opensandbox-group/OpenSandbox docker/execd/v1.0.22 on GitHub

What's New

Private-network sessions fail closed at startup. Explicit share_net: false sessions now require execd to bind-pin the workload NetNS/UserNS and return retryable 503 on failure; shared-network sessions are unchanged. (#1397)

Background runs in isolated sessions. run accepts background: true and returns a JSON handle; new runs/{runId} status and .../logs endpoints support polling. In-flight runs block idle GC. (#1456)
Read-only PTY viewers. Opt-in ?mode=viewer lets multiple clients watch a running PTY session alongside the exclusive holder, with replay + live output and backpressure isolation. (#1420)
attach(sessionId) in all five SDKs. Rebuilds a fully functional session handle from a bare id, e.g. after a worker restart; SessionState now echoes creation params. (#1295)
uid_mode availability probing. execd probes setpriv/userns independently and returns 503 NOT_SUPPORTED for unavailable modes instead of failing all isolation. (#1320)

Fail-closed workload lifecycle for isolated sessions (security). A native gate blocks the sandbox command until execd verifies workload identity; sessions are terminated if lifecycle accounting is lost. (#1388 #1392)
execd config env no longer leaks into bwrap sessions (security). EXECD_ACCESS_TOKEN, JUPYTER_*, EXECD_ISOLATION_CONFIG are always stripped, even if allow-listed. (#1314)
Fixed Jupyter execution deadlock under slow consumers — no more permanent hangs during bursty output. (#1464)
Bash → sh fallback for PTY, bash-session, and isolated APIs, including correct dash/ash export -p quoting on bash-less images. (#1359 #1361 #1367)
Stale mitmproxy CA purge on egress startup — fixes HTTPS failures after pod-container co-restart. (#1371)
SSE stream corruption eliminated — ping goroutine race and proxy error leak fixed (~64% nightly e2e failure rate). (#1216)

CVE dependency bumps: grpc v1.82.1, x/crypto v0.52.0, x/net v0.55.0, postcss 8.5.11. (#1385 #1250)
Apache 2.0 license headers added to 21 files. (#1313)

Thanks to these contributors ❤️

Docker Hub: opensandbox/execd:v1.0.22
Aliyun Registry: sandbox-registry.cn-zhangjiakou.cr.aliyuncs.com/opensandbox/execd:v1.0.22
GHCR: ghcr.io/opensandbox-group/opensandbox/execd:v1.0.22