What's New

✨ Features

• execd as sandbox init (OSEP-0018). execd can now run as PID 1: single reaper with a managedProcess abstraction on every launch path, signal forwarding (TERM/HUP/USR1/USR2/WINCH), entrypoint-owned exit-code propagation, and a subreaper fallback for the Pool path. Opt-in via EXECD_INIT=1 (injected by the server's runtime.execd_run_as_init for Docker/K8s Batch/Agent/Pool); classic topology unchanged and default off. (#1474)

• Pre-exec hardening floor. The new opensandbox-launcher native helper applies env strip → KEEPCAPS → bounding-set trim → no_new_privs → identity drop → seccomp → execve; [landlock] adds a filesystem allowlist (fail-open below ABI/kernel 5.13, reported as unsupported). GET /v1/isolated/capabilities gains a hardening object with per-layer state; every layer degrades fail-open. (#1474)

• eBPF observation variant. execd-ebpf (CGO + cilium/ebpf) hooks exec/connect/privilege with CO-RE, scoped to the sandbox cgroup, emitting a rotating JSONL audit; needs kernel ≥5.10 with BTF. The default image is unchanged. (#1474 #1562)

• preStart and periodic lifecycle hooks (OSEP-0020). CreateSandboxRequest.lifecycle is transported to the sandbox via the internal OPEN_SANDBOX_LIFECYCLE env (Kubernetes; the Docker provider rejects lifecycle requests). execd starts HTTP before preStart, runs non-overlapping periodic hooks through the reaper-aware managed-process path, and only releases the user process after preStart succeeds. Config persists at $HOME/.execd/lifecycle.toml, with EXECD_LIFECYCLE_CONFIG as exact override; bootstrap sync and preStart shutdown are fail-closed with TERM/KILL watchdogs, and internal transport vars are stripped from user code. API models aligned across Go/Python/JS/Kotlin/C# SDKs. (#1587 #1588 #1589)

🐛 Bug Fixes

• In-namespace signals no longer leak into /command in init mode. kill -HUP 1 previously killed whatever /command was running (signal: hangup); signals are now owned by the init forwarder only. (#1546)

• PTY creation failure emitted a second success body. POST /pty now stops immediately after the error response instead of appending a success body and a nonexistent session id. (#1603)

• cwd validation now honors request-scoped envs. Foreground/background /command requests can use a cwd variable from their own envs map instead of being rejected with 400. (#1611)

• Non-root workloads could not start: /bootstrap.sh normalized to 0755. A deployed image carried bootstrap.sh as 0751 root:root, sending images with a non-root default user (e.g. admin) into CrashLoopBackOff before hooks ran. The image build now forces exec bits on execd/execd-ebpf/opensandbox-supervisor/bootstrap.sh regardless of checkout permissions. (#1619 #1606)

• preStart timeout raised from 300s to 10800s (3h). periodic.timeoutSeconds stays at 300s; product policy bounds are now enforced Server-side only, with execd keeping just a technical overflow guard. (#1637)

📦 Misc

• OSEP-0018 coverage closed out: server-path and Kubernetes hardening e2e (ConfigMap-carried isolation TOML, no server logic change), PTY-under-hardening, bwrap + init-reaper integration, custom [seccomp]/keep_capabilities policy, EXECD_INIT↔TOML drift pin, K8s Restart recycle against init-mode pods, runtime-initiated stop, and an execd-ebpf bare-container smoke (doubles as kernel-5.10 validation). Test redundancy and dead code trimmed (-359 lines). (#1554 #1555 #1562 #1574)

• OTLP endpoint auto-allow shipped in the shared components (egress honors OTEL_EXPORTER_OTLP_METRICS_ENDPOINT/OTEL_EXPORTER_OTLP_ENDPOINT; PTY viewer read loop refactored along the way). (#1504)

• Lifecycle hook guide with timing diagram and per-SDK creation examples; SDK client-side timeout validation aligned with the Server. (#1605)

👥 Contributors

Thanks to these contributors ❤️

• @Gujiassh
• @jianpingpei
• @Pangjiping

• Docker Hub: opensandbox/execd:v1.1.0
• Aliyun Registry: sandbox-registry.cn-zhangjiakou.cr.aliyuncs.com/opensandbox/execd:v1.1.0
• GHCR: ghcr.io/opensandbox-group/opensandbox/execd:v1.1.0

