github kubernetes-sigs/agent-sandbox v1.0.11
on GitHub

one hour ago

🚀 Announcing Agent Sandbox v1.0.11!

We're excited to announce the release of Agent Sandbox v1.0.11! This release introduces browser path prefix routing in the sandbox router, expanded file operation capabilities and router-tunnel connection support across SDKs, critical controller stability and claim lifecycle fixes, hardened daemon security checks, and new examples for AWS Nitro Sandboxes on EKS and multi-cluster sandbox fleets.

⚠️ Breaking Changes / Action Required

  • Sandbox Router Path-Routing Response Rewriting (#2203): Path-routed requests now automatically rewrite upstream Set-Cookie paths and redirect Location headers under the routing prefix by default. Set --path-routing-rewrite-responses=false if your deployment requires legacy pass-through behavior.
  • Python SDK Signal Timeout Error (TimeoutError) (#2216): Process signaling in the Python SDK now enforces a configurable default timeout of 5 seconds and raises TimeoutError instead of RuntimeError when a deadline is exceeded.
  • Metrics Metric Label Addition (operating_mode) (#2174): The agent_sandboxes gauge metric now includes an operating_mode label (Running or Suspended). Raw unaggregated PromQL queries may see split series and should be updated to use sum by (...).

Key Highlights

Core Controller & Extensions

  • Pod Termination Status Precision (#2021): Fixed an issue where Sandbox resources reported Ready=True while their backing Pod was terminating. The controller now marks the Sandbox Ready=False with reason PodTerminating until the Pod is fully removed.
  • Retained Warm Assignment Cleanup (#2182): Ensured expired SandboxClaims configured with the Retain shutdown policy clean up their owned warm Sandbox even if controller interruption occurred before claim status was persisted.

Networking & Sandbox Router

  • Browser Path Prefix Routing & Prefix Preservation (#2203): Added support for serving browser-based applications (like JupyterLab) through the router under a /<prefix>/<namespace>/<id>/<port>/ path. Added --path-routing-preserve-prefix for applications configured with their own base URL and automatic response header/cookie path rewriting.
  • Request Body Preservation on Dial Retries (#2202): Fixed an issue where retrying dial connections to starting sandboxes caused requests with payloads (such as file writes or process execution) to fail with 502 Bad Gateway due to closed request bodies.
  • Preserve Escaped Paths for Header Routing (#2210): The router now forwards the original RawPath on header-routed requests, preventing percent-encoded slashes (%2F) from triggering HTTP 307 Temporary Redirect responses from sandboxd.
  • gRPC-Web Mid-Stream Deadlines (#2196): Mapped mid-stream RPC timeouts in gRPC-Web responses to DeadlineExceeded (grpc-status: 4) instead of Unavailable (14).

Daemon & Runtime (sandboxd)

  • PTY Stdin EOF Rejection (#2225): sandboxd now rejects EOF on PTY stdin streams with FAILED_PRECONDITION rather than closing the master terminal descriptor, preventing SIGHUP drops. Clients should send 0x04 (Ctrl-D) to signal end of input.
  • Named Pipe and Special File Protection (#2222): File transfer endpoints (GET, HEAD, append) now open descriptors with O_NONBLOCK and reject named pipes (FIFOs) and device files with INVALID_ARGUMENT, preventing indefinite handler hangs.
  • Safe Symlink Deletion (#2218): DELETE /v1/files/{path} now removes the symlink itself rather than following it and deleting the target file or root directory.
  • Router Token Header Authentication (#2164): sandboxd now accepts authentication tokens via the X-Sandboxd-Token header, enabling authenticated communication through proxies that strip standard Authorization headers.

SDKs & Client Libraries

  • Python SDK Enhancements & Fixes:
    • Added mkdir, move, and copy operations to files for both sync and async clients (#2177).
    • Added append and create_only options to files.write() (#2219).
    • Added SandboxdRouterTunnelConnectionConfig for tunneling REST and gRPC calls to sandboxd via sandbox-router over port-forward (#2169), with auth_token sent as X-Sandboxd-Token (#2200).
    • Fixed get_sandbox() handle management to prevent closing shared handles during transient lookup errors or leaking handles during async races (#2229), and replaced stale handles when claims rebind (#2187).
    • Updated claim adoption in create_sandbox(adopt_existing=True) to only adopt on AlreadyExists errors (#2190).
    • Updated claim readiness watches to ignore stale failure conditions reported for older claim generations (#2205).
    • Added client discovery latency recording (sandbox_client_discovery_latency_ms) to the async connector (#2226).
  • Go SDK Updates:
    • Added WithRecursive and WithMaxDepth options to Files.List for recursive directory listing on sandboxd (#2240).
    • Added WithAppend and WithCreateOnly options to Files.Write and Files.WriteReader (#2228).
    • Added Options.SandboxdAuthToken to send bearer tokens directly or via X-Sandboxd-Token through the router (#2206).
    • Applied RequestTimeout to Run on sandboxd when no context deadline is set (#2221).
    • Ensured ErrSandboxDeleted is only returned when a claim lookup returns NotFound, preventing transient errors from falsely reporting sandbox deletion (#2223).
  • TypeScript SDK Parity (#2241):
    • Updated files.write and files.writeStream to validate and reject combining append and createOnly options before connecting.
  • Path Normalization Across SDKs (#2211):
    • Updated Go, Python, and TypeScript SDKs to send literal / separators to sandboxd and reject invalid .. path traversals.

Examples & Integrations

  • AWS Nitro Sandbox on Amazon EKS (#2239): Added an end-to-end example demonstrating browser-based VS Code (code-server) isolated with AWS Nitro Enclaves and kernel isolation on Amazon EKS Auto Mode.
  • Scoped-Token MCP Server Sandbox (#2207): Added an end-to-end example running a Model Context Protocol (MCP) server reached securely via sandbox-router using --authz-mode=scoped-token.
  • Multi-Cluster Multi-Tenant RL Example (#2170): Expanded the multi-tenant reinforcement learning sandbox example to manage quotas, placement, and pre-pulling across multiple Kubernetes clusters simultaneously.

Installation

Standard Install (Core + Extensions)

Recommended for most users and GitOps engines (Argo CD, Config Sync, kustomize): 

kubectl apply -f https://github.com/kubernetes-sigs/agent-sandbox/releases/download/v1.0.11/sandbox-with-extensions.yaml

Selective Install

Install components separately: 

# Core only:
kubectl apply -f https://github.com/kubernetes-sigs/agent-sandbox/releases/download/v1.0.11/sandbox.yaml

# Extensions (opt-in):
kubectl apply -f https://github.com/kubernetes-sigs/agent-sandbox/releases/download/v1.0.11/extensions.yaml

Python SDK

pip install k8s-agent-sandbox==1.0.11

Contributors

We extend our sincere thanks to all contributors to this release:
@Oneimu, @Sean-790761, @aditya-shantanu, @costajohnt, @csantanapr, @dongjiang1989, @ericcurtin, @hsinhoyeh, @janetkuo, @jonyhy96, @karimad, @lbarrosby, @lilong555, @lunarwhite, @pbxqdown, @thuongvu, @tomergee

New Contributors

Full Changelog: v1.0.10...v1.0.11

Check out latest releases or
releases around kubernetes-sigs/agent-sandbox v1.0.11

Don't miss a new agent-sandbox release

NewReleases is sending notifications on new releases.

Get notifications