github kubernetes-sigs/agent-sandbox v1.0.8
on GitHub

3 hours ago

🚀 Announcing Agent Sandbox v1.0.8!

We're excited to announce the release of Agent Sandbox v1.0.8! Highlights: opt-in recovery from failed Pods, creation-latency metrics for directly created Sandboxes, GKE Pod Snapshot primitives for RL workloads, Go SDK provisioning parity with the Python SDK, bounded MCP command output, and hardened sandbox-router deployment credentials.

⚠️ Action Required

  • MCP execute_command output is now bounded (#1978): Combined stdout and stderr are capped at 30,000 Unicode code points by default. Output over the budget comes back as head-and-tail excerpts separated by [... N characters omitted ...] markers. The new max_output_chars parameter accepts 128–300,000. Responses include four new required fields: stdout_total_chars, stderr_total_chars, stdout_truncated, and stderr_truncated. The new default takes effect immediately, with no deprecation period.
    • Action: Set max_output_chars if you need longer output, or redirect verbose output to a file and read it separately. MCP clients that validate response schemas strictly must accept the new fields.
  • Sandbox router manifests are now a Kustomization (#1499): sandbox-router/deploy/ now contains a kustomization.yaml, so kubectl apply -f sandbox-router/deploy/ fails. The default install no longer includes rbac-tokenreview.yaml. The router's API token is now a projected token that expires after one hour (previously up to one year on clusters with token expiration extension enabled).
    • Action: Install with kubectl apply -k sandbox-router/deploy/. If you run --authz-mode=tokenreview, apply rbac-tokenreview.yaml separately. Otherwise, delete the sandbox-router-auth-delegator ClusterRoleBinding left behind by earlier installs; kubectl apply does not remove it.

Highlights

Core Controller

  • Opt-in recovery from Failed Pods (#1192): New spec.failedPodPolicy on Sandbox and SandboxTemplate. The default, Retain, keeps today's behavior: the Failed Pod stays and the Sandbox reports Finished=True. With Recreate, the controller deletes its Failed Pod and creates a replacement, keeping the Sandbox identity and Sandbox-owned PVCs. Repeated failures back off exponentially from 5s to 5m. The backoff resets after the replacement Pod has been Running for 10 minutes. Backoff state is in memory and resets on controller restart.
  • Creation latency for direct Sandboxes (#1076): The core SandboxReconciler now records agent_sandbox_creation_latency_ms, so Sandboxes created without a SandboxClaim get latency samples too. Labels are unchanged. For warm-pool Sandboxes, the sample is now recorded when the pool member becomes Ready, not when a claim adopts it. Sandboxes that exist when the controller starts are skipped, so a restart or leader failover can miss samples for Sandboxes that were still starting.
  • Ready message names the failing container (#2000): When a container can't start (ErrImagePull, ImagePullBackOff, CreateContainerConfigError, CrashLoopBackOff), the Ready condition message now names it. Condition reasons are unchanged.
  • API docs (#1976): Documented when podTemplate edits take effect, and that PVCs survive suspension and expiration.

SDKs

  • Go SDK provisioning parity (#1876): Added PodLabels, PodAnnotations, VolumeClaimTemplates, a fixed ClaimName with opt-in AdoptExisting, and per-call CreateOptions on Client.CreateSandbox (including WithShutdownAfter and WithSandboxReadyTimeout). A failed Open and EnableAutoCleanup never delete a claim you named explicitly. New and NewClient now copy Labels, Env, and the new map and slice options, so changing your maps after construction no longer affects later claims.
  • TypeScript SDK (#1942, #1948): New sandboxd.authToken sends a bearer token on every REST request and gRPC call to sandboxd. The TypeScript SDK README is now published on the docs site.
  • Python SDK:
    • Fixed sync kubectl port-forward tunnels (the default SandboxClient() tunnel and SandboxdPodTunnelStrategy) hanging after about 2,180 connections because kubectl's stdout was never read (#1950).
    • Package code now passes mypy strict mode, and the new AdditionalPodMetadata model types the pod_metadata argument (#1951). get_sandbox_claim_warmpool_name now raises SandboxMetadataError when spec.warmPoolRef.name is missing, where it used to return None.
    • Excluded the broken kubernetes==36.0.0 (#1968) and stopped leaving temporary certificate files behind at exit (#1973).

