2026.08.28 Release v0.7.0
CubeSandbox 0.7.0 introduces 4 major features along with multiple enhancements and bug fixes. 239 commits from 57 contributors.
🎯 Major Features
Cross-Node Pause & Resume
With an S3 backend, sandboxes support pause/resume across nodes as well as creating sandboxes from snapshots. This feature is currently in preview.
Component Multi-Versioning
- Newly created templates and snapshots now record the versions of the components they depend on. After components on compute nodes are upgraded, historical templates and snapshots remain usable, and upgrades no longer affect pause/resume of existing instances — improving stability for running workloads.
Network Subsystem Refactor: Faster Sandbox Network Provisioning
- Architecture: fewer components to deploy — the network-agent component is merged into Cubelet, reducing inter-process RPC calls during sandbox creation; TAP device lifecycle management is redesigned to prevent network rules from leaking across sandboxes, reducing attack surface.
- Performance: optimized the eBPF network policy provisioning path, significantly reducing sandbox creation latency for sandboxes with network rules; removed unnecessary netlink dump operations so that creating new TAP devices under high concurrency remains stable when idle TAP devices are exhausted.
Separation of Control Plane and Operations
Architecturally, operations capabilities are split out of CubeMaster. Node management logic now lives in CubeOps, which supports multi-replica deployment and ships the cubeopscli tool.
✨ Enhancements
Templates & Storage
- CubeS3lvol COW (#1490): besides the local XFS COW engine, cubecow now supports remote snapshot storage on S3 object storage, enabling cross-node pause/resume and snapshot cloning.
- Private HTTP image registry support (#1369): pull images from HTTP image registries to build templates.
- Built-in MinIO as the default S3 volume backend (#1408): MinIO is deployed by default as the S3 backend for the volume feature and cross-node pause/resume. Users can also specify their own S3 backend.
Lifecycle & Control Plane
- Node deletion (#1202): support removing a node from the cluster so it no longer participates in scheduling.
Networking & Security Proxy
- Network subsystem refactor: NetworkAgent is fully embedded into Cubelet, streamlining the network provisioning flow.
- Support dynamically updating network policies for running sandboxes.
- CubeEgress L7 forwarding rules now support custom ports.
- CubeVS learns MAC addresses within the same subnet, avoiding black-holed traffic in non-hairpin networks.
- CubeProxy supports a custom management port and the gRPC protocol.
SDK
- Volume support: the Go (#1269) and Node (#1277) SDKs add Volume CRUD and
volumeMounts, bringing all three languages to parity.
- Full template alias support: build-time aliases (#1119) and alias management for existing templates (#1120), covering Go / Node / Python.
- Go SDK user-level file view (#1348):
Files.ForUser isolates file access by user identity.
- Node SDK runtime timeout (#1251):
Sandbox.setTimeout(timeout) supports NEVER_TIMEOUT.
- Python SDK sandbox scheduling scope (#1144):
Sandbox.create(distribution_scope=...) explicitly specifies the nodes/zones a sandbox can be placed on.
- Go SDK private sandbox dataplane fix (#1185): RunCode / Commands / Files / PTY now correctly pass through the TrafficAccessToken.
- Node SDK auth header fix (#1360): an
Authorization header explicitly set by the caller (including lowercase variants) is no longer overridden by the SDK's default apiKey.
- Clone snapshot deferred cleanup across all three SDKs (#1095): reference counting ensures the temporary snapshot is deleted only after all clones are destroyed.
Deployment & Runtime
- Configurable log rotation policy (#1339): users can adjust cubelet's log rotation policy via the configuration file.
- Kernel / guest images published as separate artifacts (#1324): releases no longer rebuild the kernel and guest images; fixed versions are pulled from dedicated
kernel-release-* / guest-image-* releases.
Web UI / CubeOps / Other
- CubeOps: node management moved into this module; new cubeopscli tool for node management, replacing the cubemastercli node subcommands; two-replica deployment supported by default (#1384, #1494).
