OpenSandbox

No entries match these filters. Clear filters

1. release-1.2.0 Oct 27, 2026 · issue 123

   OpenSandbox 1.2.0 ships auto-pause/wake, Credential Vault API, OCIOCIOpen Container Initiative standard, maintained by the Linux Foundation, defining the image format and runtime spec that container tools share so images built once run anywhere OCI-compliant. registry snapshots, and a diagnostics context endpoint across all five SDKs.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

   └──▷ GET THIS VERSION

   copy

   $ git clone --branch release-1.2.0 https://github.com/opensandbox-group/OpenSandbox.git
   # already have the repo? check out this version:
   $ git checkout release-1.2.0

   └──▷ TRY IT
   Create a fast sandbox that auto-pauses after 5 minutes of idle and wakes transparently on the next access, keeping costs low for infrequently used environments.
   copy

   $ curl -X POST https://api.opensandbox.example/v1/sandboxes \
     -H 'Content-Type: application/json' \
     -d '{
       "template": "my-template",
       "lifecycle": {
         "idlePolicy": {
           "idleTimeoutSeconds": 300,
           "onIdle": "pause",
           "wakeOnAccess": true
         }
       }
     }'

   Enable the MITM CA pinning feature so that egress sidecar restarts never rotate the trust anchor under live sandboxes in a Kubernetes deployment.
   toml copy

   [kubernetes]
   template_mitm_ca_secret = "mitm-ca-secret"
   
   [automation.idle_pause]
   enabled = true
   
   [redis]
   dsn = "redis://localhost:6379/0"

   • Adds lifecycle.idlePolicy create field (with idleTimeoutSeconds 30–86400, onIdle: pause, wakeOnAccess, and optional activeProbe) to enable auto-pause and wake-on-access for fast sandboxes, with server config moving under [automation.idle_pause] (requiring redis.dsn when the sweeper is enabled), and typed client support with fail-fast validation and a wake-retry contract added to all five SDKs: on a 503 with OpenSandbox-Wake: expired, SDKs retry after Retry-After up to a bounded budget (default 5 attempts / 60 s) and raise a typed wake-timeout exception on exhaustion, with stream-start wake-retry active in JavaScript, Python, and Go.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠
   • Adds Credential Vault support for fast sandboxes: a POST|GET|PATCH|DELETE /v1/sandboxes/{id}/credential-vault API with credential values sanitized on every public read and expectedRevision as the cross-replica PATCH backstop, plus a Credential Vault client contract added to all five SDKs that routes vault calls through the server for template-backed sandboxes.
   • Adds GET /v1/sandboxes/{sandboxId}/diagnostics/context endpoint returning sandbox ID, lifecycle state, backend type, and backend-defined identifiers for Docker, Kubernetes, and Fast Sandbox without connecting to execd; unsupported extension backends return 501.
   • Adds [kubernetes] template_mitm_ca_secret server config (default off) to bake a pinned MITM CA into server-created SandboxTemplates via spec.egressMitmCertificate, so an egress restart no longer rotates the trust anchor under live sandboxes.
   • Adds lifecycle.renewalPolicy.extendSeconds (300–86400) structured field (OSEP-0009), replacing the opaque extensions['access.renew.extend.seconds'] key; the legacy key is deprecated through 1.x and removed in 2.0.

   +5 more show less

   • Supports publishing Fast Sandbox snapshots and template builds to, and booting from, OCI registries via OverlayBD OCI lifecycle.
   • Removes whole-call timeouts from SDK file transfers in all five languages, eliminating the 30 s default cap that caused large or slow transfers to fail mid-flight.
   • Adds OpenSandbox-Skip-Activity sentinel header to suppress one activity observation on the idle sweeper, stripped on both gateway and proxy hops.
   • Adds preflight rejection of gVisorgVisorA user-space kernel written in Go by Google that intercepts and handles system calls on behalf of a container, sandboxing it without needing a full VM. snapshots unless effective args include --overlay2=none, preventing silent write-drop on docker commit under gVisor's default --overlay2=root:self.
   • Passes through podman pasta, slirp4netns, and none network modes (with networkPolicy rejected, since there is no bridge to attach to).
   • Adds lifecycle.idlePolicy create field (with idleTimeoutSeconds 30–86400, onIdle: pause, wakeOnAccess, and optional activeProbe) to enable auto-pause and wake-on-access for fast sandboxes, with server config moving under [automation.idle_pause] (requiring redis.dsn when the sweeper is enabled), and typed client support with fail-fast validation and a wake-retry contract added to all five SDKs: on a 503 with OpenSandbox-Wake: expired, SDKs retry after Retry-After up to a bounded budget (default 5 attempts / 60 s) and raise a typed wake-timeout exception on exhaustion, with stream-start wake-retry active in JavaScript, Python, and Go.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠
   • Adds Credential Vault support for fast sandboxes: a POST|GET|PATCH|DELETE /v1/sandboxes/{id}/credential-vault API with credential values sanitized on every public read and expectedRevision as the cross-replica PATCH backstop, plus a Credential Vault client contract added to all five SDKs that routes vault calls through the server for template-backed sandboxes.
   • Adds GET /v1/sandboxes/{sandboxId}/diagnostics/context endpoint returning sandbox ID, lifecycle state, backend type, and backend-defined identifiers for Docker, Kubernetes, and Fast Sandbox without connecting to execd; unsupported extension backends return 501.
   • Adds [kubernetes] template_mitm_ca_secret server config (default off) to bake a pinned MITM CA into server-created SandboxTemplates via spec.egressMitmCertificate, so an egress restart no longer rotates the trust anchor under live sandboxes.
   • Adds lifecycle.renewalPolicy.extendSeconds (300–86400) structured field (OSEP-0009), replacing the opaque extensions['access.renew.extend.seconds'] key; the legacy key is deprecated through 1.x and removed in 2.0.

   +4 more show less

   • Supports publishing Fast Sandbox snapshots and template builds to, and booting from, OCI registries via OverlayBD OCI lifecycle.
   • Adds OpenSandbox-Skip-Activity sentinel header to suppress one activity observation on the idle sweeper, stripped on both gateway and proxy hops.
   • Adds preflight rejection of gVisorgVisorA user-space kernel written in Go by Google that intercepts and handles system calls on behalf of a container, sandboxing it without needing a full VM. snapshots unless effective args include --overlay2=none, preventing silent write-drop on docker commit under gVisor's default --overlay2=root:self.
   • Passes through podman pasta, slirp4netns, and none network modes (with networkPolicy rejected, since there is no bridge to attach to).

   1 more in Everything

   └──▷ BREAKING ON UPGRADE

   • !The extensions['access.renew.extend.seconds'] key is deprecated and fast sandboxes now reject it with 400 instead of silently accepting a no-op; migrate to lifecycle.renewalPolicy.extendSeconds before upgrading to 2.0, where the legacy key is removed.
2. release-1.2.0-rc.1 Prerelease Oct 15, 2026 · issue 116

   OpenSandbox 1.2.0-rc.1 adds auto-pause/wake-on-access for fast sandboxes, an experimental egress sidecar, OOMOOMAn out-of-memory condition: a program requests more memory than the system or device can provide. The allocation fails or the operating system may stop the process. kill reporting, and sandbox-scoped CPUCPUThe main general-purpose processor in a computer. It runs application instructions and coordinates work with memory and other hardware./memory metrics.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

   └──▷ GET THIS VERSION

   copy

   $ git clone --branch release-1.2.0-rc.1 https://github.com/opensandbox-group/OpenSandbox.git
   # already have the repo? check out this version:
   $ git checkout release-1.2.0-rc.1

   └──▷ USE IT
   Create a fast sandbox that auto-pauses after 5 minutes of inactivity and wakes transparently when the next request arrives.
   json copy

   {
     "lifecycle": {
       "idlePolicy": {
         "idleTimeoutSeconds": 300,
         "onIdle": "pause",
         "wakeOnAccess": true
       }
     }
   }

   Migrate the server config to the new idle-pause section layout and enforce a valid Redis DSN so the sweeper starts loudly rather than silently skipping.
   ini copy

   [automation.idle_pause]
   enabled = true
   redis.dsn = "redis://localhost:6379/0"

   Probe an auto-paused sandbox from a health-check script without recording the request as user activity, keeping the idle timer accurate.
   copy

   $ curl -H 'OpenSandbox-Skip-Activity: skip' https://<sandbox-host>/healthz

   • Adds lifecycle.idlePolicy create field (with idleTimeoutSeconds 30–86400, onIdle: pause, wakeOnAccess, and optional activeProbe) to opt fast sandboxes into server-side auto-pause and wake-on-access (OSEP-0024); the policy persists as the sandbox.opensandbox.io/idle-policy Sandbox CR annotation and is off by default.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠
   • Moves idle-pause configuration from [idle_pause] to [automation.idle_pause], removes the redundant redis.enabled gate, and requires redis.dsn (validated at load) when enabled = true.
   • Adds the OpenSandbox-Skip-Activity: skip request header sentinel to suppress ingress activity observation for a single request (stripped at both gateway and server-proxy hops).
   • Adds wake-retry contract to all five SDKs: on a 503 carrying the OpenSandbox-Wake: expired gateway header, the SDK resends after Retry-After within a bounded budget (default 5 attempts / 60 s, configurable per client); exhaustion raises a typed wake-timeout exception carrying attempt count and waited time.
   • Adds an experimental opt-in egress sidecar with live credential-bound Vault admission, HTTP/2 support with bounded drain, atomic policy-file persistence, and runtime fault containment (OSEP-0023).

   +4 more show less

   • Adds OOM kill reporting in execd via cgroupfs polling: polls the sandbox cgroup every 5 s, diffs memory.events (cgroup v2; best-effort v1), and exports the execd.system.oom.kills metric with a local/descendant level attribute plus structured warn logs with best-effort victim attribution.
   • Adds sandbox-scoped CPU/memory metrics in execd: when the sandbox cgroup carries configured limits, execd.system.cpu.usage and execd.system.memory.usage_bytes now read from the sandbox's own cgroup (cpu.stat/cpu.max, memory.current/memory.max, with v1 fallback) instead of the host-wide /proc view via gopsutil.
   • Treats pasta, slirp4netns, and none as valid container-runtime network modes, passing them through to podman kernel-level networking; rejects networkPolicy for these modes since no bridge is available for the egress sidecar.
   • Retains a BatchSandbox in the lifecycle API (reporting Stopping) until foreground cascading deletion and cleanup finalizers complete, preventing a replacement sandbox from writing the same persistent directory before the old writer exits.
   • Adds lifecycle.idlePolicy create field (with idleTimeoutSeconds 30–86400, onIdle: pause, wakeOnAccess, and optional activeProbe) to opt fast sandboxes into server-side auto-pause and wake-on-access (OSEP-0024); the policy persists as the sandbox.opensandbox.io/idle-policy Sandbox CR annotation and is off by default.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠
   • Adds the OpenSandbox-Skip-Activity: skip request header sentinel to suppress ingress activity observation for a single request (stripped at both gateway and server-proxy hops).
   • Adds wake-retry contract to all five SDKs: on a 503 carrying the OpenSandbox-Wake: expired gateway header, the SDK resends after Retry-After within a bounded budget (default 5 attempts / 60 s, configurable per client); exhaustion raises a typed wake-timeout exception carrying attempt count and waited time.
   • Adds an experimental opt-in egress sidecar with live credential-bound Vault admission, HTTP/2 support with bounded drain, atomic policy-file persistence, and runtime fault containment (OSEP-0023).
   • Adds OOM kill reporting in execd via cgroupfs polling: polls the sandbox cgroup every 5 s, diffs memory.events (cgroup v2; best-effort v1), and exports the execd.system.oom.kills metric with a local/descendant level attribute plus structured warn logs with best-effort victim attribution.

   +1 more show less

   • Treats pasta, slirp4netns, and none as valid container-runtime network modes, passing them through to podman kernel-level networking; rejects networkPolicy for these modes since no bridge is available for the egress sidecar.

   3 more in Everything

   └──▷ BREAKING ON UPGRADE

   • !The [idle_pause] config section is renamed to [automation.idle_pause]; the redis.enabled gate is removed and redis.dsn is now required (validated at load) when enabled = true — a previously silent non-start now fails loudly.
   • !BatchSandbox pods now default to restartPolicy: Never; any workload relying on the previous implicit restart behavior must set an explicit restartPolicy in the pod template to preserve it.
3. release-1.1.1 Oct 9, 2026 · issue 100

   OpenSandbox 1.1.1 adds identity-bound filesystem ops, multi-overlay mounts, upstream proxy config, and tenant isolation across all five SDKs.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

   └──▷ GET THIS VERSION

   copy

   $ git clone --branch release-1.1.1 https://github.com/opensandbox-group/OpenSandbox.git
   # already have the repo? check out this version:
   $ git checkout release-1.1.1

   └──▷ USE IT
   Lock sandbox port exposure to localhost so the tokenless execd port never reaches public interfaces on a Docker host.
   ini copy

   [docker]
   publish_host = "127.0.0.1"

   Route all sandbox egress through a corporate CONNECT proxy signed by an internal CA, without replacing the sidecar system trust store.
   ini copy

   [egress.upstream_proxy]
   url = "https://proxy.corp.example.com:3128"
   
   # Docker deployments
   ca_cert_path = "/etc/pki/corp-ca.pem"
   
   # Kubernetes deployments
   # ca_secret_name = "corp-ca-secret"

   • Adds identity-bound filesystem operations via /v1/filesystem/{uid}/{gid} execd routes — backed by a per-request worker running with explicit Linux UID/GID credentials — exposed as files_with_identity (Python), filesWithIdentity (JavaScript, Kotlin, Go, C#) across all five SDKs.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠
   • Adds [egress.upstream_proxy] config section (URL + optional authorization) that injects a chained upstream CONNECT proxy for both Docker and Kubernetes backends, with ca_cert_path (Docker) and ca_secret_name (Kubernetes) to trust private-CA https:// proxies without replacing the system trust store.
   • Adds [docker] publish_host config key to bind bridge-mode sandbox ports to a specific host address (default 0.0.0.0), preventing the tokenless execd port from appearing on public interfaces when set to 127.0.0.1 or the Docker bridge gateway.
   • Adds commands.setEnv across all five sandbox SDKs (Python async/sync, JavaScript, Kotlin/Java, Go, C#) for persistent runtime environment variable injection, appending KEY=VALUE to the sandbox env file at runtime.
   • Exposes CreateIsolatedSessionRequest.overlays ({path, mode, persist}) across the API and all five SDKs, enabling multiple independent overlay mounts per isolated session with separate host-tracked or ephemeral tmpfs uppers; workspace is retained as sugar and SessionState echoes the canonical list.

   +5 more show less

   • Implements pause/resume for the agent-sandbox provider by bridging to spec.operatingMode (Running/Suspended) on agents.x-k8s.io/v1beta1agents.x-k8s.io/v1beta1A Kubernetes API group version for the CAPI (Cluster API) Agents provider, maintained under the x-k8s.io experimental namespace, letting cyber tools manage cluster infrastructure lifecycle via standard Kubernetes custom resources., with state derivation (Paused/Pausing/Resuming/Terminated) and 409 on invalid transitions.
   • Isolates tenants sharing one Kubernetes namespace via a new opensandbox.io/tenant stamp label — list/get/delete/pause/resume/proxy hide other tenants' labeled sandboxes as 404 while unlabeled legacy sandboxes remain visible until expiry.
   • Adds kubernetes.insecure_skip_tls_verify config key for ServiceAccount CA mismatches in Kubernetes multi-tenant deployments.
   • Accepts env on template create, baking it into the fast-sandbox golden image at /etc/sandbox-init.env (inheriting the source image's OCIOCIOpen Container Initiative standard, maintained by the Linux Foundation, defining the image format and runtime spec that container tools share so images built once run anywhere OCI-compliant. Config.Env), supported across all five SDKs.
   • Maps proxied backend failures to typed HTTP statuses: read/write timeouts return 504 BACKEND_TIMEOUT, mid-response resets and protocol errors return 502 BACKEND_RESPONSE_FAILED, and connect failures return 502 BACKEND_CONNECTION_FAILED.
   • Adds identity-bound filesystem operations via /v1/filesystem/{uid}/{gid} execd routes — backed by a per-request worker running with explicit Linux UID/GID credentials — exposed as files_with_identity (Python), filesWithIdentity (JavaScript, Kotlin, Go, C#) across all five SDKs.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠
   • Adds [egress.upstream_proxy] config section (URL + optional authorization) that injects a chained upstream CONNECT proxy for both Docker and Kubernetes backends, with ca_cert_path (Docker) and ca_secret_name (Kubernetes) to trust private-CA https:// proxies without replacing the system trust store.
   • Adds [docker] publish_host config key to bind bridge-mode sandbox ports to a specific host address (default 0.0.0.0), preventing the tokenless execd port from appearing on public interfaces when set to 127.0.0.1 or the Docker bridge gateway.
   • Adds commands.setEnv across all five sandbox SDKs (Python async/sync, JavaScript, Kotlin/Java, Go, C#) for persistent runtime environment variable injection, appending KEY=VALUE to the sandbox env file at runtime.
   • Exposes CreateIsolatedSessionRequest.overlays ({path, mode, persist}) across the API and all five SDKs, enabling multiple independent overlay mounts per isolated session with separate host-tracked or ephemeral tmpfs uppers; workspace is retained as sugar and SessionState echoes the canonical list.

   +3 more show less

   • Implements pause/resume for the agent-sandbox provider by bridging to spec.operatingMode (Running/Suspended) on agents.x-k8s.io/v1beta1agents.x-k8s.io/v1beta1A Kubernetes API group version for the CAPI (Cluster API) Agents provider, maintained under the x-k8s.io experimental namespace, letting cyber tools manage cluster infrastructure lifecycle via standard Kubernetes custom resources., with state derivation (Paused/Pausing/Resuming/Terminated) and 409 on invalid transitions.
   • Isolates tenants sharing one Kubernetes namespace via a new opensandbox.io/tenant stamp label — list/get/delete/pause/resume/proxy hide other tenants' labeled sandboxes as 404 while unlabeled legacy sandboxes remain visible until expiry.
   • Adds kubernetes.insecure_skip_tls_verify config key for ServiceAccount CA mismatches in Kubernetes multi-tenant deployments.

   2 more in Everything

4. release-1.1.1-rc.1 Prerelease Sep 28, 2026 · issue 100

   OpenSandbox: Adds [egress.upstream_proxy] config section to chain sandbox egress through a corporate CONNECT proxy on Docker and Kubernetes.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

   └──▷ GET THIS VERSION

   copy

   $ git clone --branch release-1.1.1-rc.1 https://github.com/opensandbox-group/OpenSandbox.git
   # already have the repo? check out this version:
   $ git checkout release-1.1.1-rc.1

   └──▷ USE IT
   Lock down the tokenless execd port so it is never reachable on public interfaces in a Docker deployment.
   ini copy

   [docker]
   publish_host = "127.0.0.1"

   Create a sandbox from a full wire-format YAML file in CI, and start it from a named template with a snapshot pinned.
   copy

   $ osb sandbox create -f sandbox-spec.yaml --template my-base-template --snapshot-id snap-abc123

   • Adds OPENSANDBOX_EGRESS_UPSTREAM_PROXY / _AUTH environment variables to route transparent-proxy egress through an upstream CONNECT proxy with SNISNIA TLS extension that lets a client declare which hostname it is connecting to during the handshake, allowing one server to host multiple certificates on a single IP address./Host-consistent authority and fail-closed startup validation.
   • Adds osb template create|get|list|delete and osb snapshot ... CLI subcommands, plus --template and --snapshot-id flags on sandbox create, for template and snapshot management.
   • Adds kubectl-style -f/--file flag to sandbox create and template create for full wire-format request files with strict unknown-field rejection.
   • Adds OpenSandbox-Access-Renew: skip request header to opt individual requests out of access renew intents, for health probes and heartbeat-style traffic.