What's New

⚠️ Breaking Changes

• OPENSANDBOX_EGRESS_SANDBOX_ID is now server-injected and rejected in request env — the server unconditionally sets the egress sidecar's sandbox-id attribution variable in both Docker and Kubernetes runtimes, and removed it from the env allowlist. Requests that pass it in env now get a 400 instead of a user-spoofable value. #1381

✨ Features

• Sandbox lifecycle hooks (preStart / periodic), OSEP-0020 — CreateSandboxRequest.lifecycle is accepted, validated (reserved transports, duplicate periodic names, pool-allocation combinations), and transported to Kubernetes workloads via the reserved OPEN_SANDBOX_LIFECYCLE env for execd to execute. Docker explicitly rejects lifecycle requests; PATCH and other hook types are out of scope. Ships with aligned Java/Kotlin, Python, and TypeScript SDK models. #1588 #1589

• preStart.timeoutSeconds limit raised from 300s to 3 hours — server and OpenAPI limits now allow up to 10800s for pre-start hooks; the periodic limit stays at 300s. The execd-side product policy bound is removed, keeping policy changes server-only. #1637

• QEMU VMState pause/resume for runc-based sandboxes — opt-in capture of guest memory/vCPU/device state via QMP migration; rootfs and compressed VMState are stored as separate OCI images keyed by immutable SHA-256 digests. Supports pooled BatchSandbox pause, detachment, and standalone restoration while preserving guest memory, writable disk, boot ID, and counter continuity. Rootfs-only snapshots remain backward compatible. #1584

• Pool capacity exhaustion is now machine-identifiable — the controller publishes a PoolAllocationPending/PoolCapacityExhausted condition; the server waits a bounded acquisition window (new kubernetes.pool_acquisition_timeout_seconds, default 30s) and then returns HTTP 429 with KUBERNETES::POOL_CAPACITY_EXHAUSTED and Retry-After: 5 instead of the generic 504 readiness timeout. Older controllers safely fall back to the existing behavior. #1581

• Pool allocation summary in lifecycle responses — getSandbox now surfaces an optional Sandbox.allocation block (mode: pool, poolRef, state: allocated) for confirmed Kubernetes pool allocations, emitted only for concrete non-wildcard pool references with matching allocation evidence. No pod/namespace/IP data is exposed. #1481

• Generic HTTP request metrics via OTLP — a thin ASGI middleware exports server.http.request.duration (ms) with http_method, matched http_route (or unknown for unrouted/auth-failed requests), and http_status_code attributes, complementing the existing create-duration histogram. Raw paths, IDs, keys, and bodies are never attributes; no-op when [otel] is disabled. #1561

• Stable diagnostics API with scopes — diagnostics now honor the public inline descriptor contract: logs: container|all and events: runtime|lifecycle|all, with 400 DIAGNOSTICS_SCOPE_UNSUPPORTED for unknown scopes and explicit warnings for incomplete best-effort scopes. Deprecated no-scope plain-text responses still work with a Deprecation header. #1553

• fast-sandbox fleets backend groundwork (OSEP-0007) — a FastPath v2 gRPC client wraps all FastPathService RPCs with typed error mapping (FastPathNotFound → 404, etc.), and a create/status mapping layer converts the public contract to fast-sandbox semantics, rejecting unsupported fields (volumes, platform, resourceRequests, credentialProxy, snapshotId, etc.) with clear errors. Not yet wired as an active runtime. #1558 #1559

• Secure-access signing keys can come from a Kubernetes Secret — the server accepts OPENSANDBOX_SECURE_ACCESS_KEYS / OPENSANDBOX_SECURE_ACCESS_ACTIVE_KEY env overrides (mirroring the API-key override, gateway mode required), and the Helm chart adds server.gateway.secureAccess.existingSecret (mutually exclusive with plaintext keys, enforced at render time) so GitOps flows never commit key material. #1445

• Docker runtime sandbox_env / sandbox_binds — new [docker] fields apply fleet-wide environment variables and host bind mounts to every sandbox container (request env wins over sandbox_env; config binds precede request-derived binds), giving the Docker runtime the operator-side hook the K8s pod template has. #1303

