[dependabot]

Bumps @alibaba-group/opensandbox from 0.1.6 to 1.1.1.

Release notes

Sourced from @​alibaba-group/opensandbox's releases.

OpenSandbox 1.1.1

Stable cut of the 1.1.1 patch line: fixes the broken 1.1.0 server wheel — hatchling's VCS-exclude filtering silently dropped the committed FastPath gRPC stubs from the PyPI package, so every 1.1.0 install of opensandbox-server failed at import time; PyPI is immutable, so the fix ships on this line (#1959). SDK/CLI/server packages publish at 1.1.1 (1.1.1-rc.1 shipped images only). Everyone on 1.1.0 should upgrade. Baseline for every section below: release-1.1.0.

Highlights

• Fixes the 1.1.0 server wheel: FastPath stubs now ship in the package and installs import cleanly; SDK/CLI/server packages publish at 1.1.1 (#1959)
• Identity-bound filesystem operations: execd executes file APIs as an explicit Linux UID/GID, with FilesWithIdentity/files_with_identity in all five SDKs; isolated sessions gain multiple independent overlay mounts (#2070 #2093 #2094 #2095 #2096 #2097 #2032)
• Server hardening: snapshot creation submits the runtime object before persisting so early reads can't map to Failed, proxied backend failures map to 502/504 instead of a generic 500, and diagnostics work for pooled sandboxes (#2098 #2077 #2084 #2104)

Server

• Implement pause/resume for the agent-sandbox provider by bridging to spec.operatingMode (Running/Suspended) on agents.x-k8s.io/v1beta1, with state derivation (Paused/Pausing/Resuming/Terminated) and 409 on invalid transitions; both endpoints previously returned "not supported" (#1975)
• Isolate tenants that share one Kubernetes namespace: creates stamp opensandbox.io/tenant, and list/get/delete/pause/resume/proxy hide other tenants' labeled sandboxes as 404 while unlabeled legacy sandboxes stay visible until expiry; also adds kubernetes.insecure_skip_tls_verify for ServiceAccount CA mismatches (#1973)
• Heal the silent renew-intent drop after a server restart in multi-tenant mode: the resolver now falls back to a cluster-wide label lookup with a 403 circuit breaker and structured warnings, trusts an ingress-observed namespace from the intent payload when verifiable, and single-tenant deployments never resolve beyond the configured namespace (#1819)
• Add [docker] publish_host to publish bridge-mode sandbox ports on one host address (default 0.0.0.0 unchanged) — with 127.0.0.1 or the Docker bridge gateway, the tokenless execd port no longer lands on public interfaces (#1954)
• Add a typed, admin-only [egress.upstream_proxy] config section (URL + optional authorization, validated at load) that injects the sidecar's chained upstream CONNECT proxy on both Docker and Kubernetes, with fail-closed 400s when the requested networkPolicy is incompatible; secret values are no longer echoed in config-validation errors (#1999), plus ca_cert_path (Docker) and ca_secret_name (Kubernetes) so https:// proxies signed by a private CA are trusted without replacing the system trust store — the PEM augments /etc/ssl/certs in the sidecar (#2030)
• Make snapshot creation race-free for early readers on k8s/fsb: POST /sandboxes/{id}/snapshots now creates the runtime object (SandboxSnapshot CR / fsb submit) before persisting the Creating row and returns without queueing a worker, so read-time sync can no longer map a not-yet-created object to Failed — including on other HA replicas; recovery resubmits stuck rows inline (#2098), fixing the window where a client polling right after create flipped the row to a permanent Failed (#2077)
• Map proxied backend failures to meaningful statuses: read/write timeouts return 504 BACKEND_TIMEOUT, mid-response resets and protocol errors return 502 BACKEND_RESPONSE_FAILED, keeping 502 BACKEND_CONNECTION_FAILED for connect failures — a sandbox that dies mid-request no longer looks like a server bug (#2084)
• Find pool-allocated pods for k8s diagnostics: pooled BatchSandboxes don't carry the opensandbox.io/id pod label, so every logs/events/inspect call returned 404; the lookup now falls back to the pods listed in the workload's alloc-status annotation (#2104)
• Remove auto-created Docker volumes when create fails before the provisioning block runs (image pull, credential/upstream-proxy checks, Windows prerequisites, OSSFS prep) — a mistyped image name no longer leaks the PVC it triggered (#2103)
• Report deleting pooled/task-mode BatchSandboxes as Stopping/DELETING: metadata.deletionTimestamp now wins over runtime status publication, so a sandbox whose pods go not-ready during finalization no longer flips back to Pending/CREATING (#2122)
• Stop Docker metadata PATCHes from resurrecting deleted keys: patch() now starts from the override file (as get() does) instead of re-merging container labels, so {"env": null} stays deleted and an emptied override file doesn't restore the original labels (#2065)
• Accept env on template create and bake it into the fast-sandbox golden image (/etc/sandbox-init.env, inheriting the source image's OCI Config.Env), closing the gap where SandboxTemplate.spec.envs existed but the lifecycle API rejected it; supported across all SDKs (#1984)
• Wake Kubernetes creation waits on informer watch events instead of fixed 1-second polling, cutting prewarmed-pool create latency from ~1 s to tens of milliseconds while keeping the polling fallback (#1996)
• Ship the committed FastPath gRPC stubs in the server wheel by force-including them past hatchling's VCS excludes, and smoke-import the built wheel in the release workflow before publishing — this is the 1.1.0 install-time breakage fix (#1959)
• Fix the Fast Sandbox snapshot CR plural (sandboxsnapshots) in Helm RBAC and the fsb snapshot runtime, where sandboxesnapshots could fail list/watch with missing RBAC (#1972)
• Propagate the underlying FastPath error message through the 429 capacity mapping (keeping status and Retry-After, adding a cause field) so admission/runtime failures like a broken KVM device are no longer masked as pool exhaustion, and warn-log the raw error before mapping (#2001)
• Clarify the renewal contract: renew-expiration may shorten, preserve, or extend expiration (any future target is valid) and max_sandbox_timeout_seconds caps only creation, not renewal or total lifetime — documentation and SDK references aligned, with regression coverage across Docker, Kubernetes, and FastSandbox (#2087)
• Fix Docker edges: reject a repeated pause of an already-paused sandbox with the documented 409 instead of surfacing Docker's "already paused" as 500 (#2023), and clear Docker masked/read-only system paths only for sandboxes that opt into the isolation extension so nested Bubblewrap can mount a private procfs (#1982)

