OpenSandbox

What's New

⚠️ Breaking Changes

• Execd install path flattened from /opt/opensandbox/bin/ to /opt/opensandbox/ — the emptyDir mount in the K8s provider and the Docker bootstrap launcher now use a single /opt/opensandbox directory instead of the nested /opt/opensandbox/bin. Binary paths like /opt/opensandbox/bin/execd become /opt/opensandbox/execd. The Docker runtime also replaces its inline-generated 15-line bootstrap shim with the full bootstrap.sh from the execd image, gaining MITM CA trust, SIGTERM forwarding, and pre-script support. Users running code-interpreter images ≤v1.0.2 must upgrade to v1.1.0; custom Pool CR templates need updated mountPaths and env vars. See the migration guide for details. (#1014)

✨ Features

• Credential Vault — new credential injection system that lets sandboxes consume secrets (API keys, OAuth tokens, HTTP headers, query parameters) without exposing raw values to user code. Credentials are defined at the platform level and injected through the egress sidecar at request time. Includes server-side plumbing, K8s CRD support, egress integration, SDK surface (Python, Go, JS, Kotlin, Java), CLI commands (osb credential-vault), and E2E test coverage. (#1009, #1023, #1027)

🐛 Bug Fixes

• Conflicting endpoint modes now rejected — requests that combine use_server_proxy=true with expires (asking for both a server proxy path and a signed gateway route) now return SANDBOX::INVALID_PARAMETER instead of silently resolving a signed URL and then overwriting it with the proxy URL. Lifecycle API spec updated accordingly. (#952)

• Gzip-encoded proxy responses no longer corrupted — the server proxy forwarded backend Content-Encoding headers while using httpx.aiter_bytes(), which decodes compressed bodies. Clients then received a gzip header on already-decoded bytes, breaking content like noVNC pages. The proxy now streams raw backend bytes so preserved Content-Encoding headers stay correct. (#971)

• Docker bootstrap launcher defaults EXECD_ENVS — the Docker-generated bootstrap script now exports EXECD_ENVS before starting execd, aligning with the behavior expected by components/execd/bootstrap.sh. Previously the missing variable could cause execd startup issues. (#999)

• Null spec.template crash in platform constraint scope — pool-mode BatchSandbox CRs with spec.template: null crashed _workload_platform_constraint_scope during status polling (same root cause as #910 but in a different call path). Chained .get(key, {}) replaced with .get(key) or {} to handle both absent and null values. (#1007)

• None entrypoint crash in pool-mode creation — when SDK callers omit entrypoint for pool-mode sandboxes, None propagated into _create_workload_from_pool where it triggered TypeError: 'NoneType' object is not iterable in _build_task_template. Now normalised to DEFAULT_ENTRYPOINT at the top of the function. (#1017)

📦 Misc

• Dependency: starlette 0.50.0 → 1.0.1 — major version bump, includes malformed Host header handling fix. (#978)
• Dependency: idna 3.11 → 3.15 — DNS-length cap enforcement and helper cleanups. (#959)

👥 Contributors

Thanks to these contributors ❤️

• @Gujiassh
• @jwx0925
• @Pangjiping
• @qingyuppp
• @RajvardhanPatil07

• PyPI: opensandbox-server==0.2.0
• Docker Hub: opensandbox/server:v0.2.0
• Aliyun Registry: sandbox-registry.cn-zhangjiakou.cr.aliyuncs.com/opensandbox/server:v0.2.0