TencentCloud/CubeSandbox
CubeSandbox
CubeSandbox هو منصة قائمة على Kubernetes لتنفيذ وكلاء الذكاء الاصطناعي في بيئات آمنة وخفيفة الوزن. يوفر صندوق رمل لتنفيذ الكود يستخدم عزل الأجهزة ونواة ضيف مخصصة لتشغيل الكود غير الموثوق به دون المخاطرة بالنظام المضيف.
يتميز المشروع بجدار حماية لخروج الشبكة يقيد الاتصال الصادر عبر قوائم السماح للنطاقات وتسجيل التدقيق. يتضمن أيضاً مديراً لالتقاط لقطات الحاويات قادراً على التقاط حالة الذاكرة والقرص في وقت التشغيل للبيئات لتمكين الاستنساخ والاستعادة الفورية.
تغطي المنصة تنسيق المجموعة من خلال لوحة تحكم إدارية قائمة على الويب لمراقبة صحة العقدة وإدارة قوالب الحاويات. تشمل القدرات الإضافية حقن بيانات الاعتماد الآمنة عبر خزائن خارجية وتوزيع قوالب الصور القابلة لإعادة الاستخدام عبر عقد المجموعة لتقليل زمن بدء التشغيل.
Features
- Hardware-Isolated Execution Environments - Runs untrusted code in dedicated environments with separate kernels to prevent host system compromise.
- AI Execution Sandboxes - Provides secure and lightweight isolated environments specifically designed for AI agents to run untrusted code.
- Sandbox Environment Snapshots - Captures runtime memory and disk state of isolated environments for instant cloning or rollbacks.
- Code Execution Sandboxes - Provides a secure environment for running untrusted code using hardware isolation and dedicated guest kernels.
- Snapshot Capture and Restoration Managers - Captures and clones the runtime memory and disk state of containers to enable instant environment recovery.
- Egress Traffic Firewalls - Restricts outbound communication from sandboxes using domain allowlists and audit logging.
- Isolated Execution Sandboxes - Provides secure, resource-constrained sandboxes for the safe execution of untrusted code.
- Hardware-Isolated Environments - Provides hardware-isolated environments with dedicated guest kernels to run untrusted AI agent code safely.
- Sandbox Network Security Controls - Filters outbound traffic using domain allowlists and generates audit logs to prevent unauthorized communication.
- Domain Filtering - Implements outbound traffic filtering based on domain name patterns to prevent unauthorized connections.
- Isolated Code Execution - Runs arbitrary code in hardware-isolated environments with dedicated guest kernels to prevent unauthorized system access.
- AI Sandbox Platforms - Deploys isolated, lightweight execution environments for AI agents based on Kubernetes container orchestration.
- Network Traffic Filtering - Restricts outbound communication for isolated environments using domain allowlists and audit logs.
- Sandbox State Management Systems - Captures and restores the state of isolated environments via snapshots to enable instant cloning.
- Sandbox Templates - Converts container images into reusable templates for rapid deployment across cluster nodes.
- Cluster Orchestration Dashboards - Provides a centralized administrative interface for monitoring node health and managing containerized templates.
- Container Image Templates - Creates and distributes reusable container image templates across cluster nodes to accelerate sandbox deployment.
- Image Distributions Across Members - Replicates container images across cluster nodes to reduce environment startup latency.
- Kubernetes Dashboards - Provides a web-based administrative console for monitoring node health and managing container templates.
- Runtime Credential Injection - Retrieves sensitive keys from a secure external vault and injects them into requests during runtime.
- Automated Cluster Health Monitors - Provides a browser-based administrative console to monitor node health and manage templates.
- Security and Sandboxing - Secure and lightweight sandbox for AI agents.