SDKs

• Add identity-bound filesystem operations end to end: execd gains additive /v1/filesystem/{uid}/{gid} routes backed by a per-request worker process running with explicit credentials and account-derived supplementary groups (fail-closed, existing routes unchanged), and every sandbox SDK exposes it — Python files_with_identity, JavaScript filesWithIdentity, Kotlin filesWithIdentity, C# FilesWithIdentity, Go FilesWithIdentity — so Linux checks the selected user's permissions during actual access; identity selection belongs in the trusted backend, this enforces filesystem permissions and is not a tenant boundary (#2070 #2093 #2094 #2095 #2096 #2097)
• Expose multiple independent overlay mounts per isolated session across the API and all five SDKs: CreateIsolatedSessionRequest.overlays ({path, mode, persist}) with separate host-tracked or ephemeral tmpfs uppers, workspace kept as sugar, and SessionState echoing the canonical list — completing the internal foundation from #2021 (#2032)
• Add commands.setEnv for persistent runtime env injection in all five sandbox SDKs (Python async/sync, JavaScript, Kotlin/Java, Go, C#): appends KEY=VALUE to the sandbox env file with runtime-exact serialization, local key/NUL validation, and a loud failure when EXECD_ENVS is unset (#2013)
• Systematic cross-language audit cleanup across sandbox, code-interpreter, and MCP SDKs: Go retry backoff collapsing to zero delay and dropped session cwd, Python isolated-session ignoring encoding and readiness budgets reporting stale errors, JS resume sharing and killing the source sandbox's transport, Kotlin codes runs dropping every SSE-framed event and never setting exitCode, C# create failing on fresh-sandbox 404 and NREs on empty bodies, and MCP per-call closes tearing down the server-wide shared transport — each fixed with regression tests (#2020)
• Support env on template create across all five SDKs, matching the server-side golden-image baking (#1984)
• Align background command stream completion across languages: with execd's fixed completion delay removed, background result collection in Go, Kotlin, and C# now returns on startup acknowledgement like Python and JavaScript instead of waiting for EOF and inferring exit code 0 — query command status for the eventual outcome; foreground calls still read to EOF for older servers (#1825)