• Egress sidecar readiness timeout configurable — new [egress] timeout_seconds (default 30s, non-positive values rejected) lets Docker deployments tune how long the server waits for the sidecar health endpoint. #1522

• Tenant namespaces validated at startup (OSEP-0014) — the server fail-fast verifies every tenant namespace exists and is accessible before serving traffic, aggregating all missing/inaccessible namespaces into a single fatal error instead of failing only at request time. OSEP-0004/0005/0014 marked implemented. #1389

🔒 Security

• CVE-remediating dependency bumps — google.golang.org/grpc → v1.82.1 across kubernetes/ingress/execd/egress/internal (xDS RBAC and HTTP/2 fixes), postcss → 8.5.11 (arbitrary file read via sourceMappingURL). #1385

🐛 Bug Fixes

• Docker endpoint lookups ~108x faster — container lookup now goes through the deterministic sandbox-<id> name with opensandbox.io/id label validation, falling back to the label scan only when needed. Local benchmark: 6.07s → 56ms for execd+egress endpoint resolution. #1400

• Informer cache expires when the watch stalls — has_synced now means "cache is currently live", not "an initial list finished once"; a stalled or half-open watch (e.g. after a control-plane upgrade) degrades to direct API reads instead of serving frozen status forever, which previously caused every create to 504 with POD_READY_TIMEOUT. Bound derived from existing knobs (resync_period + watch_timeout); no new config. #1534

• Proxy connection leak on aborted responses — when a downstream client disconnected before response-body streaming started, the backend httpx response was never released, gradually exhausting the shared pool until httpcore.PoolTimeout. The proxy now owns the backend response for the full ASGI lifecycle, shields aclose() from cancellation, and releases on setup failure. Stress test: 1000/1000 disconnects cleaned up. #1488

• Unique, stable proxy operation IDs — the 20 proxied HTTP operations previously emitted 4 process-dependent duplicate operation IDs (16 OpenAPI warnings); each method now gets its own deterministic ID with identical runtime dispatch, auth, and 405 behavior. Generated clients should be regenerated. #1634

• PVC auto-create no longer crashes with a malformed 500 — the PVC owner-reference patch went through an unsupported _content_type path that raised ApiTypeError (leaving PVCs without owner refs) and SandboxErrorCodes.INTERNAL_ERROR was undefined, masking the real error. Both fixed: patch uses the supported strategic-merge call_api path; error code defined. #1538 #1447

• Template container securityContext now reaches pods — the deep-merge previously replaced the template's containers wholesale, silently dropping container-level securityContext. Template keys now supplement (never override) runtime values, matching the existing volumeMounts philosophy. #1564

• Root-relative backend redirects stay under the proxy route — Location: /login from a sandbox backend is rebased to /v1/sandboxes/{id}/proxy/{port}/login; absolute, network-path, and query-only references are left untouched. #1516

• Server-proxy endpoints drop the ingress routing header — OpenSandbox-Ingress-To (case-insensitive) is removed from use_server_proxy=true responses while secure-access and other endpoint headers are preserved. #1503

• No duplicate Date/Server headers on proxied responses — the proxy preserves an origin Date while suppressing Uvicorn's default (and the backend Server header), emitting exactly one Date. #1471

• Invalid-resume error no longer leaks controller internals — the 409 message for a Running (internally Succeed) sandbox now says "state Running" instead of "phase Succeed"; HTTP status and error code unchanged. #1586

• Non-finite CPU limits rejected — nan, infinite, and overflowed values are rejected before Docker NanoCpus conversion instead of being silently accepted. #1568

• Mixed read-only PVC subPath mounts allowed — the PVC source is set read-only only when every mount of the claim is read-only; the service-level rejection that blocked legitimate mixed-policy PVC creation is removed. #1440

• Agent-sandbox server-proxy endpoints resolve — internal endpoint resolution now delegates to the workload provider and reads agent-sandbox pod addresses from status.podIPs instead of the BatchSandbox-only annotation, and brackets IPv6 literals before appending the port. #1424