   4 details in Everything

5. release-1.1.0 Sep 21, 2026 · issue 081

   OpenSandbox 1.1.0 debuts Firecracker FastPath sandboxes, a PostgreSQL snapshot store, lifecycle hooks, and a scoped diagnostics API⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

   └──▷ GET THIS VERSION

   copy

   $ git clone --branch release-1.1.0 https://github.com/opensandbox-group/OpenSandbox.git
   # already have the repo? check out this version:
   $ git checkout release-1.1.0

   └──▷ TRY IT
   Enable the PostgreSQL snapshot store for HA multi-process deployments and migrate existing SQLite records in one shot.
   copy

   $ migrate-snapshots

   Scope diagnostics queries to only runtime events for a sandbox, using the new events:runtime scope to cut noise during incident triage.
   copy

   $ curl -H 'OPEN-SANDBOX-API-KEY: <key>' 'https://<server>/diagnostics?scope=events:runtime'

   Export egress sidecar metrics to your OpenTelemetryOpenTelemetryAn open standard and set of tools for collecting traces, metrics and logs from applications. It lets services export observability data without tying instrumentation to one monitoring vendor. collector and cap its resource footprint independently of the sandbox container.
   toml copy

   [egress]
   otlp_endpoint = "http://otel-collector:4317"
   timeout_seconds = 30
   
   [egress.resources]
   requests = { cpu = "50m", memory = "64Mi" }
   limits   = { cpu = "200m", memory = "128Mi" }

   • Adds preStart and periodic lifecycle hooks to sandbox create requests (OSEP-0020), validated server-side and serialized into a reserved environment variable for Kubernetes workloads; preStart.timeoutSeconds limit raised to 10800 seconds.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠
   • Adds opt-in PostgreSQL snapshot store with pooled connections and CAS semantics, plus the one-shot migrate-snapshots command for moving existing SQLite records, and multi-process HA coordination for snapshot create/recovery/delete on Kubernetes.
   • Adds [egress.resources] config key for independent resource requests/limits on the Kubernetes egress sidecar.
   • Adds [egress] otlp_endpoint config key so the egress sidecar exports metrics to an OpenTelemetry collector on both runtimes.
   • Adds [egress] timeout_seconds config key to make egress sidecar readiness wait configurable.

   +13 more show less

   • Adds [proxy] resolve_internal config key to make the reverse proxy's internal resolution configurable for deployments that cannot route to Docker bridge IPs.
   • Adds sandbox_env and sandbox_binds Docker-runtime-wide configuration keys, giving Docker parity with the Kubernetes pod template for fleet-wide CA bundles, proxies, and mounts.
   • Sources OSEP-0011 secure-access signing keys from the OPENSANDBOX_SECURE_ACCESS_KEYS environment variable or a Kubernetes Secret instead of plaintext chart values.
   • Injects OPENSANDBOX_EGRESS_SANDBOX_ID server-side so egress sidecar telemetry can no longer be spoofed by request environment variables.
   • Adds a stable, scoped diagnostics API with logs:container|all and events:runtime|lifecycle|all scopes, returning 400 DIAGNOSTICS_SCOPE_UNSUPPORTED for unknown scopes and backward-compatible plain-text responses.
   • Adds the FastPath fleets lifecycle backend: create, renew, delete, and status mapping via FastPath v2, plus end-to-end fast-sandbox pause/resume with async 202 semantics and UID fencing.
   • Adds fast-sandbox snapshot support and fsb template management across all five SDKs.
   • Exports generic HTTP request metrics (request rate, error rate, latency) from the server over OTLPOTLPOpenTelemetry Protocol, a standard way to send traces, metrics and logs between applications, collectors and monitoring systems. It lets telemetry move across compatible tools., complementing the SDK-reported create-duration histogram.
   • Rejects unsupported gVisorgVisorA user-space kernel written in Go by Google that intercepts and handles system calls on behalf of a container, sandboxing it without needing a full VM. (runsc) snapshots before persistence with 409 SNAPSHOT::UNSUPPORTED_RUNTIME.
   • Supports pool-only sandbox creation using poolRef without an entrypoint (previously rejected with HTTP 400), and surfaces pool back-pressure as HTTP 429 KUBERNETES::POOL_CAPACITY_EXHAUSTED with a Retry-After header.
   • Honors image.auth in create requests for the agent-sandbox provider with per-sandbox pull secrets garbage-collected with the Sandbox CR.
   • Adds sandbox lifecycle hook models (OSEP-0020) to the API spec and every SDK with consistent validation aligned to server ranges.
   • Defaults CodeInterpreter creation to a strict health check in every SDK language, blocking until both execd and the Jupyter kernel gateway are verified ready.
   • Adds preStart and periodic lifecycle hooks to sandbox create requests (OSEP-0020), validated server-side and serialized into a reserved environment variable for Kubernetes workloads; preStart.timeoutSeconds limit raised to 10800 seconds.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠
   • Adds opt-in PostgreSQL snapshot store with pooled connections and CAS semantics, plus the one-shot migrate-snapshots command for moving existing SQLite records, and multi-process HA coordination for snapshot create/recovery/delete on Kubernetes.
   • Adds [egress.resources] config key for independent resource requests/limits on the Kubernetes egress sidecar.
   • Adds [egress] otlp_endpoint config key so the egress sidecar exports metrics to an OpenTelemetry collector on both runtimes.
   • Adds [egress] timeout_seconds config key to make egress sidecar readiness wait configurable.

   +10 more show less

   • Adds [proxy] resolve_internal config key to make the reverse proxy's internal resolution configurable for deployments that cannot route to Docker bridge IPs.
   • Adds sandbox_env and sandbox_binds Docker-runtime-wide configuration keys, giving Docker parity with the Kubernetes pod template for fleet-wide CA bundles, proxies, and mounts.
   • Injects OPENSANDBOX_EGRESS_SANDBOX_ID server-side so egress sidecar telemetry can no longer be spoofed by request environment variables.
   • Adds a stable, scoped diagnostics API with logs:container|all and events:runtime|lifecycle|all scopes, returning 400 DIAGNOSTICS_SCOPE_UNSUPPORTED for unknown scopes and backward-compatible plain-text responses.
   • Adds the FastPath fleets lifecycle backend: create, renew, delete, and status mapping via FastPath v2, plus end-to-end fast-sandbox pause/resume with async 202 semantics and UID fencing.
   • Adds fast-sandbox snapshot support and fsb template management across all five SDKs.
   • Exports generic HTTP request metrics (request rate, error rate, latency) from the server over OTLPOTLPOpenTelemetry Protocol, a standard way to send traces, metrics and logs between applications, collectors and monitoring systems. It lets telemetry move across compatible tools., complementing the SDK-reported create-duration histogram.
   • Rejects unsupported gVisorgVisorA user-space kernel written in Go by Google that intercepts and handles system calls on behalf of a container, sandboxing it without needing a full VM. (runsc) snapshots before persistence with 409 SNAPSHOT::UNSUPPORTED_RUNTIME.
   • Honors image.auth in create requests for the agent-sandbox provider with per-sandbox pull secrets garbage-collected with the Sandbox CR.
   • Adds sandbox lifecycle hook models (OSEP-0020) to the API spec and every SDK with consistent validation aligned to server ranges.

   3 more in Everything

   └──▷ BREAKING ON UPGRADE

   • !The agent-sandbox provider and ingress informer migrate to agents.x-k8s.io/v1beta1agents.x-k8s.io/v1beta1A Kubernetes API group version for the CAPI (Cluster API) Agents provider, maintained under the x-k8s.io experimental namespace, letting cyber tools manage cluster infrastructure lifecycle via standard Kubernetes custom resources. (required by agent-sandbox v1.0.0), creating workloads with operatingMode: Running and service: true; existing workloads using the prior API version will break.
   • !The informer_enabled flag is removed; the informer-backed cache is now the only Kubernetes read path and the flag can no longer be used to disable it.
6. server/v0.2.3 Aug 26, 2026 · issue 058

   OpenSandbox v0.2.3 adds sandbox lifecycle hooks, QEMUQEMUAn open-source machine emulator and virtualizer that lets software run a guest OS or CPU architecture on a different host, giving cyber tools an isolated, inspectable execution environment without dedicated hardware. VMState pause/resume, pool exhaustion signaling, OTLPOTLPOpenTelemetry Protocol, a standard way to send traces, metrics and logs between applications, collectors and monitoring systems. It lets telemetry move across compatible tools. HTTP metrics, and secure-access key injection from Kubernetes Secrets.

   └──▷ GET THIS VERSION

   copy

   $ git clone --branch server/v0.2.3 https://github.com/opensandbox-group/OpenSandbox.git
   # already have the repo? check out this version:
   $ git checkout server/v0.2.3

   └──▷ USE IT
   Keep signing-key material out of Git by pointing the Helm chart at an existing Kubernetes Secret instead of committing plaintext keys.
   values.yaml copy

   server:
     gateway:
       secureAccess:
         existingSecret: opensandbox-signing-keys

   Apply fleet-wide environment variables and a host bind mount to every Docker sandbox so operators can inject shared config without touching each request.
   toml copy

   [docker]
   sandbox_env = { "LOG_LEVEL" = "info", "REGION" = "us-east-1" }
   sandbox_binds = ["/etc/ssl/certs:/etc/ssl/certs:ro"]

   Tune how long the server waits for pool allocation before returning a machine-identifiable 429, and increase the egress sidecar readiness window for slower Docker hosts.
   toml copy

   [kubernetes]
   pool_acquisition_timeout_seconds = 60
   
   [egress]
   timeout_seconds = 60

   • Adds kubernetes.pool_acquisition_timeout_seconds config key (default 30s) so the server waits a bounded window on pool exhaustion, then returns HTTP 429 with KUBERNETES::POOL_CAPACITY_EXHAUSTED and Retry-After: 5 instead of a generic 504.
   • Accepts OPENSANDBOX_SECURE_ACCESS_KEYS and OPENSANDBOX_SECURE_ACCESS_ACTIVE_KEY env overrides for secure-access signing keys; Helm chart adds server.gateway.secureAccess.existingSecret (mutually exclusive with plaintext keys) so GitOpsGitOpsA practice where Git repositories serve as the single source of truth for infrastructure and application state, with automated systems continuously reconciling live environments to match what is declared in version control. flows never commit key material.
   • New [docker] config fields sandbox_env and sandbox_binds apply fleet-wide environment variables and host bind mounts to every Docker sandbox container (request env wins over sandbox_env; config binds precede request-derived binds).
   • New [egress] timeout_seconds config key (default 30s; non-positive values rejected) lets Docker deployments tune how long the server waits for the sidecar health endpoint.
   • Experimental OPENSANDBOX_EGRESS_MITMPROXY_EXTRA_PORTS env var appends extra TCPTCPA network protocol that delivers a reliable, ordered stream of bytes between two endpoints. It detects lost data and retransmits it. ports to the always-on 80/443 interception list (multiport cap of 15) for the egress transparent MITM.

   +9 more show less

   • Adds sandbox lifecycle hooks via CreateSandboxRequest.lifecycle (preStart / periodic types per OSEP-0020), transported to Kubernetes workloads via the reserved OPEN_SANDBOX_LIFECYCLE env; Docker explicitly rejects lifecycle requests.
   • Raises preStart.timeoutSeconds server and OpenAPIOpenAPIA vendor-neutral specification for describing REST APIs in a machine-readable format, maintained by the OpenAPI Initiative. Cyber tools use it to auto-generate clients, documentation, and validation from a single source of truth. limit from 300s to 10800s (3 hours); the periodic limit stays at 300s.
   • Adds QEMU VMState pause/resume for runc-based sandboxes: opt-in capture of guest memory, vCPU, and device state via QMP migration, stored as separate OCIOCIOpen Container Initiative standard, maintained by the Linux Foundation, defining the image format and runtime spec that container tools share so images built once run anywhere OCI-compliant. images keyed by immutable SHA-256SHA-256A cryptographic hash function that turns data into a fixed 256-bit fingerprint. It is used to check integrity; hashing does not encrypt the original data. digests; supports pooled BatchSandbox pause, detachment, and standalone restoration.
   • Pool capacity exhaustion is now machine-identifiable: controller publishes a PoolAllocationPending / PoolCapacityExhausted condition.
   • getSandbox now surfaces an optional Sandbox.allocation block (mode: pool, poolRef, state: allocated) for confirmed Kubernetes pool allocations.
   • Adds generic HTTP request metrics via OTLP: a thin ASGIASGIA Python async web server interface specification that defines how servers and applications exchange HTTP and WebSocket messages; cyber tools use it to serve high-concurrency APIs without blocking on I/O. middleware exports server.http.request.duration (ms) with http_method, http_route, and http_status_code attributes; no-op when [otel] is disabled.
   • Diagnostics API now honors scopes: logs: container|all and events: runtime|lifecycle|all, with 400 DIAGNOSTICS_SCOPE_UNSUPPORTED for unknown scopes; deprecated no-scope responses still work with a Deprecation header.
   • Adds a FastPath v2 gRPCgRPCAn open-source remote procedure call framework from Google that uses HTTP/2 and Protocol Buffers to let services call each other's functions across a network, giving tools low-latency, strongly typed inter-process communication. client wrapping all FastPathService RPCs with typed error mapping (FastPathNotFound → 404, etc.) as groundwork for fast-sandbox fleets backend (OSEP-0007); not yet wired as an active runtime.
   • Tenant namespaces are validated at startup (OSEP-0014): server fail-fast verifies every tenant namespace exists and is accessible, aggregating all failures into a single fatal error before serving traffic.

   14 details in Everything

   └──▷ BREAKING ON UPGRADE

   • !OPENSANDBOX_EGRESS_SANDBOX_ID is now server-injected and removed from the env allowlist; requests that pass it in env receive HTTP 400 instead of a user-spoofable value.
7. docker/execd/1.1.0 Aug 26, 2026 · issue 058

   OpenSandbox execd 1.1.0 adds init-mode PID 1, pre-exec hardening with seccomp/Landlock, eBPFeBPFA Linux technology for running verified programs inside the kernel without changing its source. Tools use it to observe processes, enforce rules and process network traffic. audit, and lifecycle hooks

   └──▷ GET THIS VERSION

   copy

   $ git clone --branch docker/execd/1.1.0 https://github.com/opensandbox-group/OpenSandbox.git
   # already have the repo? check out this version:
   $ git checkout docker/execd/1.1.0

   └──▷ TRY IT
   Run execd as PID 1 in a Docker container to get proper signal forwarding and exit-code propagation for sandboxed workloads.
   copy

   $ docker run -e EXECD_INIT=1 opensandbox/execd:v1.1.0

   Inspect the per-layer hardening state of a running sandbox to verify seccomp, no_new_privsno_new_privsA Linux process flag, set via `prctl()`, that prevents a process or its children from gaining elevated privileges through `setuid` binaries or file capabilities, limiting exploit escalation paths., and Landlock are active.
   copy

   $ curl -s GET https://<host>/v1/isolated/capabilities | jq '.hardening'

   Configure a preStart hook and a periodic health check for a sandbox, pointing execd at a custom lifecycle config file.
   copy

   $ EXECD_LIFECYCLE_CONFIG=/etc/sandbox/lifecycle.toml execd

   • Enables execd to run as PID 1 via EXECD_INIT=1 (or server-side runtime.execd_run_as_init), providing a single reaper with signal forwarding (TERM/HUP/USR1/USR2/WINCH), entrypoint-owned exit-code propagation, and a subreaper fallback for the Pool path; classic topology unchanged and off by default.
   • Adds GET /v1/isolated/capabilities response field hardening object reporting per-layer state for the new opensandbox-launcher pre-exec hardening pipeline (env strip → KEEPCAPS → bounding-set trim → no_new_privs → identity drop → seccomp → execve); every layer degrades fail-open.
   • New [landlock] layer in opensandbox-launcher applies a filesystem allowlist; fails open below ABI/kernel 5.13 and reports state as unsupported in the hardening object.
   • Introduces execd-ebpf image variant (CGO + cilium/ebpf) that hooks exec/connect/privilege events via CO-RE, scoped to the sandbox cgroup, and emits a rotating JSONLJSONLA text format where each line is a self-contained, valid JSON object, making it easy to stream, append, and process large datasets line by line without parsing a full JSON array into memory. audit log; requires kernel ≥5.10 with BTFBTFBPF Type Format, a metadata format in the Linux kernel that embeds type and debug information directly into eBPF programs, letting cyber tools inspect kernel structures safely without kernel headers at runtime..
   • Adds preStart and periodic lifecycle hooks via CreateSandboxRequest.lifecycle; config persists at $HOME/.execd/lifecycle.toml with EXECD_LIFECYCLE_CONFIG as an exact override path; hooks are transported internally via OPEN_SANDBOX_LIFECYCLE env (Kubernetes only — Docker provider rejects lifecycle requests).

   +1 more show less

   • OTLPOTLPOpenTelemetry Protocol, a standard way to send traces, metrics and logs between applications, collectors and monitoring systems. It lets telemetry move across compatible tools. egress auto-allow now honors OTEL_EXPORTER_OTLP_METRICS_ENDPOINT and OTEL_EXPORTER_OTLP_ENDPOINT environment variables in shared components.

   6 details in Everything

8. docker/execd/v1.1.0 Aug 26, 2026 · issue 058
   └──▷ GET THIS VERSION

   copy

   $ git clone --branch docker/execd/v1.1.0 https://github.com/opensandbox-group/OpenSandbox.git
   # already have the repo? check out this version:
   $ git checkout docker/execd/v1.1.0

   └──▷ TRY IT
   Enable init-mode to get proper PID-1 signal forwarding and exit-code propagation in a Docker sandbox container.
   copy

   $ docker run -e EXECD_INIT=1 opensandbox/execd:v1.1.0

   Inspect per-layer hardening state (seccomp, landlock, no_new_privsno_new_privsA Linux process flag, set via `prctl()`, that prevents a process or its children from gaining elevated privileges through `setuid` binaries or file capabilities, limiting exploit escalation paths., etc.) reported by the new hardening object to verify the pre-exec floor is active.
   copy

   $ curl -s https://<sandbox-host>/v1/isolated/capabilities | jq '.hardening'

   • Adds EXECD_INIT=1 environment variable to run execd as PID 1 with signal forwarding (TERM/HUP/USR1/USR2/WINCH), entrypoint-owned exit-code propagation, and a subreaper fallback for the Pool path; opt-in via server's runtime.execd_run_as_init for Docker/K8s Batch/Agent/Pool — classic topology unchanged and off by default.
   • Adds CreateSandboxRequest.lifecycle field supporting preStart and periodic lifecycle hooks (OSEP-0020), transported to the sandbox via OPEN_SANDBOX_LIFECYCLE env on Kubernetes; execd starts HTTP before preStart and only releases the user process after preStart succeeds.
   • Adds $HOME/.execd/lifecycle.toml as the persistent config path for lifecycle hooks, with EXECD_LIFECYCLE_CONFIG as an exact-path override; bootstrap sync and preStart shutdown are fail-closed with TERM/KILL watchdogs.
   └──▷ BREAKING ON UPGRADE

   • !The Kubernetes provider transports lifecycle hooks via the internal OPEN_SANDBOX_LIFECYCLE environment variable, which is stripped from user code; the Docker provider rejects lifecycle requests entirely — workloads relying on Docker-side lifecycle hooks will receive errors.
9. python/sandbox/v0.1.16 Aug 26, 2026 · issue 057

   OpenSandbox v0.1.16 adds retry transport with RetryPolicy, sandbox lifecycle hooks, background runs in isolated sessions, and pool capacity back-pressure signaling.

