opensandbox-group/OpenSandbox release-1.2.1 on GitHub

Stable patch release for users upgrading from 1.2.0, including both 1.2.1 release candidates and subsequent fixes. Server, CLI, SDKs, charts, and platform images ship together at 1.2.1.

Highlights

Dynamic credentials: Credential Vault Exchange resolves credentials per request across the server, egress, and all five SDKs, without vault persistence of resolved secrets (#2457 #2535 #2534 #2560).
Multi-version Fast Sandbox VMMs: managed Firecracker 1.16.1/1.17.0 bundles let new template builds select the highest installed version while existing artifacts restore with their exact recorded VMM version, failing explicitly if it is unavailable (#2795 #2812 fast-sandbox#189).
Safer data and capacity management: staged uploads reduce overwrite data loss where atomic replacement is available, controller restarts preserve live-sandbox Pods, and Docker enforces requested writable-layer disk quotas (#2433 #2478 #2398 #2716).

Server

Carry template CPU/memory shapes through creation and snapshot restore on ResourceAware pools; legacy pools retain their existing behavior (#2602 #2619 #2623 #2628 #2633).
Enforce Docker resourceLimits.disk on the writable container layer, returning 400 for unsupported drivers or invalid limits instead of silently ignoring them (#2716).
Allow Docker snapshots directly from paused sandboxes (#1941).
Move the server-proxied data path into maintenance mode; existing traffic remains supported, but deployments should migrate to the ingress gateway (#2548).
Reject unknown fields in closed request objects rather than silently accepting misspelled options (#2576).
Reduce Kubernetes API traffic and list costs through per-object informer invalidation and server-side metadata selectors (#2599 #2559).
Require OCI template artifacts to be SHA-256-pinned in the expected repository (#2491).
Fail startup when Docker expiration enforcement cannot be restored, except for concurrently removed containers (#2533).
Other fixes improve create-timeout diagnostics and idle-pause probe bounds (#2434 #2596); Docker mount, host-path, and resource validation (#2421 #2505 #2474 #2701 #2751); proxy GET bodies and exhaustion errors (#2518 #2519); and empty metadata filters, name validation, and API error codes (#2461 #2499 #2702 #2703).

SDKs

All five SDKs support exchange credential sources and credential-only binding auth; Kotlin/C# consumers must recompile and review widened credential types (#2534 #2560).
Optional detailed download APIs expose status, headers, ranges, and partial-response detection without requiring changes to existing adapters; Python/JavaScript/C# report unknown totals when encoded lengths cannot describe decoded output (#1597 #2592).
Documentation expands lifecycle/network options, exchange credentials, template workflows, and S3 examples (#2590 #2597 #2620 #2506).

Python

MCP adds command_get_status and command_get_logs for background-command polling and incremental output (#2648).
Silent command SSE streams now time out; abandoned downloads release connections, and streaming failures consistently use SDK exceptions (#2527 #2487 #2531 #2570 #2515 #2525).
Graceful pool shutdown drains cleanup kills rather than abandoning sandboxes; smaller fixes cover endpoint invalidation, adapter redirects/hooks, and actionable MCP errors (#2507 #2409 #2553 #2524).

JavaScript

Prevent positive sub-millisecond command timeouts from becoming unbounded; fix unlimited redirect deadlines, structured isolated-session errors, and closing downloads during iteration (#2440 #2488 #2466 #2514).

Kotlin

Round fractional command/session timeout milliseconds upward, preventing sub-millisecond values from becoming unbounded (#2537).

C#

Use the common CredentialSource model for inline and exchange variants; update inline-only assumptions when recompiling (#2560).

