OpenSandbox — The Cyber Toolchain

OpenSandbox release-1.2.0

Tue, 27 Oct 2026 12:50:49 GMT

OpenSandbox 1.2.0 ships auto-pause/wake, Credential Vault API, OCI registry snapshots, and a diagnostics context endpoint across all five SDKs.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠ • Adds `lifecycle.idlePolicy` create field (with `idleTimeoutSeconds` 30–86400, `onIdle: pause`, `wakeOnAccess`, and optional `activeProbe`) to enable auto-pause and wake-on-access for fast sandboxes, with server config moving under `[automation.idle_pause]` (requiring `redis.dsn` when the sweeper is enabled), and typed client support with fail-fast validation and a wake-retry contract added to all five SDKs: on a `503` with `OpenSandbox-Wake: expired`, SDKs retry after `Retry-After` up to a bounded budget (default 5 attempts / 60 s) and raise a typed wake-timeout exception on exhaustion, with stream-start wake-retry active in JavaScript, Python, and Go.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠ • Adds Credential Vault support for fast sandboxes: a `POST|GET|PATCH|DELETE /v1/sandboxes/{id}/credential-vault` API with credential values sanitized on every public read and `expectedRevision` as the cross-replica PATCH backstop, plus a Credential Vault client contract added to all five SDKs that routes vault calls through the server for template-backed sandboxes. • Adds `GET /v1/sandboxes/{sandboxId}/diagnostics/context` endpoint returning sandbox ID, lifecycle state, backend type, and backend-defined identifiers for Docker, Kubernetes, and Fast Sandbox without connecting to execd; unsupported extension backends return 501. • Adds `[kubernetes] template_mitm_ca_secret` server config (default off) to bake a pinned MITM CA into server-created SandboxTemplates via `spec.egressMitmCertificate`, so an egress restart no longer rotates the trust anchor under live sandboxes. • Adds `lifecycle.renewalPolicy.extendSeconds` (300–86400) structured field (OSEP-0009), replacing the opaque `extensions['access.renew.extend.seconds']` key; the legacy key is deprecated through 1.x and removed in 2.0. • Supports publishing Fast Sandbox snapshots and template builds to, and booting from, OCI registries via OverlayBD OCI lifecycle. • Removes whole-call timeouts from SDK file transfers in all five languages, eliminating the 30 s default cap that caused large or slow transfers to fail mid-flight. • Adds `OpenSandbox-Skip-Activity` sentinel header to suppress one activity observation on the idle sweeper, stripped on both gateway and proxy hops. • Adds preflight rejection of gVisor snapshots unless effective args include `--overlay2=none`, preventing silent write-drop on `docker commit` under gVisor's default `--overlay2=root:self`. • Passes through podman `pasta`, `slirp4netns`, and `none` network modes (with `networkPolicy` rejected, since there is no bridge to attach to). Breaking changes: • The `extensions['access.renew.extend.seconds']` key is deprecated and fast sandboxes now reject it with 400 instead of silently accepting a no-op; migrate to `lifecycle.renewalPolicy.extendSeconds` before upgrading to 2.0, where the legacy key is removed. Full history on Cyber Toolchain: https://cybertoolchain.io/tools/opensandbox

OpenSandbox release-1.2.0-rc.1 (Prerelease)

Thu, 15 Oct 2026 09:20:43 GMT

OpenSandbox 1.2.0-rc.1 adds auto-pause/wake-on-access for fast sandboxes, an experimental egress sidecar, OOM kill reporting, and sandbox-scoped CPU/memory metrics.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠ • Adds `lifecycle.idlePolicy` create field (with `idleTimeoutSeconds` 30–86400, `onIdle: pause`, `wakeOnAccess`, and optional `activeProbe`) to opt fast sandboxes into server-side auto-pause and wake-on-access (OSEP-0024); the policy persists as the `sandbox.opensandbox.io/idle-policy` Sandbox CR annotation and is off by default.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠ • Moves idle-pause configuration from `[idle_pause]` to `[automation.idle_pause]`, removes the redundant `redis.enabled` gate, and requires `redis.dsn` (validated at load) when `enabled = true`. • Adds the `OpenSandbox-Skip-Activity: skip` request header sentinel to suppress ingress activity observation for a single request (stripped at both gateway and server-proxy hops). • Adds wake-retry contract to all five SDKs: on a `503` carrying the `OpenSandbox-Wake: expired` gateway header, the SDK resends after `Retry-After` within a bounded budget (default 5 attempts / 60 s, configurable per client); exhaustion raises a typed wake-timeout exception carrying attempt count and waited time. • Adds an experimental opt-in egress sidecar with live credential-bound Vault admission, HTTP/2 support with bounded drain, atomic policy-file persistence, and runtime fault containment (OSEP-0023). • Adds OOM kill reporting in execd via cgroupfs polling: polls the sandbox cgroup every 5 s, diffs `memory.events` (cgroup v2; best-effort v1), and exports the `execd.system.oom.kills` metric with a `local`/`descendant` level attribute plus structured warn logs with best-effort victim attribution. • Adds sandbox-scoped CPU/memory metrics in execd: when the sandbox cgroup carries configured limits, `execd.system.cpu.usage` and `execd.system.memory.usage_bytes` now read from the sandbox's own cgroup (`cpu.stat`/`cpu.max`, `memory.current`/`memory.max`, with v1 fallback) instead of the host-wide `/proc` view via gopsutil. • Treats `pasta`, `slirp4netns`, and `none` as valid container-runtime network modes, passing them through to podman kernel-level networking; rejects `networkPolicy` for these modes since no bridge is available for the egress sidecar. • Retains a BatchSandbox in the lifecycle API (reporting `Stopping`) until foreground cascading deletion and cleanup finalizers complete, preventing a replacement sandbox from writing the same persistent directory before the old writer exits. Breaking changes: • The `[idle_pause]` config section is renamed to `[automation.idle_pause]`; the `redis.enabled` gate is removed and `redis.dsn` is now required (validated at load) when `enabled = true` — a previously silent non-start now fails loudly. • BatchSandbox pods now default to `restartPolicy: Never`; any workload relying on the previous implicit restart behavior must set an explicit `restartPolicy` in the pod template to preserve it. Full history on Cyber Toolchain: https://cybertoolchain.io/tools/opensandbox