• Version reporting fixed everywhere — /openapi.json, installed package metadata, and the chart appVersion all reported stale 0.1.0; the server now reads its version from package metadata at runtime, builds inject SETUPTOOLS_SCM_PRETEND_VERSION, and the release script bumps Chart.yaml appVersion. #1439

📦 Misc

• execd v1.0.22 ships OSEP-0018 init-mode hardening — execd as sandbox init (PID 1) with pre-exec hardening floor (env strip, bounding set, no_new_privs, identity drop, ambient caps, seccomp) and Kubernetes hardening e2e + PTY/bwrap coverage. #1474 #1555

• Isolated-session fail-closed workload lifecycle gate — the server distributes a native Bubblewrap lifecycle gate to /opt/opensandbox for both runtimes; workloads stay blocked until execd marks them ready. First phase only — capability admission and session networking remain disabled. #1388

• Egress transparent MITM can intercept extra TCP ports — experimental OPENSANDBOX_EGRESS_MITMPROXY_EXTRA_PORTS appends ports to the always-on 80/443 with fail-closed validation (multiport cap 15); credential binding still applies to canonical ports only. #1379

• Auto-bumps — egress v1.1.5 → v1.1.7 (#1391 #1498 #1600); execd v1.0.22 (#1501).

👥 Contributors

Thanks to these contributors ❤️

• @aGallea
• @cwj2001
• @Federaffo
• @fengcone
• @gegemeimingzi
• @GodBlf
• @Gujiassh
• @hittyt
• @hpliStartAgain
• @jianpingpei
• @Joey777210
• @luffy0x
• @mameikagou
• @mpu
• @Pangjiping
• @ruirui6946
• @tea-artist
• @y4ney

• PyPI: opensandbox-server==0.2.3
• Docker Hub: opensandbox/server:v0.2.3
• Aliyun Registry: sandbox-registry.cn-zhangjiakou.cr.aliyuncs.com/opensandbox/server:v0.2.3
• GHCR: ghcr.io/opensandbox-group/server:v0.2.3

What's New

✨ Features

• Resilient HTTP transport — Async and sync clients now share a configurable retry transport with backoff, jitter, Retry-After handling, per-attempt timeouts, an overall deadline, and retry callbacks. Retries are enabled by default for idempotent requests on HTTP 429, 502, and 503; callers that require the previous fast-fail behavior can use RetryPolicy.disabled(). User-supplied transports remain untouched, and streaming SSE requests bypass replay. #1372
• Sandbox lifecycle hooks — Sandbox.create and SandboxSync.create now accept optional preStart and periodic lifecycle hooks, with stable Python models and server-aligned validation. Hook timeout ranges remain server-authoritative. #1588 #1605
• Background runs in isolated sessions — Isolated sessions can start detached work and poll its status and incremental combined output. Active background runs suspend idle collection; read-only workspaces reject background execution because they cannot persist run logs. #1456
• Runtime allocation and hardening visibility — Sandbox responses can expose confirmed Pool allocation summaries, while isolated capabilities include execd init mode and hardening-layer state. These fields are additive and remain absent when the server cannot confirm the corresponding state. #1481 #1474
• Pool capacity back-pressure — Compatible lifecycle servers can now surface exhausted Kubernetes Pool capacity as HTTP 429 with KUBERNETES::POOL_CAPACITY_EXHAUSTED and Retry-After, instead of eventually reporting a generic readiness timeout. Sandbox creation remains non-idempotent and is not automatically replayed on this status. #1581

⚡ Performance

• Faster sandbox startup — Async sandbox creation, connection, and resume resolve execd and egress endpoints concurrently, reducing the two management API lookups to one parallel wait. Failure propagation and create cleanup semantics remain unchanged. #1531
• Bounded parallel Pool cleanup — Idle sandbox release uses bounded concurrency while preserving best-effort cleanup and legacy public behavior. The measured 100-sandbox cleanup in the PR dropped from about 8.3 seconds to 0.8 seconds. #1475