Go

Preserve code-interpreter output fragments in Execution.Text() without inserting newlines (#2447).
Enforce wake, Running-state, and interpreter-readiness budgets without truncating established streams or accepting unfinished readiness probes (#2572 #2611 #2528 #2668 #2480 #2504).
Preserve cleanup ownership during cancelled pool operations and fence incomplete destruction for retry; cancelled acquires no longer consume healthy idle capacity (#2542 #2617 #2580 #2616).
Fence stale endpoint lookups after lifecycle changes without cancelling fetches still needed by other callers (#2503 #2564 #2579).
Other fixes bound retry overflow and server-supplied delays (#2452 #2508 #2509); improve SSE parsing, multipart boundaries, and header merging (#2439 #2618 #2468 #2529); and correct pool maintenance, telemetry deadlines, and timeout tests (#2453 #2565 #2540 #2479).

Controller

Add namespace-scoped caches, configurable leader-election timings, and controller.extraArgs for deployment tuning (#2571 #2651 #2566).
Recover pool allocations before eviction, protecting live-sandbox Pods after controller restarts (#2398).
Reject rootfs snapshots missing required digests and retain their Pods instead of deleting the only resumable runtime (#2482).
Other fixes prevent lifecycle-related memory growth, remove excess idle Pods after poolMax reductions, and place the recovery ConfigMap in the correct namespace (#2646 #2470 #2694).

Execd

Discover Jupyter runtime tokens when JUPYTER_TOKEN is unset (#2448).
Stage uploads and isolated-file replacements before rename to protect existing content; atomicity requires a writable containing directory, with an in-place permission fallback described below (#2433 #2478).
Preserve isolated-workspace contents and modes during copy-up/rename, honor overlay deletions, and reject symlink chmod rather than following host targets (#2638 #2469).
Refresh MITM trust after Kubernetes egress-sidecar CA rotation, avoiding persistent TLS failures (#2582).
Isolated runs no longer consume shell control input; deleting Bash sessions terminates all active runs, and PTY close hangs up ordinary background jobs while retaining terminal-like behavior for HUP-ignoring jobs (#2517 #2731 #2733).
Restore Jupyter startup retries and session cleanup, fail unsupported languages promptly, and deliver output/errors before reporting completion (#2486 #2689 #2606).
Recover SQL execution after temporary setup failures without automatically replaying queries (#2757).
Security hardening: percent-encode control bytes in download headers and correct RFC 8187 filename encoding (#2741 #2516).
Other fixes cover command-log correlation and validation (#2598 #2686); PTY output and exported escapes (#2644 #2772); download/search validation and file timestamps (#2451 #2687 #2604); cgroup-v1 metrics and SQL byte rendering (#2641 #2685); and an opt-in legacy SSE workaround for older Kotlin/JVM deployments (#2472).

Networking

egress

Credential Vault Exchange: resolve fresh headers through UDS/HTTPS using egress-derived sandbox identity and request targets; resolution fails closed, and resolved secrets are neither persisted nor cached by the vault (#2457 #2495 #2500 #2501 #2535 #2538 #2539 #2547 #2549 #2563).
Enforce Fast Sandbox per-subject TCP port and IP/CIDR-plus-port policies, including original-destination checks through MITM (#2662).
Hot-reload Fast Sandbox operator deny/allow rules and reachable-port caps without restarting egress; changes apply atomically across active subjects, retaining the previous policy on failure and rejecting stale DNS answers after revocation. The network-security guide documents deployment, precedence, and enforcement boundaries while preserving old guide URLs (#2727 #2814).
Allow dns+nft sidecar policy PATCH/DELETE to opt into blocking established traffic with dropEstablished=true; Fast Sandbox is not supported (#2346).
[EXPERIMENTAL] Harden strict Actions v2 ownership/persistence and subject readiness with durable fences, authenticated child sessions, and acknowledged policy/Vault snapshots; defaults remain unchanged (#2441 #2460 #2493 #2586 #2589 #2609 #2634 #2649 #2666 #2708).
[EXPERIMENTAL] — not for production: OPENSANDBOX_EGRESS_FSB_INTERCEPTION_MODE=credential-bound selects a budgeted TLS handshake experiment, not working credential injection or request forwarding: all decrypted HTTP/1.1 and HTTP/2 origin traffic is still denied. all remains the default; the OSEP-0023 rollout describes unfinished work (#2737 #2797 #2777).
Security fixes: policy PATCH preserves untouched deny rules, and invalid defaultAction values are rejected rather than producing inconsistent, potentially fail-open enforcement (#2664 #2662 #2693).
Renew Fast Sandbox DNS leases in the kernel and preserve other subjects' leases during deletion (#2652 #2653).
Other hardening covers experimental interception-port validation, idempotent readiness hooks, and nft smoke/read-back checks (#2587 #2510 #2543 #2735).

