OpenSandbox

vdocker/execd/v1.0.21 Breaking

This release includes breaking changes for platform teams planning a safe upgrade.

Published 15d Containers & Orchestration

View tool

✓ No known CVEs patched

Read the diff → Tool health → What is this tool? →

✓ No known CVEs patched in this version

Topics

ai ai-agent ai-infra kubernetes sandbox

Affected surfaces

auth deps

ReleasePort's take

Light signal

editorial:auto 12d

The release adds a GET /v1/isolated/sessions API endpoint to list active isolated sessions and introduces explicit bind‑mount support in CreateIsolatedSessionRequest.

Why it matters: Provides developers with visibility into active isolated sessions, enabling better session management; supports finer‑grained resource control via explicit bind mounts for SDK users.

Summary

AI summary

Updates 📦 Misc, ✨ Features, and 🔧 Improvements across a mixed release.

Changes in this release

Type	Severity	Summary	CVE
Feature
Feature	Medium	Adds GET /v1/isolated/sessions API to list active isolated sessions. Adds GET /v1/isolated/sessions API to list active isolated sessions. Source: llm_adapter@2026-07-15 Confidence: high	—
Feature	Medium	Adds explicit bind mounts support in CreateIsolatedSessionRequest with default allowlist. Adds explicit bind mounts support in CreateIsolatedSessionRequest with default allowlist. Source: llm_adapter@2026-07-15 Confidence: high	—
Feature	Medium	Hardens bwrap defaults with new flags and introduces opt‑in uid_mode: "userns". Hardens bwrap defaults with new flags and introduces opt‑in uid_mode: "userns". Source: llm_adapter@2026-07-15 Confidence: high	—
Feature	Medium	Imports MITM CA into JDK cacerts via bootstrap.sh for non‑OS‑store JDKs. Imports MITM CA into JDK cacerts via bootstrap.sh for non‑OS‑store JDKs. Source: llm_adapter@2026-07-15 Confidence: high	—
Feature	Medium	Publishes execd images to GHCR registry. Publishes execd images to GHCR registry. Source: llm_adapter@2026-07-15 Confidence: high	—
Performance	Medium	Normalizes OTel metric attribute keys and switches OTLP export to delta temporality. Normalizes OTel metric attribute keys and switches OTLP export to delta temporality. Source: llm_adapter@2026-07-15 Confidence: high	—
Refactor	Low	Removes unused Jupyter auth helpers, orphan types, and stale log.Warning alias. Removes unused Jupyter auth helpers, orphan types, and stale log.Warning alias. Source: llm_adapter@2026-07-15 Confidence: high	—

Full changelog

What's New

✨ Features

List isolated sessions API. New GET /v1/isolated/sessions returns all active isolated sessions, plus a list method in every SDK (Go/Python/JS/Kotlin/C#). (#1269)
Explicit bind mounts for bwrap isolation. CreateIsolatedSessionRequest accepts binds: [{source, dest, readonly}], complementing the source==dest-only extra_writable. Sources are validated against a writable allowlist; default allowlist changes from empty to /workspace, /mnt, /media, /data (feature was unreleased, no callers affected). Bind destinations must already exist inside the sandbox root. (#1264)
Hardened bwrap defaults + opt-in uid_mode: "userns". Every bwrap invocation now sets --hostname sandbox, --unshare-cgroup, --die-with-parent, --new-session. New opt-in uid_mode: "userns" as an alternative to the default setpriv for identity switching. (#1226)
MITM CA trusted by non-OS-store JDKs. bootstrap.sh imports the egress MITM CA into every JDK's cacerts via keytool, fixing PKIX failures on tarball / Alpine / distroless JDKs. Idempotent, best-effort. (#1229)

🔧 Improvements

OTel metrics normalized. Attribute keys . → _ (http_method, http_status_code, routing_result) and OTLP export switched to delta temporality. Update dashboards/alerts accordingly. (#1209)

📦 Misc

GHCR image publishing. execd images now also published to ghcr.io. (#1161)
Dead code cleanup. Removed unused Jupyter auth helpers, orphan types, and stale aliases (log.Warning → log.Warn); net −296 lines, no behavior change. (#1266)

👥 Contributors

Thanks to these contributors ❤️

@bcho
@jianpingpei
@Pangjiping

Docker Hub: opensandbox/execd:v1.0.21
Aliyun Registry: sandbox-registry.cn-zhangjiakou.cr.aliyuncs.com/opensandbox/execd:v1.0.21
GHCR: ghcr.io/opensandbox-group/opensandbox/execd:v1.0.21

View diff on GitHub

Weekly OSS security release digest.

The CVE patches and breaking changes that affected production tools this week. One email, every Sunday.

No spam, unsubscribe anytime.

Share this release

Share on X Share on Bluesky

Track OpenSandbox

Get notified when new releases ship.

About OpenSandbox

Secure, Fast, and Extensible Sandbox runtime for AI agents.

All releases →

Related context

Related tools

Earlier breaking changes

vpython/sandbox/v0.1.14 Removes `CredentialMatch.ports`; port now derived from scheme.
vjava/sandbox/v1.0.16 Removes CredentialMatch.ports; port derived from scheme instead.
vdocker/egress/v1.1.4 `Match.Ports` field removed from Credential Vault bindings; ports derived from scheme.
vdocker/egress/v1.1.4 'X-Forwarded-Proto' is trusted only from configured proxy CIDRs.
vdocker/egress/v1.1.4 Credential Vault requires `dns+nft` enforcement for egress connections.