   └──▷ GET THIS VERSION

   copy

   $ git clone --branch python/sandbox/v0.1.16 https://github.com/opensandbox-group/OpenSandbox.git
   # already have the repo? check out this version:
   $ git checkout python/sandbox/v0.1.16

   └──▷ USE IT
   Register a preStart hook when creating a sandbox to run initialisation logic before the sandbox becomes ready.
   python copy

   from opensandbox import Sandbox
   
   sandbox = Sandbox.create(
       preStart={"command": ["./init.sh"], "timeout": 30}
   )

   • Adds configurable retry transport to async and sync clients with backoff, jitter, Retry-After handling, per-attempt timeouts, and an overall deadline; opt out with RetryPolicy.disabled() to restore previous fast-fail behavior. Retries are on by default for idempotent requests on HTTP 429, 502, and 503; streaming SSESSEServer-Sent Events, a browser API and HTTP-based protocol where a server pushes a stream of text events to a client over a single long-lived connection, giving tools a lightweight alternative to WebSockets for one-way real-time updates. requests bypass replay.
   • Adds preStart and periodic lifecycle hook parameters to Sandbox.create and SandboxSync.create, with server-authoritative timeout validation.
   • Enables isolated sessions to start detached background runs, poll run status, and retrieve incremental combined output; read-only workspaces reject background execution because they cannot persist run logs.
   • Exposes confirmed Pool allocation summaries in sandbox responses and adds execd init mode and hardening-layer state fields to isolated capabilities; fields are absent when the server cannot confirm the state.
   • Surfaces exhausted Kubernetes Pool capacity as HTTP 429 with error code KUBERNETES::POOL_CAPACITY_EXHAUSTED and a Retry-After header instead of a generic readiness timeout; sandbox creation is not automatically replayed on this status.

   +1 more show less

   • Bounded concurrency for idle sandbox pool cleanup cuts 100-sandbox release time from approximately 8.3 seconds to 0.8 seconds.

   6 details in Everything

10. java/sandbox/v1.0.19 Aug 25, 2026 · issue 056

    OpenSandbox v1.0.19 adds async pool warmup with OpenTelemetryOpenTelemetryAn open standard and set of tools for collecting traces, metrics and logs from applications. It lets services export observability data without tying instrumentation to one monitoring vendor. tracing, lifecycle hooks, detached session runs, and richer runtime metadata.

    └──▷ GET THIS VERSION

    copy

    $ git clone --branch java/sandbox/v1.0.19 https://github.com/opensandbox-group/OpenSandbox.git
    # already have the repo? check out this version:
    $ git checkout java/sandbox/v1.0.19

    • Enables OpenTelemetry tracing for pool warmup phases via ConnectionConfig.enableTracing(true), covering queue wait and every warmup stage using the application's global SDK, exporter, sampler, and propagators.
    • Exposes Sandbox.allocation summary for confirmed Kubernetes Pool allocations as optional runtime metadata in the SDK.
    • Adds preStart and periodic lifecycle hook models accepted at sandbox creation time.
    • Adds shared OkHttp connection pool ownership in SandboxPool, sized from warmupConcurrency, reused across warmup, acquire, and direct-create paths, and evicted on shutdown.
    • Supports detached background runs inside persistent isolated sessions for Kotlin consumers, with incremental log polling bounded by session lifetime.

    +2 more show less

    • Models execd hardening capability results as part of richer runtime metadata exposed in the SDK.
    • Stages pool refill into a separate async pipeline covering create, readiness, prepare, post-prepare health checking, renewal, and commit, with per-pool rate-limited create admission via warmupCreateQps.

    7 details in Everything

    └──▷ BREAKING ON UPGRADE

    • !SandboxPool.Builder.reconcileInterval(...) and the corresponding PoolConfig setting have been removed; pool reconciliation now runs on a fixed one-second cadence. Callers must delete all uses of reconcileInterval with no replacement.
11. docker/egress/v1.1.7 Aug 21, 2026 · issue 053

    Egress sidecar now auto-allows its own OTLPOTLPOpenTelemetry Protocol, a standard way to send traces, metrics and logs between applications, collectors and monitoring systems. It lets telemetry move across compatible tools. metric export endpoint via OTEL_EXPORTER_OTLP_METRICS_ENDPOINT or OTEL_EXPORTER_OTLP_ENDPOINT.

    └──▷ GET THIS VERSION

    copy

    $ git clone --branch docker/egress/v1.1.7 https://github.com/opensandbox-group/OpenSandbox.git
    # already have the repo? check out this version:
    $ git checkout docker/egress/v1.1.7

    └──▷ USE IT
    Point the egress sidecar at your OTLP collector so metric export is never blocked by the deny-all policy, without writing a manual allow rule.
    .env copy

    OTEL_EXPORTER_OTLP_METRICS_ENDPOINT=https://otel-collector.internal:4318/v1/metrics

12. docker/execd/v1.0.22 Aug 13, 2026 · issue 047

    OpenSandbox execd v1.0.22 adds background runs, read-only PTY viewers, SDK attach(), and uid_mode probing

    └──▷ GET THIS VERSION

    copy

    $ git clone --branch docker/execd/v1.0.22 https://github.com/opensandbox-group/OpenSandbox.git
    # already have the repo? check out this version:
    $ git checkout docker/execd/v1.0.22

    └──▷ TRY IT
    Submit a long-running job in the background and poll its status without holding an open connection.
    copy

    $ # Start a background run
    curl -X POST https://execd/run \
      -H 'Content-Type: application/json' \
      -d '{"background": true, "command": "python train.py"}'
    
    # Poll status using the returned runId
    curl https://execd/runs/<runId>
    
    # Stream logs
    curl https://execd/runs/<runId>/logs

    Reconnect to an existing session from SDK code after a worker restart, without needing the original session object.
    python copy

    session = client.attach(sessionId)

    • Adds background: true to the run API, returning a JSON handle; new runs/{runId} and runs/{runId}/logs endpoints enable status polling for long-running sessions without blocking the caller.
    • Adds ?mode=viewer query parameter to PTY sessions, letting multiple read-only clients watch a live PTY alongside the exclusive holder, with replay, live output, and backpressure isolation.
    • Adds attach(sessionId) to all five SDKs, rebuilding a fully functional session handle from a bare session ID (e.g. after a worker restart); SessionState now echoes creation parameters.
    • Adds uid_mode availability probing: execd independently probes setpriv/userns support and returns 503 NOT_SUPPORTED for unavailable isolation modes instead of failing all isolation globally.
    • Private-network sessions with share_net: false now bind-pin the workload NetNS/UserNS and return a retryable 503 on failure, failing closed at startup.

    5 details in Everything

    └──▷ BREAKING ON UPGRADE

    • !share_net: false sessions now fail closed at startup: execd must successfully bind-pin the workload NetNS/UserNS or it returns a retryable 503; previously, failure did not block session creation.
13. docker/egress/v1.1.6 Aug 11, 2026 · release notes

    OpenSandbox egress v1.1.6 adds Prometheus failure counters for DNS and nftables updates

    └──▷ GET THIS VERSION

    copy

    $ git clone --branch docker/egress/v1.1.6 https://github.com/opensandbox-group/OpenSandbox.git
    # already have the repo? check out this version:
    $ git checkout docker/egress/v1.1.6

    └──▷ USE IT
    Configure the egress service to write combined mitmproxy logs to a file via rotation.
    shell copy

    export OPENSANDBOX_LOG_OUTPUT=file

    • egress.dns.query.failed_total{reason} Prometheus counter for DNS resolution failures (values: no_upstreams, upstream_error, empty_response, rcode)
    • egress.nftables.updates.failed_total{operation} Prometheus counter for nftables dynamic allow-set update failures
    • mitmproxy and credential-proxy logs printed via ctx.log are now piped into the egress zap log sink

    3 details in Everything

14. java/sandbox/v1.0.18 Aug 6, 2026 · release notes

    OpenSandbox v1.0.18 adds configurable retry policies and rolling pool warmups to the Kotlin SDK

    └──▷ GET THIS VERSION

    copy

    $ git clone --branch java/sandbox/v1.0.18 https://github.com/opensandbox-group/OpenSandbox.git
    # already have the repo? check out this version:
    $ git checkout java/sandbox/v1.0.18

    └──▷ USE IT
    Disable automatic retries to restore previous SDK policy behavior for idempotent calls.
    code copy

    .retryPolicy(RetryPolicy.disabled())

    • Adds RetryPolicy configuration with bounded exponential backoff, jitter modes, and per-attempt timeouts for non-streaming calls.
    • Changes automatic retry behavior: idempotent methods now retry 429, 502, and 503 by default; use .retryPolicy(RetryPolicy.disabled()) to revert.
    • Enables rolling pool warmups via warmupConcurrency to prevent single slow creation from stalling the rest of the refill wave.

    3 details in Everything

15. docker/egress/v1.1.5 Jul 27, 2026 · release notes

    OpenSandbox Egress v1.1.5 adds OPENSANDBOX_EGRESS_MITMPROXY_EXTRA_PORTS to intercept TCPTCPA network protocol that delivers a reliable, ordered stream of bytes between two endpoints. It detects lost data and retransmits it. ports beyond 80/443.

    └──▷ GET THIS VERSION

    copy

    $ git clone --branch docker/egress/v1.1.5 https://github.com/opensandbox-group/OpenSandbox.git
    # already have the repo? check out this version:
    $ git checkout docker/egress/v1.1.5

    └──▷ TRY IT
    Intercept and log traffic on a non-standard port (e.g. 8443 or 9000) alongside the default 80/443 — useful when sandbox workloads communicate with internal services on custom TLS ports.
    copy

    $ OPENSANDBOX_EGRESS_MITMPROXY_EXTRA_PORTS=8443,9000 docker run opensandbox/egress:v1.1.5

16. sdks/sandbox/go/v1.0.5 Jul 24, 2026 · release notes

    OpenSandbox Go v1.0.5 adds session attach, isolated bind mounts, metrics, retry policies, and snapshot filtering.

    └──▷ GET THIS VERSION

    copy

    $ git clone --branch sdks/sandbox/go/v1.0.5 https://github.com/opensandbox-group/OpenSandbox.git
    # already have the repo? check out this version:
    $ git checkout sdks/sandbox/go/v1.0.5

    └──▷ USE IT
    Configure sandbox pool acquisition to retry on stale connections before creating a new session.
    yaml copy

    AcquirePolicyRetryNextIdle
    MaxAcquireRetries: 3

    Disable telemetry metrics in your environment if the lifecycle server is unavailable or unsupported.
    shell copy

    export OPENSANDBOX_DISABLE_METRICS=1

    • AcquirePolicyRetryNextIdle and AcquirePolicyRetryNextIdleThenCreate sandbox pool acquire policies with a configurable MaxAcquireRetries defaulting to 3
    • OPENSANDBOX_DISABLE_METRICS=1 environment variable to disable the new fire-and-forget sandbox.create latency metrics for Sandbox.Create
    • session_id parameter on Attach to recover an existing isolated session handle in stateless workers
    • Exact name filter for snapshot listing
    • Explicit bind mounts and active session listing API for isolated sessions

    +1 more show less

    • Placeholder substitution opt-in for request matching across path, query, header, and body surfaces in credential vault config

    6 details in Everything

17. csharp/sandbox/v0.1.5 Jul 24, 2026 · release notes

    OpenSandbox v0.1.5 adds isolated session bind mounts, attach to live sessions, and credential vault placeholders.

    └──▷ GET THIS VERSION

    copy

    $ git clone --branch csharp/sandbox/v0.1.5 https://github.com/opensandbox-group/OpenSandbox.git
    # already have the repo? check out this version:
    $ git checkout csharp/sandbox/v0.1.5

    └──▷ USE IT
    Reattach to a running isolated session using its ID for stateless worker resilience
    csharp copy

    var handle = await client.AttachAsync(existingSessionId);

    • Adds OPENSANDBOX_DISABLE_METRICS environment variable and DisableMetrics config key to control sandbox create metrics reporting
    • Adds OPEN-SANDBOX-CLIENT-IP HTTP header injection for host intranet IPv4 addresses
    • Adds AttachAsync(sessionId) method to rebuild handles for existing isolated sessions
    • Exposes per-mode setpriv / userns availability in isolated session responses with 503 error for unavailable modes
    • Adds exact name filter support for snapshot listing

    +2 more show less

    • Adds explicit bind mounts and SDK-exposed listing for isolated sessions
    • Adds credential vault placeholder substitutions for path, query, header, and body surfaces

    7 details in Everything

18. js/sandbox/v0.1.11 Jul 24, 2026 · release notes

    New Sandbox.create metrics, isolated session binding/listing, and credential vault placeholder substitution

    └──▷ GET THIS VERSION

    copy

    $ git clone --branch js/sandbox/v0.1.11 https://github.com/opensandbox-group/OpenSandbox.git
    # already have the repo? check out this version:
    $ git checkout js/sandbox/v0.1.11

    └──▷ USE IT
    Disable metric reporting for Sandbox.create latency events to reduce network overhead.
    shell copy

    OPENSANDBOX_DISABLE_METRICS=1 node -e "const sb = require('opensandbox'); new sb.Sandbox().create()"

    Attach to an existing isolated session using its session ID.
    code copy

    sandbox.isolation.attach('existing-session-id')

    Use credential vault placeholders in request matching to substitute dynamic auth data.
    code copy

    // Request matching with placeholders
    const match = await vault.match({
      body: '{"token": "{{VAULT_AUTH_TOKEN}}"}'
    });

    • Adds OPENSANDBOX_DISABLE_METRICS environment variable to disable fire-and-forget latency reporting for Sandbox.create.
    • SDK detects host intranet IPv4 and sends it as OPEN-SANDBOX-CLIENT-IP header, preserving user-provided values.
    • sandbox.isolation.attach(sessionId) reconstructs handles for existing execd isolated sessions.
    • Isolated session responses now expose per-mode setpriv / userns availability; unavailable modes fail with 503 NOT_SUPPORTED.
    • Snapshot listing now supports an exact name filter parameter.

    +2 more show less

    • Isolated sessions accept explicit bind mounts and the SDK exposes a new session listing capability for active sessions.
    • Credential vault request matching now supports opt-in placeholders for path, query, header, and body surfaces including passthrough auth bindings.

    7 details in Everything

19. python/sandbox/v0.1.15 Jul 24, 2026 · release notes

    OpenSandbox v0.1.15 adds isolation attach, UID mode detection, and snapshot filtering to the Python SDK

    └──▷ GET THIS VERSION

    copy

    $ git clone --branch python/sandbox/v0.1.15 https://github.com/opensandbox-group/OpenSandbox.git
    # already have the repo? check out this version:
    $ git checkout python/sandbox/v0.1.15

    └──▷ TRY IT
    Skip stale idle pool members before falling back to direct create for lower latency.
    copy

    $ python -c "
    from opensandbox.pool import Pool
    pool = Pool(acquire_policy='RETRY_NEXT_IDLE')
    session = await pool.acquire()
    "

    Rebuild a handle for an in-memory isolated session from a stateless worker.
    copy

    $ python -c "
    import asyncio
    from sandbox import Sandbox
    async def main():
        session_id = 'sess-abc'
        handle = await Sandbox.isolation.attach(session_id)
        print(handle.state)
    "
    "

    • RETRY_NEXT_IDLE and RETRY_NEXT_IDLE_THEN_CREATE policies for pool acquire allow skipping stale idle candidates before falling back or failing; max_acquire_retries defaults to 3.
    • Sandbox.create (async/sync) reports fire-and-forget latency events to the lifecycle server, controllable via OPENSANDBOX_DISABLE_METRICS=1.
    • SDK now sends host intranet IPv4 as OPEN-SANDBOX-CLIENT-IP header on outbound requests; detection is cached and respects user-provided values.
    • sandbox.isolation.attach(session_id) lets stateless workers rebuild a handle for an existing execd isolated session.
    • Isolated session responses expose per-mode setpriv/userns availability; unavailable modes fail with 503 NOT_SUPPORTED.

    +2 more show less

    • Snapshot listing now supports exact name filter.
    • Sandbox.destroy() and SandboxSync.destroy() perform remote termination plus local cleanup, preserving original exception if kill() fails.

    7 details in Everything

20. java/sandbox/v1.0.17 Jul 24, 2026 · release notes

    OpenSandbox v1.0.17 adds session attachment API, sandbox metrics toggle, and client IP header support

    └──▷ GET THIS VERSION

    copy

    $ git clone --branch java/sandbox/v1.0.17 https://github.com/opensandbox-group/OpenSandbox.git
    # already have the repo? check out this version:
    $ git checkout java/sandbox/v1.0.17

    └──▷ USE IT
    Recover a session handle from an idle worker without reconnecting
    text copy

    isolation.attach('<existing_session_id>')

    Filter snapshot listing by a specific name using the new exact filter
    copy

    $ GET /rest/snapshots?name='<snapshot_name>'

    • isolation.attach(sessionId) allows stateless workers to rebuild a handle for an existing execd isolated session.
    • New RETRY_NEXT_IDLE and RETRY_NEXT_IDLE_THEN_CREATE pool acquire policies skip stale idle candidates; maxAcquireRetries defaults to 3.
    • Sandbox.create latency events sent as fire-and-forget sandbox.create; controllable via OPENSANDBOX_DISABLE_METRICS=1 or disableMetrics.
    • SDK detects host intranet IPv4 and sends it in the OPEN-SANDBOX-CLIENT-IP header for session requests.
    • Isolated session responses now expose per-mode setpriv / userns availability; unavailable modes return 503 NOT_SUPPORTED.

    +1 more show less

    • Snapshot listing supports exact name filter parameter.

    6 details in Everything

21. server/v0.2.2 Jul 20, 2026 · release notes

    OpenSandbox v0.2.2 adds multi-tenancy providers, sandbox.create metrics, and snapshot name filtering

    └──▷ GET THIS VERSION

    copy

    $ git clone --branch server/v0.2.2 https://github.com/opensandbox-group/OpenSandbox.git
    # already have the repo? check out this version:
    $ git checkout server/v0.2.2

    └──▷ TRY IT
    Record sandbox creation latency as an OTELOTELAn open standard and set of tools for collecting traces, metrics and logs from applications. It lets services export observability data without tying instrumentation to one monitoring vendor. histogram via the new metrics endpoint.
    copy

    $ curl -X POST 'https://<server>/v1/metrics/events' \  -H 'Content-Type: application/json' \  -d '{"event": "MetricsEvent", "payload": {"type": "opensandbox.sandbox.create.duration", "value": 120}}'

    Filter snapshots by exact name using the API query parameter.
    copy

    $ curl 'https://<server>/v1/snapshots?name=my-snapshot-01'

    • [egress] mode = "dns+nft" required; DNS-only egress no longer carries credential-bound traffic.
    • New multi-tenancy provider with file and HTTP backends isolates sandboxes per tenant via K8s namespaces.
    • New POST /v1/metrics/events endpoint accepts fire-and-forget MetricsEvent payloads, recording latency as OTEL histogram opensandbox.sandbox.create.duration.
    • CreateSandboxResponse, getSandbox, and listSandboxes now return opensandbox.extensions.* values.
    • New optional name query parameter on GET /snapshots for exact-name filtering with pagination support.

    +3 more show less

    • [docker] port_range_min and port_range_max config fields narrow host-port allocation (defaults 40000-60000).
    • OPENSANDBOX_EGRESS_POLICY_FILE and OPENSANDBOX_EGRESS_SANDBOX_ID env vars allowlisted for sandbox creates.
    • bootstrap.sh now discovers every JDK and imports the egress MITM CA into each cacerts via keytool.

    8 details in Everything

    └──▷ BREAKING ON UPGRADE

    • !Credential Vault requires [egress] mode = "dns+nft"; DNS-only egress can no longer carry credential-bound traffic.
    • !OPENSANDBOX_EGRESS_CREDENTIAL_VAULT_TRUSTED_PROXY_CIDRS env var added for trusted proxy addresses; X-Forwarded-Proto no longer trusted by default by the server proxy.
    • !OPENSANDBOX_EGRESS_MITMPROXY_SCRIPT removed from the env allowlist; requests carrying it are now rejected.
    • !Sandbox pods no longer mount a service-account token (kubernetes.service_account config removed and automountServiceAccountToken: false set).
22. java/code-interpreter/v1.0.16 Jul 13, 2026 · release notes

    OpenSandbox v1.0.16 SDK adds runOnce/withSession isolation, bind mounts, credential vault placeholders, and session list/destruct endpoints.