OpenSandbox release-1.1.1

Fri, 09 Oct 2026 15:09:23 GMT

OpenSandbox 1.1.1 adds identity-bound filesystem ops, multi-overlay mounts, upstream proxy config, and tenant isolation across all five SDKs.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠ • Adds identity-bound filesystem operations via `/v1/filesystem/{uid}/{gid}` execd routes — backed by a per-request worker running with explicit Linux UID/GID credentials — exposed as `files_with_identity` (Python), `filesWithIdentity` (JavaScript, Kotlin, Go, C#) across all five SDKs.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠ • Adds `[egress.upstream_proxy]` config section (URL + optional authorization) that injects a chained upstream CONNECT proxy for both Docker and Kubernetes backends, with `ca_cert_path` (Docker) and `ca_secret_name` (Kubernetes) to trust private-CA `https://` proxies without replacing the system trust store. • Adds `[docker] publish_host` config key to bind bridge-mode sandbox ports to a specific host address (default `0.0.0.0`), preventing the tokenless execd port from appearing on public interfaces when set to `127.0.0.1` or the Docker bridge gateway. • Adds `commands.setEnv` across all five sandbox SDKs (Python async/sync, JavaScript, Kotlin/Java, Go, C#) for persistent runtime environment variable injection, appending `KEY=VALUE` to the sandbox env file at runtime. • Exposes `CreateIsolatedSessionRequest.overlays` (`{path, mode, persist}`) across the API and all five SDKs, enabling multiple independent overlay mounts per isolated session with separate host-tracked or ephemeral tmpfs uppers; `workspace` is retained as sugar and `SessionState` echoes the canonical list. • Implements pause/resume for the agent-sandbox provider by bridging to `spec.operatingMode` (`Running`/`Suspended`) on `agents.x-k8s.io/v1beta1`, with state derivation (`Paused`/`Pausing`/`Resuming`/`Terminated`) and 409 on invalid transitions. • Isolates tenants sharing one Kubernetes namespace via a new `opensandbox.io/tenant` stamp label — list/get/delete/pause/resume/proxy hide other tenants' labeled sandboxes as 404 while unlabeled legacy sandboxes remain visible until expiry. • Adds `kubernetes.insecure_skip_tls_verify` config key for ServiceAccount CA mismatches in Kubernetes multi-tenant deployments. • Accepts `env` on template create, baking it into the fast-sandbox golden image at `/etc/sandbox-init.env` (inheriting the source image's OCI `Config.Env`), supported across all five SDKs. • Maps proxied backend failures to typed HTTP statuses: read/write timeouts return 504 `BACKEND_TIMEOUT`, mid-response resets and protocol errors return 502 `BACKEND_RESPONSE_FAILED`, and connect failures return 502 `BACKEND_CONNECTION_FAILED`. Full history on Cyber Toolchain: https://cybertoolchain.io/tools/opensandbox

OpenSandbox release-1.1.1-rc.1 (Prerelease)

Mon, 28 Sep 2026 08:21:29 GMT

OpenSandbox: Adds `[egress.upstream_proxy]` config section to chain sandbox egress through a corporate CONNECT proxy on Docker and Kubernetes.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠ • Adds `OPENSANDBOX_EGRESS_UPSTREAM_PROXY` / `_AUTH` environment variables to route transparent-proxy egress through an upstream CONNECT proxy with SNI/Host-consistent authority and fail-closed startup validation. • Adds `osb template create|get|list|delete` and `osb snapshot ...` CLI subcommands, plus `--template` and `--snapshot-id` flags on `sandbox create`, for template and snapshot management. • Adds kubectl-style `-f`/`--file` flag to `sandbox create` and `template create` for full wire-format request files with strict unknown-field rejection. • Adds `OpenSandbox-Access-Renew: skip` request header to opt individual requests out of access renew intents, for health probes and heartbeat-style traffic. Full history on Cyber Toolchain: https://cybertoolchain.io/tools/opensandbox

OpenSandbox release-1.1.0

Mon, 21 Sep 2026 07:46:25 GMT

OpenSandbox 1.1.0 debuts Firecracker FastPath sandboxes, a PostgreSQL snapshot store, lifecycle hooks, and a scoped diagnostics API⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠ • Adds `preStart` and `periodic` lifecycle hooks to sandbox create requests (OSEP-0020), validated server-side and serialized into a reserved environment variable for Kubernetes workloads; `preStart.timeoutSeconds` limit raised to 10800 seconds.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠ • Adds opt-in PostgreSQL snapshot store with pooled connections and CAS semantics, plus the one-shot `migrate-snapshots` command for moving existing SQLite records, and multi-process HA coordination for snapshot create/recovery/delete on Kubernetes. • Adds `[egress.resources]` config key for independent resource requests/limits on the Kubernetes egress sidecar. • Adds `[egress] otlp_endpoint` config key so the egress sidecar exports metrics to an OpenTelemetry collector on both runtimes. • Adds `[egress] timeout_seconds` config key to make egress sidecar readiness wait configurable. • Adds `[proxy] resolve_internal` config key to make the reverse proxy's internal resolution configurable for deployments that cannot route to Docker bridge IPs. • Adds `sandbox_env` and `sandbox_binds` Docker-runtime-wide configuration keys, giving Docker parity with the Kubernetes pod template for fleet-wide CA bundles, proxies, and mounts. • Sources OSEP-0011 secure-access signing keys from the `OPENSANDBOX_SECURE_ACCESS_KEYS` environment variable or a Kubernetes Secret instead of plaintext chart values. • Injects `OPENSANDBOX_EGRESS_SANDBOX_ID` server-side so egress sidecar telemetry can no longer be spoofed by request environment variables. • Adds a stable, scoped diagnostics API with `logs:container|all` and `events:runtime|lifecycle|all` scopes, returning `400 DIAGNOSTICS_SCOPE_UNSUPPORTED` for unknown scopes and backward-compatible plain-text responses. • Adds the FastPath fleets lifecycle backend: create, renew, delete, and status mapping via FastPath v2, plus end-to-end fast-sandbox pause/resume with async 202 semantics and UID fencing. • Adds fast-sandbox snapshot support and fsb template management across all five SDKs. • Exports generic HTTP request metrics (request rate, error rate, latency) from the server over OTLP, complementing the SDK-reported create-duration histogram. • Rejects unsupported gVisor (`runsc`) snapshots before persistence with `409 SNAPSHOT::UNSUPPORTED_RUNTIME`. • Supports pool-only sandbox creation using `poolRef` without an entrypoint (previously rejected with HTTP 400), and surfaces pool back-pressure as HTTP 429 `KUBERNETES::POOL_CAPACITY_EXHAUSTED` with a `Retry-After` header. • Honors `image.auth` in create requests for the agent-sandbox provider with per-sandbox pull secrets garbage-collected with the Sandbox CR. • Adds sandbox lifecycle hook models (OSEP-0020) to the API spec and every SDK with consistent validation aligned to server ranges. • Defaults `CodeInterpreter` creation to a strict health check in every SDK language, blocking until both execd and the Jupyter kernel gateway are verified ready. Breaking changes: • The agent-sandbox provider and ingress informer migrate to `agents.x-k8s.io/v1beta1` (required by agent-sandbox v1.0.0), creating workloads with `operatingMode: Running` and `service: true`; existing workloads using the prior API version will break. • The `informer_enabled` flag is removed; the informer-backed cache is now the only Kubernetes read path and the flag can no longer be used to disable it. Full history on Cyber Toolchain: https://cybertoolchain.io/tools/opensandbox

