OpenSandbox 1.1.0

First stable release of the unified umbrella release line: one platform version — 1.1.0 — covers server, component images, charts, CLI, and every published SDK, cut from one commit and pinned in a signed BOM (versioning starts at 1.1.0; 1.0.0 was already consumed by legacy releases, so the line skips it by design per the umbrella governance OSEP). Everyone on a legacy per-component version should upgrade; legacy tag namespaces are frozen. Because this is the first umbrella cut, sections carry different baselines — the controller jumps from its May v0.2.0 release, ingress from July, the JavaScript/C#/Go SDKs from their July releases — so those sections list several months of changes at once.

Highlights

First unified umbrella release: every artifact ships at 1.1.0 from tag release-1.1.0, with a Sigstore-signed BOM as the digest authority
First release of the Fast Sandbox integration: a Firecracker microVM runtime behind the FastPath fleets backend, with pause/resume, ingress FastPath routing, and fsb template management in all five SDKs
Snapshot persistence gains an opt-in PostgreSQL store with multi-process HA and a SQLite migration command, and sandboxes gain preStart/periodic lifecycle hooks

Server

Add the FastPath fleets lifecycle backend: create, renew, delete, and status mapping served through FastPath v2, plus end-to-end fsb pause/resume with async 202 semantics and UID fencing (#1703 #1844)
Converge snapshot status via a per-namespace watch instead of blocking polls, and add fast-sandbox snapshot support (#1846)
Add an opt-in PostgreSQL snapshot store with pooled connections and CAS semantics, a one-shot migrate-snapshots command for moving SQLite records, and multi-process HA coordination for snapshot create/recovery/delete on Kubernetes (#1653 #1670 #1724)
Transport sandbox lifecycle hooks (OSEP-0020): create requests accept preStart and periodic hooks, validated and serialized into a reserved environment variable for Kubernetes workloads; the Docker provider rejects lifecycle requests for now (#1589 #1542)
Implement a stable, scoped diagnostics API over the existing log/event collectors with logs:container|all and events:runtime|lifecycle|all scopes, explicit warnings on partial scopes, 400 DIAGNOSTICS_SCOPE_UNSUPPORTED for unknown scopes, and backward-compatible plain-text responses (#1553)
Export generic HTTP request metrics (request rate, error rate, latency) from the server over OTLP, complementing the SDK-reported create-duration histogram (#1561)
Reject unsupported gVisor (runsc) snapshots before persistence with 409 SNAPSHOT::UNSUPPORTED_RUNTIME (#1720)
Support independent resource requests/limits for the Kubernetes egress sidecar via [egress.resources] (#1620), add [egress] otlp_endpoint so the sidecar exports metrics to an OpenTelemetry collector on both runtimes (#1753), pause and resume the sidecar together with the sandbox (#1441), make the sidecar readiness wait configurable via [egress] timeout_seconds (#1522), and inject OPENSANDBOX_EGRESS_SANDBOX_ID server-side so sidecar telemetry can no longer be spoofed by request env (#1381)
Honor image.auth in create requests for the agent-sandbox provider with per-sandbox pull secrets that are garbage-collected with the Sandbox CR (#1789)
Source OSEP-0011 secure-access signing keys from the OPENSANDBOX_SECURE_ACCESS_KEYS environment variables or a Kubernetes Secret instead of plaintext chart values (#1445)
Make the reverse proxy's internal resolution configurable with [proxy] resolve_internal for deployments that cannot route to Docker bridge IPs (#1631)
Raise the preStart.timeoutSeconds limit from 300 to 10800 seconds across the server API, execd, and SDKs (#1637)
Add Docker-runtime-wide sandbox_env and sandbox_binds configuration, giving Docker parity with the Kubernetes pod template for fleet-wide CA bundles, proxies, and mounts (#1303)
Breaking: migrate the agent-sandbox provider and ingress informer to agents.x-k8s.io/v1beta1 required by agent-sandbox v1.0.0, creating workloads with operatingMode: Running and service: true; see Upgrade & Compatibility (#1763)
Support pool-only sandbox creation (poolRef without entrypoint) instead of rejecting it with HTTP 400, scheduling the execd-start task per allocation (#1729), fail fast on exhausted namespace ResourceQuotas by surfacing the Sandbox CR's admission rejection (#1752), and surface pool back-pressure as HTTP 429 KUBERNETES::POOL_CAPACITY_EXHAUSTED with Retry-After instead of a generic readiness timeout (#1581)
Propagate template container securityContext into generated pods (#1564), honor the PVC readOnly flag on the volume source and not just the mount (#1246), allow mixed read-only subPath mounts from a shared PVC (#1440), reject networkPolicy combined with extensions.poolRef (#1319), and patch PVC owner references through the supported strategic-merge path (#1538)
Make the informer-backed cache the only Kubernetes read path by removing the informer_enabled flag, and expire stale informer entries when a watch stops delivering (#1926 #1534)
Reserve Docker host ports in-process between probing and container start, and retry container creation when the probed port conflicts at Docker bind time (#1666 #1715)
Map completed agent-sandbox pods to terminal states (#1643), report Failed when a pooled sandbox task fails (#1663), keep direct responses out of the informer cache (#1674), resolve agent-sandbox server-proxy endpoints from status.podIPs with IPv6 bracketing (#1424), and use the public state in invalid-resume errors (#1586)
Handle websocket close semantics: map abnormal upstream closures and relay client closes with a legal status code (#1642 #1731)
Fix HTTP proxy fidelity: preserve repeated response headers without duplicating Uvicorn's own (#1858 #1471), forward the query string unchanged (#1902), rewrite root-relative redirects to stay on the proxy path (#1516), release backend responses when clients abort mid-stream (#1488), stop leaking the ingress routing header on server-proxied endpoints (#1503), and generate unique OpenAPI operation IDs (#1634)
Improve proxy diagnostics: identify backend connection failures (#1675) and describe transparent proxy responses in the spec (#1701)
Preserve the egress auth token on internal proxy requests to port 18080 across Docker and Kubernetes (#1880)
Route Compose proxying through host port mappings (#1698)
Fix Docker runtime edges: skip a missing IPv6 sysctl in Kubernetes init (#1721), use the supported no-new-privileges separator (#1383), detect Podman when resolving the Docker host IP (#1806), reject invalid (#1742) and non-finite (#1568) resource limits, and honor [docker].host_ip when the server itself runs in a container bound to loopback (#1918)
Define the missing SandboxErrorCodes.INTERNAL_ERROR so PVC auto-create failures return a proper 500 (#1447), and report the deployed version consistently across the API, package metadata, and chart (#1439)