    └──▷ GET THIS VERSION

    copy

    $ git clone --branch java/code-interpreter/v1.0.16 https://github.com/opensandbox-group/OpenSandbox.git
    # already have the repo? check out this version:
    $ git checkout java/code-interpreter/v1.0.16

    • com.alibaba.opensandbox:sandbox artifact now includes runOnce and withSession isolation modes via the sandbox SDK 1.0.16
    • Added support for listing isolated sessions and destroying the sandbox pool in the updated SDK dependencies

    2 details in Everything

23. python/sandbox/v0.1.14 Jul 13, 2026 · release notes

    OpenSandbox v0.1.14 adds isolation lifecycle APIs, isolated bind mounts, session listing, and credential vault placeholders

    └──▷ GET THIS VERSION

    copy

    $ git clone --branch python/sandbox/v0.1.14 https://github.com/opensandbox-group/OpenSandbox.git
    # already have the repo? check out this version:
    $ git checkout python/sandbox/v0.1.14

    └──▷ USE IT
    Run code in an isolated sandbox and automatically clean up resources afterward.
    python copy

    from opensandbox.isolation import run_once
    
    run_once(code="print('hello')", workspace='/tmp/output')

    Mount host directories into an isolated session with read-write access.
    python copy

    from opensandbox.isolation import CreateIsolatedSessionRequest, BindMount
    
    req = CreateIsolatedSessionRequest(
        binds=[BindMount(source='/host/data', dest='/container/data', readonly=False)]
    )

    List currently active isolated sessions in the sandbox pool.
    python copy

    from opensandbox.isolation import list
    
    sessions = list()

    • sandbox.isolation.run_once() API for one-shot create → run → delete flows
    • async with sandbox.isolation.session(req) context manager for scoped multi-run workflows
    • sandbox.isolation.list() to list isolated sessions
    • CreateIsolatedSessionRequest.binds accepting BindMount(source, dest, readonly) for host→namespace path mappings and uid_mode support
    • Sandbox pool FORCE-destroy via DESTROYING fence and DESTROYED tombstone in SandboxPoolManager

    +2 more show less

    • Credential Vault placeholder substitutions for path, query, header, and body request surfaces
    • Endpoint cache with inflight dedup, TTLTTLTime to live, a limit on how long data remains valid or how far a packet can travel. Caches use a time limit; IP packets use a hop limit. 600s, MaxSize 1024, configurable via ConnectionConfig

    7 details in Everything

    └──▷ BREAKING ON UPGRADE

    • !CredentialMatch.ports removed; intercept port is derived from scheme (http→80, https→443)
24. java/sandbox/v1.0.16 Jul 13, 2026 · release notes

    OpenSandbox v1.0.16 adds new isolation and credential vault APIs.

    └──▷ GET THIS VERSION

    copy

    $ git clone --branch java/sandbox/v1.0.16 https://github.com/opensandbox-group/OpenSandbox.git
    # already have the repo? check out this version:
    $ git checkout java/sandbox/v1.0.16

    • isolation.runOnce(code, workspace, ...) and isolation.withSession(req) { ... } for one-shot and scoped sessions with guaranteed cleanup
    • sandbox.isolation().list() to list isolated sessions
    • CreateIsolatedSessionRequest.binds accepts BindMount(source, dest, readonly) for arbitrary host-to-namespace mappings; also exposes uidMode
    • Sandbox pool destroy via SandboxPoolManager with DESTROYING fence and DESTROYED tombstone in both in-memory and Redis stores
    • Opt-in credential vault placeholder substitutions for path, query, header, and body (including passthrough bindings)

    +1 more show less

    • The IsolationService interface now declares runOnce and withSession as default methods

    6 details in Everything

    └──▷ BREAKING ON UPGRADE

    • !CredentialMatch.ports removed; intercept port is derived from scheme (http→80, https→443). Drop any .ports(...) calls.
    • !PoolStateStoreContentionException removed (never actually raised).
25. docker/egress/v1.1.4 Jul 12, 2026 · release notes

    OpenSandbox egress v1.1.4 adds Credential Vault placeholder substitution and a pluggable CredentialSource interface for secret managers.

    └──▷ GET THIS VERSION

    copy

    $ git clone --branch docker/egress/v1.1.4 https://github.com/opensandbox-group/OpenSandbox.git
    # already have the repo? check out this version:
    $ git checkout docker/egress/v1.1.4

    └──▷ USE IT
    Configure the egress sidecar to use DNS-bound credential enforcement instead of direct IP.
    ini copy

    [egress]
    mode = "dns+nft"

    Set the trusted proxy CIDRCIDRA notation for a block of IP addresses, such as 10.0.0.0/24. The number after the slash says how many leading address bits identify the network. list so TLS termination in front of the sidecar passes validation.
    shell copy

    export OPENSANDBOX_EGRESS_CREDENTIAL_VAULT_TRUSTED_PROXY_CIDRS='10.0.0.0/8,172.16.0.0/12'

    • Adds mode = "dns+nft" to [egress] config in .opensandbox/config.yaml to enforce DNS binding for Credential Vault destinations
    • Adds OPENSANDBOX_EGRESS_CREDENTIAL_VAULT_TRUSTED_PROXY_CIDRS environment variable to define trusted IPs/CIDRs for X-Forwarded-Proto validation
    • Removes support for the ports field in Credential Vault binding configs; port is now derived from scheme
    • Enables placeholder substitution for path, query, header, and body surfaces within Credential Vault bindings

    4 details in Everything

    └──▷ BREAKING ON UPGRADE

    • !Credential Vault now requires mode = "dns+nft" in [egress] config; direct-IP connections bypassing DNS are rejected
    • !X-Forwarded-Proto header is no longer trusted unless the client IP is listed in OPENSANDBOX_EGRESS_CREDENTIAL_VAULT_TRUSTED_PROXY_CIDRS; otherwise requests are rejected as non-HTTPSHTTPSHTTP carried over an encrypted TLS connection. It protects traffic in transit and lets a browser verify the server's certificate.
    • !The ports field is removed from Credential Vault binding configs; deployments must regenerate SDK models and remove this field
26. docker/execd/v1.0.21 Jul 12, 2026 · release notes

    OpenSandbox execd v1.0.21 adds isolated sessions API, explicit bind mounts, userns mode, and JDK CA trust

    └──▷ GET THIS VERSION

    copy

    $ git clone --branch docker/execd/v1.0.21 https://github.com/opensandbox-group/OpenSandbox.git
    # already have the repo? check out this version:
    $ git checkout docker/execd/v1.0.21

    └──▷ USE IT
    Create a session with explicit bind mounts using the new binds field.
    json copy

    {
      "session_name": "my-sandbox",
      "binds": [
        {"source": "/host/data", "dest": "/data", "readonly": true},
        {"source": "/host/code", "dest": "/workspace/src", "readonly": false}
      ]
    }

    Enable user namespace mode for identity switching in the session request.
    json copy

    {
      "session_name": "ns-sandbox",
      "uid_mode": "userns"
    }

    • GET /v1/isolated/sessions and list SDK methods return all active isolated sessions.
    • CreateIsolatedSessionRequest accepts binds: [{source, dest, readonly}] for explicit bind mounts.
    • New opt-in uid_mode: "userns" enables user namespace identity switching in bwrap.
    • bootstrap.sh imports the MITM CA into every JDK's cacerts for non-OS-store environments.

    4 details in Everything

27. js/sandbox/v0.1.10 Jul 8, 2026 · release notes

    OpenSandbox v0.1.10 adds directory listing API, line-based file reads, isolation helpers, and credential vault support.

    └──▷ GET THIS VERSION

    copy

    $ git clone --branch js/sandbox/v0.1.10 https://github.com/opensandbox-group/OpenSandbox.git
    # already have the repo? check out this version:
    $ git checkout js/sandbox/v0.1.10

    └──▷ TRY IT
    Read lines 10-20 of a large log file from a sandbox.
    copy

    $ curl 'http://localhost:8080/files/download?path=/var/log/app.log&offset=10&limit=11'

    Scan directory structure in a sandbox without following symlinks.
    copy

    $ curl -s 'http://localhost:8080/execd/directory?path=/app/src&depth=1' | jq '.[].type'

    • Adds execd directory API with depth-controlled traversal (depth) and FileInfo.type field for symlinks
    • Adds offset and limit query parameters to GET /files/download for line-based file reads
    • Adds optional resourceRequests field to sandbox creation for Burstable QoS on Kubernetes-backed sandboxes
    • Adds Credential Vault support to the JS/TS SDK surface including models and egress adapter
    • Adds sandbox.isolation.runOnce() and sandbox.isolation.withSession() convenience helpers

    +2 more show less

    • Adds LRU + TTLTTLTime to live, a limit on how long data remains valid or how far a packet can travel. Caches use a time limit; IP packets use a hop limit. endpoint cache with in-flight request deduplication, tunable via ConnectionConfig
    • Sandbox lifecycle responses now expose opensandbox.extensions.* data

    7 details in Everything

28. csharp/sandbox/v0.1.4 Jul 8, 2026 · release notes

    Adds RunOnceAsync and WithSessionAsync isolation helpers, endpoint caching, and resourceRequests support in OpenSandbox C# SDK v0.1.4

    └──▷ GET THIS VERSION

    copy

    $ git clone --branch csharp/sandbox/v0.1.4 https://github.com/opensandbox-group/OpenSandbox.git
    # already have the repo? check out this version:
    $ git checkout csharp/sandbox/v0.1.4

    └──▷ TRY IT
    Use RunOnceAsync to run a script in an isolated sandbox with guaranteed cleanup.
    copy

    $ await client.Sessions.RunOnceAsync(code: "echo hello", workspace: "/tmp");

    • Adds RunOnceAsync(code, workspace, ...) and WithSessionAsync(req, fn) extension methods on IIsolatedSessions to simplify isolated session lifecycle management.
    • Adds LRU + TTLTTLTime to live, a limit on how long data remains valid or how far a packet can travel. Caches use a time limit; IP packets use a hop limit. endpoint caching (ConnectionConfig) with in-flight request deduplication for sandbox endpoints (enabled by default, TTL 600s, max size 1024).
    • Sandbox lifecycle responses now surface opensandbox.extensions.* data via extensions fields in C# SDK response models.
    • Adds optional resourceRequests field to sandbox creation for setting resource requests separately from limits on Kubernetes-backed sandboxes.

    4 details in Everything

    └──▷ BREAKING ON UPGRADE

    • !The credential vault binding no longer carries a Ports field; port is now derived from the scheme (https → 443, http → 80). If your C# code constructs credential vault bindings and sets Match.Ports, remove that field on upgrade.
29. sdks/sandbox/go/v1.0.4 Jul 8, 2026 · release notes

    OpenSandbox Go SDK v1.0.4 adds sandbox pooling, isolation helpers, endpoint caching, and resource requests.

    └──▷ GET THIS VERSION

    copy

    $ git clone --branch sdks/sandbox/go/v1.0.4 https://github.com/opensandbox-group/OpenSandbox.git
    # already have the repo? check out this version:
    $ git checkout sdks/sandbox/go/v1.0.4

    └──▷ USE IT
    Use the isolated helper to run a task with guaranteed cleanup
    code copy

    err := sandbox.IsolationRunOnce(ctx, req, run, handlers)

    • Adds PoolBuilder API for client-side sandbox pooling with leader election, fill-deficit/shrink-excess management, and near-expiry-aware idle reuse
    • Adds optional poolredis sub-module providing RedisPoolStateStore via go-redis v9 for distributed pool state
    • Adds InMemoryPoolStateStore for single-process deployments when using the new sandbox pool
    • Adds sandbox.IsolationRunOnce(ctx, req, run, handlers) helper for create-run-delete lifecycle with guaranteed cleanup
    • Adds sandbox.IsolationWithSession(ctx, req, fn) helper for multi-run isolated workflows with auto-delete on exit

    +1 more show less

    • Enables LRU + TTLTTLTime to live, a limit on how long data remains valid or how far a packet can travel. Caches use a time limit; IP packets use a hop limit. endpoint cache with in-flight request deduplication by default (TTL 600s, max size 1024), tunable via ConnectionConfig

    6 details in Everything

    └──▷ BREAKING ON UPGRADE

    • !The credential vault binding match no longer carries a Ports field; port is now derived from the scheme (https → 443, http → 80)
30. docker/ingress/v1.0.9 Jul 5, 2026 · release notes

    OpenSandbox v1.0.9 adds OpenTelemetryOpenTelemetryAn open standard and set of tools for collecting traces, metrics and logs from applications. It lets services export observability data without tying instrumentation to one monitoring vendor. metrics instrumentation with OTLPOTLPOpenTelemetry Protocol, a standard way to send traces, metrics and logs between applications, collectors and monitoring systems. It lets telemetry move across compatible tools./HTTP export

    └──▷ GET THIS VERSION

    copy

    $ git clone --branch docker/ingress/v1.0.9 https://github.com/opensandbox-group/OpenSandbox.git
    # already have the repo? check out this version:
    $ git checkout docker/ingress/v1.0.9

    └──▷ USE IT
    Export OpenSandbox ingress metrics to an OTLP collector (e.g., Jaeger, Zipkin, or Datadog agent) by setting the standard OTELOTELAn open standard and set of tools for collecting traces, metrics and logs from applications. It lets services export observability data without tying instrumentation to one monitoring vendor. exporter environment variables.
    shell copy

    OTEL_EXPORTER_OTLP_ENDPOINT=http://collector:4318 ./opensandbox-ingress

    • Adds OpenTelemetry metrics instrumentation for request count/duration, routing resolution, proxy type counters, system CPUCPUThe main general-purpose processor in a computer. It runs application instructions and coordinates work with memory and other hardware./memory gauges, and active TCPTCPA network protocol that delivers a reliable, ordered stream of bytes between two endpoints. It detects lost data and retransmits it. connection gauge via gopsutil.
    • Enables OTLP/HTTP export of OpenTelemetry metrics with a noop fallback when unconfigured.

    2 details in Everything

31. server/v0.2.1 Jun 29, 2026 · release notes

    OpenSandbox v0.2.1 adds resourceRequests for Burstable QoS and OPENSANDBOX_EGRESS_* env var injection to egress sidecar

    └──▷ GET THIS VERSION

    copy

    $ git clone --branch server/v0.2.1 https://github.com/opensandbox-group/OpenSandbox.git
    # already have the repo? check out this version:
    $ git checkout server/v0.2.1

    └──▷ TRY IT
    Configure Burstable QoS by specifying distinct resource requests in the API payload.
    copy

    $ {
      "metadata": { "name": "test-sandbox" },
      "container": { "image": "alpine", "command": ["sleep", "infinity"] },
      "resourceRequests": {
        "cpu": "50m",
        "memory": "64Mi"
      }
    }

    • Adds resourceRequests field to CreateSandboxRequest API to set Kubernetes resource requests separately from limits, enabling Burstable QoS class sandboxes
    • Enables automatic routing of OPENSANDBOX_EGRESS_* prefixed environment variables in CreateSandboxRequest.env to the egress sidecar container instead of the main sandbox container
    • Adds bubblewrap (bwrap) filesystem isolation layer for execd via new pkg/isolation/ package, with bwrap statically compiled via musl-gcc and injected alongside execd

    3 details in Everything

32. docker/execd/v1.0.20 Jun 29, 2026 · release notes

    OpenSandbox execd v1.0.20 adds bubblewrap-based filesystem isolation with configurable env vars for sandbox command execution

    └──▷ GET THIS VERSION

    copy

    $ git clone --branch docker/execd/v1.0.20 https://github.com/opensandbox-group/OpenSandbox.git
    # already have the repo? check out this version:
    $ git checkout docker/execd/v1.0.20

    • Adds a bubblewrap-based filesystem isolation layer via a new pkg/isolation/ package and the Isolator interface for sandbox command execution.
    • Makes the bwrap binary statically built (musl-gcc) and injects it into the execd container image alongside the binary.
    • Adds environment variable overrides for isolation configuration: upper root, max bytes, diff max bytes, allowed writable.

    3 details in Everything

33. docker/egress/v1.1.3 Jun 29, 2026 · release notes

    OpenSandbox v1.1.3 adds OPENSANDBOX_EGRESS_MITMPROXY_SCRIPT environment variable to load multiple mitmdump addon scripts.

    └──▷ GET THIS VERSION

    copy

    $ git clone --branch docker/egress/v1.1.3 https://github.com/opensandbox-group/OpenSandbox.git
    # already have the repo? check out this version:
    $ git checkout docker/egress/v1.1.3

    └──▷ TRY IT
    Load custom analysis addons for both incoming and outgoing traffic in your sandbox environment.
    copy

    $ export OPENSANDBOX_EGRESS_MITMPROXY_SCRIPT='/scripts/login.py,/scripts/analytics.py'

    • OPENSANDBOX_EGRESS_MITMPROXY_SCRIPT now accepts comma-separated paths, passing each as a separate -s flag to mitmdump

    1 detail in Everything

34. java/sandbox/v1.0.15 Jun 25, 2026 · release notes

    OpenSandbox v1.0.15 adds custom SandboxPool creators and isolated-session SDK APIs.

    └──▷ GET THIS VERSION

    copy

    $ git clone --branch java/sandbox/v1.0.15 https://github.com/opensandbox-group/OpenSandbox.git
    # already have the repo? check out this version:
    $ git checkout java/sandbox/v1.0.15

    • SandboxPool accepts a custom creator function to control sandbox instance construction while retaining pool-level lifecycle management.
    • Kotlin Sandbox SDK exposes models, services, and adapters for creating and deleting isolated execution sessions with isolated filesystem operations.

    2 details in Everything

35. python/sandbox/v0.1.13 Jun 25, 2026 · release notes

    OpenSandbox v0.1.13 adds custom sandbox creators to SandboxPool and isolated session/client APIs.

    └──▷ GET THIS VERSION

    copy

    $ git clone --branch python/sandbox/v0.1.13 https://github.com/opensandbox-group/OpenSandbox.git
    # already have the repo? check out this version:
    $ git checkout python/sandbox/v0.1.13

    • Adds custom_sandbox_creator configuration to SandboxPool for client-side pool management
    • Exposes generated isolated-session and isolated-filesystem clients in the Python SDK

    2 details in Everything

36. java/code-interpreter/v1.0.14 Jun 22, 2026 · release notes

    Adds SandboxManager.waitForSnapshotReady() method and SnapshotState constants for snapshot readiness polling

    └──▷ GET THIS VERSION

    copy

    $ git clone --branch java/code-interpreter/v1.0.14 https://github.com/opensandbox-group/OpenSandbox.git
    # already have the repo? check out this version:
    $ git checkout java/code-interpreter/v1.0.14

    • SandboxManager.waitForSnapshotReady(snapshotId, timeout, pollingInterval) now allows blocking calls until a snapshot reaches the Ready state, replacing manual polling logic.
    • New SnapshotState constants (Creating, Ready, Failed, Deleting, Unknown) are available for state comparison without using magic strings.