OpenSandbox server/v0.2.3

Wed, 26 Aug 2026 09:39:29 GMT

OpenSandbox v0.2.3 adds sandbox lifecycle hooks, QEMU VMState pause/resume, pool exhaustion signaling, OTLP HTTP metrics, and secure-access key injection from Kubernetes Secrets. • Adds `kubernetes.pool_acquisition_timeout_seconds` config key (default 30s) so the server waits a bounded window on pool exhaustion, then returns HTTP 429 with `KUBERNETES::POOL_CAPACITY_EXHAUSTED` and `Retry-After: 5` instead of a generic 504. • Accepts `OPENSANDBOX_SECURE_ACCESS_KEYS` and `OPENSANDBOX_SECURE_ACCESS_ACTIVE_KEY` env overrides for secure-access signing keys; Helm chart adds `server.gateway.secureAccess.existingSecret` (mutually exclusive with plaintext `keys`) so GitOps flows never commit key material. • New `[docker]` config fields `sandbox_env` and `sandbox_binds` apply fleet-wide environment variables and host bind mounts to every Docker sandbox container (request `env` wins over `sandbox_env`; config binds precede request-derived binds). • New `[egress] timeout_seconds` config key (default 30s; non-positive values rejected) lets Docker deployments tune how long the server waits for the sidecar health endpoint. • Experimental `OPENSANDBOX_EGRESS_MITMPROXY_EXTRA_PORTS` env var appends extra TCP ports to the always-on 80/443 interception list (multiport cap of 15) for the egress transparent MITM. • Adds sandbox lifecycle hooks via `CreateSandboxRequest.lifecycle` (`preStart` / `periodic` types per OSEP-0020), transported to Kubernetes workloads via the reserved `OPEN_SANDBOX_LIFECYCLE` env; Docker explicitly rejects lifecycle requests. • Raises `preStart.timeoutSeconds` server and OpenAPI limit from 300s to 10800s (3 hours); the periodic limit stays at 300s. • Adds QEMU VMState pause/resume for runc-based sandboxes: opt-in capture of guest memory, vCPU, and device state via QMP migration, stored as separate OCI images keyed by immutable SHA-256 digests; supports pooled BatchSandbox pause, detachment, and standalone restoration. • Pool capacity exhaustion is now machine-identifiable: controller publishes a `PoolAllocationPending` / `PoolCapacityExhausted` condition. • `getSandbox` now surfaces an optional `Sandbox.allocation` block (`mode: pool`, `poolRef`, `state: allocated`) for confirmed Kubernetes pool allocations. • Adds generic HTTP request metrics via OTLP: a thin ASGI middleware exports `server.http.request.duration` (ms) with `http_method`, `http_route`, and `http_status_code` attributes; no-op when `[otel]` is disabled. • Diagnostics API now honors scopes: `logs: container|all` and `events: runtime|lifecycle|all`, with 400 `DIAGNOSTICS_SCOPE_UNSUPPORTED` for unknown scopes; deprecated no-`scope` responses still work with a `Deprecation` header. • Adds a FastPath v2 gRPC client wrapping all FastPathService RPCs with typed error mapping (`FastPathNotFound` → 404, etc.) as groundwork for fast-sandbox fleets backend (OSEP-0007); not yet wired as an active runtime. • Tenant namespaces are validated at startup (OSEP-0014): server fail-fast verifies every tenant namespace exists and is accessible, aggregating all failures into a single fatal error before serving traffic. Breaking changes: • `OPENSANDBOX_EGRESS_SANDBOX_ID` is now server-injected and removed from the env allowlist; requests that pass it in `env` receive HTTP 400 instead of a user-spoofable value. Full history on Cyber Toolchain: https://cybertoolchain.io/tools/opensandbox

OpenSandbox docker/execd/1.1.0

Wed, 26 Aug 2026 09:31:56 GMT

OpenSandbox execd 1.1.0 adds init-mode PID 1, pre-exec hardening with seccomp/Landlock, eBPF audit, and lifecycle hooks • Enables execd to run as PID 1 via `EXECD_INIT=1` (or server-side `runtime.execd_run_as_init`), providing a single reaper with signal forwarding (TERM/HUP/USR1/USR2/WINCH), entrypoint-owned exit-code propagation, and a subreaper fallback for the Pool path; classic topology unchanged and off by default. • Adds `GET /v1/isolated/capabilities` response field `hardening` object reporting per-layer state for the new `opensandbox-launcher` pre-exec hardening pipeline (env strip → KEEPCAPS → bounding-set trim → `no_new_privs` → identity drop → seccomp → execve); every layer degrades fail-open. • New `[landlock]` layer in `opensandbox-launcher` applies a filesystem allowlist; fails open below ABI/kernel 5.13 and reports state as `unsupported` in the `hardening` object. • Introduces `execd-ebpf` image variant (CGO + cilium/ebpf) that hooks exec/connect/privilege events via CO-RE, scoped to the sandbox cgroup, and emits a rotating JSONL audit log; requires kernel ≥5.10 with BTF. • Adds `preStart` and `periodic` lifecycle hooks via `CreateSandboxRequest.lifecycle`; config persists at `$HOME/.execd/lifecycle.toml` with `EXECD_LIFECYCLE_CONFIG` as an exact override path; hooks are transported internally via `OPEN_SANDBOX_LIFECYCLE` env (Kubernetes only — Docker provider rejects lifecycle requests). • OTLP egress auto-allow now honors `OTEL_EXPORTER_OTLP_METRICS_ENDPOINT` and `OTEL_EXPORTER_OTLP_ENDPOINT` environment variables in shared components. Full history on Cyber Toolchain: https://cybertoolchain.io/tools/opensandbox

OpenSandbox docker/execd/v1.1.0

Wed, 26 Aug 2026 09:31:56 GMT

• Adds `EXECD_INIT=1` environment variable to run execd as PID 1 with signal forwarding (TERM/HUP/USR1/USR2/WINCH), entrypoint-owned exit-code propagation, and a subreaper fallback for the Pool path; opt-in via server's `runtime.execd_run_as_init` for Docker/K8s Batch/Agent/Pool — classic topology unchanged and off by default. • Adds `CreateSandboxRequest.lifecycle` field supporting `preStart` and `periodic` lifecycle hooks (OSEP-0020), transported to the sandbox via `OPEN_SANDBOX_LIFECYCLE` env on Kubernetes; execd starts HTTP before `preStart` and only releases the user process after `preStart` succeeds. • Adds `$HOME/.execd/lifecycle.toml` as the persistent config path for lifecycle hooks, with `EXECD_LIFECYCLE_CONFIG` as an exact-path override; bootstrap sync and preStart shutdown are fail-closed with TERM/KILL watchdogs. Breaking changes: • The Kubernetes provider transports lifecycle hooks via the internal `OPEN_SANDBOX_LIFECYCLE` environment variable, which is stripped from user code; the Docker provider rejects lifecycle requests entirely — workloads relying on Docker-side lifecycle hooks will receive errors. Full history on Cyber Toolchain: https://cybertoolchain.io/tools/opensandbox