Python

• Raise on error responses from create_session and delete_session: both passed the parsed model to the error handler (which needs the raw status), so 400/404/500 returned None as success and unknown statuses raised with a bogus status_code=200 — the CLI could print "Deleted session" for a session that never existed (#2066)
• Expose follow_redirects on ConnectionConfig/ConnectionConfigSync, propagated to all handwritten async/sync httpx clients including SSE clients and generated-client wrappers (#1123)
• Keep the last real endpoint error when the readiness deadline expires mid-request: the budget no longer records its own SandboxReadyTimeoutException as last_error, so causes like KUBERNETES::POD_IP_NOT_AVAILABLE aren't masked as a plain timeout (#2121)
• Authenticate Code Interpreter requests in server-proxy mode: context creation and streamed execution now attach the API key like sandbox file requests, fixing 401s from the same proxy (#2125)
• Serialize SandboxPoolSync.shutdown() teardown: concurrent shutdown (or shutdown racing start()) could close the warmup event loop twice; teardown is now idempotent under a dedicated lock (#2041)
• Orphan the shared warmup event loop instead of closing it over an in-flight warmup: when the bounded drain wait ends with warmups still running, shutdown leaves the loop alive so the in-flight warmup finishes and cleans up its sandbox, instead of destroying the pending task and skipping cleanup (#2142)
• MCP: map expected OpenSandbox validations to MCP 2.x ToolError so clients get the actionable message instead of a generic "Error executing tool" (#2108)

JavaScript

... (truncated)

Commits

• 531700c ci(release): trim umbrella workflow comments and default dry_run to false
• 016d61f ci(release): publish package legs in parallel and drop post-publish index checks
• db58ec1 release(opensandbox): pin BOM for 1.1.1
• 6150f36 fix(egress): close nft admission before draining writers
• b12c8c6 feat(egress): quiesce nft writers during revision recovery
• b7d7697 docs(release): cover python warmup-loop orphaning in 1.1.1 notes
• 4428c55 docs(release): cover scheduler NotReady fix in 1.1.1 notes
• f54406e docs(release): tighten 1.1.1 notes intro
• bab94cf docs(release): address codex review findings in 1.1.1 notes
• 9085c80 docs(release): cover execd line-ending preservation in 1.1.1 notes
• Additional commits viewable in compare view

[Copilot]

🔵 Needs a closer look

Compatibility of the major SDK upgrade with the pinned OpenSandbox v0.2.3 server remains unverified and needs integration validation.

No open issues 🎉

What changed in this PR

Updates the control plane’s OpenSandbox SDK from 0.1.6 to 1.1.1.

Changes:

• Raises the SDK dependency range to ^1.1.1.
• Updates the lockfile to resolve SDK 1.1.1 and its new OpenTelemetry API dependency.

File	Description
control-plane/​package.json	Updates the OpenSandbox SDK dependency range.
control-plane/​bun.lock	Locks the upgraded SDK and adds OpenTelemetry API.

_{Review effort: Balanced}

[Copilot]

🔵 Needs a closer look

The SDK upgrade changes create/connect endpoint resolution while deployments still pin server v0.2.3, so compatibility requires live creation, connection, file-access, and command-execution checks beyond the mocked unit tests.

No open issues 🎉

_{Review effort: Balanced}