    2 details in Everything

37. java/sandbox/v1.0.14 Jun 22, 2026 · release notes

    New SandboxManager.waitForSnapshotReady method and SnapshotState constants

    └──▷ GET THIS VERSION

    copy

    $ git clone --branch java/sandbox/v1.0.14 https://github.com/opensandbox-group/OpenSandbox.git
    # already have the repo? check out this version:
    $ git checkout java/sandbox/v1.0.14

    └──▷ USE IT
    Block execution until a snapshot is ready before proceeding with sandbox operations.
    text copy

    SandboxManager.waitForSnapshotReady(snapshotId, 15, TimeUnit.MINUTES, 2, TimeUnit.SECONDS)

    Check the state of a snapshot using typed constants instead of string literals.
    text copy

    if (snapshot.getState() == SnapshotState.Ready) { /* proceed */ }

    • Adds SandboxManager.waitForSnapshotReady(snapshotId, timeout, pollingInterval) to block until a snapshot reaches Ready state
    • Adds SnapshotState constants (Creating, Ready, Failed, Deleting, Unknown) for state comparison without magic strings

    2 details in Everything

38. docker/ingress/v1.0.8 Jun 22, 2026 · release notes

    Ingress now auto-discovers OTLPOTLPOpenTelemetry Protocol, a standard way to send traces, metrics and logs between applications, collectors and monitoring systems. It lets telemetry move across compatible tools. endpoint via HOST_IP env var or /etc/hostinfo when no exporter endpoint is configured

    └──▷ GET THIS VERSION

    copy

    $ git clone --branch docker/ingress/v1.0.8 https://github.com/opensandbox-group/OpenSandbox.git
    # already have the repo? check out this version:
    $ git checkout docker/ingress/v1.0.8

    • OTEL_EXPORTER_OTLP_METRICS_ENDPOINT and OTEL_EXPORTER_OTLP_ENDPOINT are now optional; ingress defaults to <node-ip>:4318 using HOST_IP (fallback /etc/hostinfo)
    • WebSocketWebSocketA protocol that upgrades an HTTP connection into a persistent, full-duplex channel, letting a server push data to a client without repeated polling. Cyber tools use it for real-time event streaming and live command output. proxy now forwards all headers except hop-by-hop and handshake-specific headers (replacing hardcoded whitelist)

    2 details in Everything

39. docker/egress/v1.1.2 Jun 22, 2026 · release notes

    OpenSandbox egress v1.1.2 adds full policy logging and automatic env var routing to the egress sidecar

    └──▷ GET THIS VERSION

    copy

    $ git clone --branch docker/egress/v1.1.2 https://github.com/opensandbox-group/OpenSandbox.git
    # already have the repo? check out this version:
    $ git checkout docker/egress/v1.1.2

    • OPENSANDBOX_EGRESS_* prefixed environment variables in CreateSandboxRequest.env are now automatically routed to the egress sidecar instead of the main sandbox container, with reserved vars (OPENSANBOX_EGRESS_RULES, OPENSANBOX_EGRESS_MODE, OPENSANBOX_EGRESS_TOKEN) blocked.

    1 detail in Everything

40. java/code-interpreter/v1.0.13 Jun 16, 2026 · release notes

    OpenSandbox v1.0.13 adds paginated file reads and directory listing API

    └──▷ GET THIS VERSION

    copy

    $ git clone --branch java/code-interpreter/v1.0.13 https://github.com/opensandbox-group/OpenSandbox.git
    # already have the repo? check out this version:
    $ git checkout java/code-interpreter/v1.0.13

    └──▷ TRY IT
    Read the last 100 lines of a large log file without downloading the entire content.
    copy

    $ curl -X GET "https://<sandbox-host>/files/download?path=/var/log/app.log&offset=900&limit=100"

    List the top-level directory structure of a workspace, including symlink types.
    copy

    $ curl -X GET "https://<sandbox-host>/execd/directory?path=/workspace&depth=1"

    • Adds offset and limit query parameters to GET /files/download for line-based pagination of large text files
    • Adds a new execd directory API endpoint supporting depth control, entry type reporting (file, directory, symlink, other), and symlink traversal controls

    2 details in Everything

    └──▷ BREAKING ON UPGRADE

    • !Code Interpreter runtime paths have moved from /opt/opensandbox to /opt/code-interpreter. If you hardcoded /opt/opensandbox/code-interpreter.sh, /opt/opensandbox/code-interpreter-env.sh, or /opt/opensandbox/jupyter.log, update them to /opt/code-interpreter/code-interpreter.sh, /opt/code-interpreter/code-interpreter-env.sh, and /opt/code-interpreter/jupyter.log.
41. sdks/sandbox/go/v1.0.3 Jun 16, 2026 · release notes

    OpenSandbox Go SDK v1.0.3 adds credential vault support, directory listing, line-based file reads, and configurable resource requests for sandboxes.

    └──▷ GET THIS VERSION

    copy

    $ git clone --branch sdks/sandbox/go/v1.0.3 https://github.com/opensandbox-group/OpenSandbox.git
    # already have the repo? check out this version:
    $ git checkout sdks/sandbox/go/v1.0.3

    • Adds resourceRequests field to sandbox creation API to set Kubernetes resource requests independently from limits
    • Adds line-based file reads via GET /files/download?offset=<int>&limit=<int> query parameters
    • Adds ListDirectory(ctx, path) and ListDirectoryWithDepth(ctx, path, depth) methods to the Go SDK for directory listing
    • Adds CredentialVault model and adapter support to the Go SDK surface

    4 details in Everything

    └──▷ BREAKING ON UPGRADE

    • !The CodeInterpreterEntrypoint constant now points to /opt/code-interpreter/code-interpreter.sh; if you hardcoded the old path /opt/opensandbox, you must update your configuration or code when upgrading.
42. csharp/sandbox/v0.1.3 Jun 16, 2026 · release notes

    OpenSandbox v0.1.3 adds resourceRequests for Kubernetes sandboxes, line-based file reads via API, directory listing API, replace feedback, and Credential Vault support

    └──▷ GET THIS VERSION

    copy

    $ git clone --branch csharp/sandbox/v0.1.3 https://github.com/opensandbox-group/OpenSandbox.git
    # already have the repo? check out this version:
    $ git checkout csharp/sandbox/v0.1.3

    └──▷ USE IT
    Set resource requests independently from limits when creating a Kubernetes-backed sandbox.
    code copy

    // Existing SDK usage with new `resourceRequests` field
    var sandbox = await client.CreateSandboxAsync(new CreateRequest {
        Resources = new Resources {
            Limits = new ResourceQuota { Cpu = "1", Memory = "512Mi" },
            Requests = new ResourceQuota { Cpu = "0.5", Memory = "256Mi" } // New `resourceRequests` field
        }
    });

    Read a specific range of lines from a large text file using the new offset/limit API.
    api copy

    curl -X GET 'https://sandbox.example.com/files/download?offset=100&limit=10'

    • Adds resourceRequests to sandbox creation so Kubernetes-backed sandboxes can set resource requests separately from limits.
    • Adds line-based file reads through GET /files/download with offset and limit query parameters, enabling C# callers to read large text files by line range.
    • Adds directory listing support through the new execd directory API, with depth-controlled traversal and symlink reporting.
    • Adds detailed replace-content feedback via new methods that return per-file replacedCount results.
    • Adds Credential Vault support to the C# SDK surface.

    5 details in Everything

43. java/sandbox/v1.0.13 Jun 16, 2026 · release notes

    OpenSandbox v1.0.13 adds resourceRequests for sandboxes, offset/limit file download, directory listing API, replace-content feedback, and Credential Vault integration.

    └──▷ GET THIS VERSION

    copy

    $ git clone --branch java/sandbox/v1.0.13 https://github.com/opensandbox-group/OpenSandbox.git
    # already have the repo? check out this version:
    $ git checkout java/sandbox/v1.0.13

    • Adds resourceRequests field to sandbox creation payloads so Kubernetes-backed sandboxes can set resource requests separately from limits (omitting the field preserves existing behavior where requests match limits).
    • Adds offset and limit query parameters to GET /files/download for line-based file reads via the REST APIREST APIA web API design style where clients interact with resources over HTTP using standard methods like GET, POST, and DELETE, giving cyber tools a predictable, language-agnostic way to integrate with external services..
    • Adds directory listing support through the new execd directory API with depth-controlled traversal and symlink handling.
    • Adds detailed replace-content feedback with per-file replacedCount results while keeping existing replace methods backward-compatible.
    • Adds Credential Vault support to the Kotlin/JVMJVMThe Java Virtual Machine, a runtime maintained by Oracle (and implemented by others) that executes Java bytecode on any OS, giving cyber tools a portable, garbage-collected environment with a large ecosystem of libraries. SDK surface, including model, adapter, sandbox creation, and E2E coverage.

    5 details in Everything

44. python/sandbox/v0.1.11 Jun 16, 2026 · release notes

    OpenSandbox v0.1.11 adds resource request configuration, paginated file downloads, directory listing API, replace feedback, and Credential Vault support

    └──▷ GET THIS VERSION

    copy

    $ git clone --branch python/sandbox/v0.1.11 https://github.com/opensandbox-group/OpenSandbox.git
    # already have the repo? check out this version:
    $ git checkout python/sandbox/v0.1.11

    • Adds resourceRequests field to sandbox creation payload so Kubernetes-backed sandboxes can set resource requests separately from limits
    • Adds line-based file reads through GET /files/download with offset and limit query parameters for large text files
    • Adds directory listing support through the execd directory API, exposing depth-controlled traversal in the Python SDK
    • Adds detailed replace-content feedback via a new verbose parameter to detect no-match and multi-match replacements
    • Adds Credential Vault support to the Python SDK path aligned with multi-language coverage for credential injection flows

    5 details in Everything

45. js/sandbox/v0.1.9 Jun 16, 2026 · release notes

    OpenSandbox v0.1.9 adds resource requests, offset file downloads, directory listing and credential vault support

    └──▷ GET THIS VERSION

    copy

    $ git clone --branch js/sandbox/v0.1.9 https://github.com/opensandbox-group/OpenSandbox.git
    # already have the repo? check out this version:
    $ git checkout js/sandbox/v0.1.9

    • Adds resourceRequests field to sandbox creation for Kubernetes-backed sandboxes
    • Adds line-based file reads via GET /files/download with offset and limit query parameters
    • Adds depth-controlled directory traversal through the new execd directory API
    • Adds optional per-file replacedCount feedback in detailed replace methods
    • Adds Credential Vault support to the JavaScript SDK for credential injection

    5 details in Everything

46. docker/egress/v1.1.1 Jun 16, 2026 · release notes

    OpenSandbox v1.1.1 adds OPENSANDBOX_EGRESS_CREDENTIAL_VAULT_REQUIRE_TLS env var to enforce TLS for vault writes

    └──▷ GET THIS VERSION

    copy

    $ git clone --branch docker/egress/v1.1.1 https://github.com/opensandbox-group/OpenSandbox.git
    # already have the repo? check out this version:
    $ git checkout docker/egress/v1.1.1

47. server/v0.2.0 Jun 15, 2026 · release notes

    OpenSandbox v0.2.0 adds a Credential Vault system with CLI commands and SDK surfaces for injecting secrets into sandboxes.

    └──▷ GET THIS VERSION

    copy

    $ git clone --branch server/v0.2.0 https://github.com/opensandbox-group/OpenSandbox.git
    # already have the repo? check out this version:
    $ git checkout server/v0.2.0

    • Introduces the Credential Vault, a new credential injection system that allows sandboxes to consume secrets (API keys, OAuth tokens, HTTP headers, query parameters) without exposing raw values to user code.
    • Adds osb credential-vault CLI commands for managing the Credential Vault from the command line.
    • Exposes SDK surfaces for Python, Go, JS, Kotlin, and Java to interact with the Credential Vault.

    3 details in Everything

    └──▷ BREAKING ON UPGRADE

    • !The execd install path is flattened from /opt/opensandbox/bin/ to /opt/opensandbox/; binary paths like /opt/opensandbox/bin/execd become /opt/opensandbox/execd.
    • !Custom Pool CR templates need updated mountPaths and env vars to reflect the flattened /opt/opensandbox directory structure.
48. docker/execd/v1.0.19 Jun 15, 2026 · release notes

    OpenSandbox execd v1.0.19 adds PTY takeover, one-shot commands, directory/file listing, and OTLPOTLPOpenTelemetry Protocol, a standard way to send traces, metrics and logs between applications, collectors and monitoring systems. It lets telemetry move across compatible tools. auto-discovery.

    └──▷ GET THIS VERSION

    copy

    $ git clone --branch docker/execd/v1.0.19 https://github.com/opensandbox-group/OpenSandbox.git
    # already have the repo? check out this version:
    $ git checkout docker/execd/v1.0.19

    • Adds ?takeover=1 query parameter to GET /pty/:sessionId/ws for live PTY session handoff
    • Adds optional command field to POST /pty for one-shot terminal I/O
    • Adds GET /directories/list endpoint with depth-controlled traversal and type field to FileInfo responses
    • Adds offset and limit query parameters to GET /files/download for line-based file reading
    • Adds replacedCount field to POST /files/replace response for match detection

    +1 more show less

    • Adds OTLP endpoint auto-discovery via HOST_IP env var or /etc/hostinfo when OTELOTELAn open standard and set of tools for collecting traces, metrics and logs from applications. It lets services export observability data without tying instrumentation to one monitoring vendor. exporters are unset

    6 details in Everything

49. docker/egress/v1.1.0 Jun 12, 2026 · release notes

    OpenSandbox egress v1.1.0 adds credential vault injection and moves Mitmproxy config to config.yaml

    └──▷ GET THIS VERSION

    copy

    $ git clone --branch docker/egress/v1.1.0 https://github.com/opensandbox-group/OpenSandbox.git
    # already have the repo? check out this version:
    $ git checkout docker/egress/v1.1.0

    • Egress participates in the credential vault injection pipeline, enabling sandboxes to receive injected credentials (API keys, tokens, OAuth) for outbound requests
    • Mitmproxy static options (mode, listen_host, stream_large_bodies, ssl_verify_upstream_trusted_confdir, ignore_hosts) are now declared in a baked-in config.yaml under the standard mitm confdir layout

    2 details in Everything

    └──▷ BREAKING ON UPGRADE

    • !The environment variable OPENSANDBOX_EGRESS_MITMPROXY_CONFDIR is removed and will break config.yaml discovery if set
    • !The environment variable OPENSANDBOX_EGRESS_MITMPROXY_IGNORE_HOSTS is removed; multi-host lists were silently truncated to the last value, now replaced by the yaml-native list in config.yaml
50. docker/code-interpreter/v1.1.0 Jun 11, 2026 · release notes

    v1.1.0 adds Sigstore/cosign image signing and a seccomp-based clone3 fallback in execd

    └──▷ GET THIS VERSION

    copy

    $ git clone --branch docker/code-interpreter/v1.1.0 https://github.com/opensandbox-group/OpenSandbox.git
    # already have the repo? check out this version:
    $ git checkout docker/code-interpreter/v1.1.0

    • Adds sigstore/cosign keyless signing to Docker images with GitHub attestations for authenticity verification
    • Adds a seccomp-based clone3 fallback to execd that switches to clone when the profile blocks clone3

    2 details in Everything

    └──▷ BREAKING ON UPGRADE

    • !The entrypoint path is renamed from /opt/opensandbox/code-interpreter.sh to /opt/code-interpreter/code-interpreter.sh
51. python/sandbox/v0.1.10 Jun 8, 2026 · release notes

    OpenSandbox v0.1.10 adds skip_accumulation for constant-memory streaming, secure_access for ingress headers, and PVC auto-provisioning SDK support

    └──▷ GET THIS VERSION

    copy

    $ git clone --branch python/sandbox/v0.1.10 https://github.com/opensandbox-group/OpenSandbox.git
    # already have the repo? check out this version:
    $ git checkout python/sandbox/v0.1.10

    • Adds acquire_min_remaining_ttl parameter to pool.acquire() to skip idle sandboxes nearing expiry
    • Adds skip_accumulation option to execution handlers to stream stdout/stderr with constant memory
    • Adds PVC auto-provisioning fields to the SDK model
    • Adds secure_access support for sandbox creation and endpoint access headers in Kubernetes ingress gateway mode

    4 details in Everything

52. sdks/sandbox/go/v1.0.2 Jun 8, 2026 · release notes

    OpenSandbox Go SDK v1.0.2 adds skipAccumulation, platform selection, and SecureAccess support

    └──▷ GET THIS VERSION

    copy

    $ git clone --branch sdks/sandbox/go/v1.0.2 https://github.com/opensandbox-group/OpenSandbox.git
    # already have the repo? check out this version:
    $ git checkout sdks/sandbox/go/v1.0.2

    • Adds skipAccumulation to execution handlers to prevent unbounded memory growth by delivering stdout/stderr events without appending them to accumulated logs
    • Adds CreateSandboxRequest.Platform, SandboxInfo.Platform, and SandboxCreateOptions.Platform fields for specifying OS/architecture targets like Windows
    • Adds SDK model support for PVC auto-provisioning fields
    • Adds SecureAccess support for sandbox creation, currently supported by Kubernetes ingress gateway mode

    4 details in Everything

53. csharp/sandbox/v0.1.2 Jun 8, 2026 · release notes

    OpenSandbox v0.1.2 adds skipAccumulation, PVC auto-provisioning SDK support, and SecureAccess headers

    └──▷ GET THIS VERSION

    copy

    $ git clone --branch csharp/sandbox/v0.1.2 https://github.com/opensandbox-group/OpenSandbox.git
    # already have the repo? check out this version:
    $ git checkout csharp/sandbox/v0.1.2

    • Adds skipAccumulation to execution handlers config to prevent unbounded memory growth for streamed commands
    • Adds SDK model support for PVC auto-provisioning fields
    • Adds opt-in SecureAccess support for sandbox creation and endpoint access headers in Kubernetes ingress gateway mode

    3 details in Everything

54. js/sandbox/v0.1.8 Jun 8, 2026 · release notes

    OpenSandbox v0.1.8 adds skipAccumulation for logs, PVC auto-provisioning fields, and secureAccess headers

    └──▷ GET THIS VERSION

    copy

    $ git clone --branch js/sandbox/v0.1.8 https://github.com/opensandbox-group/OpenSandbox.git
    # already have the repo? check out this version:
    $ git checkout js/sandbox/v0.1.8

    • Adds the skipAccumulation execution handler option to prevent unbounded memory growth during long-running streamed commands
    • Adds SDK model support for Persistent Volume Claim (PVC) auto-provisioning fields
    • Adds secureAccess option for sandbox creation and endpoint access headers in Kubernetes ingress gateway mode

    3 details in Everything

55. java/sandbox/v1.0.12 Jun 8, 2026 · release notes

    OpenSandbox v1.0.12 adds skipAccumulation, PVC auto-provisioning support, and secureAccess with log redaction

    └──▷ GET THIS VERSION

    copy

    $ git clone --branch java/sandbox/v1.0.12 https://github.com/opensandbox-group/OpenSandbox.git
    # already have the repo? check out this version:
    $ git checkout java/sandbox/v1.0.12

    • Duration.ZERO disables the sandbox expiry threshold to control idle pool behavior
    • SDK model support for PVC auto-provisioning fields enables automatic volume claims in sandbox builders
    • secureAccess flag enables endpoint header propagation and log redaction for sandbox builders and pool creation specs

    3 details in Everything

    └──▷ BREAKING ON UPGRADE

    • !Command timeout APIs now use java.time.Duration as the primary public type; kotlin.time.Duration overloads are deprecated
56. docker/egress/v1.0.13 Jun 5, 2026 · release notes

    OpenSandbox egress v1.0.13 adds a DELETE /policy API endpoint and supervisor-based restart reliability.

    └──▷ GET THIS VERSION

    copy

    $ git clone --branch docker/egress/v1.0.13 https://github.com/opensandbox-group/OpenSandbox.git
    # already have the repo? check out this version:
    $ git checkout docker/egress/v1.0.13

    • Adds the DELETE /policy HTTP endpoint to remove egress rules by accepting a JSON array of target strings
    • Introduces a dedicated supervisor process (opensandbox-supervisor) that manages egress lifecycle, implements exponential backoff with jitter and a crashloop circuit breaker, and forwards SIGTERM with a configurable 20-second grace period before SIGKILL
    • Adds an idempotent cleanup.sh script that runs as pre-start and post-exit hooks to reset iptables DNS REDIRECT rules, transparent-HTTP rules, the nftables opensandbox table, and stray mitmdump processes
    • Enables OTLPOTLPOpenTelemetry Protocol, a standard way to send traces, metrics and logs between applications, collectors and monitoring systems. It lets telemetry move across compatible tools. endpoint auto-discovery when OTEL_EXPORTER_OTLP_METRICS_ENDPOINT or OTEL_EXPORTER_OTLP_ENDPOINT is unset: resolves node IP from the HOST_IP environment variable (falling back to /etc/hostinfo) and points the exporter to <node-ip>:4318 over plaintext

    4 details in Everything

57. docker/execd/v1.0.17 May 19, 2026 · release notes

    OpenSandbox execd v1.0.17 adds EXECD_BOOTSTRAP_PRE_SCRIPT env var for pre-bootstrap seeding

    └──▷ GET THIS VERSION

    copy

    $ git clone --branch docker/execd/v1.0.17 https://github.com/opensandbox-group/OpenSandbox.git
    # already have the repo? check out this version:
    $ git checkout docker/execd/v1.0.17

58. server/v0.1.14 May 18, 2026 · release notes

    Adds Sandbox metadata PATCH endpoint and stable diagnostics CLI; unblocks event loop with concurrency knobs.

