🚀 Announcing Agent Sandbox v1.0.1!

We're excited to announce the release of Agent Sandbox v1.0.1! This release introduces the foundational TypeScript SDK for sandbox resource management, adds a first-class OpenHands agent workspace integration, hardens SDK lifecycle teardown and pod resolution, refines testing benchmarks, and resolves key bugs across documentation, metrics, and examples.

Key Highlights

SDKs & Integrations

TypeScript SDK Resource Layer (#976): Introduced the initial TypeScript client (agentic-sandbox-client) under clients/typescript/ for managing SandboxClaim lifecycles, watching sandbox readiness, and optional OpenTelemetry tracing.
OpenHands Workspace Integration (#1488): Added AgentSandboxWorkspace, enabling the OpenHands agent SDK to bind to pre-warmed Agent Sandbox pods with sub-second startup latency, supporting direct pod IP access, sandbox-router mode, and pool-level authentication.
Python SDK atexit Cleanup Fix (#1512): Switched AsyncSandboxClient process exit cleanup to a synchronous client to resolve an interpreter shutdown race condition that caused sandbox resource leaks.
SDK Pod Name Fallback (#1467): Ensured Go and Python SDKs correctly fall back to the Sandbox name when the legacy agents.x-k8s.io/pod-name annotation is present but empty.

Testing & Reliability

Runtime Burst Benchmarking Improvements (#1485): Refactored TestRuntimeClassBurstRecovery to provision fresh warm pools per iteration, eliminating stale controller expectations and classifying claim latency into clear Green (≤1s), Grey (>1s), and Cold zones.
Accurate Metric Documentation (#1443): Corrected Prometheus metric HELP strings and label documentation across internal metrics collectors to match controller behavior.

Examples & Documentation

Sandboxd Quickstart & Topologies (#1416): Added an end-to-end Go SDK quickstart for sandboxd along with dedicated runtime container and binary-injection deployment topology configurations.
SandboxClaim Label-Domain Allowlist Docs (#1530): Documented the SandboxClaim.spec.additionalPodMetadata.labels allowlist and improved controller rejection error messages to reference the agent-sandbox-config ConfigMap.
Command Governance Policy Example (#1456): Added an example demonstrating client-side command classification and pre-execution filtering before dispatching commands to a running sandbox.
Sandboxed Tools Refactoring (#1482): Extracted the interactive sandboxed-tools agent loop into an importable pkg/agent package with a dedicated CLI.
Gateway API Examples(#1331, #1471): Expanded Gateway API documentation beyond GKE to include Istio and other providers, and audited manifests, schemas, and instructions across the examples repository.

Installation

Standard Install (Core + Extensions)

Recommended for most users and GitOps engines (Argo CD, Config Sync, kustomize):

kubectl apply -f https://github.com/kubernetes-sigs/agent-sandbox/releases/download/v1.0.1/sandbox-with-extensions.yaml

Selective Install

Install components separately:

# Core only:
kubectl apply -f https://github.com/kubernetes-sigs/agent-sandbox/releases/download/v1.0.1/sandbox.yaml

# Extensions (opt-in):
kubectl apply -f https://github.com/kubernetes-sigs/agent-sandbox/releases/download/v1.0.1/extensions.yaml

Python SDK

pip install k8s-agent-sandbox==1.0.1

Contributors

We extend our sincere thanks to all contributors to this release:
@Oneimu, @adibmbrk, @aditya-shantanu, @app/dependabot, @briankhoi, @dongjiang1989, @esposem, @hchenxa, @janetkuo, @justinsb, @karimad, @khirotaka, @kincoy, @lunarwhite, @pujitha24, @sairajp-rewind, @tomergee, @vvoronko

New Contributors

@adibmbrk made their first contribution in #1486
@khirotaka made their first contribution in #976

Full Changelog: v1.0.0...v1.0.1

kubernetes-sigs/agent-sandbox v1.0.1 on GitHub