SDKs

Default code-interpreter creation to a strict health check in every language: CodeInterpreter now blocks until both execd and the Jupyter kernel gateway are verified ready (#1754)
Add sandbox lifecycle hook models (OSEP-0020) to the API spec and every SDK, with consistent validation aligned to the server's authoritative ranges (#1588 #1605)
Wait for endpoint publication when connecting or creating, fixing connections that raced endpoint propagation (#1751 #1830)
Resolve the execd and egress endpoints in parallel during create/connect/resume, roughly halving startup endpoint latency (#1531)
Protect the tenant API key: JavaScript and C# no longer forward OPEN-SANDBOX-API-KEY to execd/egress in direct data-plane mode (#1691)
Bound readiness polling sleeps across all SDKs (#1734 #1747 #1745 #1748 #1744)
Reject invalid inputs: negative readiness polling intervals in Python and JavaScript (#1826), negative session and command timeouts in Python (#1726 #1733), negative log cursors in Go and JavaScript (#1835 #1836), and a negative code-interpreter polling interval in Go (#1885)
Bring JavaScript, C#, and Go to parity with the Python and Kotlin SDKs: background runs in isolated sessions (#1456), execd-as-init request support (#1474), and pool allocation summaries (#1481)
Add fsb (fast-sandbox) template management to every sandbox SDK (#1877 #1895 #1894 #1898 #1897)
Fail fast on readiness auth errors in Python (#1782) and handle an unset volume.host safely (#1659)
Document snapshots and isolated sessions in the Python, JavaScript, Kotlin, C#, and Go SDK references, and fix non-compiling README snippets in Kotlin and Go (#1863 #1854 #1870 #1856 #1876 #1888)

Python

Align the client pool with Kotlin: warmup_create_qps, staged readiness, leader-epoch fencing, and opt-in OpenTelemetry warmup tracing (#1889 #1697)
Preserve replacement endpoint fetches when an earlier cache fetch completes out of order (#1567), and keep pool cleanup running when acquire() is cancelled mid-renewal (#1938)
Preserve Unicode separators in SSE data (#1444)
Carry the API key on execd requests per use_server_proxy (#1687)
MCP: constrain the SDK to MCP 1.x with a guard and migrate the sandbox server to the MCP 2.x API (#1725 #1737), add a --use-server-proxy option (#1509), and expose streamable HTTP host/port options (#1929)

