copy Chapter

Prerequisites Copy Section

• Rust 1.93+ (installation via rustup is recommended)
• A FICLONE-capable filesystem to host root_dir (production setups should use mkfs.xfs -m reflink=1,crc=1)

Compile Copy Section

# Debug
cargo build

# Release (produces target/release/libcubecow.{so,a})
cargo build --release

Unit tests / benchmarks Copy Section

# Unit tests (no root required; nothing is actually mkfs'd or mounted)
cargo test --lib

# End-to-end reflink performance benchmark (requires root + xfsprogs + losetup)
sudo cargo bench --bench reflink_ops

Configuration Copy Chapter

Both TOML and JSON are supported; the JSON form is consumed directly by the FFI entry points cubecow_init_*_from_json as a string. The schema is intentionally minimal:

TOML Copy Section

[log]
level = "info,h2=warn,hyper=warn"
format = "compact"               # "json" | "compact" | "pretty"
file = "/var/log/cubecow.log"    # optional; logs go to stdout when unset
rotation = "daily"               # "daily" | "hourly" | "never"

[backend]
kind = "reflink"                 # the only backend currently supported

[backend.reflink]
root_dir = "/var/lib/cubecow/reflink"

JSON Copy Section

{
  "log": {
    "level": "info",
    "format": "compact"
  },
  "backend": {
    "kind": "reflink",
    "reflink": { "root_dir": "/var/lib/cubecow/reflink" }
  }
}

root_dir must be an absolute path whose mount point supports FICLONE. During initialize the engine performs a one-shot FICLONE probe; if it fails, startup is rejected outright.

Rust SDK usage Copy Chapter

use cubecow::{config::AppConfig, Engine};

let config = AppConfig::load("/etc/cubecow.toml")?;
let engine: Box<dyn Engine> = cubecow::initialize(config)?;

// Create a volume
let vol = engine.create_volume("my-vol", 10 * 1024 * 1024 * 1024)?;
println!("device path: {}", vol.device_path);

// Create a snapshot (metadata-only; do not activate immediately)
let snap = engine.create_snapshot("my-vol", "my-snap", false)?;

// List snapshots
let (snaps, _next) = engine.list_snapshots("my-vol", 10, None);

C FFI / Go integration Copy Chapter

The C header lives at include/cubecow.h. The cubecow_ function prefix is preserved to keep ABI compatibility. A typical call flow:

#include "cubecow.h"

CubecowEngineHandle eng = cubecow_init_from_json(json_blob);
if (!eng) {
    fprintf(stderr, "init failed: %s\n", cubecow_last_error());
    return 1;
}

char* dev = NULL;
int rc = cubecow_create_volume(eng, "my-vol", 10ULL << 30, &dev);
if (rc == COW_OK) {
    printf("created at %s\n", dev);
    cubecow_free_string(dev);
}
cubecow_shutdown(eng);

A Go example lives at examples/go-test/ and uses cgo to link against -lcubecow:

# 1. Build the Rust shared lib
cargo build --release

# 2. Build & run the Go test binary
cd examples/go-test
make run

File: Cubelet/doc/cubelet-api.md Copy Chapter

Protocol Documentation

Table of Contents Copy Chapter

• api/services/cubebox/v1/cubebox.proto

  • AppSnapshotRequest

  • AppSnapshotResponse

  • CDIDevice

  • Capability

  • CleanupOrphanStorageFilesRequest

  • CleanupOrphanStorageFilesResponse

  • CleanupTemplateRequest

  • CleanupTemplateResponse

  • CommitSandboxRequest

  • CommitSandboxResponse

  • Container

  • Container.LabelsEntry

  • ContainerConfig

  • ContainerConfig.AnnotationsEntry

  • ContainerConfig.SysctlsEntry

  • ContainerSecurityContext

  • ContainerStateValue

  • CowObjectRef

  • CowObjectStatus

  • CubeNetworkConfig

  • CubeSandbox

  • CubeSandbox.LabelsEntry

  • CubeSandboxFilter

  • CubeSandboxFilter.LabelSelectorEntry

  • DNSConfig

  • DestroyCubeSandboxRequest

  • DestroyCubeSandboxRequest.AnnotationsEntry

  • DestroyCubeSandboxResponse

  • DestroyCubeSandboxResponse.ExtInfoEntry

  • Device

  • EgressRule

  • EgressRuleAction

  • EgressRuleInject

  • EgressRuleMatch

  • EmptyDirVolumeSource

  • ExecCubeSandboxRequest

  • ExecCubeSandboxResponse

  • GetLocalSnapshotRequest

  • GetLocalSnapshotResponse

  • GetStorageMetricsRequest

  • GetStorageMetricsResponse

  • GetStorageMetricsResponse.MetricsEntry

  • HTTPGetAction

  • HTTPHeader

  • Hook

  • Hooks

  • HostAlias

  • HostDirSource

  • HostDirVolumeSources

  • IDMapping

  • InspectStorageVolumesRequest

  • InspectStorageVolumesResponse

  • Int64Value

  • KeyValue

  • LifecycleHandler

  • LinuxSeccompArg

  • ListCubeSandboxOption

  • ListCubeSandboxRequest

  • ListCubeSandboxResponse

  • ListLocalSnapshotsRequest

  • ListLocalSnapshotsResponse

  • ListSandboxSnapshotsRequest

  • ListSandboxSnapshotsResponse

  • LocalSnapshotInfo

  • OCIConfig

  • PingAction

  • PortMapping

  • PostStop

  • PreStop

  • Probe

  • ProbeHandler

  • RLimit

  • Resource

  • RollbackSandboxRequest

  • RollbackSandboxResponse

  • RunCubeSandboxRequest

  • RunCubeSandboxRequest.AnnotationsEntry

  • RunCubeSandboxRequest.LabelsEntry

  • RunCubeSandboxResponse

  • RunCubeSandboxResponse.ExtInfoEntry

  • SELinuxOption

  • SandboxPathVolumeSource

  • SandboxStorageInfo

  • StorageOrphanEntry

  • StorageVolumeInfo

  • SysCall

  • TCPSocketAction

  • UpdateCubeSandboxRequest

  • UpdateCubeSandboxRequest.AnnotationsEntry

  • UpdateCubeSandboxResponse

  • UpdateCubeSandboxResponse.ExtInfoEntry

  • Volume

  • VolumeMounts

  • VolumeSource

  • ContainerState

  • InstanceType

  • MountPropagation

  • NetworkType

  • SandboxPathType

  • StorageMedium

  • CubeboxMgr

• api/services/cubehost/v1/hostimage.proto

  • ClientMessage

  • DNSConfig

  • ForwardImageRequest

  • ForwardImageResponse

  • HostImage

  • ImageDev

  • ImageFsStats

  • InflightRequest

  • LayerMount

  • ListImagesRequest

  • ListImagesResponse

  • ListInflightRequest

  • MountImageRequest

  • PodSandboxConfig

  • PodSandboxConfig.AnnotationsEntry

  • PodSandboxConfig.LabelsEntry

  • PodSandboxMetadata

  • RemoveSnapshotRequest

  • ResponseStatus

  • ServerMessage

  • LayerType

  • MessageType

  • ResponseStatusCode

  • CubeHostImageService

  • CubeVMImageService

• api/services/errorcode/v1/errorcode.proto

  • Ret

  • ErrorCode

• api/services/images/v1/images.proto

  • CreateImageRequest

  • CreateImageRequestResponse

  • CubeListImageRequest

  • CubeListImageResponse

  • DestroyImageRequest

  • DestroyImageResponse

  • ImageSpec

  • ImageSpec.AnnotationsEntry

  • ImageVolumeSource

