OpenSandbox

First release candidate on the 1.2.1 patch line, cut from release-1.2.0 (2026-10-27). Headline: OSEP-0025 Credential Vault Exchange — an exchange credential source with per-request header resolution through a pluggable resolver, wired end to end across egress, server, all five SDKs, fast-sandbox e2e, and the Credential Vault guide. Also notable: execd atomic uploads, digest validation for rootfs snapshots, Kubernetes create-timeout startup diagnostics, and informer-cache scoping for large clusters. Baseline for every section is release-1.2.0. rc releases publish images but hold packages — SDK/CLI artifacts ship at the 1.2.1 stable bump.

Highlights

• Credential Vault Exchange (OSEP-0025): per-request dynamic header resolution, fail-closed and never persisted, across server and all five SDKs (#2457 #2535 #2534 #2560)
• Data-safety: execd uploads replace atomically so a failed write keeps the old file (#2433); the controller refuses rootfs snapshots whose commit result lacks digests (#2482)
• Operability: create timeouts report the pod startup failure reason (#2434); controller and fsb controller gain --namespaces cache scoping (#2571 #2581)

Server

• Sandbox list pushes metadata equality filters into the Kubernetes label selector, so large namespaces no longer materialize every workload before filtering (#2559)
• Template OCI hardening: publish repository syntax is validated at create, and sandbox creation requires a digest-pinned publish reference — a succeeded template can no longer resolve to a mutable or unrelated manifest (#2491)
• Kubernetes create timeouts append the pod startup failure reason (unschedulable, ImagePullBackOff, warning events) before rollback — image pull and scheduling failures are diagnosable through the API again (#2434)
• Docker: a concurrent container removal no longer aborts the startup expiration restore, and remaining Docker errors fail startup instead of silently dropping timers (#2533); duplicate, root, and server-mount-clashing destinations are rejected with 400 before provisioning (#2421 #2505)
• An explicit POSIX root in storage.allowed_host_paths now covers its descendants; the descendant check produced // and never matched (#2474)
• Proxy: a GET that declares a body is forwarded with it, so Elasticsearch-style requests stop failing with 500 (#2518); pool exhaustion returns 503 PROXY_POOL_EXHAUSTED instead of a 180-second wait ending in 500 (#2519)
• Smaller fixes: metadata=env= filters on the empty value instead of matching everything (#2461); gateway, bucket-name, and env-name validators reject trailing newlines (#2499)

SDKs

Exchange credential vault payloads (exchange source + typeless binding auth) are accepted across all five SDKs, al

Second release candidate on the 1.2.0 line, carrying everything merged since release-1.2.0-rc.1 — the headline is the Credential Vault (OSEP-0022) landing end to end for fast sandboxes: an egress-held vault with durable per-subject persistence and pause/resume transfer, the user-reachable server-routed vault API, and a pool-pinned MITM CA. Network policy follows the same egress-held pattern, and NetworkRule gains port-scoped rules in the classic profile — fast sandboxes reject them fail-closed until the fastlet nft path enforces them. Images publish now; SDK/CLI packages ship at the 1.2.0 stable bump. Please test and report issues.

Highlights

• Credential Vault (OSEP-0022) lands end to end for fast sandboxes: the egress sidecar holds the vault with durable per-subject files, sealed snapshot transfer for pause/resume, and stale-subject takeover on slot reuse (#2249 #2252 #2255 #2250); the server exposes the user-reachable POST|GET|PATCH|DELETE /v1/sandboxes/{id}/credential-vault API over the FastPath handler relay with credential values never appearing on any public read (#2263), and the MITM CA is pinned per pool so an egress restart no longer rotates the trust anchor under live sandboxes (#2251)
• Network policy mirrors the vault: the recorded fast-sandbox policy becomes egress-held state with relay CRUD, durable persistence, and pause/resume snapshot transfer (#2309), and NetworkRule gains port-scoped rules end to end in the classic profile — spec, sidecar nftables, server validation, and all five SDKs, while fast sandboxes reject ports fail-closed for now — plus an operator-side TCP port floor that no user policy can open (#2212)
• Lifecycle and diagnostics polish: lifecycle.renewalPolicy replaces the opaque renew extensions key (OSEP-0009) (#2296); the diagnostics context API reaches server, all five SDKs, and the CLI (#2292); execd fixes make start failures distinguishable, preserve session output byte-for-byte, and stop silent disk growth (#2303 #2318 #2295)

Server

• Implement the server side of the Credential Vault (OSEP-0022, fast-sandbox profile): the user-reachable POST|GET|PATCH|DELETE /v1/sandboxes/{id}/credential-vault API pushes complete vault revisions over the FastPath InvokeHandlerAction handler relay and treats the relay response as the synchronous egress-validated ack — the CRD never carries vault material, and every public read is sanitized server-side; PATCH composes in memory (delete → replace → add, each name resolving at most once) with expectedRevision as the cross-replica backstop, non-fsb backends proxy the sidecar's /credential-vault surface, and the fsb credentialProxy create-time rejection is lifted (#2263)
• Bake the pinned MITM CA into server-created SandboxTemplates (OSEP-0022): new [kubernetes] template_mitm_ca_secret / template_mitm_ca_secret_key config (default off) emits spec.egressMitmCertificate — the certificate entry only, never the private key — on every server-created template; the Secret must exist in each template namespace (ops-runbook distribution), and a missed copy fails th

First release candidate on the 1.2.0 line, carrying everything merged since release-1.1.1 — the headline is OSEP-0024: auto-pause and wake-on-access for fast sandboxes, landing end to end. Images publish now; SDK/CLI packages ship at the 1.2.0 stable bump. Please test and report issues.