JavaScript

Add a client-side SandboxPool aligned with Kotlin: staged warmup, FIFO idle acquisition, lifecycle fencing, and optional Redis-backed distributed state (#1716 #1875)
Bound pool readiness checks and align pool warmup resources with Python (#1793 #1909), and always make the final warmup attempt when the initial delay is capped by the readiness deadline (#1927)
Allow aborting Sandbox.create() and Sandbox.connect() via AbortSignal, with background cleanup after cancellation (#1685)
Stop background SSE streams on the complete event (#1532), include response bodies in client error messages (#1496), drop readiness network hints (#1493), and escape the multipart filename on streamed uploads (#1862)

Kotlin

Add structured exceptions for sandbox-not-found and capacity-exceeded outcomes plus a typed exception for proxy backend-connection failures (#1667 #1683)
Send an empty egress array instead of null (#1630)

C#

Add fsb (fast-sandbox) template CRUD to the sandbox SDK (#1898)

Go

Merge poolredis into the parent Go module; the import path is unchanged (#1903)
Add a SandboxPoolManager with fence/tombstone parity (#1525)
Release idle sandboxes with bounded concurrency and bound completion-driven pool reconcile (#1475 #1494)
Stop capping SSE event lines at 4 MiB (#1881)

Controller

The controller section carries everything since the last standalone controller release (k8s/controller/v0.2.0, May 2026).

Stabilize pool scheduling: a capacity predicate in pool-assign, a fix for pool scale expectations getting stuck, and scaling stabilization (#1143 #906 #1425)
Add lifecycle hooks to the task schedule (#420) and emit Kubernetes events for BatchSandbox and Pool lifecycle (#1099)
Support opt-in PVC deletion together with sandboxes via the Pool recycle strategy (#880)
Add a containerd socket path flag to the controller (#859)
Rework the image committer: a reusable pkg/imagecommitter interface with a containerd-native default implementation, source-registry authentication, self-signed/plain-HTTP transport policy, and an operator-controlled Job template overlay (#1431), plus pull secrets for authenticated registry proxies (#1300)
Add QEMU VMState pause/resume support in the Kubernetes runtime path (#1584)
Sync Kata guests before snapshot commit and fall back to stopped snapshot containers (#1356)
Sync SandboxSnapshot RBAC (#1088) and add the missing pods/log permission to the server ClusterRole (#1211)
Export low-cardinality Pool and BatchSandbox capacity gauges over OTLP/HTTP from the elected controller, computed from actual Pod specs (#1651)
Helm: default the server deployment to one active replica (#1723), allow configuring the server Service type (#1628), expose the controller-runtime metrics endpoint in the controller chart (#1331), add scheduling/tolerations fields for the server and ingress-gateway Deployments (#1245 #1235), roll the server Deployment on config.toml changes via a checksum annotation (#1473), render imagePullSecrets on the ingress-gateway Deployment (#1236), allow extra env vars on the ingress-gateway container (#1333), sync the missing Pool CRD strategy fields into the chart CRD (#1337), remove the dead networkPolicy block (#1243), guard empty extraVolumes/extraVolumeMounts rendering (#1244), fix the containerdSocketPath CrashLoopBackOff against controller v0.2.x and bump the umbrella chart to 0.2.2 (#1557), and source secure-access keys from a Secret (#1445)
Restructure all charts under manifests/charts/ (#1857)
Release stranded BatchSandbox finalizers when the referenced Pool is missing or terminating, and stop recreating an idle task scheduler after cleanup (#1657)
Fail sandbox recovery when the executor status is unknown, fail the sandbox when the main container terminates without restart while the Pod stays Running, and propagate terminal Pod failures to sandbox status (#1599 #1741 #1722)
Fix pool reconciliation: compare replica counts by value, trigger reconcile when poolRef changes, and stop attributing failures of already-deleting Pods (#1779 #1794 #1828)
Improve controller logging and performance (#919)

Execd

Support native argv command execution in /command (literal arguments without shell parsing, environment-aware executable resolution), wired through all five SDKs (#1760)
Add a runtime-init handshake: POST /init applies a one-shot RuntimeBinding (authoritative sandbox id, token hash, envs, lifecycle config, telemetry attributes) with GET /ready reporting readiness, moving identity out of image build time (#1871); fast-sandbox restores can rebind a restored runtime via preserveRuntimeState (#1946)
Execute the runtime side of sandbox lifecycle hooks (OSEP-0020): preStart gates the user entrypoint, non-overlapping periodic hooks run through the init-reaper-aware process path, with fail-closed TERM/KILL watchdogs and atomic lifecycle config persistence (#1587)
Fix EXECD_ENVS handling with lossless dotenv-style round-tripping and apply the env file to bash session env and cwd expansion (#1893 #1868)
Drop the fsync from the task-create critical path that could stall sandbox startup for seconds on congested block devices (#1614)
Bound command output retention (#1710), clamp background log cursors to the end of the log (#1708), and avoid re-reading unfinished command output (#1746)
Validate command cwd against request-scoped environment variables (#1611), make bootstrap.sh readable by non-root workload users (#1619), and stop PTY creation from appending a success body after an error (#1603)
Reclaim stale overlay upper dirs at startup (#1784)
Skip credential switches for same-identity uid/gid requests (#1809)
Surface NSS trust prerequisites (#1712)
Shorten the default SSE drain timeout (#1840)