OpenSandbox python/sandbox/v0.1.16

Wed, 26 Aug 2026 08:01:49 GMT

OpenSandbox v0.1.16 adds retry transport with `RetryPolicy`, sandbox lifecycle hooks, background runs in isolated sessions, and pool capacity back-pressure signaling. • Adds configurable retry transport to async and sync clients with backoff, jitter, `Retry-After` handling, per-attempt timeouts, and an overall deadline; opt out with RetryPolicy.disabled() to restore previous fast-fail behavior. Retries are on by default for idempotent requests on HTTP 429, 502, and 503; streaming SSE requests bypass replay. • Adds `preStart` and periodic lifecycle hook parameters to `Sandbox.create` and `SandboxSync.create`, with server-authoritative timeout validation. • Enables isolated sessions to start detached background runs, poll run status, and retrieve incremental combined output; read-only workspaces reject background execution because they cannot persist run logs. • Exposes confirmed Pool allocation summaries in sandbox responses and adds execd init mode and hardening-layer state fields to isolated capabilities; fields are absent when the server cannot confirm the state. • Surfaces exhausted Kubernetes Pool capacity as HTTP 429 with error code `KUBERNETES::POOL_CAPACITY_EXHAUSTED` and a `Retry-After` header instead of a generic readiness timeout; sandbox creation is not automatically replayed on this status. • Bounded concurrency for idle sandbox pool cleanup cuts 100-sandbox release time from approximately 8.3 seconds to 0.8 seconds. Full history on Cyber Toolchain: https://cybertoolchain.io/tools/opensandbox

OpenSandbox java/sandbox/v1.0.19

Tue, 25 Aug 2026 11:23:59 GMT

OpenSandbox v1.0.19 adds async pool warmup with OpenTelemetry tracing, lifecycle hooks, detached session runs, and richer runtime metadata. • Enables OpenTelemetry tracing for pool warmup phases via ConnectionConfig.enableTracing(true), covering queue wait and every warmup stage using the application's global SDK, exporter, sampler, and propagators. • Exposes `Sandbox.allocation` summary for confirmed Kubernetes Pool allocations as optional runtime metadata in the SDK. • Adds `preStart` and `periodic` lifecycle hook models accepted at sandbox creation time. • Adds shared OkHttp connection pool ownership in `SandboxPool`, sized from `warmupConcurrency`, reused across warmup, acquire, and direct-create paths, and evicted on shutdown. • Supports detached background runs inside persistent isolated sessions for Kotlin consumers, with incremental log polling bounded by session lifetime. • Models execd hardening capability results as part of richer runtime metadata exposed in the SDK. • Stages pool refill into a separate async pipeline covering create, readiness, prepare, post-prepare health checking, renewal, and commit, with per-pool rate-limited create admission via `warmupCreateQps`. Breaking changes: • SandboxPool.Builder.reconcileInterval(...) and the corresponding `PoolConfig` setting have been removed; pool reconciliation now runs on a fixed one-second cadence. Callers must delete all uses of `reconcileInterval` with no replacement. Full history on Cyber Toolchain: https://cybertoolchain.io/tools/opensandbox

OpenSandbox docker/egress/v1.1.7

Fri, 21 Aug 2026 14:52:23 GMT

Egress sidecar now auto-allows its own OTLP metric export endpoint via `OTEL_EXPORTER_OTLP_METRICS_ENDPOINT` or `OTEL_EXPORTER_OTLP_ENDPOINT`. • Adds automatic always-allow egress rule for the sidecar's own OTLP metric export: reads `OTEL_EXPORTER_OTLP_METRICS_ENDPOINT` (preferred) or `OTEL_EXPORTER_OTLP_ENDPOINT` at startup and injects the destination into the deny-all policy — domains via the DNS proxy, IPs into the static nft allow sets — surviving policy updates and reloads, with `deny.always` still taking precedence. Full history on Cyber Toolchain: https://cybertoolchain.io/tools/opensandbox

OpenSandbox docker/execd/v1.0.22

Thu, 13 Aug 2026 06:30:07 GMT

OpenSandbox execd v1.0.22 adds background runs, read-only PTY viewers, SDK attach(), and uid_mode probing • Adds `background: true` to the `run` API, returning a JSON handle; new `runs/{runId}` and `runs/{runId}/logs` endpoints enable status polling for long-running sessions without blocking the caller. • Adds `?mode=viewer` query parameter to PTY sessions, letting multiple read-only clients watch a live PTY alongside the exclusive holder, with replay, live output, and backpressure isolation. • Adds attach(sessionId) to all five SDKs, rebuilding a fully functional session handle from a bare session ID (e.g. after a worker restart); `SessionState` now echoes creation parameters. • Adds `uid_mode` availability probing: execd independently probes `setpriv`/`userns` support and returns `503 NOT_SUPPORTED` for unavailable isolation modes instead of failing all isolation globally. • Private-network sessions with `share_net: false` now bind-pin the workload NetNS/UserNS and return a retryable `503` on failure, failing closed at startup. Breaking changes: • `share_net: false` sessions now fail closed at startup: execd must successfully bind-pin the workload NetNS/UserNS or it returns a retryable `503`; previously, failure did not block session creation. Full history on Cyber Toolchain: https://cybertoolchain.io/tools/opensandbox

OpenSandbox java/sandbox/v1.0.15

Thu, 25 Jun 2026 07:08:57 GMT

OpenSandbox v1.0.15 adds custom SandboxPool creators and isolated-session SDK APIs. • `SandboxPool` accepts a custom creator function to control sandbox instance construction while retaining pool-level lifecycle management. • Kotlin `Sandbox` SDK exposes models, services, and adapters for creating and deleting isolated execution sessions with isolated filesystem operations. Full history on Cyber Toolchain: https://cybertoolchain.io/tools/opensandbox

OpenSandbox python/sandbox/v0.1.13

Thu, 25 Jun 2026 06:52:41 GMT

OpenSandbox v0.1.13 adds custom sandbox creators to SandboxPool and isolated session/client APIs. • Adds `custom_sandbox_creator` configuration to `SandboxPool` for client-side pool management • Exposes generated isolated-session and isolated-filesystem clients in the Python SDK Full history on Cyber Toolchain: https://cybertoolchain.io/tools/opensandbox