ingress

Use one queue-plus-wait wake budget and validate it against flight lifetime; mixed regular/Fast Sandbox wake routing no longer panics at startup (#2511 #2513 #2600).
Other fixes validate legacy hostname ports, correct final-status/client-IP telemetry, and remove a wake-test race (#2578 #2484 #2688 #2512).

Fast Sandbox

Bundle managed Firecracker 1.16.1/1.17.0 binaries for runtime and template builds, selecting the exact artifact-recorded version for restore rather than silently using the latest installed VMM (#2795 #2812 fast-sandbox#189).
Isolate ResourceAware direct-Firecracker VMMs in a bounded cgroup subtree, protecting Fastlet from pool-local OOM while retaining failed-runtime identities for cleanup (#2626 fast-sandbox#162).
Enable free-page reporting in new object-store templates, returning guest-freed memory to the host without changing static resource commitments; OCI templates are not yet supported (#2546 fast-sandbox#114).
Improve OCI storage with reusable warm ublk devices and best-effort checkpoint/rootfs layer compaction (#2594 fast-sandbox#163 #2546 fast-sandbox#158).
Reuse locally published OCI checkpoint blobs for faster same-node resume, with bounded storage, protection for live-device references, and registry fallback (#2812 fast-sandbox#178).
[EXPERIMENTAL] RootfsOnly OCI snapshots now extend from runtime capture to Fast Sandbox's FastPath and SandboxSnapshot CRD, with capability checks, produced-mode validation, and journaled recovery. Restores cold-boot without preserving memory; OpenSandbox REST/SDK mode selection and RootfsOnly pause/resume remain unsupported (#2706 fast-sandbox#173 #2812 fast-sandbox#177).
OverlayBD template builds now inject guest-control and validate freeze/thaw by default; existing templates need rebuilding to gain RootfsOnly capture capability (#2812 fast-sandbox#183).
Add shared YAML-configured file logging and rotation for first-party Kubernetes components, with optional stderr mirroring; log collectors and custom launch flags need migration (#2812 fast-sandbox#197).
Expose timestamped template-build phases, elapsed times, and failures across image pull, rootfs preparation, guest readiness, snapshotting, and publication (#2815 fast-sandbox#201).
[EXPERIMENTAL] Fence delayed strict Actions v2 operations with durable owner identity and confirmed retirement; v1 remains the default (#2546 fast-sandbox#152).
Add namespace/API-client tuning, chart scheduling hooks, optional direct-origin delivery, and template-baked execd init mode (#2581 fast-sandbox#161 #2566 #2494 #2497).
Immediate create/pause/resume transitions now converge without settle delays, and active pools replace terminal Fastlet Pods instead of counting them as capacity (#2626 fast-sandbox#166 #2706 fast-sandbox#172).
Recover idle shared snapfiles attachments after ublkd device loss without manual cache wipes; attachments with other Sandbox leases remain protected rather than being rebuilt under live consumers (#2812 fast-sandbox#193).
Other fixes cover BusyBox-based template readiness, timestamp precision, and existing-secret rendering (#2626 fast-sandbox#164 #2706 fast-sandbox#170 #2695); restore cache-affinity matching for Firecracker image/template references (#2812 fast-sandbox#119).
Expand ResourceAware rollout coverage and correct fixture CPU budgets without changing saturation capacity (#2622 #2637 #2647 #2669 #2812); improve ublk recovery, exchange/console integration tests, KVM selection, and snapshot-staging documentation (#2454 #2561 #2676 #2665 #2714); gate PR KVM runs on maintainer-added ok-to-test, without unrelated labels cancelling an active run (#2813).