Networking

egress

Fleet profile [EXPERIMENTAL]: multi-sandbox egress control plane with per-subject credential vaults, shared MITM data plane with per-subject DNAT and subject-aware active vault, DoH-443 blocking with a blocklist, per-sandbox netns OUTPUT rules with connection refresh, and a fastlet Sandbox Actions handler protocol replacing file observation (#1595 #1608 #1633 #1678)
Credential-bound TLS interception foundation [EXPERIMENTAL]: host selector, request-weighted TLS shadow observations, and the revision snapshot pipeline (transaction receiver, coordinator, Unix transport, receiver endpoint, decision snapshots, validation, process-session provisioning, bootstrap, and outcome reconciliation, lifecycle wiring) — groundwork only, not enabled by default (#1775 #1777 #1791 #1800 #1812 #1834 #1839 #1845 #1850 #1867 #1892 #1915)
Make Credential Vault create/patch/delete immediately visible to the next intercepted flow (replacing the 0.5s cache window), and add opt-in strict scope enforcement rejecting bindings without method/path matches or with host-wide /* paths (#1755 #1762)
Support kernels without xtables compat and IPv6 transports with a native nftables redirect backend (OPENSANDBOX_EGRESS_REDIRECT_BACKEND), and renew timed nft elements atomically (#1861 #1786)
Cut DNS read amplification in domain revalidation (#1808), revalidate observed domain addresses (#1804), log a warning on DNS denies (#1807), and shrink the DNS upstream ejection window so unhealthy resolvers recover faster (#1943)
Drain webhooks during bounded Docker deletion so egress shutdown cannot hang sandbox deletion (#1827)
Report the sidecar's own resource usage from its cgroup (#1411)

ingress

Add fleets FastPath routing with tenant-scoped (namespace, sandbox_id, port) resolution, HMAC-bound route scopes, and short-lived route caching (#1577)
Observe upstream network readiness with a bounded shadow assessment exposed at /status.ok/network-readiness (#1693)
Add OpenTelemetry metrics instrumentation (OSEP-0010): request count/duration, routing resolution, proxy-type counters, and system CPU/memory plus active-connection gauges (#1181)
Migrate the WebSocket proxy off the archived gorilla/websocket to coder/websocket and fix Connection header token-list detection (#1822)
Verify route signatures with a constant-time comparison (#1417)
Eliminate an SSE ping goroutine race and a proxy error leak (#1216)
Serve only intentionally registered routes by replacing http.DefaultServeMux with a dedicated mux (#1224)
Shared egress/ingress telemetry: honor OTEL_SDK_DISABLED=true and OTEL_METRICS_EXPORTER=none and respect caller-chosen metric temporality (#1783)

Fast Sandbox

First release with fast-sandbox: an external, template-backed sandbox platform that provisions sandboxes as Firecracker microVMs from golden-image templates, exposed to clients through a FastPath v2 gRPC control plane (#1558 #1559). OpenSandbox's server, ingress, execd, and SDKs integrate with it as the fast-sandbox runtime provider. The upstream source this release builds against is pinned at manifests/third-party/fast-sandbox.commit (d51fa69, first pinned 1a420a22, #1899); from that commit the release builds the Firecracker-scope image family only — fsb-controller, fsb-fastlet, fsb-fastlet-proxy, fsb-janitor, fsb-firecracker-runtime, fsb-sandboxtemplate-builder — and vendors its CRDs, deployable with the new fast-sandbox Helm chart (#1869)