OpenSandbox java/code-interpreter/v1.0.14

Mon, 22 Jun 2026 10:27:48 GMT

Adds SandboxManager.waitForSnapshotReady() method and `SnapshotState` constants for snapshot readiness polling • SandboxManager.waitForSnapshotReady(snapshotId, timeout, pollingInterval) now allows blocking calls until a snapshot reaches the `Ready` state, replacing manual polling logic. • New `SnapshotState` constants (`Creating`, `Ready`, `Failed`, `Deleting`, `Unknown`) are available for state comparison without using magic strings. Full history on Cyber Toolchain: https://cybertoolchain.io/tools/opensandbox

OpenSandbox java/sandbox/v1.0.14

Mon, 22 Jun 2026 08:17:15 GMT

New SandboxManager.waitForSnapshotReady method and SnapshotState constants • Adds SandboxManager.waitForSnapshotReady(snapshotId, timeout, pollingInterval) to block until a snapshot reaches Ready state • Adds `SnapshotState` constants (`Creating`, `Ready`, `Failed`, `Deleting`, `Unknown`) for state comparison without magic strings Full history on Cyber Toolchain: https://cybertoolchain.io/tools/opensandbox

OpenSandbox docker/ingress/v1.0.8

Mon, 22 Jun 2026 02:39:39 GMT

Ingress now auto-discovers OTLP endpoint via HOST_IP env var or /etc/hostinfo when no exporter endpoint is configured • `OTEL_EXPORTER_OTLP_METRICS_ENDPOINT` and `OTEL_EXPORTER_OTLP_ENDPOINT` are now optional; ingress defaults to `:4318` using `HOST_IP` (fallback `/etc/hostinfo`) • WebSocket proxy now forwards all headers except hop-by-hop and handshake-specific headers (replacing hardcoded whitelist) Full history on Cyber Toolchain: https://cybertoolchain.io/tools/opensandbox

OpenSandbox docker/egress/v1.1.2

Mon, 22 Jun 2026 02:32:44 GMT

OpenSandbox egress v1.1.2 adds full policy logging and automatic env var routing to the egress sidecar • `OPENSANDBOX_EGRESS_*` prefixed environment variables in `CreateSandboxRequest.env` are now automatically routed to the egress sidecar instead of the main sandbox container, with reserved vars (`OPENSANBOX_EGRESS_RULES`, `OPENSANBOX_EGRESS_MODE`, `OPENSANBOX_EGRESS_TOKEN`) blocked. Full history on Cyber Toolchain: https://cybertoolchain.io/tools/opensandbox

OpenSandbox java/code-interpreter/v1.0.13

Tue, 16 Jun 2026 08:31:16 GMT

OpenSandbox v1.0.13 adds paginated file reads and directory listing API • Adds `offset` and `limit` query parameters to `GET /files/download` for line-based pagination of large text files • Adds a new execd directory API endpoint supporting depth control, entry type reporting (`file`, `directory`, `symlink`, `other`), and symlink traversal controls Breaking changes: • Code Interpreter runtime paths have moved from `/opt/opensandbox` to `/opt/code-interpreter`. If you hardcoded `/opt/opensandbox/code-interpreter.sh`, `/opt/opensandbox/code-interpreter-env.sh`, or `/opt/opensandbox/jupyter.log`, update them to `/opt/code-interpreter/code-interpreter.sh`, `/opt/code-interpreter/code-interpreter-env.sh`, and `/opt/code-interpreter/jupyter.log`. Full history on Cyber Toolchain: https://cybertoolchain.io/tools/opensandbox

OpenSandbox sdks/sandbox/go/v1.0.3

Tue, 16 Jun 2026 08:11:33 GMT

OpenSandbox Go SDK v1.0.3 adds credential vault support, directory listing, line-based file reads, and configurable resource requests for sandboxes. • Adds `resourceRequests` field to sandbox creation API to set Kubernetes resource requests independently from limits • Adds line-based file reads via `GET /files/download?offset=&limit=` query parameters • Adds ListDirectory(ctx, path) and ListDirectoryWithDepth(ctx, path, depth) methods to the Go SDK for directory listing • Adds `CredentialVault` model and adapter support to the Go SDK surface Breaking changes: • The `CodeInterpreterEntrypoint` constant now points to `/opt/code-interpreter/code-interpreter.sh`; if you hardcoded the old path `/opt/opensandbox`, you must update your configuration or code when upgrading. Full history on Cyber Toolchain: https://cybertoolchain.io/tools/opensandbox

OpenSandbox csharp/sandbox/v0.1.3

Tue, 16 Jun 2026 08:11:22 GMT

OpenSandbox v0.1.3 adds `resourceRequests` for Kubernetes sandboxes, line-based file reads via API, directory listing API, replace feedback, and Credential Vault support • Adds `resourceRequests` to sandbox creation so Kubernetes-backed sandboxes can set resource requests separately from limits. • Adds line-based file reads through `GET /files/download` with `offset` and `limit` query parameters, enabling C# callers to read large text files by line range. • Adds directory listing support through the new execd directory API, with depth-controlled traversal and symlink reporting. • Adds detailed replace-content feedback via new methods that return per-file `replacedCount` results. • Adds Credential Vault support to the C# SDK surface. Full history on Cyber Toolchain: https://cybertoolchain.io/tools/opensandbox

OpenSandbox java/sandbox/v1.0.13

Tue, 16 Jun 2026 08:10:52 GMT

OpenSandbox v1.0.13 adds resourceRequests for sandboxes, offset/limit file download, directory listing API, replace-content feedback, and Credential Vault integration. • Adds `resourceRequests` field to sandbox creation payloads so Kubernetes-backed sandboxes can set resource requests separately from limits (omitting the field preserves existing behavior where requests match limits). • Adds `offset` and `limit` query parameters to `GET /files/download` for line-based file reads via the REST API. • Adds directory listing support through the new execd directory API with depth-controlled traversal and symlink handling. • Adds detailed replace-content feedback with per-file `replacedCount` results while keeping existing replace methods backward-compatible. • Adds Credential Vault support to the Kotlin/JVM SDK surface, including model, adapter, sandbox creation, and E2E coverage. Full history on Cyber Toolchain: https://cybertoolchain.io/tools/opensandbox

OpenSandbox python/sandbox/v0.1.11

Tue, 16 Jun 2026 08:10:35 GMT

OpenSandbox v0.1.11 adds resource request configuration, paginated file downloads, directory listing API, replace feedback, and Credential Vault support • Adds `resourceRequests` field to sandbox creation payload so Kubernetes-backed sandboxes can set resource requests separately from limits • Adds line-based file reads through `GET /files/download` with `offset` and `limit` query parameters for large text files • Adds directory listing support through the execd directory API, exposing depth-controlled traversal in the Python SDK • Adds detailed replace-content feedback via a new verbose parameter to detect no-match and multi-match replacements • Adds Credential Vault support to the Python SDK path aligned with multi-language coverage for credential injection flows Full history on Cyber Toolchain: https://cybertoolchain.io/tools/opensandbox