Reinforcement Learning

  • GKE Pod Snapshot primitives in examples/agent-sandbox-rl (#1540): With ClusterConfig(snapshots=True), SandboxHandle and SandboxFleet expose snapshot, suspend, resume, restore, and snapshot cleanup. An RL loop can park a sandbox between turns and bring back its exact memory and filesystem state, or roll an episode back to a checkpoint. Requires GKE Pod Snapshot CRDs and a gVisor runtime class. Nothing changes if the flag is unset.

Sandbox Router

  • Deployment identity hardening (#1499): Turned off ServiceAccount token automounting; the router now gets a projected one-hour token. Added a scoped-token v2 Kustomize overlay in sandbox-router/examples/scoped-token-v2/, with a runbook for rotating verification keys (readers first). See Action Required above.
  • TLS for /metrics (#1943): New --metrics-secure-serving flag serves /metrics over TLS with the proxy's certificate and TLS settings. It works with or without --https-bind-address.

Examples

  • Claude Code (#1999): New examples/claude-code-sandbox shows headless Claude Code driven by the Python SDK: one-shot runs, session resume backed by PVCs, and API keys injected from a Secret.
  • PodDisruptionBudget example (#2012): The manual PDB example now uses an integer minAvailable. The old maxUnavailable: 0 version only blocked evictions because PDB sync failed (Sandbox has no /scale subresource). Idle warm-pool Pods are no longer protected.
  • Faster cross-arch builds for sandboxed-tools (#2018): The geminicli-toolbox builder stage now runs on the build host's architecture instead of under emulation.

Testing, CI & Tooling

  • WarmPool capacity-cliff load tests (#1923): ClusterLoader2 scenarios for one growing pool and for many pools sharing a template with Recreate rollouts, with convergence checks.
  • gVisor periodic E2E (#2002): A daily job installs gVisor (runsc) on KIND and runs the TestRuntimeClass* E2E tests.
  • E2E on remote clusters (#1933, #1940): The E2E suite treats any node with a cloud provider ID as a real cluster and no longer hangs waiting for Chrome readiness on remote clusters. One E2E test moved to a unit test (#1958).
  • Stress tests and Metrics Explorer: The Metrics Explorer now streams and indexes multi-GB metrics logs incrementally (#1955). Also: fixed control-plane node classification on AWS (#1954), exported root cgroup.stat (live and dying cgroups) through node-exporter (#1970), and collected containerd CNI and pod sandbox timings (#1972).
  • Tooling: Helm chart linting with chart-testing via make lint-helm (#1464), golangci-lint v2.15.0 (#2001), Node.js >= 22 required before using the system npm (#1952), and stale PRs are now marked after 15 days of inactivity (#1947).

Installation

Standard Install (Core + Extensions)

Recommended for most users and GitOps engines (Argo CD, Config Sync, kustomize): 

kubectl apply -f https://github.com/kubernetes-sigs/agent-sandbox/releases/download/v1.0.8/sandbox-with-extensions.yaml

Selective Install

Install components separately: 

# Core only:
kubectl apply -f https://github.com/kubernetes-sigs/agent-sandbox/releases/download/v1.0.8/sandbox.yaml

# Extensions (opt-in):
kubectl apply -f https://github.com/kubernetes-sigs/agent-sandbox/releases/download/v1.0.8/extensions.yaml

Python SDK

pip install k8s-agent-sandbox==1.0.8

Contributors

We extend our sincere thanks to all contributors to this release:
@BootstrapperSBL, @LinghaoLiOfficial, @Quiyyy, @RachelWanggg, @YoungJinJung, @abhayjoshi201, @aditya-shantanu, @aegeiger, @app/dependabot, @dongjiang1989, @ericcurtin, @esposem, @git-jxj, @hakman, @hyperb1iss, @janetkuo, @justinsb, @leomcl, @tomergee, @vvoronko

New Contributors

Full Changelog: v1.0.7...v1.0.8

Check out latest releases or
releases around kubernetes-sigs/agent-sandbox v1.0.8

Don't miss a new agent-sandbox release

NewReleases is sending notifications on new releases.

Get notifications