  • VolumUtilsRequest

  • VolumUtilsResponse

  • ImageStorageMediaType

  • PullPolicy

  • Images

• api/services/multimetadb/v1/multimeta_db.proto

  • BucketDefine

  • CommonRequestHeader

  • CommonResponseHeader

  • DbData

  • GetBucketDefinesResponse

  • GetDataRequest

  • MultiMetaDBServer

• api/services/nbi/v1/cubelet_api.proto

  • InitRequest

  • InitResponse

  • InitResponse.ExtInfoEntry

  • CubeLet

• api/services/version/v1/version.proto

  • VersionResponse

  • Version

• api/services/volumeplugin/v1/volumeplugin.proto

  • AttachRequest

  • AttachResponse

  • AttachResponse.MetadataEntry

  • CreateRequest

  • CreateResponse

  • DestroyRequest

  • DestroyResponse

  • DetachRequest

  • DetachRequest.MetadataEntry

  • DetachResponse

  • PluginVolumeSource

  • VolumeControllerService

  • VolumePluginService

• api/types/v1/descriptor.proto

  • Descriptor
  • Descriptor.AnnotationsEntry

• api/types/v1/images.proto

  • AuthConfig
  • Image
  • ImageFilter
  • ImageSpec
  • ImageSpec.AnnotationsEntry
  • Int64Value

• Scalar Value Types

Top

api/services/cubebox/v1/cubebox.proto Copy Chapter

AppSnapshotRequest Copy Section

AppSnapshotRequest is the request for creating an app snapshot.
This request creates a cubebox, makes an app snapshot using cube-runtime,
and then destroys the cubebox.

AppSnapshotResponse Copy Section

AppSnapshotResponse is the response for app snapshot creation.

CDIDevice Copy Section

CDIDevice specifies a CDI device information.

Capability Copy Section

Capability contains the container capabilities to add or drop

CleanupOrphanStorageFilesRequest Copy Section

CleanupOrphanStorageFilesResponse Copy Section

CleanupTemplateRequest Copy Section

CleanupTemplateResponse Copy Section

CommitSandboxRequest Copy Section

CommitSandboxResponse Copy Section

Container Copy Section

Container.LabelsEntry Copy Section

ContainerConfig Copy Section

ContainerConfig.AnnotationsEntry Copy Section

ContainerConfig.SysctlsEntry Copy Section

ContainerSecurityContext Copy Section

ContainerSecurityContext holds linux security configuration that will be applied to a container.

Privileged mode implies the following specific options are applied: 1. All capabilities are added. 2. Sensitive paths, such as kernel module paths within sysfs, are not masked. 3. Any sysfs and procfs mounts are mounted RW. 4. AppArmor confinement is not applied. 5. Seccomp restrictions are not applied. 6. The device cgroup does not restrict access to any devices. 7. All devices from the host's /dev are available within the container. 8. SELinux restrictions are not applied (e.g. label=disabled). |
| run_as_user | Int64Value | | UID to run the container process as. Only one of run_as_user and run_as_username can be specified at a time. |
| no_new_privs | bool | | no_new_privs defines if the flag for no_new_privs should be set on the container. |
| run_as_group | Int64Value | | GID to run the container process as. run_as_group should only be specified when run_as_user or run_as_username is specified; otherwise, the runtime MUST error. |
| run_as_username | string | | User name to run the container process as. If specified, the user MUST exist in the container image (i.e. in the /etc/passwd inside the image), and be resolved there by the runtime; otherwise, the runtime MUST error. |
| readonly_rootfs | bool | | If set, the root filesystem of the container is read-only. when not set,RunCubeSandboxRequest.volumes should provide one empty_dir source for the rootfs rw and Container.VolumeMounts provide container_path="/" format |

ContainerStateValue Copy Section

ContainerStateValue is the wrapper of ContainerState.