OpenSandbox js/sandbox/v0.1.9

Tue, 16 Jun 2026 08:10:20 GMT

OpenSandbox v0.1.9 adds resource requests, offset file downloads, directory listing and credential vault support • Adds `resourceRequests` field to sandbox creation for Kubernetes-backed sandboxes • Adds line-based file reads via `GET /files/download` with `offset` and `limit` query parameters • Adds depth-controlled directory traversal through the new execd directory API • Adds optional per-file `replacedCount` feedback in detailed replace methods • Adds Credential Vault support to the JavaScript SDK for credential injection Full history on Cyber Toolchain: https://cybertoolchain.io/tools/opensandbox

OpenSandbox docker/egress/v1.1.1

Tue, 16 Jun 2026 06:24:30 GMT

OpenSandbox v1.1.1 adds OPENSANDBOX_EGRESS_CREDENTIAL_VAULT_REQUIRE_TLS env var to enforce TLS for vault writes • Supports `X-Forwarded-Proto: https` header for TLS-terminating proxies when `OPENSANDBOX_EGRESS_CREDENTIAL_VAULT_REQUIRE_TLS` is enabled. Full history on Cyber Toolchain: https://cybertoolchain.io/tools/opensandbox

OpenSandbox server/v0.2.0

Mon, 15 Jun 2026 12:55:42 GMT

OpenSandbox v0.2.0 adds a Credential Vault system with CLI commands and SDK surfaces for injecting secrets into sandboxes. • Introduces the `Credential Vault`, a new credential injection system that allows sandboxes to consume secrets (API keys, OAuth tokens, HTTP headers, query parameters) without exposing raw values to user code. • Adds `osb credential-vault` CLI commands for managing the Credential Vault from the command line. • Exposes SDK surfaces for Python, Go, JS, Kotlin, and Java to interact with the Credential Vault. Breaking changes: • The execd install path is flattened from `/opt/opensandbox/bin/` to `/opt/opensandbox/`; binary paths like `/opt/opensandbox/bin/execd` become `/opt/opensandbox/execd`. • Custom Pool CR templates need updated mountPaths and env vars to reflect the flattened `/opt/opensandbox` directory structure. Full history on Cyber Toolchain: https://cybertoolchain.io/tools/opensandbox

OpenSandbox docker/execd/v1.0.19

Mon, 15 Jun 2026 06:17:01 GMT

OpenSandbox execd v1.0.19 adds PTY takeover, one-shot commands, directory/file listing, and OTLP auto-discovery. • Adds `?takeover=1` query parameter to `GET /pty/:sessionId/ws` for live PTY session handoff • Adds optional `command` field to `POST /pty` for one-shot terminal I/O • Adds `GET /directories/list` endpoint with depth-controlled traversal and `type` field to FileInfo responses • Adds `offset` and `limit` query parameters to `GET /files/download` for line-based file reading • Adds `replacedCount` field to `POST /files/replace` response for match detection • Adds OTLP endpoint auto-discovery via `HOST_IP` env var or `/etc/hostinfo` when OTEL exporters are unset Full history on Cyber Toolchain: https://cybertoolchain.io/tools/opensandbox

OpenSandbox docker/egress/v1.1.0

Fri, 12 Jun 2026 11:10:58 GMT

OpenSandbox egress v1.1.0 adds credential vault injection and moves Mitmproxy config to config.yaml • Egress participates in the credential vault injection pipeline, enabling sandboxes to receive injected credentials (API keys, tokens, OAuth) for outbound requests • Mitmproxy static options (`mode`, `listen_host`, `stream_large_bodies`, `ssl_verify_upstream_trusted_confdir`, `ignore_hosts`) are now declared in a baked-in `config.yaml` under the standard mitm confdir layout Breaking changes: • The environment variable `OPENSANDBOX_EGRESS_MITMPROXY_CONFDIR` is removed and will break config.yaml discovery if set • The environment variable `OPENSANDBOX_EGRESS_MITMPROXY_IGNORE_HOSTS` is removed; multi-host lists were silently truncated to the last value, now replaced by the yaml-native list in `config.yaml` Full history on Cyber Toolchain: https://cybertoolchain.io/tools/opensandbox

OpenSandbox docker/code-interpreter/v1.1.0

Thu, 11 Jun 2026 01:51:53 GMT

v1.1.0 adds Sigstore/cosign image signing and a seccomp-based clone3 fallback in execd • Adds `sigstore/cosign` keyless signing to Docker images with GitHub attestations for authenticity verification • Adds a seccomp-based `clone3` fallback to `execd` that switches to `clone` when the profile blocks `clone3` Breaking changes: • The entrypoint path is renamed from `/opt/opensandbox/code-interpreter.sh` to `/opt/code-interpreter/code-interpreter.sh` Full history on Cyber Toolchain: https://cybertoolchain.io/tools/opensandbox

OpenSandbox python/sandbox/v0.1.10

Mon, 08 Jun 2026 09:42:42 GMT

OpenSandbox v0.1.10 adds `skip_accumulation` for constant-memory streaming, `secure_access` for ingress headers, and PVC auto-provisioning SDK support • Adds `acquire_min_remaining_ttl` parameter to pool.acquire() to skip idle sandboxes nearing expiry • Adds `skip_accumulation` option to execution handlers to stream stdout/stderr with constant memory • Adds PVC auto-provisioning fields to the SDK model • Adds `secure_access` support for sandbox creation and endpoint access headers in Kubernetes ingress gateway mode Full history on Cyber Toolchain: https://cybertoolchain.io/tools/opensandbox

OpenSandbox sdks/sandbox/go/v1.0.2

Mon, 08 Jun 2026 08:57:37 GMT

OpenSandbox Go SDK v1.0.2 adds `skipAccumulation`, platform selection, and SecureAccess support • Adds `skipAccumulation` to execution handlers to prevent unbounded memory growth by delivering stdout/stderr events without appending them to accumulated logs • Adds `CreateSandboxRequest.Platform`, `SandboxInfo.Platform`, and `SandboxCreateOptions.Platform` fields for specifying OS/architecture targets like Windows • Adds SDK model support for PVC auto-provisioning fields • Adds `SecureAccess` support for sandbox creation, currently supported by Kubernetes ingress gateway mode Full history on Cyber Toolchain: https://cybertoolchain.io/tools/opensandbox

OpenSandbox csharp/sandbox/v0.1.2

Mon, 08 Jun 2026 08:57:22 GMT

OpenSandbox v0.1.2 adds `skipAccumulation`, PVC auto-provisioning SDK support, and `SecureAccess` headers • Adds `skipAccumulation` to execution handlers config to prevent unbounded memory growth for streamed commands • Adds SDK model support for PVC auto-provisioning fields • Adds opt-in `SecureAccess` support for sandbox creation and endpoint access headers in Kubernetes ingress gateway mode Full history on Cyber Toolchain: https://cybertoolchain.io/tools/opensandbox

