Skip to content

OpenSandbox

vsdks/sandbox/go/v1.0.5 Feature

This release adds 3 notable features for engineering teams evaluating rollout.

✓ No known CVEs patched
Read the diff → Tool health → What is this tool? →

✓ No known CVEs patched in this version

Topics

ai ai-agent ai-infra kubernetes sandbox

Summary

AI summary

Updates ✨ Features, 👥 Contributors, and 🐛 Bug Fixes across a mixed release.

Full changelog

What's New

✨ Features

  • Retrying pool acquire policies — Go sandbox pools now support AcquirePolicyRetryNextIdle and AcquirePolicyRetryNextIdleThenCreate, allowing Acquire to skip stale idle candidates before failing or falling back to direct create. Existing policies keep their current behavior; MaxAcquireRetries defaults to 3. #1347
  • Sandbox create metricsSandbox.Create now reports fire-and-forget sandbox.create latency events to the lifecycle server. Reporting ignores old-server version skew and can be disabled with OPENSANDBOX_DISABLE_METRICS=1. #1307
  • Client IP header — the SDK now best-effort detects the host intranet IPv4 and sends it as OPEN-SANDBOX-CLIENT-IP on outbound requests. User-provided headers are never overwritten. #1326
  • Attach to isolated sessions — the SDK can now attach to an existing isolated session by session ID, allowing stateless workers to recover a functional handle while the execd in-memory session remains alive. #1295
  • UID mode availability — isolated session responses now expose per-mode setpriv / userns availability, and unavailable requested modes fail with 503 NOT_SUPPORTED. #1320
  • Exact snapshot name filtering — snapshot listing now supports an exact name filter. #1301
  • Isolated session bind mounts and listing — isolated sessions can now receive explicit bind mounts, and the SDK exposes isolated session listing so callers can inspect active sessions. #1264 #1269
  • Credential Vault placeholder substitutions — request matching now supports opt-in placeholders for path, query, header, and body surfaces, including passthrough auth bindings. #1251

🐛 Bug Fixes

  • Streaming and stale connection hardening — long-lived SSE command streams no longer use the normal total request timeout, so command output is not cut off by RequestTimeout. Idempotent GET / HEAD requests retry once on a fresh connection after timeout, reset, or EOF errors. #1316

📦 Misc

  • Bumped the Go SDK version constant and default User-Agent string for this release. #1384

👥 Contributors

  • @FAUST-BENCHOU
  • @Pangjiping
  • @jianpingpei
  • @jwx0925
  • @ninan-nn
  • @ruirui6946

Weekly OSS security release digest.

The CVE patches and breaking changes that affected production tools this week. One email, every Sunday.

No spam, unsubscribe anytime.

Share this release

Track OpenSandbox

Get notified when new releases ship.

Sign up free

About OpenSandbox

Secure, Fast, and Extensible Sandbox runtime for AI agents.

All releases →

Related context

Earlier breaking changes

Beta — feedback welcome: [email protected]