🐛 Bug Fixes

• Standards-compliant SSE parsing — Command and isolated execution streams now use SSE-specific framing, preserving Unicode separators inside JSON strings while remaining compatible with legacy bare-JSON frames. #1444
• Reliable background command completion — Background command streams stop after execution_complete, preventing false RemoteProtocolError failures when the peer closes before the final HTTP terminator. Foreground streaming behavior is unchanged. #1532
• Endpoint cache race fix — Completing an older endpoint fetch no longer removes a newer replacement inflight fetch in async or sync clients. #1567
• More useful API errors — Unstructured 4xx and 5xx response bodies are included in exception messages and remain available as raw response_body bytes. HTTP 429 responses use SandboxRateLimitException and expose parsed retry_after when present. #1496 #1372
• Cleaner readiness diagnostics — Readiness timeout messages retain timing, connection context, and the last health-check error without suggesting deployment-specific network fixes that may not apply. #1493

📦 Misc

• Regenerated lifecycle models, bumped the package fallback version to 0.1.16, and aligned async and sync default User-Agent strings with the release. #1622 #1623

👥 Contributors

• @Pangjiping
• @bcfre
• @cwj2001
• @hpliStartAgain
• @jianpingpei
• @mameikagou
• @ninan-nn
• @wakqasahmed
• @zpzjzj

What's New

⚠️ Breaking Changes

• Client-pool reconcile interval is no longer configurable — SandboxPool.Builder.reconcileInterval(...) and the corresponding PoolConfig setting have been removed. Pool reconciliation now runs on a fixed one-second cadence, while new sandbox creation is bounded by warmupCreateQps; callers should delete uses of reconcileInterval with no replacement. #1575

✨ Features

• Scalable asynchronous client-pool warmup — Pool refill now separates create, readiness, prepare, post-prepare health checking, renewal, and commit into a staged asynchronous pipeline. Create admission is rate-limited per pool, delayed retries no longer occupy worker threads, and staged warmups use a single create transport attempt while direct create and other non-pool paths retain their existing retry behavior. #1575
• Pool warmup tracing and operational summaries — Applications can opt in with ConnectionConfig.enableTracing(true) to emit OpenTelemetry traces covering queue wait and every warmup phase, using the application's global SDK, exporter, sampler, and propagators. Warmups now also expose bounded terminal outcome attributes, rate-limited failure logs, and active-pool summaries without allowing telemetry failures to affect pool behavior. #1524 #1604
• Lifecycle hook models — Sandbox creation now accepts additive preStart and periodic lifecycle hook models. Hook timeout validation remains authoritative on the server rather than being duplicated in stable Kotlin models; Docker support, PATCH operations, and additional hook types remain outside this release's scope. #1588 #1605
• Detached runs in isolated sessions — Kotlin consumers can start background work inside a persistent isolated session, poll its status, and read logs incrementally. Background runs are bounded by the session lifetime, do not support per-run timeouts, and are rejected for read-only workspaces because they require a host-visible writable log location. #1456
• Richer runtime metadata — The SDK now models execd hardening capability results and exposes an optional Sandbox.allocation summary for confirmed Kubernetes Pool allocations. Allocation metadata is omitted when evidence is incomplete or inconsistent and does not expose Pod, node, namespace, or internal controller details. #1474 #1481
• Shared HTTP connections for client pools — When callers do not provide an OkHttp connection pool, SandboxPool now creates and owns one sized from warmupConcurrency, reuses it across warmup, acquire, and direct-create paths, and evicts it on shutdown. User-supplied connection pools retain their existing ownership semantics. #1517

🐛 Bug Fixes

• Stable warmup pacing under failures and throttling — Fast create failures can no longer drive a self-sustaining reconcile loop, and pool warmups now honor Retry-After without counting rate limits as degraded failures. Stale-sandbox cleanup triggers prompt replenishment, while concurrent warmup commits no longer serialize behind a single JVM mutex or starve health-check work. #1494 #1512 #1519 #1621
• More actionable client errors — Kotlin ClientException messages now retain response bodies for caller-fixable 4xx responses across generated and handwritten paths. Readiness timeout messages no longer suggest Docker bridge, remote-network, or server-proxy settings that may not apply, while preserving timeout and last-error context. #1496 #1493
• Faster bounded idle cleanup — releaseAllIdle() now deletes idle sandboxes with bounded concurrency instead of serially, preserving best-effort cleanup semantics while substantially reducing drain time for large pools. #1475

📦 Misc

• Published Kotlin/JVM sandbox, code-interpreter, Redis pool, and BOM artifacts at version 1.0.19 under the existing com.alibaba.opensandbox coordinates.