Misc

Console: add a browser PTY shell with BFF-held credentials and automatic session cleanup, improve disconnect feedback, and translate the interface into English (#2233 #2639 #2657).
Node-agent: collect guest kernel/init console output through an opt-in vm-console source, using node-local VM metadata and restart-safe offsets rather than cluster-wide Sandbox watches (#2234 #2677 #2546 fast-sandbox#154).
CLI fixes preserve literal output and string configuration (#2520 #2522); improve config, argument, timeout, and overwrite-refusal errors (#2521 #2551 #2692 #2742 #2748 #2743); and repair PTY cleanup, metrics watching, and table output, including osb template get's missing manifest_ref (#2523 #2691 #2747 #2745).
Examples add an ACK PeerPods/TDX walkthrough and adopt Google ADK 2.13.0's native environment/toolset, while correcting the Python network-isolation example (#2545 #2734 #2711).
Governance/docs publish the AAIF charter and DCO/CC-BY-4.0 contribution rules, clarify voting and ownership, reconcile proposal statuses, and document signing/provenance gaps (#2490 #2678 #2679 #2680 #2624 #2670 #2671 #2672 #2673 #2674 #2467).
Maintenance covers orphan node-agent streams, dead-code/test cleanup, single-platform Kind imports, and Linux/eBPF test setup (#2471 #2496 #2640 #2736 #2573 #2473).
Release preparation includes candidate version bumps, notes, and generated BOMs (#2583 #2584 #2585 #2588 #2720 #2723 #2724 #2725 #2726).