Highlights

• Auto-pause and wake-on-access for fast sandboxes (OSEP-0024) lands end to end: ingress activity tracking and the wake path, the server-side idle sweeper, the opt-in lifecycle.idlePolicy create field, and the wake-retry contract in all five SDKs — off by default, additive only (#2156 #2180 #2192 #2198 #2218)
• Egress sidecar (experimental, opt-in): live credential-bound Vault admission, HTTP/2 support with bounded drain, atomic policy-file persistence, and runtime fault containment (#2176 #2201 #2182 #2162 #2172)
• SDK reliability: file uploads and downloads are no longer aborted at the 30-second request timeout in any of the five SDKs; execd now reports sandbox-scoped CPU/memory and OOM kills (#2165 #2186 #2196 #2206 #2191 #2200)

Server

• Implement the server side of OSEP-0024 auto-pause for fast sandboxes: the lifecycle create field lifecycle.idlePolicy (idleTimeoutSeconds 30–86400, onIdle: pause, wakeOnAccess, optional activeProbe) validates with pydantic bounds and persists as the reserved sandbox.opensandbox.io/idle-policy Sandbox CR annotation (annotation-write failure stays fail-safe — the sandbox is created unpolicied); an idle sweeper enumerates opted-in fsb sandboxes from the informer cache, checks activity in Redis (monotonic-max writes, missing-key tombstones can only delay a pause), takes a per-sandbox pause lock with re-verify under lock, and issues an idempotent FastPath PauseSandbox; a declared activeProbe executes through the ingress gateway and a busy answer records ordinary activity; an OpenSandbox-Skip-Activity: skip sentinel suppresses the observation for one request and is stripped on both gateway and server-proxy hops (#2192 #2181)
• Configure idle-pause under the new lifecycle-automation umbrella: [idle_pause] becomes [automation.idle_pause] and the redundant redis.enabled gate is removed — redis.dsn is required (validated at load) when enabled = true, failing loudly instead of silently not starting the sweeper; configuration.md is rewritten for conciseness and now documents ingress.secure_access and the missing env-var overrides (#2215)
• Default BatchSandbox pods to restartPolicy: Never: a kubelet in-place container restart recreated the main container from its image — wiping the writable layer and in-memory state — while the sandbox kept reporting Succeed; restarting is never a meaningful recovery for a sandbox, so the honest default is no restart, which also makes the controller's term

Stable cut of the 1.1.1 patch line: fixes the broken 1.1.0 server wheel — hatchling's VCS-exclude filtering silently dropped the committed FastPath gRPC stubs from the PyPI package, so every 1.1.0 install of opensandbox-server failed at import time; PyPI is immutable, so the fix ships on this line (#1959). SDK/CLI/server packages publish at 1.1.1 (1.1.1-rc.1 shipped images only). Everyone on 1.1.0 should upgrade. Baseline for every section below: release-1.1.0.

Highlights

• Fixes the 1.1.0 server wheel: FastPath stubs now ship in the package and installs import cleanly; SDK/CLI/server packages publish at 1.1.1 (#1959)
• Identity-bound filesystem operations: execd executes file APIs as an explicit Linux UID/GID, with FilesWithIdentity/files_with_identity in all five SDKs; isolated sessions gain multiple independent overlay mounts (#2070 #2093 #2094 #2095 #2096 #2097 #2032)
• Server hardening: snapshot creation submits the runtime object before persisting so early reads can't map to Failed, proxied backend failures map to 502/504 instead of a generic 500, and diagnostics work for pooled sandboxes (#2098 #2077 #2084 #2104)

Server

• Implement pause/resume for the agent-sandbox provider by bridging to spec.operatingMode (Running/Suspended) on agents.x-k8s.io/v1beta1, with state derivation (Paused/Pausing/Resuming/Terminated) and 409 on invalid transitions; both endpoints previously returned "not supported" (#1975)
• Isolate tenants that share one Kubernetes namespace: creates stamp opensandbox.io/tenant, and list/get/delete/pause/resume/proxy hide other tenants' labeled sandboxes as 404 while unlabeled legacy sandboxes stay visible until expiry; also adds kubernetes.insecure_skip_tls_verify for ServiceAccount CA mismatches (#1973)
• Heal the silent renew-intent drop after a server restart in multi-tenant mode: the resolver now falls back to a cluster-wide label lookup with a 403 circuit breaker and structured warnings, trusts an ingress-observed namespace from the intent payload when verifiable, and single-tenant deployments never resolve beyond the configured namespace (#1819)
• Add [docker] publish_host to publish bridge-mode sandbox ports on one host address (default 0.0.0.0 unchanged) — with 127.0.0.1 or the Docker bridge gateway, the tokenless execd port no longer lands on public interfaces (#1954)
• Add a typed, admin-only [egress.upstream_proxy] config section (URL + optional authorization, validated at load) that injects the sidecar's chained upstream CONNECT proxy on both Docker and Kubernetes, with fail-closed 400s when the requested networkPolicy is incompatible; secret values are no longer echoed in config-validation errors (#1999), plus ca_cert_path (Docker) and ca_secret_name (Kubernetes) so https:// proxies signed by a private CA are trus