CowObjectRef Copy Section

CowObjectStatus Copy Section

CubeNetworkConfig Copy Section

CubeSandbox Copy Section

CubeSandbox.LabelsEntry Copy Section

CubeSandboxFilter Copy Section

PodSandboxFilter is used to filter a list of PodSandboxes.
All those fields are combined with 'AND'

CubeSandboxFilter.LabelSelectorEntry Copy Section

DNSConfig Copy Section

DNSConfig specifies the DNS servers and search domains of a sandbox.

DestroyCubeSandboxRequest Copy Section

DestroyCubeSandboxRequest.AnnotationsEntry Copy Section

DestroyCubeSandboxResponse Copy Section

DestroyCubeSandboxResponse.ExtInfoEntry Copy Section

Device Copy Section

Device specifies a host device to mount into a container.

EgressRule Copy Section

EgressRuleAction Copy Section

EgressRuleInject Copy Section

EgressRuleMatch Copy Section

EmptyDirVolumeSource Copy Section

EmptyDirVolumeSource represents an empty directory for a sandbox.

ExecCubeSandboxRequest Copy Section

ExecCubeSandboxResponse Copy Section

GetLocalSnapshotRequest Copy Section

GetLocalSnapshotResponse Copy Section

GetStorageMetricsRequest Copy Section

GetStorageMetricsResponse Copy Section

GetStorageMetricsResponse.MetricsEntry Copy Section

HTTPGetAction Copy Section

HTTPGetAction describes an action based on HTTP Get requests.

HTTPHeader Copy Section

HTTPHeader describes a custom header to be used in HTTP probes

Hook Copy Section

Hooks Copy Section

HostAlias Copy Section

HostAlias holds the mapping between IP and hostnames that will be injected as an entry in the
sandbox's hosts file.

HostDirSource Copy Section

HostDirSource defines a single host directory to be shared into the VM/container
via a virtiofs propagation channel.

HostDirVolumeSources Copy Section

HostDirVolumeSources contains a list of host directory volumes to share into
containers via virtiofs propagation channels (virtio_ro / virtio_rw).

IDMapping Copy Section

IDMapping describes host to container ID mappings for a pod sandbox.

InspectStorageVolumesRequest Copy Section

InspectStorageVolumesResponse Copy Section

Int64Value Copy Section

Int64Value is the wrapper of int64.

KeyValue Copy Section

LifecycleHandler Copy Section

LifecycleHandler defines a specific action that should be taken in a lifecycle hook. One and only one of the fields, except TCPSocket must be specified

LinuxSeccompArg Copy Section

ListCubeSandboxOption Copy Section

ListCubeSandboxRequest Copy Section

ListCubeSandboxResponse Copy Section

ListLocalSnapshotsRequest Copy Section

ListLocalSnapshotsResponse Copy Section

ListSandboxSnapshotsRequest Copy Section

ListSandboxSnapshotsResponse Copy Section

LocalSnapshotInfo Copy Section

OCIConfig Copy Section

PingAction Copy Section

TCPSocketAction describes an action based on ping.

PortMapping Copy Section

PostStop Copy Section

PreStop Copy Section

PreStop This hook is called immediately before a container is terminated due to an API request or management event such as a liveness/startup probe failure, preemption,
resource contention and others.

Probe Copy Section

Probe describes a health check to be performed against a container to determine whether it is
alive or ready to receive traffic.

ProbeHandler Copy Section

ProbeHandler defines a specific action that should be taken in a probe.
One and only one of the fields must be specified.

RLimit Copy Section

Rlimits specifies rlimit options to apply to the process.

Resource Copy Section

Resource
ref by https://kubernetes.io/zh-cn/docs/reference/kubernetes-api/common-definitions/quantity/#Quantity

RollbackSandboxRequest Copy Section

RollbackSandboxResponse Copy Section

RunCubeSandboxRequest Copy Section

RunCubeSandboxRequest.AnnotationsEntry Copy Section

RunCubeSandboxRequest.LabelsEntry Copy Section

RunCubeSandboxResponse Copy Section

RunCubeSandboxResponse.ExtInfoEntry Copy Section

SELinuxOption Copy Section

SELinuxOption are the labels to be applied to the container.