Upgrade & Compatibility

Managed Firecracker: deploy matching charts, runtime, and builder images; runtimeEnvironments → firecracker.firecracker.vmmDir is now supported and must reference an absolute managed-binary directory. New managed builds choose the highest installed version (currently 1.17.0); Full/RootfsOnly restores require the manifest-recorded version and fail if it is unavailable, rather than falling back to latest. Keep 1.16.1 binaries for existing artifacts without relabeling them; retaining old binaries does not guarantee downgrade compatibility for persisted Fast Sandbox state (#2795 #2812 fast-sandbox#189).
Request validation: remove unknown keys from closed request objects and use only one alias spelling; these now return 422. Replace ImageAuth.token/Docker-config extras with supported username/password, remove trailing newlines from names/addresses, and use only allow/deny for policy defaultAction (#2576 #2499 #2693).
SDK credential models: Kotlin/C# are not ABI-compatible with 1.2.0; recompile and review widened sources and nullable/typeless auth assumptions. Exchange auth contains only credential; Python inline sources reject extra keys, and generated-model users should prefer handwritten models. Use keyed Go literals for changed source/metadata models and Execution; JSON round-tripping loses Execution.Text()'s private formatting mode (#2560 #2534 #2447).
Proxy/ingress: migrate maintenance-only server-proxy options to ingress; legacy hostname ports must be canonical decimals in 1–65535, and --wake-park-budget must be below --wake-max-flight-lifetime (#2548 #2578 #2511).
Docker quotas: supplied disk/storage/ephemeral-storage limits must be positive and supported by the storage driver or creation returns 400. Only the writable layer is covered, not bind mounts, volumes, or image layers; Windows retains its existing disk-size behavior (#2716).
Docker preflight/startup: correct duplicate, root, colon-containing, or reserved mount destinations and quantities above signed int64; an explicit / host-path allowlist authorizes all POSIX descendants. Expiration-restore failures now prevent startup unless the container was concurrently removed; investigate persistent daemon errors (#2421 #2505 #2751 #2474 #2533).
Downloads: detailed APIs remain optional for custom adapters; check 206/isPartial and ranges before appending, and close response bodies. Unknown totals use -1; encoded HTTP lengths/ranges are not decoded progress or resume offsets. Python callers should catch SDK exceptions rather than raw httpx errors (#1597 #2592 #2515 #2525).
Timeouts and polling: Python command streams time out after max(request_timeout, 30s) without bytes; raise request_timeout for legitimate silence. MCP pollers must read logs once more after completion and retain opaque cursors; empty output is not completion. Custom Go pool stores must honor cancellation, and incomplete destruction stays fenced for retry (#2527 #2648 #2580).
Upload atomicity: use writable containing directories for staged uploads/isolated replacements; existing writable files fall back to non-atomic truncation on staging permission errors. Ordinary /files/replace remains in-place. Staged replacement preserves modes, not xattrs/ACLs/capabilities/SELinux labels; ownership is best effort for ordinary writes and session UID/GID for isolated writes (#2433 #2478).
Upload storage: hardlinks/open readers retain the old inode, multipart overwrites may need roughly three times the file size, and interrupted writers can leave staging files. Avoid reserved .osb-upload-/.osb-staging- names, especially a prefix plus 16 hex digits; rename existing collisions directly. Special-file targets are rejected, while bind-mounted/open files can prevent rename; directory sync is best effort (#2433 #2478).
Session lifecycle: isolated foreground stdin is now /dev/null; use files or here-documents. Bash-session deletion terminates all overlapping runs; PTY close adds SIGHUP and up to 500 ms before group kill, while nohup/HUP-ignoring jobs can survive (#2517 #2731 #2733).
Jupyter/JVM: custom images need an explicit token or discoverable runtime token files and the requested kernel. Prefer shaded sandbox-api 1.0.18+ over EXECD_SSE_LEGACY_COMPAT, which is off by default and removes structured exit_code values (#2448 #2689 #2472).
Controller configuration: cache scope must include all managed namespaces, plus Fast Sandbox template/runtime-environment namespaces; it does not change RBAC or provide tenant isolation. Review controller.podRecovery.*, which now takes effect, and remove obsolete ConfigMaps left by plain-manifest upgrades. Custom election timings require lease > renew > 1.2×retry (#2571 #2581 fast-sandbox#161 #2694 #2651).
Exchange deployment: align server/SDK/egress versions; the sidecar live revision runtime does not support exchange. Resolver caller authentication is not implemented—Ed25519/JWKS remains design-only. Use a protected UDS or trusted-egress-only HTTPS with trusted CAs; sandbox allow rules must not expose resolvers, and MITM UID exclusion alone is not isolation (#2501 #2549 #2631 #2547).
[EXPERIMENTAL] Strict Actions v2: enable matching OPENSANDBOX_EGRESS_ACTIONS_API_VERSION/Fastlet actionsApiVersion values of sandbox.fast.io/actions/v2 only on clean-base direct-Firecracker deployments with durable state, isolated management ports, and manager authorization. Pause/resume, snapshots/restore, live binding removal, owner migration, and same-UID reuse remain unsupported; use terminal deletion/new UIDs, preserve fences, and never treat fencing as authentication or downgrade existing state to v1 (#2441 #2460 #2493 #2546 fast-sandbox#152).
[EXPERIMENTAL] Credential-bound interception: OPENSANDBOX_EGRESS_FSB_INTERCEPTION_MODE=credential-bound still denies decrypted application forwarding and must not be enabled in production. With the switch unset, both legacy gates enabled remain a deprecated alias; revision-runtime alone is installation-only. Explicit mode/gate conflicts, empty/unknown values, and setting this switch on sidecar fail startup (#2737 #2797).
Experimental startup requirements: credential-bound mode requires transparent MITM, dns+nft, and only default interception ports 80,443; remove insecure TLS verification, chained proxies, and effective ignore_hosts/allow_hosts. Runtime-user config.yaml then config.yml are checked; read/parse errors fail closed. To return to all, unset both legacy gates; sidecar live revision also rejects extra interception ports (#2587 #2797).