    └──▷ GET THIS VERSION

    copy

    $ git clone --branch server/v0.1.14 https://github.com/opensandbox-group/OpenSandbox.git
    # already have the repo? check out this version:
    $ git checkout server/v0.1.14

    • Adds PATCH /sandboxes/{sandboxId}/metadata endpoint for incremental label updates: pass a value to set/update, pass null to delete a key
    • Adds osb diagnostics logs|events subcommands to CLI/SDK with required scope argument; server returns 501 DIAGNOSTICS_NOT_IMPLEMENTED until stable backend lands
    • Adds [server] config keys workers, limit_concurrency, backlog, thread_pool_size, loop, http to tune concurrency behavior
    • Adds uvicorn[standard] upgrade introducing uvloop, httptools, and watchfiles support

    4 details in Everything

59. sdks/sandbox/go/v1.0.1 May 18, 2026 · release notes

    OpenSandbox Go SDK v1.0.1 adds UploadFiles, sets User-Agent header by default, and enforces TLS 1.2 minimum.

    └──▷ GET THIS VERSION

    copy

    $ git clone --branch sdks/sandbox/go/v1.0.1 https://github.com/opensandbox-group/OpenSandbox.git
    # already have the repo? check out this version:
    $ git checkout sdks/sandbox/go/v1.0.1

    • Adds UploadFiles method on the Sandbox type to perform multipart uploads against /files/upload
    • Sets OpenSandbox-Go-SDK/1.0.1 User-Agent header on all outgoing requests automatically

    2 details in Everything

    └──▷ BREAKING ON UPGRADE

    • !Sandbox.Close / SandboxManager.Close now return error to satisfy io.Closer
    • !TLS 1.2 minimum for SDK-created HTTP clients, enforcing the NIST 2030 minimum certificate key/hash length policy
60. js/sandbox/v0.1.7 May 15, 2026 · release notes

    OpenSandbox JS SDK v0.1.7 adds platform constraints, PVC storage config, secure endpoints, signed URLs, pause/resume, snapshots, and metadata patching.

    └──▷ GET THIS VERSION

    copy

    $ git clone --branch js/sandbox/v0.1.7 https://github.com/opensandbox-group/OpenSandbox.git
    # already have the repo? check out this version:
    $ git checkout js/sandbox/v0.1.7

    └──▷ USE IT
    Request a sandbox running on a specific platform, such as Windows, with auto-provisioned storage.
    shell copy

    const sandbox = await Sandbox.create({
      image: 'opensandbox/js:latest',
      platform: 'windows/amd64',
      createIfNotExists: true,
      storageClass: 'standard',
      storage: '10Gi'
    });

    Get a time-limited URL to access a port inside the sandbox without sharing static secrets.
    shell copy

    const signedUrl = await sandbox.getSignedEndpoint(8080, new Date(Date.now() + 3600 * 1000));
    console.log(signedUrl); // Returns https://...?token=...

    • Sandbox.create() now accepts a platform argument to constrain the runtime OS/architecture
    • JS models include createIfNotExists, storageClass, storage, and accessModes fields for PVC auto-provisioning in Windows sandboxes
    • Sandbox.create() accepts a secureAccess option to preserve transport headers for secured Kubernetes gateway endpoints
    • New sandbox.getSignedEndpoint(port, expires) method generates time-limited signed route tokens
    • Sandbox and SandboxManager expose pause/resume lifecycle methods; Sandbox.resume(...) reconnects after resume

    +1 more show less

    • New Sandbox.patchMetadata(...) and SandboxManager.patchSandboxMetadata(...) methods for JSON merge-patch updates

    6 details in Everything

61. k8s/controller/v0.2.0 May 15, 2026 · release notes

    OpenSandbox k8s/controller/v0.2.0 adds pause/resume, public snapshot API, and secure runtimes.

    └──▷ GET THIS VERSION

    copy

    $ git clone --branch k8s/controller/v0.2.0 https://github.com/opensandbox-group/OpenSandbox.git
    # already have the repo? check out this version:
    $ git checkout k8s/controller/v0.2.0

    • Implements pause and resume operations for batchsandbox instances backed by rootfs snapshots
    • Adds support for a public snapshots API on the Kubernetes runtime
    • Enables auto-assignment of pools for batchsandbox workloads
    • Adds per-volume API fields to automatically create or delete PVCs and Docker volumes
    • Supports GVisorGVisorA user-space kernel written in Go by Google that intercepts and handles system calls on behalf of a container, sandboxing it without needing a full VM. and Kata Containers as secure-container RuntimeClass options

    +4 more show less

    • Adds scaleStrategy configuration to control pool scaling behavior
    • Allows overriding the api_key environment variable via Helm values
    • Introduces a signed endpoint for secure route access per OSEP-0011
    • Adds a recycle handler for pool management and optimizes pool controller synchronization

    9 details in Everything

62. helm/opensandbox/0.2.0 May 15, 2026 · release notes

    OpenSandbox 0.2.0 adds pause/resume capabilities with rootfs snapshot support for sandboxed workloads.

    └──▷ GET THIS VERSION

    copy

    $ git clone --branch helm/opensandbox/0.2.0 https://github.com/opensandbox-group/OpenSandbox.git
    # already have the repo? check out this version:
    $ git checkout helm/opensandbox/0.2.0

    └──▷ TRY IT
    Pause a running sandbox to preserve its root filesystem state for later inspection.
    copy

    $ opensandbox pause <sandbox_id>

63. k8s/task-executor/v0.2.0 May 15, 2026 · release notes

    OpenSandbox v0.2.0 adds pause/resume with rootfs snapshots, public snapshot API, gVisorgVisorA user-space kernel written in Go by Google that intercepts and handles system calls on behalf of a container, sandboxing it without needing a full VM./Kata RuntimeClass support, and per-volume PVC/Docker volume management.

    └──▷ GET THIS VERSION

    copy

    $ git clone --branch k8s/task-executor/v0.2.0 https://github.com/opensandbox-group/OpenSandbox.git
    # already have the repo? check out this version:
    $ git checkout k8s/task-executor/v0.2.0

    • Adds pause and resume operations with rootfs snapshot support to suspend and restore task execution state
    • Adds support for the public snapshots API on the Kubernetes runtime for programmatic access to sandbox disk images
    • Adds gVisor and Kata RuntimeClass support via the new secure-container feature for enhanced isolation
    • Enables automatic PVC and Docker volume lifecycle management through per-volume API fields
    • Adds environment variable override capability for api_key via the Helm chart and server configuration

    5 details in Everything

64. cli/v0.1.1 May 13, 2026 · release notes

    OpenSandbox CLI v0.1.1 introduces stable osb diagnostics commands with scoped scope and structured outputstructured outputForcing a model's response to match a given format or JSON schema, so software can parse it reliably instead of hoping the text is well formed. modes.

    └──▷ GET THIS VERSION

    copy

    $ git clone --branch cli/v0.1.1 https://github.com/opensandbox-group/OpenSandbox.git
    # already have the repo? check out this version:
    $ git checkout cli/v0.1.1

    • Adds stable osb diagnostics logs and osb diagnostics events subcommands that require an explicit diagnostic scope argument and support table, json, yaml, and raw output formats
    • Migrates osb devops logs and osb devops events to deprecated compatibility wrappers while preserving existing --tail, --since, and --limit flag behaviors

    2 details in Everything

65. docker/egress/v1.0.11 May 13, 2026 · release notes

    OpenSandbox egress v1.0.11 adds connection_strategy=lazy and OPENSANDBOX_EGRESS_MITMPROXY_SSL_INSECURE env var

    └──▷ GET THIS VERSION

    copy

    $ git clone --branch docker/egress/v1.0.11 https://github.com/opensandbox-group/OpenSandbox.git
    # already have the repo? check out this version:
    $ git checkout docker/egress/v1.0.11

    • Adds connection_strategy=lazy to mitmproxy to defer upstream connections until the full request is received, avoiding useless connections for intercepted or filtered requests.
    • Adds OPENSANDBOX_EGRESS_MITMPROXY_SSL_INSECURE environment variable (default false) to skip upstream TLS certificate verification when set to true, resolving IP address mismatch errors for direct IP connections.

    2 details in Everything

66. python/sandbox/v0.1.9 May 12, 2026 · release notes

    New metadata patch and stable diagnostics APIs in the OpenSandbox Python SDK v0.1.9

    └──▷ GET THIS VERSION

    copy

    $ git clone --branch python/sandbox/v0.1.9 https://github.com/opensandbox-group/OpenSandbox.git
    # already have the repo? check out this version:
    $ git checkout python/sandbox/v0.1.9

    • Adds JSON merge-patch support for sandbox metadata via Sandbox / SandboxManager flows

    1 detail in Everything

67. java/sandbox/v1.0.11 May 12, 2026 · release notes

    OpenSandbox v1.0.11 adds sandbox metadata patch and stable Diagnostics API to the Kotlin SDK

    └──▷ GET THIS VERSION

    copy

    $ git clone --branch java/sandbox/v1.0.11 https://github.com/opensandbox-group/OpenSandbox.git
    # already have the repo? check out this version:
    $ git checkout java/sandbox/v1.0.11

    • Adds metadata patch support via a new API in the Kotlin SDK to apply JSON merge-patch updates (including delete semantics for null values) on Sandbox and SandboxManager objects
    • Exposes stable Diagnostics API endpoints getDiagnosticLogs and getDiagnosticEvents on Sandbox and SandboxManager requiring a diagnostic scope argument

    2 details in Everything

68. python/sandbox/v0.1.8 May 8, 2026 · release notes

    OpenSandbox v0.1.8 adds snapshot APIs, Python sandbox pools, and secure endpoint access surfaces.

    └──▷ GET THIS VERSION

    copy

    $ git clone --branch python/sandbox/v0.1.8 https://github.com/opensandbox-group/OpenSandbox.git
    # already have the repo? check out this version:
    $ git checkout python/sandbox/v0.1.8

    └──▷ TRY IT
    Enable Redis-backed distributed sandbox pools in a Python client by installing the optional dependency.
    copy

    $ pip install opensandbox[pool-redis]

    Request secure access for a new sandbox to get signed, short-lived endpoint URLs.
    python copy

    sandbox = await client.sandboxes.create(
        ..., 
        secureAccess=True
    )

    • Add first-class Python sandbox pool support for both async and sync clients with single-node in-memory and optional Redis-backed distributed stores via opensandbox[pool-redis].
    • Add snapshot APIs (create, get, list, delete) to the Python SDK, enabling creation of new sandboxes from a snapshotId.
    • Add secure endpoint access surfaces allowing secureAccess on sandbox creation and signed endpoint retrieval for short-lived sandbox route access without sharing static tokens.

    3 details in Everything

69. docker/execd/v1.0.15 May 7, 2026 · release notes

    OpenSandbox execd v1.0.15 adds EXECD_ACCESS_TOKEN env var for server access tokenaccess tokenA credential that authorizes a client to use a service or API. It usually has limited permissions and a lifetime; anyone holding it may be able to use those permissions. configuration.

    └──▷ GET THIS VERSION

    copy

    $ git clone --branch docker/execd/v1.0.15 https://github.com/opensandbox-group/OpenSandbox.git
    # already have the repo? check out this version:
    $ git checkout docker/execd/v1.0.15

    • ServerAccessToken can now be set via EXECD_ACCESS_TOKEN environment variable as an alternative to the --access-token CLI flag.

    1 detail in Everything

70. server/v0.1.13 May 7, 2026 · release notes

    New snapshot lifecycle APIs, signed endpoint URLs, and pause/resume controls in OpenSandbox server v0.1.13

    └──▷ GET THIS VERSION

    copy

    $ git clone --branch server/v0.1.13 https://github.com/opensandbox-group/OpenSandbox.git
    # already have the repo? check out this version:
    $ git checkout server/v0.1.13

    └──▷ TRY IT
    Generate a temporary, signed token for internal route access within a sandbox.
    copy

    $ curl "https://<opensandbox-host>/sandboxes/{sandboxId}/endpoints/{port}?expires=1709251200"

    • Adds snapshot lifecycle management with create/get/list/delete APIs and sandbox restore via snapshotId
    • Adds GET /sandboxes/{sandboxId}/endpoints/{port}?expires=<unix_seconds> endpoint for SHA256SHA256A cryptographic hash function that turns data into a fixed 256-bit fingerprint. It is used to check integrity; hashing does not encrypt the original data.-signed, time-limited route access tokensaccess tokensA credential that authorizes a client to use a service or API. It usually has limited permissions and a lifetime; anyone holding it may be able to use those permissions.
    • Adds /pause and /resume endpoints with SandboxSnapshot CRDCRDA Kubernetes extension that adds a new object type to the cluster, so a tool's configuration is stored, validated and versioned by Kubernetes itself rather than in a file beside it. support for Kubernetes pause/resume functionality
    • Adds OPENSANDBOX_SERVER_API_KEY environment variable to override the server.api_key TOML config setting

    4 details in Everything

71. java/sandbox/v1.0.10 May 7, 2026 · release notes

    OpenSandbox v1.0.10 adds snapshot lifecycle, secure endpoint access, signed API, Windows support, PVC auto-provisioning, custom execd port, and distributed pool.

    └──▷ GET THIS VERSION

    copy

    $ git clone --branch java/sandbox/v1.0.10 https://github.com/opensandbox-group/OpenSandbox.git
    # already have the repo? check out this version:
    $ git checkout java/sandbox/v1.0.10

    └──▷ USE IT
    Create a sandbox using a previously saved snapshot ID instead of booting from scratch.
    shell copy

    val sandbox = Sandbox.create(client, SnapshotRequest("snapshotId-abc123"))

    Enable secure access for a Kubernetes gateway sandbox to propagate and redact sensitive headers.
    shell copy

    val sandbox = Sandbox.builder()\n  .secureAccess(true)\n  ...\n  .build()

    Request a time-limited route token using the new signed endpoint API.
    shell copy

    val token = client.getSignedEndpoint(tokenRequest)

    • Adds snapshotId to Kotlin SDK for sandbox creation from snapshots and full CRUDCRUDThe four basic database operations — Create, Read, Update, Delete — used as shorthand for any system that manages persistent data records, giving cyber tools a standard model for interacting with stored information. lifecycle flows (create/get/list/delete).
    • Adds secureAccess opt-in flag to Kotlin Sandbox creation for Kubernetes gateway mode with header propagation and redaction.
    • Adds signed endpoint retrieval API (OSEP-0011) via the Kotlin SDK for time-limited route tokens instead of static credentials.
    • Adds Windows OS platform support in Kotlin SDK models and converters.
    • Adds PVC auto-provisioning fields to Kotlin sandbox models for automatic volume creation on startup.

    +2 more show less

    • Adds execdPort(port: Int) method to Sandbox.Connector Builder/Resumer to target a custom execd port other than default 44772.
    • Adds distributed SandboxPool support via the optional sandbox-pool-redis module for shared state coordination.

    7 details in Everything

72. docker/ingress/v1.0.7 May 6, 2026 · release notes

    OpenSandbox ingress v1.0.7 adds multi-namespace watching, signed URL verification via --secure-access-keys, and auto log rotation

    └──▷ GET THIS VERSION

    copy

    $ git clone --branch docker/ingress/v1.0.7 https://github.com/opensandbox-group/OpenSandbox.git
    # already have the repo? check out this version:
    $ git checkout docker/ingress/v1.0.7

    • --secure-access-keys flag for verified access to sandboxes marked with opensandbox.io/secure-access annotation
    • Multi-namespace support: ingress now watches sandbox CRs across all namespaces instead of a single one (with --namespace deprecated)
    • Automatic log rotation for file outputs using lumberjack (100MB, 30d retention, 10 backups default)

    3 details in Everything

73. docker/egress/v1.0.10 Apr 29, 2026 · release notes

    OpenSandbox Egress adds file-based log rotation with configurable size and retention defaults

    └──▷ GET THIS VERSION

    copy

    $ git clone --branch docker/egress/v1.0.10 https://github.com/opensandbox-group/OpenSandbox.git
    # already have the repo? check out this version:
    $ git checkout docker/egress/v1.0.10

74. docker/execd/v1.0.14 Apr 27, 2026 · release notes

    Adds lumberjack-backed log rotation for file outputs with configurable size, retention, and backup limits

    └──▷ GET THIS VERSION

    copy

    $ git clone --branch docker/execd/v1.0.14 https://github.com/opensandbox-group/OpenSandbox.git
    # already have the repo? check out this version:
    $ git checkout docker/execd/v1.0.14

    └──▷ TRY IT
    Ensure Chrome and Node.js trust intercepted TLS certificates in transparent egress mode.
    copy

    $ export NODE_EXTRA_CA_CERTS=/path/to/mitmproxy-ca.pem

    • Adds lumberjack-backed log rotation to file outputs (auto-enabled; 100MB max size, 30-day retention, 10 backups, no compression)
    • Forwards SIGTERM to the entrypoint process for graceful shutdown
    • Imports mitmproxy CA into NSS DB and sets NODE_EXTRA_CA_CERTS for TLS trust behind interception

    3 details in Everything

    └──▷ BREAKING ON UPGRADE

    • !The default execd listener is now tcp4 only, dropping dual-stack IPv6IPv6The current version of the Internet Protocol, standardized by the IETF, using 128-bit addresses to replace the exhausted IPv4 space. Cyber tools target it because modern networks run dual-stack or IPv6-only. binding.
75. server/v0.1.12 Apr 25, 2026 · release notes

    OpenSandbox v0.1.12 adds Windows Sandbox support, GPUGPUA graphics processing unit, a processor that performs many calculations in parallel. AI workloads use GPUs to speed up model training and inference. limits for Docker/K8s, and propagates opensandbox.extensions. annotations to Pods.

    └──▷ GET THIS VERSION

    copy

    $ git clone --branch server/v0.1.12 https://github.com/opensandbox-group/OpenSandbox.git
    # already have the repo? check out this version:
    $ git checkout server/v0.1.12

    • allowed_host_paths now defaults to deny-all, requiring explicit configuration like allowed_host_paths = ["/"] for legacy host mount access
    • Adds Windows Sandbox support via dockur/windows image and Kubernetes BatchSandbox workload compatibility
    • Propagates Pod annotations prefixed with opensandbox.extensions. to Kubernetes Pods with prefix opensandbox.io/extensions.
    • Honors GPU resource limits in Docker (DeviceRequest) and translates them to nvidia.com/gpu extended resources for Kubernetes scheduling

    4 details in Everything

    └──▷ BREAKING ON UPGRADE

    • !The default value of [storage].allowed_host_paths has changed from allowing all host path mounts to denying all, which may break existing sandbox setups that rely on implicit host mount access.
    • !The server now requires explicit startup confirmation when the api_key configuration is unset.
76. docker/execd/v1.0.13 Apr 21, 2026 · release notes

    OpenSandbox execd v1.0.13 adds OTELOTELAn open standard and set of tools for collecting traces, metrics and logs from applications. It lets services export observability data without tying instrumentation to one monitoring vendor. metrics and Windows distribution artifacts

    └──▷ GET THIS VERSION

    copy

    $ git clone --branch docker/execd/v1.0.13 https://github.com/opensandbox-group/OpenSandbox.git
    # already have the repo? check out this version:
    $ git checkout docker/execd/v1.0.13

    • Adds basic runtime OTEL metrics to execd
    • Pre-builds execd.exe and install.bat in the release image for Windows distribution

    2 details in Everything

77. server/v0.1.11 Apr 19, 2026 · release notes

    OpenSandbox v0.1.11 enables auto-creation of PVC and Docker volumes during sandbox creation

    └──▷ GET THIS VERSION

    copy

    $ git clone --branch server/v0.1.11 https://github.com/opensandbox-group/OpenSandbox.git
    # already have the repo? check out this version:
    $ git checkout server/v0.1.11

    • Adds automatic creation of PersistentVolumeClaim (PVC) and Docker volumes when a new sandbox is created
    • Changes log level configuration key from [server].log_level to [log].level

    2 details in Everything

    └──▷ BREAKING ON UPGRADE

    • !The configuration key [server].log_level is renamed to [log].level; existing configs using the old key will fail to set the log level.
78. docker/egress/v1.0.8 Apr 17, 2026 · release notes

    OpenSandbox v1.0.8 adds beta mitmproxy support and auto-reloading of deny.always/allow.always

    └──▷ GET THIS VERSION

    copy

    $ git clone --branch docker/egress/v1.0.8 https://github.com/opensandbox-group/OpenSandbox.git
    # already have the repo? check out this version:
    $ git checkout docker/egress/v1.0.8

    • Adds [beta] built-in mitmproxy support
    • Automatically reloads deny.always and allow.always rules every minute using mtime/size checks

    2 details in Everything

79. docker/execd/v1.0.12 Apr 16, 2026 · release notes

    OpenSandbox execd v1.0.12 adds OPENSANDBOX_EGRESS_MITMPROXY_TRANSPARENT env var to trust MITM proxies.