- Web UI: node isolation/unisolation and node operation history viewing (#1384).
🐛 Bug Fixes
Lifecycle & Sandbox
- Fixed sandbox state inconsistency, zombie processes, and deletion failures caused by failed pause/resume (#978, #985, #1137, #1274).
- Fixed snapshot performance issues (#1300, #1504).
- Fixed a template cache data race during concurrent sandbox creation (#1366).
Networking & Security
- Fixed sandbox state anomalies caused by TAP device recovery failures during pause/resume and node restarts (#930, #987, #1207).
Other
- Fixed log rotation configuration not taking effect (#1289).
- Expanded the Python SDK compatibility end-to-end tests with coverage for the filesystem, rollback & cloning, online timeout updates, abnormal lifecycles, and advanced template parameters (#1226).
📚 Documentation
- New K8s deployment guide covering compute-node cube-node rebuild constraints and hostNetwork guidance (#1495).
- Community pages (#1344, #1364): sponsors and contributors wall added to the README.
详细ChangeLog
2026.07.24 Release v0.6.0
CubeSandbox 0.6.0 continues to strengthen core capabilities for production deployment and operations.
This release introduces 6 major features along with multiple enhancements and bug fixes. 92 commits from 31 contributors.
🎯 Major Features
Kubernetes Deployment: Deploy Cube Control Plane and Compute Nodes on K8s
Deploy CubeSandbox control-plane components and compute nodes directly onto Tencent Cloud TKE, standard Kubernetes, or k3s clusters via Helm Chart. Perform rolling upgrades, canary releases, and other operations using standard Kubernetes practices. For details, see the Kubernetes Deployment Guide.
::: warning Preview
Kubernetes deployment is currently in preview. Advanced capabilities such as seamless upgrades are still under active development. Feedback is welcome.
:::
E2B-Compatible Volume Framework
Introduces an E2B-compatible Volume framework that lets users plug in custom backend storage while remaining compatible with the E2B standard. Provides four hooks — Create / Destroy / Attach / Detach — and two plugin forms: Binary and RPC. This release includes Volume lifecycle management, sandbox–Volume binding APIs, and supporting SDK and cubemastercli capabilities. For details, see the Volume Plugin Guide.
Template Aliases
Support setting an alias when creating a template, and creating sandboxes by specifying that alias.
Note: Aliases can only be set at template creation time; existing templates cannot have aliases added or changed. Specifying an alias when creating a sandbox is currently supported only in the Python SDK; other SDKs will follow soon.
Configurable Host for Inbound Sandbox Requests
Allow configuring the Host header forwarded to the sandbox (instead of the default <port>-<sandboxId>.<domain>), improving compatibility with Host-based services inside the sandbox. The new network.maskRequestHost parameter can be set when creating a sandbox to specify the Host forwarded to in-sandbox services (for example localhost:${PORT}, which expands to localhost:3000 when accessing port 3000), so applications that rely on Host for routing, validation, or callbacks work correctly.
Compute Node Isolation
Support isolating a compute node at the scheduling layer so operators can log in for maintenance, upgrades, and troubleshooting. After isolation, no new sandboxes are scheduled to that node; existing sandboxes continue to run unaffected.
Isolate a node with cubemastercli node isolate <node-id>, and lift isolation with the unisolate subcommand. For details, see Node Isolation.
CubeOps Operations Service: Decouple Ops & Web Console Logic from CubeAPI
Web console capabilities are split out of the CubeAPI module into a standalone CubeOps service, making CubeAPI lighter and more extensible.
✨ Enhancements
SDK
- Go SDK PTY (#815): Improved interactive terminal capabilities.
- Python SDK X-API-Key coverage (#995): Carry X-API-Key on all request paths.