SandboxPathVolumeSource Copy Section

Represents a sandbox path mapped into a container.

SandboxStorageInfo Copy Section

SandboxStorageInfo aggregates every backend volume cubelet has registered
for a single sandbox.

StorageOrphanEntry Copy Section

StorageVolumeInfo Copy Section

StorageVolumeInfo describes a single backend file/volume entry attached to a
sandbox, as understood by cubelet at the time of inspection.

SysCall Copy Section

TCPSocketAction Copy Section

TCPSocketAction describes an action based on opening a socket.

UpdateCubeSandboxRequest Copy Section

UpdateCubeSandboxRequest.AnnotationsEntry Copy Section

UpdateCubeSandboxResponse Copy Section

UpdateCubeSandboxResponse.ExtInfoEntry Copy Section

Volume Copy Section

Volume represents a named volume in a pod that may be accessed by any container in the pod.

VolumeMounts Copy Section

VolumeMount describes a mounting of a Volume within a container.

VolumeSource Copy Section

VolumeSource represents the source location of a volume to mount.
Only one of its members may be specified.

ContainerState Copy Section

ContainerState represents the lifecycle state of a container.

InstanceType Copy Section

MountPropagation Copy Section

MountPropagation determines how mounts are propagated from the host
to container and the other way around.
When not set, MountPropagationNone is used.

NetworkType Copy Section

SandboxPathType Copy Section

StorageMedium Copy Section

CubeboxMgr Copy Section

Service for handling cubesandbox

Top

api/services/cubehost/v1/hostimage.proto Copy Chapter

ClientMessage Copy Section

DNSConfig Copy Section

DNSConfig specifies the DNS servers and search domains of a sandbox.

ForwardImageRequest Copy Section

ForwardImageResponse Copy Section

HostImage Copy Section

Basic information about a container image.

ImageDev Copy Section

ImageFsStats Copy Section

InflightRequest Copy Section

LayerMount Copy Section

Mount specifies a host volume to mount into a container.

ListImagesRequest Copy Section

ListImagesResponse Copy Section

ListInflightRequest Copy Section

ListInflightRequest is the request message for listing inflight requests.

MountImageRequest Copy Section

PodSandboxConfig Copy Section

PodSandboxConfig holds all the required and optional fields for creating a
sandbox.

Annotations MUST NOT be altered by the runtime; the annotations stored here MUST be returned in the PodSandboxStatus associated with the pod this PodSandboxConfig creates.

In general, in order to preserve a well-defined interface between the kubelet and the container runtime, annotations SHOULD NOT influence runtime behaviour.

Annotations can also be useful for runtime authors to experiment with new features that are opaque to the Kubernetes APIs (both user-facing and the CRI). Whenever possible, however, runtime authors SHOULD consider proposing new typed fields for any new features instead.

Optional configurations specific to Linux hosts. LinuxPodSandboxConfig linux = 8; Optional configurations specific to Windows hosts. WindowsPodSandboxConfig windows = 9; |

PodSandboxConfig.AnnotationsEntry Copy Section

PodSandboxConfig.LabelsEntry Copy Section

PodSandboxMetadata Copy Section

PodSandboxMetadata holds all necessary information for building the sandbox name.
The container runtime is encouraged to expose the metadata associated with the
PodSandbox in its user interface for better user experience. For example,
the runtime can construct a unique PodSandboxName based on the metadata.

RemoveSnapshotRequest Copy Section

RemoveSnapshotRequest is the request message for removing a snapshot.

ResponseStatus Copy Section

ServerMessage Copy Section

LayerType Copy Section

MessageType Copy Section

ResponseStatusCode Copy Section

CubeHostImageService Copy Section

Note: When the host has not actively connected to the server inside the VM, the server is considered invalid and image forwarding is prohibited. |
| ListImages | ListImagesRequest | ListImagesResponse | ListImages lists existing images. |

CubeVMImageService Copy Section

CubeVMImageService is used by cube image converter service in vm.