OpenSandbox js/sandbox/v0.1.8

Mon, 08 Jun 2026 08:57:13 GMT

OpenSandbox v0.1.8 adds `skipAccumulation` for logs, PVC auto-provisioning fields, and `secureAccess` headers • Adds the `skipAccumulation` execution handler option to prevent unbounded memory growth during long-running streamed commands • Adds SDK model support for Persistent Volume Claim (PVC) auto-provisioning fields • Adds `secureAccess` option for sandbox creation and endpoint access headers in Kubernetes ingress gateway mode Full history on Cyber Toolchain: https://cybertoolchain.io/tools/opensandbox

OpenSandbox java/sandbox/v1.0.12

Mon, 08 Jun 2026 08:45:57 GMT

OpenSandbox v1.0.12 adds skipAccumulation, PVC auto-provisioning support, and secureAccess with log redaction • `Duration.ZERO` disables the sandbox expiry threshold to control idle pool behavior • SDK model support for PVC auto-provisioning fields enables automatic volume claims in sandbox builders • `secureAccess` flag enables endpoint header propagation and log redaction for sandbox builders and pool creation specs Breaking changes: • Command timeout APIs now use `java.time.Duration` as the primary public type; `kotlin.time.Duration` overloads are deprecated Full history on Cyber Toolchain: https://cybertoolchain.io/tools/opensandbox

OpenSandbox docker/egress/v1.0.13

Fri, 05 Jun 2026 11:02:08 GMT

OpenSandbox egress v1.0.13 adds a DELETE /policy API endpoint and supervisor-based restart reliability. • Adds the `DELETE /policy` HTTP endpoint to remove egress rules by accepting a JSON array of target strings • Introduces a dedicated supervisor process (`opensandbox-supervisor`) that manages egress lifecycle, implements exponential backoff with jitter and a crashloop circuit breaker, and forwards SIGTERM with a configurable 20-second grace period before SIGKILL • Adds an idempotent `cleanup.sh` script that runs as pre-start and post-exit hooks to reset iptables DNS REDIRECT rules, transparent-HTTP rules, the nftables `opensandbox` table, and stray mitmdump processes • Enables OTLP endpoint auto-discovery when `OTEL_EXPORTER_OTLP_METRICS_ENDPOINT` or `OTEL_EXPORTER_OTLP_ENDPOINT` is unset: resolves node IP from the `HOST_IP` environment variable (falling back to `/etc/hostinfo`) and points the exporter to `:4318` over plaintext Full history on Cyber Toolchain: https://cybertoolchain.io/tools/opensandbox

OpenSandbox docker/execd/v1.0.17

Tue, 19 May 2026 03:04:21 GMT

OpenSandbox execd v1.0.17 adds `EXECD_BOOTSTRAP_PRE_SCRIPT` env var for pre-bootstrap seeding • Adds support for the `EXECD_BOOTSTRAP_PRE_SCRIPT` environment variable to allow pre-bootstrap environment seeding Full history on Cyber Toolchain: https://cybertoolchain.io/tools/opensandbox

OpenSandbox server/v0.1.14

Mon, 18 May 2026 12:12:13 GMT

Adds Sandbox metadata PATCH endpoint and stable diagnostics CLI; unblocks event loop with concurrency knobs. • Adds `PATCH /sandboxes/{sandboxId}/metadata` endpoint for incremental label updates: pass a value to set/update, pass `null` to delete a key • Adds `osb diagnostics logs|events` subcommands to CLI/SDK with required `scope` argument; server returns `501 DIAGNOSTICS_NOT_IMPLEMENTED` until stable backend lands • Adds `[server]` config keys `workers`, `limit_concurrency`, `backlog`, `thread_pool_size`, `loop`, `http` to tune concurrency behavior • Adds `uvicorn[standard]` upgrade introducing uvloop, httptools, and watchfiles support Full history on Cyber Toolchain: https://cybertoolchain.io/tools/opensandbox

OpenSandbox sdks/sandbox/go/v1.0.1

Mon, 18 May 2026 08:26:36 GMT

OpenSandbox Go SDK v1.0.1 adds `UploadFiles`, sets `User-Agent` header by default, and enforces TLS 1.2 minimum. • Adds `UploadFiles` method on the `Sandbox` type to perform multipart uploads against `/files/upload` • Sets `OpenSandbox-Go-SDK/1.0.1` `User-Agent` header on all outgoing requests automatically Breaking changes: • `Sandbox.Close` / `SandboxManager.Close` now return `error` to satisfy `io.Closer` • TLS 1.2 minimum for SDK-created HTTP clients, enforcing the NIST 2030 minimum certificate key/hash length policy Full history on Cyber Toolchain: https://cybertoolchain.io/tools/opensandbox

OpenSandbox js/sandbox/v0.1.7

Fri, 15 May 2026 07:53:17 GMT

OpenSandbox JS SDK v0.1.7 adds platform constraints, PVC storage config, secure endpoints, signed URLs, pause/resume, snapshots, and metadata patching. • Sandbox.create() now accepts a `platform` argument to constrain the runtime OS/architecture • JS models include `createIfNotExists`, `storageClass`, `storage`, and `accessModes` fields for PVC auto-provisioning in Windows sandboxes • Sandbox.create() accepts a `secureAccess` option to preserve transport headers for secured Kubernetes gateway endpoints • New sandbox.getSignedEndpoint(port, expires) method generates time-limited signed route tokens • `Sandbox` and `SandboxManager` expose pause/resume lifecycle methods; Sandbox.resume(...) reconnects after resume • New Sandbox.patchMetadata(...) and SandboxManager.patchSandboxMetadata(...) methods for JSON merge-patch updates Full history on Cyber Toolchain: https://cybertoolchain.io/tools/opensandbox

OpenSandbox k8s/controller/v0.2.0

Fri, 15 May 2026 06:46:35 GMT

OpenSandbox k8s/controller/v0.2.0 adds pause/resume, public snapshot API, and secure runtimes. • Implements pause and resume operations for batchsandbox instances backed by rootfs snapshots • Adds support for a public snapshots API on the Kubernetes runtime • Enables auto-assignment of pools for batchsandbox workloads • Adds per-volume API fields to automatically create or delete PVCs and Docker volumes • Supports GVisor and Kata Containers as secure-container RuntimeClass options • Adds `scaleStrategy` configuration to control pool scaling behavior • Allows overriding the `api_key` environment variable via Helm values • Introduces a signed endpoint for secure route access per OSEP-0011 • Adds a recycle handler for pool management and optimizes pool controller synchronization Full history on Cyber Toolchain: https://cybertoolchain.io/tools/opensandbox