- Go SDK Connect protocol frames and dataplane fixes (#828, #941): process.Process/Start, exit-0 end event parsing, encode deduplication, and dataplane defect fixes.
- Short sandbox ID prefix resolution (#697): CubeMaster / Cubelet support short ID prefix resolution for easier ops and troubleshooting.
Templates & Storage
- Templates can enable the ivshmem device (#858).
- cubemastercli UX improvements (#891): Better experience for
tpl info / delete / redo.
- New cubemastercli volume-related subcommands (#1077).
Lifecycle & Control Plane
- CLM state sync (#956): Stronger sandbox lifecycle state consistency; control-plane pause/resume actions are synced to the dataplane.
- Async CubeProxy state push (#1044): Push with backoff retries to reduce sync-push jitter.
- Skip capacity checks for delete-triggered auto-resume (#1015): Prevent resume on the delete path from being wrongly blocked by capacity checks.
- Schema migration toggle (#1037, #1076): New
CUBE_AUTO_MIGRATION env var to skip automatic DB migration at startup for controlled upgrades.
- Support deleting sandboxes that are in the paused state.
Networking & Security Proxy
- CubeEgress MITM leaf certificate SAN (#948): Write subjectAltName on leaf certificates for better TLS verification compatibility.
- Return 403 on traffic token validation failure (#1053): Align with E2B and avoid confusion with other error codes.
- CubeProxy Redis hostname resolver (#714): Correctly resolve Redis hostnames.
- Disable gzip on Connect streams (#1083): Prevent streaming RPCs from being broken by compression.
Deployment & Runtime
- PostgreSQL metadata backend (#674, #1000): CubeMaster DAO layer supports PostgreSQL.
- Switch in-sandbox cgroup from v1 to v2 (#899).
- Cubelet state tmpfs supports dynamic expansion (#1008).
Web UI / CubeOps / Other
- Improved compute-node component version inventory reporting (#1020).
- CubeMaster HTTP APIs now handled with the gin framework (#922).
🐛 Bug Fixes
Lifecycle & Sandbox
- Nested host-mount mount order: apply configuration in user-specified order (#946).
- Periodic compute-node health sync (#730): Avoid inconsistency between health state and the scheduling view.
- WebUI: Converge to a 404 terminal state after sandbox timeout cleanup (#1036); eliminate session invalidation risk (#1048).
Security & Validation
📚 Documentation
- Kubernetes deployment guide (#1067 and others): EN/ZH install / architecture / upgrade / FAQ.
- Node isolation guide (#1093).
- Volume plugin guide and COS examples (#997, #1089).
- Component troubleshooting guide (#968).
详细ChangeLog
2026.07.10 Release v0.5.1
CubeSandbox 0.5.1 is a production follow-up to 0.5.0, hardening AutoPause, ARM64, and cluster deployment for real-world scale. Headline items: a standalone cube-lifecycle-manager control-plane service (extracted from the CubeProxy sidecar so CubeProxy can scale horizontally), a three-value timeout semantics refactor with server-side defaults and NEVER_TIMEOUT, and host-mount path allowlisting to close arbitrary host bind-mounts. The release also fixes ARM64 64 KB page snapshot integrity and substantially improves egress policy / TAP recycle reliability. 59 commits from 18 contributors.
🎯 Major Features
cube-lifecycle-manager: Standalone AutoPause Coordinator
Splits the former in-image cube-proxy-sidecar into a standalone control-plane service — cube-lifecycle-manager (CLM) — so CubeProxy can run multiple replicas without a single-instance sidecar bottleneck.
- Standalone deploy: CLM is wired into
cube-sandbox-control.target; one-click and TencentCloud Terraform deployments both include it.
- Redis service discovery: each CubeProxy replica registers its admin endpoint in Redis; CLM discovers live replicas and coordinates auto-pause / auto-resume with no static replica list.
- Protocol compatibility: wire protocol, Redis schema, and SDK behavior are unchanged; existing AutoPause / AutoResume semantics are preserved.