Port policies: Fast Sandbox supports TCP only, at most 256 ports per rule, and no domain-plus-port combinations; normal updates preserve established flows. dropEstablished is supported only on dns+nft sidecar PATCH/DELETE, ignored by POST, and unsupported in Fast Sandbox, dns-only, live-revision, or chained-proxy-plus-transparent-MITM modes; it installs packet drops, not TCP resets. Removing a port-only allow alone does not trigger established-flow blocking (#2662 #2346).
Operator-rule reload: Fast Sandbox reloads runtime-mutable rule files on a one-minute tick; mount ConfigMaps as directories, not subPath, and allow for kubelet projection delay. Image-baked rules still require a new image and recreation. Successful reloads clear DNS-learned leases, so allowed domains need another lookup; failed reloads retain the previous overlay, and established connections are not forcibly terminated (#2727 #2814).
Network-security boundaries: domain denies filter DNS, not direct connections to known IPs; use explicit IP/CIDR denies or default-deny policies for those paths. Operator denies override operator allows, so permitted internal services require a deny-range carve-out. Classic Docker/Kubernetes creation injects egress only when networkPolicy is supplied; poolRef plus networkPolicy is unsupported, so configure pooled controls in the template (#2814).
ResourceAware rollout: direct-Firecracker resource-admission.json moves from v2 to v3; old/new Fastlets reject the other configuration version, so coordinate controller/Fastlet upgrades per pool. Heartbeats remain v2. Hosts require writable cgroup v2, clone3(CLONE_INTO_CGROUP), and zero effective pool swap; the shared memory ceiling is not per-VM protection or a guarantee of survival across container replacement (#2626 fast-sandbox#162).
Restore sizing: ResourceAware pools use template CPU/memory shapes; new snapshots replay source limits, which restore-time caller limits must match. Legacy pools and snapshots without recorded limits retain their prior behavior (#2623 #2628 #2633).
[EXPERIMENTAL] RootfsOnly: Full remains the default; explicit RootfsOnly mode is available through Fast Sandbox FastPath/CRDs for reusable OCI snapshots, not pause/resume or OpenSandbox REST/SDK mode selection. New capture requires qualified patched Firecracker 1.17.0 templates, a live guest helper, qualified kernel/OverlayBD backend, exclusive ext4 ownership, and an absolute FAST_SANDBOX_ROOTFS_QUALIFICATION profile with matching digests/storage attestation; custom binary digests do not bypass the version gate. Upgrade runtime, Fastlet/Proxy, builder, and tools together, rebuild qualified templates, and preserve journals/fences. Restore cold-boots and reruns the entrypoint; no application-memory preservation or validated cross-CPU/architecture portability is promised (#2706 fast-sandbox#173 #2812 fast-sandbox#177 fast-sandbox#189).
OverlayBD template builds: guest-control injection and freeze/thaw validation are now mandatory for the OCI builder; FSB_GUEST_CONTROL_ENABLED is no longer an opt-out. Missing/incompatible helpers or failed probes stop the build. Native templates are unchanged; existing OCI templates need rebuilding rather than metadata edits to gain capture capability (#2812 fast-sandbox#183).
Fast Sandbox logs: covered Kubernetes components now write rotating files under /var/log/fast-sandbox by default (100 MiB per file, 10 backups, 7-day backup retention, gzip); application logs no longer appear in kubectl logs unless alsoStderr: true is configured. Replace legacy klog output flags with the shared logging YAML, wire ConfigMap/log-volume mounts for chart-managed static workloads, and configure each tenant namespace separately. Configuration is startup-only: use controlled Pool draining/replacement for Fastlets, not deletion of live Pods, and arrange collection before ephemeral logs are lost. Explicit missing/invalid configuration or unwritable output prevents startup; rotation limits are not a hard disk quota and do not cover guest/VM logs (#2812 fast-sandbox#197).
OCI checkpoint cache: reserve space for the additional blob cache (defaults: 16 GiB, 4096 files, 1 GiB free-space reserve), separately from OverlayBD's block cache. Keep staging/cache/device state on one filesystem for hard-link reuse; cross-filesystem placement or contention falls back to the registry. Set FAST_SANDBOX_OCI_BLOB_CACHE_SIZE_BYTES=0 to disable blob-cache insertion/lookups; active-device pins remain protected, including when budgets shrink (#2812 fast-sandbox#178).
ublkd recovery: automatic shared-snapfiles rebuilding applies only when no other Sandbox lease needs the attachment; it is not transparent recovery of running VMs. Remove affected Sandboxes through their normal lifecycle before retrying when other leases remain, rather than manually wiping shared caches (#2812 fast-sandbox#193).
Template rebuilds: opt-in runtime.execd_run_as_init needs rebuilt templates; execd remains a subreaper beneath guest PID 1. Free-page reporting also needs rebuilt object-store templates and compatible VMM/kernel support, cannot toggle restored device state, and does not enable OCI reporting or justify higher overcommit; rollback uses an older template (#2494 #2497 #2546 fast-sandbox#114).
OCI chart defaults: idle ublk devices are now reserved; set runtime.oci.poolLow=0 for on-demand allocation and match poolSizeGB to rounded-up rootfs capacity. P2P remains enabled by default; custom runtime.config needs separate adjustment for direct-origin delivery (#2594 fast-sandbox#163 #2566).
Snapshot integrity: missing commit digests now fail pause while retaining Pods; old snapshots are not repaired. OCI template references must carry a full SHA-256 digest in the expected repository; rebuild invalid references (#2482 #2491).
CLI scripts: non-positive request timeouts and empty rule targets are usage errors; osb config init overwrite refusal now exits 1 without changing the file (#2742 #2692 #2743).
VM console collection: opt in to vm-console, align hostPaths.vmConsole with the runtime state root, cover every runtime node, and manage file-sink retention (#2234 #2677).
Artifact verification: umbrella workflows do not provide blanket signing/provenance coverage; BOM digest matching is not proof of origin, and signature requirements must not be bypassed (#2467).
Images: opensandbox/<component>:release-1.2.1 (all three registries; fsb images for fast-sandbox)
Packages: server / CLI / SDKs all at 1.2.1
Charts: render from this tag (helm template ./manifests/charts/opensandbox)
Kubernetes: supported range v1.21 – v1.34
Skew: server ↔ CLI/SDK same line supported; ±1 minor warns