👥 Contributors

• @Gujiassh
• @KXHXK
• @Pangjiping
• @cwj2001
• @jianpingpei
• @ninan-nn

What's New

✨ Features

• Auto-allow OTLP endpoint egress. The egress sidecar's own metric export was blocked by its deny-all policy. OTEL_EXPORTER_OTLP_METRICS_ENDPOINT (preferred) or OTEL_EXPORTER_OTLP_ENDPOINT is now parsed at startup and injected as an always-allow rule — domains resolved via the DNS proxy, IPs into the static nft allow sets. The rule survives policy updates and reloads; deny.always still takes precedence. Host-scoped, no per-port enforcement. (#1504)

🐛 Bug Fixes

• Vault path checks now scoped to matching bindings. Requests with nested percent-encoded separators (e.g. double-encoded package URLs) were 403'd locally even when no credential could be injected. Binding selection now runs first; unmatched requests pass through unchanged, fail-closed behavior for credentialed requests is preserved. (#1485)

📦 Misc

• Dead code, stale docs, ineffective tests pruned. Removed unused UpstreamHost(), RegisterFunc, nftables.NewManager(); fixed Dockerfile and docs/components/egress.md drift; trimmed verbose comments; dropped duplicate test assertions. No public spec/SDK changes. (#1593)

👥 Contributors

Thanks to these contributors ❤️

• @Pangjiping
• @jwx0925

• Docker Hub: opensandbox/egress:v1.1.7
• Aliyun Registry: sandbox-registry.cn-zhangjiakou.cr.aliyuncs.com/opensandbox/egress:v1.1.7
• GHCR: ghcr.io/opensandbox-group/opensandbox/egress:v1.1.7

opensandbox Helm Chart

Chart Version: 0.2.2
App Version: 0.2.2

Installation

直接从 GitHub Release 安装:

helm install opensandbox \
  https://github.com/opensandbox-group/OpenSandbox/releases/download/helm/opensandbox/0.2.2/opensandbox-0.2.2.tgz \
  --namespace opensandbox-system \
  --create-namespace

或者先下载后安装:

# 下载
wget https://github.com/opensandbox-group/OpenSandbox/releases/download/helm/opensandbox/0.2.2/opensandbox-0.2.2.tgz

# 安装
helm install opensandbox ./opensandbox-0.2.2.tgz \
  --namespace opensandbox-system \
  --create-namespace

Note: This is an all-in-one chart that bundles controller and server. The packaged chart already includes all dependencies, no need to run helm dependency build when installing from release.

What's Changed

• Chart version: 0.2.2
• App version: 0.2.2

What's New

⚠️ Breaking Changes

• Private-network sessions fail closed at startup. Explicit share_net: false sessions now require execd to bind-pin the workload NetNS/UserNS and return retryable 503 on failure; shared-network sessions are unchanged. (#1397)

✨ Features

• Background runs in isolated sessions. run accepts background: true and returns a JSON handle; new runs/{runId} status and .../logs endpoints support polling. In-flight runs block idle GC. (#1456)

• Read-only PTY viewers. Opt-in ?mode=viewer lets multiple clients watch a running PTY session alongside the exclusive holder, with replay + live output and backpressure isolation. (#1420)

• attach(sessionId) in all five SDKs. Rebuilds a fully functional session handle from a bare id, e.g. after a worker restart; SessionState now echoes creation params. (#1295)

• uid_mode availability probing. execd probes setpriv/userns independently and returns 503 NOT_SUPPORTED for unavailable modes instead of failing all isolation. (#1320)

🐛 Bug Fixes

• Fail-closed workload lifecycle for isolated sessions (security). A native gate blocks the sandbox command until execd verifies workload identity; sessions are terminated if lifecycle accounting is lost. (#1388 #1392)

• execd config env no longer leaks into bwrap sessions (security). EXECD_ACCESS_TOKEN, JUPYTER_*, EXECD_ISOLATION_CONFIG are always stripped, even if allow-listed. (#1314)

• Fixed Jupyter execution deadlock under slow consumers — no more permanent hangs during bursty output. (#1464)