- TencentCloud Terraform (#814): control plane gains a
cube-lifecycle-manager Deployment; supports TENCENTCLOUD_CUBE_PROXY_REPLICAS multi-replica plus CLM replica count / discovery refresh / admin token knobs.
Three-Value Timeout Semantics + Server-Side Default
Unifies sandbox idle-timeout semantics (E2B-aligned) and moves the "not set" vs "explicit default" decision from SDK / CubeAPI down to CubeMaster.
| Value |
Meaning |
Omitted (None / nil) |
Cluster default_timeout_insec; if unset or ≤0 → never timeout |
NEVER_TIMEOUT (-1) |
Never reclaim on idle |
0 |
Immediate timeout (reclaimed on the first idle sweep) |
N > 0 |
Idle TTL = N seconds |
- SDK: Go / Python
CreateOptions.Timeout become optional pointers; Create / Connect / Resume no longer inject a hard-coded default. Expose NeverTimeout / NEVER_TIMEOUT sentinels.
- CubeAPI / CubeMaster: timeout fields are
Option / *int, preserving "unset"; EndAt follows three-value rules (-1 → no deadline).
- RPC deadline decoupled from idle TTL: new
create_timeout_insec (default 300s) bounds only the create/scheduling RPC.
- CLM sweeper: skip reclaim when
TimeoutSeconds < 0; immediate reclaim at == 0; legacy nil falls back to DefaultIdleTimeout.
- Runtime adjustment: Python / Go SDKs add
set_timeout() / SetTimeout(), including NEVER_TIMEOUT (#743, #850). Web UI can pass timeout on sandbox create (#798).
Host-Mount Path Allowlist Hardening
Host-mount previously accepted any absolute path, letting sandboxes bind-mount arbitrary host directories. Paths are now restricted to configurable prefixes (default /data/shared/), with filepath.Clean neutralizing .. traversal; / is explicitly forbidden in config (#756).
Persistent-storage docs updated (path restriction, permissions, multi-tenant isolation, multi-node shared storage); examples aligned to the default prefix (#768).
✨ Enhancements
SDK
- Node.js / TypeScript SDK (preview) (#792): adds
@cubesandbox/sdk aligned with the Python / Go surface; still under validation — use with caution in production.
- Python / Go
set_timeout (#743, #850): E2B-aligned; CubeAPI / CubeMaster accept -1 (NEVER_TIMEOUT) and reject other negatives.
- Go SDK allowOut guard alignment (#802):
AllowPublicTraffic=false is no longer treated as deny-all; matches CubeAPI (deny-all only when AllowInternetAccess=false or denyOut contains 0.0.0.0/0).
Networking & Egress
- CubeEgress credential injection on plain HTTP (#726): allows inject against HTTP-only upstreams. The security boundary is that sandbox code never sees the secret, not that egress→upstream must be TLS.
- CubeEgress transparent-proxy IP from sandbox CIDR (#851): no longer hard-codes
192.168.0.1; derives the first usable IP from CUBE_SANDBOX_NETWORK_CIDR so custom sandbox networks get correct TPROXY / OpenResty listen addresses.
- Minimum TTL for DNS-learned egress entries: clamp learned allow entries to ≥300s so short DNS TTLs do not cause reconnect denials.
- Skip policy re-check for established CubeEgress sessions: CubeVS skips egress policy re-evaluation for existing TCP sessions so DNS expiry does not break live connections; policy check folded into
create_nat_session with per-session caching.
- Always replay default deny on replace: replace / flush always replays private / link-local default deny entries so create and replace policy shapes stay consistent.
Deployment & Installer
- CubeProxy pre-published multi-arch images (#849): one-click pulls TCR multi-arch images instead of building on-host; supports
MIRROR=cn|int and airgap local-cache fallback.