    └──▷ GET THIS VERSION

    copy

    $ git clone --branch docker/execd/v1.0.12 https://github.com/opensandbox-group/OpenSandbox.git
    # already have the repo? check out this version:
    $ git checkout docker/execd/v1.0.12

80. sdks/sandbox/go/v1.0.0 Apr 13, 2026 · release notes

    OpenSandbox releases the first Go SDK with oapi-codegen for Lifecycle, Execd, and Egress APIs

    └──▷ GET THIS VERSION

    copy

    $ git clone --branch sdks/sandbox/go/v1.0.0 https://github.com/opensandbox-group/OpenSandbox.git
    # already have the repo? check out this version:
    $ git checkout sdks/sandbox/go/v1.0.0

    • Adds Go SDK to provide generated clients for Lifecycle, Execd, and Egress APIs via oapi-codegen

    1 detail in Everything

81. docker/egress/v1.0.7 Apr 10, 2026 · release notes

    Adds configurable probe names for upstream health checks and graceful shutdown with network namespace rollback.

    └──▷ GET THIS VERSION

    copy

    $ git clone --branch docker/egress/v1.0.7 https://github.com/opensandbox-group/OpenSandbox.git
    # already have the repo? check out this version:
    $ git checkout docker/egress/v1.0.7

    • Adds probe.name config key to define the name used in active upstream health probes
    • Enables graceful shutdown that rolls back all network namespaces when the egress connection closes

    2 details in Everything

82. server/v0.1.10 Apr 10, 2026 · release notes

    OpenSandbox v0.1.10 adds file logging for server/access logs, uvicorn keep-alive timeout config, and optional platform constraints in sandbox lifecycle spec.

    └──▷ GET THIS VERSION

    copy

    $ git clone --branch server/v0.1.10 https://github.com/opensandbox-group/OpenSandbox.git
    # already have the repo? check out this version:
    $ git checkout server/v0.1.10

    • Adds file_logger configuration to write both server logs and access logs to files
    • Exposes timeout_keep_alive setting from uvicorn in configuration
    • Introduces optional platform object in the sandbox lifecycle spec for scheduling/runtime constraints

    3 details in Everything

83. docker/egress/v1.0.6 Apr 7, 2026 · release notes

    OpenSandbox egress adds OPENSANDBOX_EGRESS_DNS_UPSTREAM env var to override DNS resolvers

    └──▷ GET THIS VERSION

    copy

    $ git clone --branch docker/egress/v1.0.6 https://github.com/opensandbox-group/OpenSandbox.git
    # already have the repo? check out this version:
    $ git checkout docker/egress/v1.0.6

    └──▷ USE IT
    Force the egress proxy to use specific external DNS servers like Google's or Cloudflare's.
    shell copy

    docker run -e OPENSANDBOX_EGRESS_DNS_UPSTREAM=8.8.8.8,1.1.1.1 opensandbox/egress:v1.0.6

    • Add OPENSANDBOX_EGRESS_DNS_UPSTREAM environment variable to specify custom DNS resolver addresses instead of relying solely on /etc/resolv.conf

    1 detail in Everything

84. java/sandbox/v1.0.6 Apr 3, 2026 · release notes

    OpenSandbox v1.0.6 adds the runInSession method to its SDK, enhancing sandbox pool functions.

    └──▷ GET THIS VERSION

    copy

    $ git clone --branch java/sandbox/v1.0.6 https://github.com/opensandbox-group/OpenSandbox.git
    # already have the repo? check out this version:
    $ git checkout java/sandbox/v1.0.6

    • Adds the runInSession method to execute code within an existing session context.

    1 detail in Everything

85. docker/ingress/v1.0.6 Apr 2, 2026 · release notes

    OpenSandbox Ingress adds Kubernetes system tests for the ingress-gateway component.

    └──▷ GET THIS VERSION

    copy

    $ git clone --branch docker/ingress/v1.0.6 https://github.com/opensandbox-group/OpenSandbox.git
    # already have the repo? check out this version:
    $ git checkout docker/ingress/v1.0.6

86. docker/execd/v1.0.10 Apr 2, 2026 · release notes

    OpenSandbox v1.0.10 adds websocket PTY support and EXECD_CLONE3_COMPAT fallback

    └──▷ GET THIS VERSION

    copy

    $ git clone --branch docker/execd/v1.0.10 https://github.com/opensandbox-group/OpenSandbox.git
    # already have the repo? check out this version:
    $ git checkout docker/execd/v1.0.10

    • Adds EXECD_CLONE3_COMPAT environment variable to enable seccomp-based clone3 fallback
    • Adds websocket PTY support for terminal sessions

    2 details in Everything

87. docker/egress/v1.0.5 Apr 2, 2026 · release notes

    OpenSandbox v1.0.5 adds fixed allow/deny list files and OTelOTelAn open standard and set of tools for collecting traces, metrics and logs from applications. It lets services export observability data without tying instrumentation to one monitoring vendor. metrics

    └──▷ GET THIS VERSION

    copy

    $ git clone --branch docker/egress/v1.0.5 https://github.com/opensandbox-group/OpenSandbox.git
    # already have the repo? check out this version:
    $ git checkout docker/egress/v1.0.5

    • Adds OTel metrics and internal telemetry support.

    1 detail in Everything

88. docker/egress/v1.0.4 Mar 30, 2026 · release notes

    Adds support for persisting egress policies to a local file via OPENSANDBOX_EGRESS_POLICY_FILE

    └──▷ GET THIS VERSION

    copy

    $ git clone --branch docker/egress/v1.0.4 https://github.com/opensandbox-group/OpenSandbox.git
    # already have the repo? check out this version:
    $ git checkout docker/egress/v1.0.4

    └──▷ USE IT
    Persist the egress policy to a specific file path instead of relying on in-memory or default storage.
    shell copy

    OPENSANDBOX_EGRESS_POLICY_FILE=/etc/opensandbox/egress.yaml opensandbox-egress

    • Adds OPENSANDBOX_EGRESS_POLICY_FILE environment variable to persist egress policy configuration

    1 detail in Everything

89. python/sandbox/v0.1.6 Mar 27, 2026 · release notes

    OpenSandbox v0.1.6 adds persistent sessions, OSSFS volumes, and manual lifecycle control to the Python SDK

    └──▷ GET THIS VERSION

    copy

    $ git clone --branch python/sandbox/v0.1.6 https://github.com/opensandbox-group/OpenSandbox.git
    # already have the repo? check out this version:
    $ git checkout python/sandbox/v0.1.6

    • Adds run_in_session subcommand in the Python SDK for persistent shell workflows
    • Adds ossfs volume backend support in the Python SDK
    • Adds uid, gid, and environment variable fields to run-command requests
    • Adds manual cleanup lifecycle support (e.g., cleanup() method) in the Python SDK

    4 details in Everything

90. csharp/sandbox/v0.1.0 Mar 27, 2026 · release notes

    Initial release of OpenSandbox C# SDK adds runInSession API.

    └──▷ GET THIS VERSION

    copy

    $ git clone --branch csharp/sandbox/v0.1.0 https://github.com/opensandbox-group/OpenSandbox.git
    # already have the repo? check out this version:
    $ git checkout csharp/sandbox/v0.1.0

    └──▷ USE IT
    Execute a session using the newly available SDK method.
    csharp copy

    await client.runInSession(sessionId);

91. js/code-interpreter/v0.1.3 Mar 26, 2026 · release notes

    JavaScript SDK supports sandbox endpoint auth headers for code-interpreter requests

    └──▷ GET THIS VERSION

    copy

    $ git clone --branch js/code-interpreter/v0.1.3 https://github.com/opensandbox-group/OpenSandbox.git
    # already have the repo? check out this version:
    $ git checkout js/code-interpreter/v0.1.3

92. java/code-interpreter/v1.0.5 Mar 26, 2026 · release notes

    OpenSandbox v1.0.5 adds sandbox endpoint auth header support for code-interpreter requests in the Java SDK

    └──▷ GET THIS VERSION

    copy

    $ git clone --branch java/code-interpreter/v1.0.5 https://github.com/opensandbox-group/OpenSandbox.git
    # already have the repo? check out this version:
    $ git checkout java/code-interpreter/v1.0.5

    └──▷ USE IT
    Pass a custom authentication header when invoking code interpreters via the Java SDK to secure sandbox endpoint access.
    java copy

    CodeExample.java:
    
    CodeInterpreterClient client = new CodeInterpreterClient();
    client.setSandboxEndpointAuthHeader("Bearer <token>");

93. java/sandbox/v1.0.5 Mar 26, 2026 · release notes

    OpenSandbox v1.0.5 adds egress patching, PVC subPath volumes, client-side pooling, and manual cleanup for Java SDK users

    └──▷ GET THIS VERSION

    copy

    $ git clone --branch java/sandbox/v1.0.5 https://github.com/opensandbox-group/OpenSandbox.git
    # already have the repo? check out this version:
    $ git checkout java/sandbox/v1.0.5

    • Adds egress patch support for sandbox network configuration allowing traffic rule updates
    • Adds Docker named volume support with PVC subPath in sandbox lifecycle integration
    • Adds client-side sandbox pool support for Java SDK to manage connections locally
    • Adds manual-cleanup sandbox lifecycle support in the Java SDK for explicit resource control
    • Adds command exit-code support for Java SDK command execution flows

    +2 more show less

    • Adds OSSFS volume support to the Java SDK sandbox models and converters
    • Adds x-request-id propagation support in the Java SDK for distributed tracing

    7 details in Everything

94. js/sandbox/v0.1.5 Mar 25, 2026 · release notes

    OpenSandbox v0.1.5 adds runInSession, exit codes, OSSFS backend, and uid/gid support

    └──▷ GET THIS VERSION

    copy

    $ git clone --branch js/sandbox/v0.1.5 https://github.com/opensandbox-group/OpenSandbox.git
    # already have the repo? check out this version:
    $ git checkout js/sandbox/v0.1.5

    • runInSession flag and subcommand in the JavaScript SDK to execute commands within an existing session
    • Command exit-code return value for JavaScript sandbox command execution
    • OSSFS volume backend integration in the JavaScript SDK
    • x-request-id header propagation in the JavaScript SDK
    • uid/gid and environment variable fields in run-command requests

    5 details in Everything

95. server/v0.1.9 Mar 24, 2026 · release notes

    OpenSandbox server v0.1.9 adds websocket proxy, experimental auto-renew, and Pool CRUDCRUDThe four basic database operations — Create, Read, Update, Delete — used as shorthand for any system that manages persistent data records, giving cyber tools a standard model for interacting with stored information. API

    └──▷ GET THIS VERSION

    copy

    $ git clone --branch server/v0.1.9 https://github.com/opensandbox-group/OpenSandbox.git
    # already have the repo? check out this version:
    $ git checkout server/v0.1.9

    • Adds server proxy by websocket to enable bidirectional sandbox communication.
    • [EXPERIMENTAL] Enables auto-renew on sandbox proxy/ingress access per OSEP-0009 for session persistence.
    • [UNSTABLE] Adds Pool CRUD API and Kubernetes CRDCRDA Kubernetes extension that adds a new object type to the cluster, so a tool's configuration is stored, validated and versioned by Kubernetes itself rather than in a file beside it. service for automated pool management.

    3 details in Everything

96. docker/ingress/v1.0.5 Mar 24, 2026 · release notes

    Adds EXPERIMENTAL publish_renew_intent to Redis for sandbox auto-renew on ingress access

    └──▷ GET THIS VERSION

    copy

    $ git clone --branch docker/ingress/v1.0.5 https://github.com/opensandbox-group/OpenSandbox.git
    # already have the repo? check out this version:
    $ git checkout docker/ingress/v1.0.5

    • [EXPERIMENTAL] publishing renew-intent to Redis for OSEP-0009

    1 detail in Everything

97. server/v0.1.8 Mar 22, 2026 · release notes

    OpenSandbox server v0.1.8 adds configurable egress modes and manual cleanup for sandboxes.

    └──▷ GET THIS VERSION

    copy

    $ git clone --branch server/v0.1.8 https://github.com/opensandbox-group/OpenSandbox.git
    # already have the repo? check out this version:
    $ git checkout server/v0.1.8

    • egress.mode is a new configuration option accepting dns or dns+nft (default: dns) to control network egress behavior.
    • The OPENSANDBOX_EGRESS_MODE environment variable wires the egress mode into the sidecar for both Docker and Kubernetes deployments.
    • Per-sandbox egress auth header generation is now supported, propagating headers through lifecycle endpoint responses.

    3 details in Everything

    └──▷ BREAKING ON UPGRADE

    • !Some unset optional lifecycle response fields are serialized as explicit JSON null values instead of being omitted, which may break older released SDKs that do not tolerate null.
98. docker/execd/v1.0.8 Mar 18, 2026 · release notes

    OpenSandbox execd v1.0.8 adds Session API for pipe-based bash sessions

    └──▷ GET THIS VERSION

    copy

    $ git clone --branch docker/execd/v1.0.8 https://github.com/opensandbox-group/OpenSandbox.git
    # already have the repo? check out this version:
    $ git checkout docker/execd/v1.0.8

99. docker/execd/v1.0.7 Mar 15, 2026 · release notes

    OpenSandbox execd v1.0.7 adds env support in run requests and uid/gid execution.

    └──▷ GET THIS VERSION

    copy

    $ git clone --branch docker/execd/v1.0.7 https://github.com/opensandbox-group/OpenSandbox.git
    # already have the repo? check out this version:
    $ git checkout docker/execd/v1.0.7

    └──▷ USE IT
    Pass environment variables when executing a command via the API.
    shell copy

    curl -X POST https://<host>/api/run \
      -H 'Content-Type: application/json' \
      -d '{
        "cmd": "printenv MY_VAR",
        "env": {
          "MY_VAR": "hello"
        }
      }'

    Execute a command as a specific non-root user by specifying uid and gid.
    shell copy

    curl -X POST https://<host>/api/run \
      -H 'Content-Type: application/json' \
      -d '{
        "cmd": "whoami",
        "uid": 1000,
        "gid": 1000
      }'

    • docker/execd/v1.0.7 now passes environment variables to the executed command via the env field in the run request payload
    • Adds uid and gid parameters to command execution configuration
    • Falls back from /bin/bash to /bin/sh for Alpine-based container images

    3 details in Everything

100. server/v0.1.7 Mar 13, 2026 · release notes

     OpenSandbox v0.1.7 adds PVC support to agents, user-defined Docker networks, and RBACRBACRole-based access control, where permissions are assigned to roles such as reader or administrator and users receive those roles. It makes access easier to manage than individual permission lists. for secrets.

     └──▷ GET THIS VERSION

     copy

     $ git clone --branch server/v0.1.7 https://github.com/opensandbox-group/OpenSandbox.git
     # already have the repo? check out this version:
     $ git checkout server/v0.1.7

     • Adds Persistent Volume Claim (PVC) support to the agent-sandbox and batchsandbox runtimes
     • Supports user-defined Docker network stacks within sandboxed environments
     • Adds server-side Role-Based Access ControlRole-Based Access ControlRole-based access control, where permissions are assigned to roles such as reader or administrator and users receive those roles. It makes access easier to manage than individual permission lists. (RBAC) rules for accessing secrets

     3 details in Everything

101. docker/egress/v1.0.3 Mar 12, 2026 · release notes

     OpenSandbox v1.0.3 adds denied hostname webhook fanout and includes sandboxID in deny payloads

     └──▷ GET THIS VERSION

     copy

     $ git clone --branch docker/egress/v1.0.3 https://github.com/opensandbox-group/OpenSandbox.git
     # already have the repo? check out this version:
     $ git checkout docker/egress/v1.0.3

     • Adds denied_hostname webhook fanout to notify external listeners when egress is blocked
     • Includes the sandboxID field within the deny webhook payload for request tracing

     2 details in Everything

102. docker/egress/v1.0.2 Mar 10, 2026 · release notes

     OpenSandbox v1.0.2 adds nameserver exemption for direct DNS forwarding and updates patch policies.

     └──▷ GET THIS VERSION

     copy

     $ git clone --branch docker/egress/v1.0.2 https://github.com/opensandbox-group/OpenSandbox.git
     # already have the repo? check out this version:
     $ git checkout docker/egress/v1.0.2

     • Adds nameserver exempt configuration option to bypass direct DNS forwarding rules

     1 detail in Everything

103. server/v0.1.6 Mar 9, 2026 · release notes

     OpenSandbox v0.1.6 adds configurable resource limits to the execd init container.

     └──▷ GET THIS VERSION

     copy

     $ git clone --branch server/v0.1.6 https://github.com/opensandbox-group/OpenSandbox.git
     # already have the repo? check out this version:
     $ git checkout server/v0.1.6

     └──▷ USE IT
     Set specific resource constraints for the execd init container when launching a sandbox.
     shell copy

     export EXECD_INIT_CPU_LIMIT=500m
     export EXECD_INIT_MEM_LIMIT=128Mi
     # Then launch your sandbox as usual

104. docker/ingress/v1.0.3 Mar 8, 2026 · release notes

     Adds official linux/arm64 image support for OpenSandbox ingress

     └──▷ GET THIS VERSION

     copy

     $ git clone --branch docker/ingress/v1.0.3 https://github.com/opensandbox-group/OpenSandbox.git
     # already have the repo? check out this version:
     $ git checkout docker/ingress/v1.0.3

105. server/v0.1.5 Mar 3, 2026 · release notes

     OpenSandbox server v0.1.5 adds server.eip config key for Docker runtime endpoint host and improves proxy error handling.

     └──▷ GET THIS VERSION

     copy

     $ git clone --branch server/v0.1.5 https://github.com/opensandbox-group/OpenSandbox.git
     # already have the repo? check out this version:
     $ git checkout server/v0.1.5

     • Adds server.eip configuration key to specify the endpoint host when running in Docker runtime
     • Preserves HTTP errors from upstream proxies and expands route coverage for better debugging
     • Correlates spans with server logs by propagating the X-Request-ID header

     3 details in Everything

106. docker/egress/v1.0.1 Feb 27, 2026 · release notes

     OpenSandbox egress v1.0.1 adds DNS-based dynamic IP rules and unified logging

     └──▷ GET THIS VERSION

     copy

     $ git clone --branch docker/egress/v1.0.1 https://github.com/opensandbox-group/OpenSandbox.git
     # already have the repo? check out this version:
     $ git checkout docker/egress/v1.0.1

     • Adds Egress stage two support for blocking traffic via IP/CIDRCIDRA notation for a block of IP addresses, such as 10.0.0.0/24. The number after the slash says how many leading address bits identify the network. rules and DoTDoTDNS over TLS: an IETF standard (RFC 7858) that wraps DNS queries in a TLS session on port 853, preventing eavesdropping and tampering that plain UDP DNS allows./DoHDoHDNS over HTTPS, an IETF standard (RFC 8484) that tunnels DNS queries inside encrypted HTTPS traffic, making resolution indistinguishable from web traffic and bypassing traditional DNS-based monitoring.
     • Adds Egress stage three to perform dynamic IP insertion using DNS answer data
     • Introduces a unified logger managed by an internal package
     • Prints build and compile information during startup

     4 details in Everything

107. server/v0.1.3 Feb 26, 2026 · release notes

     OpenSandbox v0.1.3 adds multi-ingress, header ingress, informer-based K8s resources, and Docker PVC with subPath.