Top

api/services/errorcode/v1/errorcode.proto Copy Chapter

Ret Copy Section

ErrorCode Copy Section

Top

api/services/images/v1/images.proto Copy Chapter

CreateImageRequest Copy Section

CreateImageRequestResponse Copy Section

CreateImageRequestResponse contains the response for CreateImageRequest

CubeListImageRequest Copy Section

CubeListImageResponse Copy Section

DestroyImageRequest Copy Section

DestroyImageRequest destroy image

DestroyImageResponse Copy Section

DestroyImageResponse destroy image

ImageSpec Copy Section

ImageSpec is an internal representation of an image.
ImageSpec defines the specification of an image

ImageSpec.AnnotationsEntry Copy Section

ImageVolumeSource Copy Section

ImageVolumeSource represents a image volume resource.

VolumUtilsRequest Copy Section

VolumUtilsRequest volum utils

VolumUtilsResponse Copy Section

VolumUtilsResponse volum utils

ImageStorageMediaType Copy Section

PullPolicy Copy Section

Policy for pulling OCI objects. Possible values are:
Always: the kubelet always attempts to pull the reference. Container creation will fail If the pull fails.
Never: the kubelet never pulls the reference and only uses a local image or artifact. Container creation will fail if the reference isn't present.
IfNotPresent: the kubelet pulls if the reference isn't already present on disk. Container creation will fail if the reference isn't present and the pull fails.
Defaults to Always if :latest tag is specified, or IfNotPresent otherwise.
+optional

Images Copy Section

Service for handling image operations.

Top

api/services/multimetadb/v1/multimeta_db.proto Copy Chapter

BucketDefine Copy Section

bucket define for boltdb

CommonRequestHeader Copy Section

CommonResponseHeader Copy Section

DbData Copy Section

GetBucketDefinesResponse Copy Section

GetDataRequest Copy Section

MultiMetaDBServer Copy Section

Service for machine level operations.

Top

api/services/nbi/v1/cubelet_api.proto Copy Chapter

InitRequest Copy Section

InitResponse Copy Section

InitResponse.ExtInfoEntry Copy Section

CubeLet Copy Section

Service for machine level operations.

Top

api/services/version/v1/version.proto Copy Chapter

VersionResponse Copy Section

Version Copy Section

Top

api/services/volumeplugin/v1/volumeplugin.proto Copy Chapter

AttachRequest Copy Section

AttachResponse Copy Section

AttachResponse.MetadataEntry Copy Section

CreateRequest Copy Section

CreateResponse Copy Section

DestroyRequest Copy Section

DestroyResponse Copy Section

DetachRequest Copy Section

DetachRequest.MetadataEntry Copy Section

DetachResponse Copy Section

PluginVolumeSource Copy Section

PluginVolumeSource selects an external volume plugin by driver name.
Embedded in cubebox.VolumeSource.

VolumeControllerService Copy Section

VolumeControllerService is the gRPC interface for CubeMaster Controller hooks.
RPC-type plugins implement this service alongside VolumePluginService (Node).

VolumePluginService Copy Section

VolumePluginService is the gRPC interface implemented by RPC-type plugins.
The Cubelet VolumePlugin framework calls these RPCs instead of forking a
subprocess.

Top

api/types/v1/descriptor.proto Copy Chapter

Descriptor Copy Section

Descriptor describes a blob in a content store.

This descriptor can be used to reference content from an
oci descriptor found in a manifest.
See https://godoc.org/github.com/opencontainers/image-spec/specs-go/v1#Descriptor

Descriptor.AnnotationsEntry Copy Section

Top

api/types/v1/images.proto Copy Chapter

AuthConfig Copy Section

AuthConfig contains authorization information for connecting to a registry.

Image Copy Section

Basic information about a container image.