- Component image release pipeline (#795):
release-docker-images.yml pushes multi-arch component images to GHCR / TCR; bump-image.sh is the single source of truth for hard-coded tags.
- CubeMaster Dockerfile (#813, #824): unified Docker build args / context and ARG scoping fixes; CubeAPI Dockerfile switched to single-shot build with safety gates (#854).
- One-click dnsmasq fallback (#740): optional script-owned dnsmasq when systemd-resolved is absent and NetworkManager's dnsmasq plugin never spawns, restoring
cube.app resolution.
- Anchored cubelet config patching (#776): sed replacements anchored at line start so updating
CUBE_SANDBOX_NETWORK_CIDR cannot rewrite an empty cube_router_cidr.
Web UI / AgentHub / Other
- CubeAPI lifecycle snake_case (#772): accepts Python-style
lifecycle.on_timeout / lifecycle.auto_resume, avoiding silent fallback to kill / no-resume.
- AgentHub OpenClaw bind=lan (#769): force gateway bind to
lan so cube-proxy can reach it via tap IP (auto could resolve to loopback).
- ARM64 runtime hardening (#807): dirty-bitmap granularity uses host page size (fixes severely incomplete snapshots on 64 KB pages and 200% CPU on restore); aarch64 vCPU falls back to PMU-less init when the host lacks PMUv3.
- Dev-env QEMU 10.x (#713): explicit
-drive if=none + -device virtio-blk-pci fixes empty-drive errors on QEMU 10.2.2+.
🐛 Bug Fixes
Lifecycle & Sandboxes
- Idempotent resume (#817): already-Running sandboxes return an "already in target state" signal (treated as success by CLM), distinct from truly non-resumable states.
- 404 on delete missing sandbox (#759): CubeAPI / CubeMaster map missing-sandbox deletes to NotFound.
- Stable sandbox list order (#762): sort by creation time descending with SandboxID tie-break so WebUI / SDK refreshes no longer reshuffle.
- Preserve template network rules & resource defaults (#581): keep egress rules when creating templates from images; retain the first CPU/memory validation error; request-side overrides win under first-match-wins.
Networking & Data Plane
- Safe TAP recycle (network-agent): do not return TAPs to the pool until cleanup and pool prep succeed; failed cleanup keeps residual policy off the reusable pool; clear policy / DNS allow state before reuse to prevent cross-sandbox leakage.
- Go SDK envd port (#821): envd RPCs (commands / files / filesystem / PTY) route to port 49983 instead of Jupyter 49999; only
RunCode / /execute stays on Jupyter.
Other
- Example host-mount paths (#768): examples and docs use
/data/shared/... to match the default allowlist.
📚 Documentation
- ARM64 support announcement blog (#866): bilingual InfoQ-style post on the joint Arm multi-arch effort.
- Pi Agent integration guide (#701): bilingual docs + runnable example (pause/resume, network policy, credential injection).
- Lifecycle / quota docs (#739): ARM64 install notes and lifecycle quota documentation.
- Persistent storage guide (#756): host-mount path restriction, permissions, multi-tenant isolation, multi-node shared storage.
- Roadmap (#731): roadmap added to README and docs site.
- v0.5.0 release materials (#770, #781): release blog and feature copy updates; Quickstart notes Multi-Arch image availability (#806).
- Dev skills & doc hygiene (#788, #789): Claude Code
run-dev skill; i18n sync checks and change-driven doc audit rules.
⚙️ Engineering Improvements
- Platform-suffixed versions in matrix checks (#747).
- PVM guest build trigger tightened (#819): only on version tags.
- Image tag bumps: one-click / Terraform defaults synced through
v0.5.1-rc* candidates (#826, #867).
- Python SDK version bump to 0.5.0 (#818).
- CubeAPI dead-code cleanup (#796) and other small engineering tidy-ups.
Note: Web Example Center (#615) was merged and immediately reverted (#778); it is not part of this release.
详细ChangeLog