OpenSandbox helm/opensandbox/0.2.0

Fri, 15 May 2026 06:32:42 GMT

OpenSandbox 0.2.0 adds pause/resume capabilities with rootfs snapshot support for sandboxed workloads. • Implements `pause/resume` functionality with underlying `rootfs` snapshot support Full history on Cyber Toolchain: https://cybertoolchain.io/tools/opensandbox

OpenSandbox k8s/task-executor/v0.2.0

Fri, 15 May 2026 06:32:17 GMT

OpenSandbox v0.2.0 adds pause/resume with rootfs snapshots, public snapshot API, gVisor/Kata RuntimeClass support, and per-volume PVC/Docker volume management. • Adds `pause` and `resume` operations with rootfs snapshot support to suspend and restore task execution state • Adds support for the public snapshots API on the Kubernetes runtime for programmatic access to sandbox disk images • Adds gVisor and Kata RuntimeClass support via the new secure-container feature for enhanced isolation • Enables automatic PVC and Docker volume lifecycle management through per-volume API fields • Adds environment variable override capability for `api_key` via the Helm chart and server configuration Full history on Cyber Toolchain: https://cybertoolchain.io/tools/opensandbox

OpenSandbox cli/v0.1.1

Wed, 13 May 2026 03:09:56 GMT

OpenSandbox CLI v0.1.1 introduces stable `osb diagnostics` commands with scoped scope and structured output modes. • Adds stable `osb diagnostics logs` and `osb diagnostics events` subcommands that require an explicit diagnostic `scope` argument and support `table`, `json`, `yaml`, and `raw` output formats • Migrates `osb devops logs` and `osb devops events` to deprecated compatibility wrappers while preserving existing `--tail`, `--since`, and `--limit` flag behaviors Full history on Cyber Toolchain: https://cybertoolchain.io/tools/opensandbox

OpenSandbox docker/egress/v1.0.11

Wed, 13 May 2026 02:14:34 GMT

OpenSandbox egress v1.0.11 adds `connection_strategy=lazy` and `OPENSANDBOX_EGRESS_MITMPROXY_SSL_INSECURE` env var • Adds `connection_strategy=lazy` to mitmproxy to defer upstream connections until the full request is received, avoiding useless connections for intercepted or filtered requests. • Adds `OPENSANDBOX_EGRESS_MITMPROXY_SSL_INSECURE` environment variable (default `false`) to skip upstream TLS certificate verification when set to `true`, resolving IP address mismatch errors for direct IP connections. Full history on Cyber Toolchain: https://cybertoolchain.io/tools/opensandbox

OpenSandbox python/sandbox/v0.1.9

Tue, 12 May 2026 12:26:30 GMT

New metadata patch and stable diagnostics APIs in the OpenSandbox Python SDK v0.1.9 • Adds JSON merge-patch support for sandbox metadata via `Sandbox` / `SandboxManager` flows Full history on Cyber Toolchain: https://cybertoolchain.io/tools/opensandbox

OpenSandbox java/sandbox/v1.0.11

Tue, 12 May 2026 11:12:12 GMT

OpenSandbox v1.0.11 adds sandbox metadata patch and stable Diagnostics API to the Kotlin SDK • Adds `metadata` patch support via a new API in the Kotlin SDK to apply JSON merge-patch updates (including delete semantics for null values) on `Sandbox` and `SandboxManager` objects • Exposes stable Diagnostics API endpoints `getDiagnosticLogs` and `getDiagnosticEvents` on `Sandbox` and `SandboxManager` requiring a diagnostic `scope` argument Full history on Cyber Toolchain: https://cybertoolchain.io/tools/opensandbox

OpenSandbox python/sandbox/v0.1.8

Fri, 08 May 2026 07:21:45 GMT

OpenSandbox v0.1.8 adds snapshot APIs, Python sandbox pools, and secure endpoint access surfaces. • Add first-class Python sandbox pool support for both async and sync clients with single-node in-memory and optional Redis-backed distributed stores via `opensandbox[pool-redis]`. • Add snapshot APIs (`create`, `get`, `list`, `delete`) to the Python SDK, enabling creation of new sandboxes from a `snapshotId`. • Add secure endpoint access surfaces allowing `secureAccess` on sandbox creation and signed endpoint retrieval for short-lived sandbox route access without sharing static tokens. Full history on Cyber Toolchain: https://cybertoolchain.io/tools/opensandbox

OpenSandbox docker/execd/v1.0.15

Thu, 07 May 2026 10:04:07 GMT

OpenSandbox execd v1.0.15 adds `EXECD_ACCESS_TOKEN` env var for server access token configuration. • `ServerAccessToken` can now be set via `EXECD_ACCESS_TOKEN` environment variable as an alternative to the `--access-token` CLI flag. Full history on Cyber Toolchain: https://cybertoolchain.io/tools/opensandbox

OpenSandbox server/v0.1.13

Thu, 07 May 2026 07:27:57 GMT

New snapshot lifecycle APIs, signed endpoint URLs, and pause/resume controls in OpenSandbox server v0.1.13 • Adds snapshot lifecycle management with create/get/list/delete APIs and sandbox restore via `snapshotId` • Adds `GET /sandboxes/{sandboxId}/endpoints/{port}?expires=` endpoint for SHA256-signed, time-limited route access tokens • Adds `/pause` and `/resume` endpoints with SandboxSnapshot CRD support for Kubernetes pause/resume functionality • Adds `OPENSANDBOX_SERVER_API_KEY` environment variable to override the `server.api_key` TOML config setting Full history on Cyber Toolchain: https://cybertoolchain.io/tools/opensandbox

OpenSandbox java/sandbox/v1.0.10

Thu, 07 May 2026 04:44:27 GMT

OpenSandbox v1.0.10 adds snapshot lifecycle, secure endpoint access, signed API, Windows support, PVC auto-provisioning, custom execd port, and distributed pool. • Adds `snapshotId` to Kotlin SDK for sandbox creation from snapshots and full CRUD lifecycle flows (create/get/list/delete). • Adds `secureAccess` opt-in flag to Kotlin `Sandbox` creation for Kubernetes gateway mode with header propagation and redaction. • Adds signed endpoint retrieval API (`OSEP-0011`) via the Kotlin SDK for time-limited route tokens instead of static credentials. • Adds Windows OS platform support in Kotlin SDK models and converters. • Adds PVC auto-provisioning fields to Kotlin sandbox models for automatic volume creation on startup. • Adds execdPort(port: Int) method to `Sandbox.Connector` Builder/Resumer to target a custom execd port other than default `44772`. • Adds distributed `SandboxPool` support via the optional `sandbox-pool-redis` module for shared state coordination. Full history on Cyber Toolchain: https://cybertoolchain.io/tools/opensandbox