• Bash → sh fallback for PTY, bash-session, and isolated APIs, including correct dash/ash export -p quoting on bash-less images. (#1359 #1361 #1367)

• Stale mitmproxy CA purge on egress startup — fixes HTTPS failures after pod-container co-restart. (#1371)

• SSE stream corruption eliminated — ping goroutine race and proxy error leak fixed (~64% nightly e2e failure rate). (#1216)

📦 Misc

• CVE dependency bumps: grpc v1.82.1, x/crypto v0.52.0, x/net v0.55.0, postcss 8.5.11. (#1385 #1250)
• Apache 2.0 license headers added to 21 files. (#1313)

👥 Contributors

Thanks to these contributors ❤️

• @bcho
• @hittyt
• @khandar-william
• @Pangjiping
• @ruirui6946

• Docker Hub: opensandbox/execd:v1.0.22
• Aliyun Registry: sandbox-registry.cn-zhangjiakou.cr.aliyuncs.com/opensandbox/execd:v1.0.22
• GHCR: ghcr.io/opensandbox-group/opensandbox/execd:v1.0.22

What's New

✨ Features

• Failure counters for DNS resolution and nftables updates. New egress.dns.query.failed_total{reason} (no_upstreams / upstream_error / empty_response / rcode) and egress.nftables.updates.failed_total{operation} counters make failures that previously existed only in logs observable — including the silent fail-closed case where a failed dynamic allow-set update drops traffic the policy permits. (#1410)

• mitmdump output now lands in the egress log sink. mitmproxy and credential-proxy logs printed via ctx.log are piped line-by-line into the egress zap logger, so they reach the log file and rotation when OPENSANDBOX_LOG_OUTPUT is set; with the env var unset, behavior stays on stdout as before. (#1468)

🐛 Bug Fixes

• mitmproxy 11.0.2 restores HTTP/2 throughput. The upstream HTTP/2 flow-control fix (mitmproxy/mitmproxy#7317) removes severe throttling of large HTTP/2 responses: a 216 MiB response went from 0.61 MiB/s on mitmproxy 10.4.2 to 24.43 MiB/s — near the direct-path throughput. (#1396)

• DNS-derived nft entries no longer expire under long-lived connections. In dns+nft mode, IPs learned from allowed DNS responses are renewed while an active TCP connection holds them, with one final renewal after activity ends. The stock six-minute lease previously dropped reconnects after ~370s in a persistent gRPC-channel scenario; that scenario now reconnects cleanly. TCP only — UDP/QUIC still rely on DNS-driven refresh. (#1399)

• DNS latency histogram buckets now match its seconds unit. egress.dns.query.duration was using the SDK-default millisecond ladder, so every realistic latency landed in a single bucket and quantiles were meaningless interpolations. Explicit second-based boundaries restore a usable distribution, with a regression test guarding them. (#1405)

• Credential Vault header injection fixed for streamed request bodies. With stream_large_bodies, bodies over 1 MiB are forwarded before the request hook fired, so auth headers arrived too late and uploads failed with 403 invalid api-key. Injection moved to the requestheaders hook (fires before the upstream connection), and this also fixes missed response redaction when the response arrives before the request hook (e.g. a 413 mid-upload). (#1466)

• No-SNI TLS connections now pass through transparent MITM instead of breaking. With no hostname in the ClientHello, mitmproxy's hostname verification fell back to the destination IP and tore down the connection (hostname mismatch) — breaking HTTPS egress to OSS for clients like ossfs2 that connect by IP, unless the insecure flag was set (which Credential Vault rejects). No-SNI flows now pass through untouched; hostname-based ignore_hosts matching and TCP deny/allow enforcement still apply. (#1469)

📦 Misc

• mitmproxy SSE truncation repro tooling. Self-contained reproduction scripts and docs for mitmproxy/mitmproxy#8364, where large SSE bodies over TLS HTTP/1.1 are truncated when the upstream closes right after the body: TLS mode reproduces, plain/delayed-close controls pass. (#1462)

