opensandbox-group/OpenSandbox docker/egress/v1.1.7 on GitHub

What's New

Auto-allow OTLP endpoint egress. The egress sidecar's own metric export was blocked by its deny-all policy. OTEL_EXPORTER_OTLP_METRICS_ENDPOINT (preferred) or OTEL_EXPORTER_OTLP_ENDPOINT is now parsed at startup and injected as an always-allow rule — domains resolved via the DNS proxy, IPs into the static nft allow sets. The rule survives policy updates and reloads; deny.always still takes precedence. Host-scoped, no per-port enforcement. (#1504)

Vault path checks now scoped to matching bindings. Requests with nested percent-encoded separators (e.g. double-encoded package URLs) were 403'd locally even when no credential could be injected. Binding selection now runs first; unmatched requests pass through unchanged, fail-closed behavior for credentialed requests is preserved. (#1485)

Dead code, stale docs, ineffective tests pruned. Removed unused UpstreamHost(), RegisterFunc, nftables.NewManager(); fixed Dockerfile and docs/components/egress.md drift; trimmed verbose comments; dropped duplicate test assertions. No public spec/SDK changes. (#1593)

Thanks to these contributors ❤️

Docker Hub: opensandbox/egress:v1.1.7
Aliyun Registry: sandbox-registry.cn-zhangjiakou.cr.aliyuncs.com/opensandbox/egress:v1.1.7
GHCR: ghcr.io/opensandbox-group/opensandbox/egress:v1.1.7