     └──▷ GET THIS VERSION

     copy

     $ git clone --branch server/v0.1.3 https://github.com/opensandbox-group/OpenSandbox.git
     # already have the repo? check out this version:
     $ git checkout server/v0.1.3

     • multi ingress gateway mode support
     • header ingress gateway mode
     • retrieve Kubernetes resources via Informer
     • Docker named volume with subPath for PVC backend

     4 details in Everything

108. js/sandbox/v0.1.4 Feb 12, 2026 · release notes

     OpenSandbox v0.1.4 adds command query support, host/PVC volume types in OpenAPIOpenAPIA vendor-neutral specification for describing REST APIs in a machine-readable format, maintained by the OpenAPI Initiative. Cyber tools use it to auto-generate clients, documentation, and validation from a single source of truth., server proxy access, command timeout, and execd headers.

     └──▷ GET THIS VERSION

     copy

     $ git clone --branch js/sandbox/v0.1.4 https://github.com/opensandbox-group/OpenSandbox.git
     # already have the repo? check out this version:
     $ git checkout js/sandbox/v0.1.4

     • command query now supported via the SDKs
     • host and pvc volume types added to the OpenAPI spec
     • Sandbox endpoints accessible via the server proxy
     • execd headers support in command execution

     4 details in Everything

109. java/sandbox/v1.0.4 Feb 12, 2026 · release notes

     OpenSandbox v1.0.4 adds command query support, host/PVC volume types in OpenAPIOpenAPIA vendor-neutral specification for describing REST APIs in a machine-readable format, maintained by the OpenAPI Initiative. Cyber tools use it to auto-generate clients, documentation, and validation from a single source of truth. spec, and server proxy access for sandbox endpoints

     └──▷ GET THIS VERSION

     copy

     $ git clone --branch java/sandbox/v1.0.4 https://github.com/opensandbox-group/OpenSandbox.git
     # already have the repo? check out this version:
     $ git checkout java/sandbox/v1.0.4

     • Adds command query support via SDKs to filter or retrieve commands
     • Adds host and pvc volume types to the OpenAPI specification for sandbox storage configuration
     • Enables accessing sandbox endpoints through a server proxy mechanism

     3 details in Everything

110. python/sandbox/v0.1.5 Feb 12, 2026 · release notes

     OpenSandbox v0.1.5 adds command query, proxy access to endpoints, and host/PVC volume support in OpenAPIOpenAPIA vendor-neutral specification for describing REST APIs in a machine-readable format, maintained by the OpenAPI Initiative. Cyber tools use it to auto-generate clients, documentation, and validation from a single source of truth.

     └──▷ GET THIS VERSION

     copy

     $ git clone --branch python/sandbox/v0.1.5 https://github.com/opensandbox-group/OpenSandbox.git
     # already have the repo? check out this version:
     $ git checkout python/sandbox/v0.1.5

     • server_proxy feature enables accessing sandbox endpoints via the server proxy.
     • host and pvc volume types added to the OpenAPI spec for volume configuration.
     • Support for querying commands (command query feature).

     3 details in Everything

111. python/sandbox/v0.1.5.dev0 Prerelease Feb 11, 2026 · release notes

     OpenSandbox v0.1.5 adds server proxy access for sandbox endpoints and command query support.

     └──▷ GET THIS VERSION

     copy

     $ git clone --branch python/sandbox/v0.1.5.dev0 https://github.com/opensandbox-group/OpenSandbox.git
     # already have the repo? check out this version:
     $ git checkout python/sandbox/v0.1.5.dev0

     • feat(volume): Adds host and pvc volume types to the OpenAPIOpenAPIA vendor-neutral specification for describing REST APIs in a machine-readable format, maintained by the OpenAPI Initiative. Cyber tools use it to auto-generate clients, documentation, and validation from a single source of truth. spec.
     • feat(server): Supports accessing sandbox endpoints via a server proxy.
     • feat(sdks): Supports command query functionality.
     • Supports server proxy in SDKs.
     • Adds command timeout and execd headers support.

     5 details in Everything

112. docker/execd/v1.0.6 Feb 10, 2026 · release notes

     OpenSandbox execd v1.0.6 adds timeout support for run_command requests and human-readable logs.

     └──▷ GET THIS VERSION

     copy

     $ git clone --branch docker/execd/v1.0.6 https://github.com/opensandbox-group/OpenSandbox.git
     # already have the repo? check out this version:
     $ git checkout docker/execd/v1.0.6

     • Adds a configurable timeout to the run_command request to prevent indefinite hangs
     • Implements human-readable logs and concise SSESSEServer-Sent Events, a browser API and HTTP-based protocol where a server pushes a stream of text events to a client over a single long-lived connection, giving tools a lightweight alternative to WebSockets for one-way real-time updates. summary log for better observability

     2 details in Everything

113. server/v0.1.2 Feb 9, 2026 · release notes

     OpenSandbox server/v0.1.2 adds local host volume mount and Kubernetes NetworkPolicyNetworkPolicyA Kubernetes API object that defines which pods may send or receive traffic, enforced by the cluster's CNI plugin to give cyber tools namespace-level network segmentation without host firewall rules. support.

     └──▷ GET THIS VERSION

     copy

     $ git clone --branch server/v0.1.2 https://github.com/opensandbox-group/OpenSandbox.git
     # already have the repo? check out this version:
     $ git checkout server/v0.1.2

114. docker/ingress/v1.0.1 Feb 9, 2026 · release notes

     OpenSandbox Ingress v1.0.1 adds proxy mode with URI/header support and new watch capability for agent-sandbox resources

     └──▷ GET THIS VERSION

     copy

     $ git clone --branch docker/ingress/v1.0.1 https://github.com/opensandbox-group/OpenSandbox.git
     # already have the repo? check out this version:
     $ git checkout docker/ingress/v1.0.1

     • Introduces proxy mode in ingress, enabling traffic interception via uri or header modes.
     • Adds the ability to watch agent-sandbox resource from within the ingress component.

     2 details in Everything

     └──▷ BREAKING ON UPGRADE

     • !Dropped support for linux/arm64 architecture.
115. server/v0.1.1 Feb 6, 2026 · release notes

     OpenSandbox v0.1.1 adds host/PVC volume API definition and built-in proxy support for sandbox endpoints.

     └──▷ GET THIS VERSION

     copy

     $ git clone --branch server/v0.1.1 https://github.com/opensandbox-group/OpenSandbox.git
     # already have the repo? check out this version:
     $ git checkout server/v0.1.1

     • [runtime].egress_image config key is no longer accepted; egress configuration has been extracted as an independent module
     • Adds [preview] API definition for host and PVC volumes to enable mounting persistent storage into sandboxes
     • Enables accessing sandbox endpoints via the server's built-in proxy

     3 details in Everything

     └──▷ BREAKING ON UPGRADE

     • ![runtime].egress_image config key is no longer accepted; egress configuration has been extracted as an independent module (refers to [Configuration reference](https://github.com/alibaba/OpenSandbox/blob/main/server/README.md#configuration-reference))
116. python/mcp/sandbox/v0.1.1 Feb 6, 2026 · release notes

     Initial public release of the OpenSandbox python sandbox MCPMCPModel Context Protocol, a standard for connecting AI applications to external tools and data sources. A compatible server exposes capabilities an assistant can use through a common interface. server

     └──▷ GET THIS VERSION

     copy

     $ git clone --branch python/mcp/sandbox/v0.1.1 https://github.com/opensandbox-group/OpenSandbox.git
     # already have the repo? check out this version:
     $ git checkout python/mcp/sandbox/v0.1.1

117. server/v0.1.0 Feb 4, 2026 · release notes

     OpenSandbox v0.1.0 introduces the first production-grade service for managing containerized sandbox lifecycle.

     └──▷ GET THIS VERSION

     copy

     $ git clone --branch server/v0.1.0 https://github.com/opensandbox-group/OpenSandbox.git
     # already have the repo? check out this version:
     $ git checkout server/v0.1.0

     └──▷ USE IT
     Run the new sandbox control plane service locally for testing.
     shell copy

     docker run -p 8000:8000 opensandbox/server:v0.1.0

     • opensandbox-server is now available on PyPI (v0.1.0) and Docker Hub (opensandbox/server:v0.1.0) as the control plane for isolated execution environments.
     • Provides FastAPI-based endpoints to create, run, monitor, and dispose containerized sandboxes across platforms.

     2 details in Everything

118. java/code-interpreter/v1.0.3 Jan 28, 2026 · release notes

     OpenSandbox java/code-interpreter v1.0.3 adds egress traffic control rules when creating sandboxes.

     └──▷ GET THIS VERSION

     copy

     $ git clone --branch java/code-interpreter/v1.0.3 https://github.com/opensandbox-group/OpenSandbox.git
     # already have the repo? check out this version:
     $ git checkout java/code-interpreter/v1.0.3

     • Supports network policy configuration at sandbox creation time, with allow/deny rules for outbound (egress) traffic control.

     1 detail in Everything

119. python/sandbox/v0.1.4 Jan 28, 2026 · release notes

     Adds network policy support for controlling egress traffic in OpenSandbox sandboxes

     └──▷ GET THIS VERSION

     copy

     $ git clone --branch python/sandbox/v0.1.4 https://github.com/opensandbox-group/OpenSandbox.git
     # already have the repo? check out this version:
     $ git checkout python/sandbox/v0.1.4

     • Supports outbound (egress) traffic control with allow/deny rules when creating a sandbox.

     1 detail in Everything

120. js/sandbox/v0.1.3 Jan 28, 2026 · release notes

     OpenSandbox v0.1.3 adds network policy configuration for sandbox egress rules

     └──▷ GET THIS VERSION

     copy

     $ git clone --branch js/sandbox/v0.1.3 https://github.com/opensandbox-group/OpenSandbox.git
     # already have the repo? check out this version:
     $ git checkout js/sandbox/v0.1.3

121. java/sandbox/v1.0.3 Jan 28, 2026 · release notes

     OpenSandbox v1.0.3 adds egress rule support for sandbox network policies

     └──▷ GET THIS VERSION

     copy

     $ git clone --branch java/sandbox/v1.0.3 https://github.com/opensandbox-group/OpenSandbox.git
     # already have the repo? check out this version:
     $ git checkout java/sandbox/v1.0.3

122. docker/execd/v1.0.4 Jan 28, 2026 · release notes

     OpenSandbox execd v1.0.4 adds configurable log output file and switches bootstrap shell to bash.

     └──▷ GET THIS VERSION

     copy

     $ git clone --branch docker/execd/v1.0.4 https://github.com/opensandbox-group/OpenSandbox.git
     # already have the repo? check out this version:
     $ git checkout docker/execd/v1.0.4

     └──▷ TRY IT
     Redirect execd logs to a persistent volume path instead of stdout/stderr.
     copy

     $ EXECD_LOG_FILE=/var/log/opensandbox/execd.log docker run opensandbox/execd:v1.0.4

     • Adds EXECD_LOG_FILE environment variable to configure the log output file path
     • Replaces sh with bash for bootstrap execution under docker/execd

     2 details in Everything

123. docker/execd/v1.0.3 Jan 19, 2026 · release notes

     Supports configuring the API grace shutdown timeout via the EXECD_API_GRACE_SHUTDOWN environment variable

     └──▷ GET THIS VERSION

     copy

     $ git clone --branch docker/execd/v1.0.3 https://github.com/opensandbox-group/OpenSandbox.git
     # already have the repo? check out this version:
     $ git checkout docker/execd/v1.0.3

     └──▷ TRY IT
     Control how long the tool waits for in-flight SSESSEServer-Sent Events, a browser API and HTTP-based protocol where a server pushes a stream of text events to a client over a single long-lived connection, giving tools a lightweight alternative to WebSockets for one-way real-time updates. connections to close before terminating
     copy

     $ EXECD_API_GRACE_SHUTDOWN=30s docker run opensandbox/execd:v1.0.3

     • Adds support for the EXECD_API_GRACE_SHUTDOWN environment variable to configure the SSE API grace shutdown timeout
     • Modifies the web framework from the previous implementation to Gin (#94)

     2 details in Everything

124. docker/code-interpreter/v1.0.1 Jan 16, 2026 · release notes

     OpenSandbox code-interpreter v1.0.1 allows appending to EXECD_ENVS

     └──▷ GET THIS VERSION

     copy

     $ git clone --branch docker/code-interpreter/v1.0.1 https://github.com/opensandbox-group/OpenSandbox.git
     # already have the repo? check out this version:
     $ git checkout docker/code-interpreter/v1.0.1

     • Adds support for appending environment variables to the EXECD_ENVS configuration variable

     1 detail in Everything

125. docker/execd/v1.0.2 Jan 14, 2026 · release notes

     OpenSandbox execd v1.0.2 adds code context APIs, output tailing, EXECD_ENVS injection, and exec trace flag.

     └──▷ GET THIS VERSION

     copy

     $ git clone --branch docker/execd/v1.0.2 https://github.com/opensandbox-group/OpenSandbox.git
     # already have the repo? check out this version:
     $ git checkout docker/execd/v1.0.2

     └──▷ TRY IT
     Query the new context management endpoints to inspect code state.
     copy

     $ curl -s http://<execd-host>:<port>/api/v1/context

     Inject environment variables from a file into the sandboxed execution.
     copy

     $ export EXECD_ENVS=/path/to/env-file.env
     execd run my-task

     • Adds new REST endpoints for code context management (API #48)
     • Adds the ability to tail background command outputs in real-time
     • Supports EXECED_ENVS environment file injection for containerized workloads

     3 details in Everything

126. java/code-interpreter/v1.0.1 Jan 13, 2026 · release notes

     OpenSandbox v1.0.1 adds code context management API and run overloads

     └──▷ GET THIS VERSION

     copy

     $ git clone --branch java/code-interpreter/v1.0.1 https://github.com/opensandbox-group/OpenSandbox.git
     # already have the repo? check out this version:
     $ git checkout java/code-interpreter/v1.0.1

     • Adds getContext, listContexts, createContext, deleteContext, and deleteContexts(language) methods to manage code execution contexts.
     • Adds convenience overloads for run: run(code, context), run(code, language), and run(code, language, handlers).

     2 details in Everything

     └──▷ BREAKING ON UPGRADE

     • !Removed duplicated sandbox lifecycle methods (endpoint/info/metrics/renew/pause/resume/kill) from CodeInterpreter; must use sandbox directly.
127. python/code-interpreter/v0.1.1 Jan 13, 2026 · release notes

     OpenSandbox v0.1.1 adds code context management API and language-aware run convenience

     └──▷ GET THIS VERSION

     copy

     $ git clone --branch python/code-interpreter/v0.1.1 https://github.com/opensandbox-group/OpenSandbox.git
     # already have the repo? check out this version:
     $ git checkout python/code-interpreter/v0.1.1

     └──▷ USE IT
     Manage code contexts programmatically via the SDK
     python copy

     ctx = interpreter.create_context(language="python")
     contexts = interpreter.list_contexts()
     interpreter.delete_contexts(language="java")

     Run code with explicit language specification using the new convenience argument
     python copy

     result = interpreter.run("print('hello')", language="python")

     • Adds create_context, get_context, list_contexts, delete_context, and delete_contexts(language) methods for code context management
     • Supports language argument in run() method to specify execution language (e.g., python) with automatic server-side default context selection

     2 details in Everything

     └──▷ BREAKING ON UPGRADE

     • !CodeInterpreter no longer re-exports sandbox operations (endpoint/info/metrics/renew/pause/resume/kill); use interpreter.sandbox instead.
128. java/sandbox/v1.0.1 Jan 13, 2026 · release notes

     OpenSandbox SDK adds resumer entrypoint, extension map support, and /v1 API base URL.

     └──▷ GET THIS VERSION

     copy

     $ git clone --branch java/sandbox/v1.0.1 https://github.com/opensandbox-group/OpenSandbox.git
     # already have the repo? check out this version:
     $ git checkout java/sandbox/v1.0.1

     • ConnectionConfig.getBaseUrl() now automatically appends /v1 to the base URL.
     • Sandbox.id is now a String instead of UUIDUUIDA universally unique identifier, usually a 128-bit value used to identify an object across systems. It is designed to make independently generated identifiers unlikely to collide..
     • Adds skipHealthCheck option for create, connect, and resume flows.
     • Adds dedicated Sandbox.resumer() entrypoint for resuming sandbox sessions.
     • Sandbox create supports extensions: Map<String, String> parameter.

     5 details in Everything

     └──▷ BREAKING ON UPGRADE

     • !ConnectionConfig.getBaseUrl() now appends /v1 and normalizes trailing slashes.
     • !Sandbox.id changed from UUID to String.
129. python/sandbox/v0.1.1 Jan 13, 2026 · release notes

     OpenSandbox v0.1.1 adds skip_health_check flag, extension support, SandboxState constants, and response return for renew.

     └──▷ GET THIS VERSION

     copy

     $ git clone --branch python/sandbox/v0.1.1 https://github.com/opensandbox-group/OpenSandbox.git
     # already have the repo? check out this version:
     $ git checkout python/sandbox/v0.1.1

     └──▷ USE IT
     Bypass slow health checks when creating a sandbox for quick local testing.
     python copy

     sandbox.create(skip_health_check=True)

     Pass custom extensions when provisioning a new sandbox environment.
     python copy

     sandbox.create(extensions=['extension-a', 'extension-b'])

     Check when an renewed sandbox expires using the new response object.
     python copy

     response = sandbox.renew()
     print(response.expires_at)

     • Adds skip_health_check parameter to Sandbox.create(...), Sandbox.connect(...), and Sandbox.resume(...) to bypass readiness checks
     • Adds extensions parameter to sandbox creation request, passed through to the lifecycle API
     • Adds SandboxState constants for expanded sandbox lifecycle state modeling
     • Sandbox.renew(...) and SandboxManager.renew_sandbox(...) now return a SandboxRenewResponse object containing expires_at

     4 details in Everything

     └──▷ BREAKING ON UPGRADE

     • !The API base URL now requires /v1; ConnectionConfig.get_base_url() appends /v1, so if OPEN_SANDBOX_DOMAIN already contained /v1 you must remove it to avoid a double suffix.
     • !Sandbox IDs have changed from UUIDUUIDA universally unique identifier, usually a 128-bit value used to identify an object across systems. It is designed to make independently generated identifiers unlikely to collide. type to str type across Sandbox, SandboxManager, and lifecycle models like SandboxInfo and SandboxCreateResponse.
130. docker/ingress/v1.0.0 Jan 8, 2026 · release notes

     OpenSandbox v1.0.0 adds a Kubernetes-native ingress controller for transparent L7 proxy routing.

     └──▷ GET THIS VERSION

     copy

     $ git clone --branch docker/ingress/v1.0.0 https://github.com/opensandbox-group/OpenSandbox.git
     # already have the repo? check out this version:
     $ git checkout docker/ingress/v1.0.0

131. docker/execd/v1.0.1 Jan 7, 2026 · release notes

     OpenSandbox execd v1.0.1 adds Windows support, CR-delimited output, and beta command status APIs

     └──▷ GET THIS VERSION

     copy

     $ git clone --branch docker/execd/v1.0.1 https://github.com/opensandbox-group/OpenSandbox.git
     # already have the repo? check out this version:
     $ git checkout docker/execd/v1.0.1

     • Adds Windows platform support for the execd image.
     • Supports CR-delimited output format for command responses.
     • [beta] Exposes API endpoints to get command status and output, including exit info with RFC3339 timestamps.

     3 details in Everything