👥 Contributors

Thanks to these contributors ❤️

• @bcho
• @ferponse
• @Pangjiping

• Docker Hub: opensandbox/egress:v1.1.6
• Aliyun Registry: sandbox-registry.cn-zhangjiakou.cr.aliyuncs.com/opensandbox/egress:v1.1.6
• GHCR: ghcr.io/opensandbox-group/opensandbox/egress:v1.1.6

What's New

⚠️ Behavior Changes

• Automatic retries are enabled by default — Non-streaming Kotlin SDK clients now apply the SDK retry policy automatically. By default, idempotent methods retry 429, 502, and 503 responses, while POST and PATCH status-code retries remain opt-in; pre-send connection failures may still be retried. Applications that require the previous SDK-policy behavior should configure .retryPolicy(RetryPolicy.disabled()); this disables SDK-managed retries while retaining OkHttp's pre-existing connection recovery for non-streaming calls. Streaming command and code-execution requests never retry automatically. #1413

✨ Features

• Resilient Kotlin transport — Added configurable retry policies with bounded exponential backoff, jitter modes, Retry-After support, per-attempt timeouts, overall deadlines, and retry callbacks. The public exception hierarchy now distinguishes rate limits, timeouts, and connection failures while exposing retryability, request IDs, retry delays, and raw response bodies consistently across generated and handwritten API paths. #1413
• Rolling pool warmups — Sandbox pool replenishment now treats warmupConcurrency as a rolling in-flight limit and immediately reuses capacity when each warmup finishes, so one slow creation no longer stalls the rest of the refill wave. Distributed primary heartbeats, ownership fencing, cleanup, and backoff continue while warmups run; public APIs and configuration names remain unchanged. #1427

🐛 Bug Fixes

• Safer pool shutdown and restart lifecycle — Graceful shutdown now drains admitted warmups before forcing executor termination and reliably cleans up remotely created sandboxes when interruption occurs, closing a resource-leak window. Pool acquire and warmup paths also propagate cancellation correctly, fence work by lifecycle generation, and release resources and counters even for non-Exception failures, preventing retired work from leaking into a restarted pool. #1415 #1438

📦 Misc

• Published Kotlin/JVM sandbox, code-interpreter, Redis pool, and BOM artifacts at version 1.0.18 under the existing com.alibaba.opensandbox coordinates. #1415

👥 Contributors

• @Pangjiping
• @ninan-nn

What's New

✨ Features

• Intercept extra TCP ports beyond 80/443 (experimental). New env var OPENSANDBOX_EGRESS_MITMPROXY_EXTRA_PORTS (comma-separated) appends extra destination ports to the transparent-mitm REDIRECT rule, with fail-closed validation. Note: extra ports are decrypted and logged but not yet matched against credential bindings. (#1379)

🐛 Bug Fixes

• npm scoped packages no longer 403 under Credential Vault. A single-layer %2f (e.g. /@scope%2fname) is now allowed, while %2f that crosses a credential binding boundary — plus nested encodings, backslashes, and dot-segments — is still rejected. (#1369)

• DNS survives deny.always overlays containing 127.0.0.0/8. In dns+nft mode, DNS redirected to 127.0.0.1:15353 is now accepted before the deny sets, so a loopback deny rule no longer breaks sandbox DNS under Docker. (#1380)

• Purge stale mitmproxy CA on startup. egress now erases the exported CA early in startup so a co-restarting agent doesn't install a stale CA, fixing unable to get local issuer certificate on HTTPS from the agent. (#1371)

🔒 Security

• CVE patches for Go dependencies. grpc → v1.82.1 (xDS RBAC / HTTP/2) and postcss → 8.5.11 (#1385); x/net → v0.55.0 (HTML parser DoS) and x/crypto → v0.52.0 (13 SSH advisories), bringing modules to Go 1.25. (#1250)

📦 Misc

• License headers. Added missing Apache 2.0 headers to fix the verify-license CI workflow. (#1313)

👥 Contributors

Thanks to these contributors ❤️

• @LorenzoRD2003
• @Pangjiping

• Docker Hub: opensandbox/egress:v1.1.5
• Aliyun Registry: sandbox-registry.cn-zhangjiakou.cr.aliyuncs.com/opensandbox/egress:v1.1.5
• GHCR: ghcr.io/opensandbox-group/opensandbox/egress:v1.1.5