OpenSandbox

What's New

✨ Features

• Sandbox metadata PATCH endpoint — new PATCH /sandboxes/{sandboxId}/metadata for incremental label updates: pass a value to set/update, pass null to delete a key. Smoke tests included. (#861)

• Stable Diagnostics API (server-side stub) — SDKs and CLI gain osb diagnostics logs|events with required scope. The server returns 501 DIAGNOSTICS_NOT_IMPLEMENTED for scope-bearing requests until the stable backend lands; requests without scope keep the legacy DevOps text/plain behavior, so existing clients are unaffected. (#869)

⚡ Performance

• Unblock the event loop, expose concurrency knobs — 17 lifecycle/pool route handlers that wrap synchronous Kubernetes/Docker SDK calls switched from async def to sync def, letting FastAPI auto-offload them to the anyio threadpool. The four sync K8s calls inside create_sandbox / _wait_for_sandbox_ready are now wrapped in asyncio.to_thread. list_custom_objects serves from the informer cache when synced, falling back to the API for unsynced caches or unsupported label-selector grammars. New [server] keys: workers, limit_concurrency, backlog, thread_pool_size, loop, http — all additive, defaults preserve current behavior. uvicorn upgraded to uvicorn[standard] (uvloop / httptools / watchfiles). 8 × 200 ms concurrent list_sandboxes drops from a 1.6 s serial floor to ~250 ms. Closes #887. (#903)

🐛 Bug Fixes

• Pool-mode sandbox creation returned HTTP 500 — pool-mode BatchSandbox CRs come back from the K8s API server with spec.template: null (key present, value None) because the CRD declares template as an optional preserve-unknown-fields object. The previous spec.get("template", {}).get("spec") in _extract_platform_from_workload crashed because dict.get only returns the default when the key is absent, not when its value is None. The underlying sandbox actually reached Running, but clients saw a 500 with no sandbox_id, leaking resources. Switched to the or {} pattern that treats null and missing alike; six regression tests cover null template, missing template, template-mode happy path, podTemplate alias, null spec, and empty workload. (#910)

• image / entrypoint / resourceLimits no longer required when poolRef is set — these fields are defined on the Pool CRD template, but the schema previously rejected pool-mode requests without dummy values (422). Validation in schema.py, kubernetes_service.py, docker_service.py, and container_ops.py now skips these fields when poolRef is present, explicitly rejects the poolRef + snapshotId combination, and rejects poolRef on the Docker provider (unsupported). specs/sandbox-lifecycle.yml updated accordingly. Fixes #885. (#883)

• K8s patch_sandbox_metadata failed to delete keys and returned stale state — two bugs combined to break the nightly e2e test_02_metadata_filter_and_logic: (1) JSON merge patch (RFC 7396) merges labels recursively, so keys absent from the patch body are kept; the old code computed the final desired dict (already without the deleted keys) and sent that, so the deletes never reached the API server. (2) After PATCH the code re-read via _get_workload_or_404, which prefers the informer cache and could land before the watch event arrived, returning pre-patch labels. Fix: build the merge-patch body with explicit None for deleted keys, and use the API server's PATCH response directly instead of re-reading the cache. WorkloadProvider.patch_labels now takes Dict[str, Optional[str]] and returns the patched workload dict. (#899)

📦 Misc

• Dependency: urllib3 2.6.3 → 2.7.0, includes two high-severity security fixes — GHSA-mf9v-mfxr-j63j (decompression-bomb safeguard bypass on drain_conn / second read(amt=N) with Brotli) and GHSA-qccp-gfcp-xxvc (ProxyManager.connection_from_url did not strip Retry.remove_headers_on_redirect headers on cross-host redirect). (#872)
• Bundled runtime image bumps — egress → v1.0.11 / v1.0.12, execd → v1.0.15 / v1.0.16, synced across example configs and docker-compose. (#847, #876, #889, #907)
• Docs: fixed dead links to example.config*.toml in server/README.md and server/configuration.md (files actually live under server/opensandbox_server/examples/). (#904)
• Example: added dockur windows pool example. (#878)
• Agent guidance: updated server/AGENTS.md. (#839)

👥 Contributors

Thanks to these contributors ❤️

• @qingyuppp
• @Pangjiping
• @longsuizhi
• @ninan-nn
• @Generalwin
• @immanuwell
• @jwx0925

• PyPI: opensandbox-server==0.1.14
• Docker Hub: opensandbox/server:v0.1.14
• Aliyun Registry: sandbox-registry.cn-zhangjiakou.cr.aliyuncs.com/opensandbox/server:v0.1.14