Contributors

Thanks to these contributors.

Artifacts

BOM: docs/releases/1.2.1.yaml
Images: opensandbox/<component>:release-1.2.1 (Docker Hub / GHCR / ACR)
Packages: PyPI ×5, npm ×2, Maven Central ×5, NuGet ×2 — all at 1.2.1
Go module: github.com/alibaba/OpenSandbox/sdks/sandbox/go@v1.2.1

Installation

# Platform (Kubernetes) — render the chart at this tag and apply
git clone https://github.com/opensandbox-group/OpenSandbox
cd OpenSandbox
git checkout release-1.2.1
helm dependency build manifests/charts/opensandbox  # package file:// sub-charts (not committed)
helm template ./manifests/charts/opensandbox | kubectl apply -f -
# or point your GitOps platform (Argo / Flux) at the repo path + tag

# SDKs
pip install opensandbox==1.2.1            # Python
npm install @alibaba-group/opensandbox@1.2.1   # JavaScript
# Kotlin/JVM: implementation("com.alibaba.opensandbox:sandbox:1.2.1")
dotnet add package Alibaba.OpenSandbox --version 1.2.1
go get github.com/alibaba/OpenSandbox/sdks/sandbox/go@v1.2.1

# Run the server locally
uvx opensandbox-server==1.2.1

opensandbox-group/OpenSandbox release-1.2.1 OpenSandbox 1.2.1 on GitHub