Misc

CLI: add Credential Vault management commands (#1027), report pause request acceptance (#1537), pass native argv to command run without shell quoting (#1829), preserve local files when downloads fail, and restore downloads to devices and named pipes (#1820 #1847)
node-agent: add durable sandbox log collection and a compile-time multi-Source architecture (isolated Source state, event multiplexing, acknowledgement routing) (#1435 #1656), and add an opt-in eBPF syscalls Source emitting ordered NDJSON syscall records to file/OSS sinks with least-privilege Helm capabilities (#1682)
Images: publish component images to GHCR alongside Docker Hub and ACR (#1161) and document registry provenance with digest-pinning verification guidance (#1339)
Move the code-interpreter sandbox image to the standalone opensandbox-group/sandbox-images repository; the image keeps versioning independently of the umbrella (#1796)
Resolve Dependabot security alerts and bump vulnerable dependencies: grpc, containerd, ebpf-go, cel-go, x/crypto, x/net, vitest, js-yaml, fast-uri, @humanfs/node, selinux, postcss, anyio, and otel-go (#1545 #1736 #1838 #1390 #1250 #1385 #1467 #1921)
Docs: refresh the architecture overview, add the contributor advancement process, publish the OSEP set (pause/resume, resilient SDK transport, lifecycle hooks, multi-sandbox egress, TLS interception, execd-as-init, node-agent collection), add isolation-session, client-pool, and secure-access guides, extend the Claude Code and Codex CLI examples and add Deep Agents and OpenCode examples, use pip/uv install tabs, clarify pooled sandbox readiness, refresh SDK capability pages, and trim the README (#1848 #1761 #1896 #1149 #1368 #1542 #1592 #1714 #1394 #1428 #1346 #1352 #1349 #1774 #1803 #1797 #1535 #1544 #1727 #1821 #1696 #1728 #1852 #1912)
Scripts: bootstrap a source-built fast-sandbox integration environment with source-built server and ingress (#1756 #1769)
CI/release: enforce repository and release safeguards (tag immutability, protected release environment, scoped required checks) (#1274), gate release approval on the consistency scan and make the umbrella release idempotent (#1911), render the BOM from channel templates and publish images directly to release tags (#1920 #1925), stop auto-bumping the server chart on release (#1646), pass the gateway route mode in e2e chart values (#1874), and remove the verify-license workflow (#1813)
Update code copyright to The OpenSandbox Authors across remaining components (#1878 #1945 #1942 #1890)

Upgrade & Compatibility

Breaking: the agent-sandbox provider and ingress require agents.x-k8s.io/v1beta1 (agent-sandbox v1.0.0); install the beta CRDs/controller before upgrading — see the migration guide in #1763
Breaking for chart users: charts moved to manifests/charts/ (#1857)
Config: the beta informer_enabled flag was removed; the informer-backed cache is now the only Kubernetes read path (it was already the default, so remove the key when upgrading) (#1926)
Behavior change: code-interpreter creation blocks until strictly ready by default (#1754); set the previous lenient behavior explicitly if you depend on it
Behavior change: lifecycle hooks are validated at create time and rejected on the Docker provider in this release (#1589)
Go module: poolredis is merged into the parent module github.com/alibaba/OpenSandbox/sdks/sandbox/go with the import path unchanged; a single companion tag now versions both (#1903)
Images: opensandbox/<component>:release-1.1.0 (all three registries)
Packages: server / CLI / SDKs all at 1.1.0
Charts: render from this tag (helm template ./manifests/charts/opensandbox)
Kubernetes: supported range v1.21 – v1.34 (charts declare kubeVersion: ">=1.21.1-0")
Skew: server ↔ CLI/SDK same line supported; ±1 minor warns

👥 Contributors

Thanks to these contributors ❤️

Artifacts

BOM: docs/releases/1.1.0.yaml
Images: opensandbox/<component>:release-1.1.0 (Docker Hub / GHCR / ACR)
Packages: PyPI ×5, npm ×2, Maven Central ×5, NuGet ×2 — all at 1.1.0
Go module: github.com/alibaba/OpenSandbox/sdks/sandbox/go@v1.1.0

Installation

# Platform (Kubernetes) — render the chart at this tag and apply
git clone https://github.com/opensandbox-group/OpenSandbox
git checkout release-1.1.0
helm dependency build manifests/charts/opensandbox  # package file:// sub-charts (not committed)
helm template ./manifests/charts/opensandbox | kubectl apply -f -
# or point your GitOps platform (Argo / Flux) at the repo path + tag

# SDKs
pip install opensandbox==1.1.0            # Python
npm install @alibaba-group/opensandbox@1.1.0   # JavaScript
# Kotlin/JVM: implementation("com.alibaba.opensandbox:sandbox:1.1.0")
dotnet add package Alibaba.OpenSandbox --version 1.1.0
go get github.com/alibaba/OpenSandbox/sdks/sandbox/go@v1.1.0

# Run the server locally
uvx opensandbox-server==1.1.0

opensandbox-group/OpenSandbox release-1.1.0 OpenSandbox 1.1.0 on GitHub