github.com/TencentCloud/CubeSandbox changelog and release notes

v0.7.224 Sept 20262 sources agree

CubeSandbox 0.7.2 introduces 3 major features along with multiple enhancements and bug fixes. 56 commits from 29 contributors.

2026.09.24 Release v0.7.2

CubeSandbox 0.7.2 introduces 3 major features along with multiple enhancements and bug fixes. 56 commits from 29 contributors.

🎯 Major Features

Much faster cross-node restore reads

Sandboxes restored cross-node on the S3 backend read disk data from S3 on demand; this release optimizes that read path systematically:

New whole-object local cache: immutable data objects on S3 are kept on the local node, so repeated reads after a restore — and re-importing the same snapshot — hit the local cache instead of going back to S3.
Reduced read amplification during restore: scattered small reads are coalesced into whole-object GETs, and the concurrent fetch budget is capped.
With the default MinIO setup, cross-node restore / create-from-snapshot reaches running in under 1 second.

New JuiceFS volume plugin

New JuiceFS storage plugin: sandboxes can mount a JuiceFS filesystem as a persistent volume, with full POSIX semantics.

Automatic reclaim of idle guest memory

Idle memory inside sandboxes is reclaimed back to the host: node memory usage falls back dynamically with the real usage of the sandboxes, so a single node can host more sandboxes.

✨ Enhancements

Templates & Storage

S3lvol hot upgrade: fixes the EIO errors seen inside sandboxes when upgrading the CubeS3lvol storage component.
Local-filesystem storage for component repositories and template artifacts (#1749): component repositories and template artifacts can be stored on S3 / local disk / PVC / NFS.
Incremental snapshot fix (#1343): fixed data loss in incremental snapshots.
Faster virtiofs on the pause / snapshot path (#1748): optimized the state preparation flow before pause.
Cubelet can configure the template install path, allowing large templates to be moved to the data disk (#1675).
CubeS3lvol object cache: identical objects read during a cross-node restore are served from the local object cache first, and the object cache and dest cache share the same local cache storage (#1756).

Lifecycle & Control Plane

sandbox.connect supports a timeout parameter (#1352).

Deployment & Runtime

cube-node now runs on the host network by default in K8s deployments (#1815): recreating the cube-node Pod no longer destroys the network namespace, so the network of every sandbox on the node stays up. Switching an existing cluster requires draining compute nodes and explicit confirmation (hostNetworkChangeAck); fresh installs are unaffected.
Faster sandbox cold start (#1694): disabled the RAID6 PQ startup benchmark in the guest kernel, which is unrelated to workloads.

Web UI / CubeOps / Other

Removed the legacy E2B SDK reference; Python SDK command execution now goes through the envd Connect RPC (#1786).
The Python SDK's run_code (E2B-compatible code-interpreter interface) can now read environment variables injected at sandbox creation (#1323), matching the behavior of commands.run; the new sandbox-code example image is required.

🐛 Bug Fixes

Lifecycle & Sandbox

Fixed inconsistent memory-snapshot and image-snapshot state when building a template (#1760).
Fixed existing snapshots becoming unusable after a template was deleted (#1763).
Fixed a race where concurrent image builds left tasks stuck in BUILT with database connection timeouts (#1802).
Fixed snapshot creation retries being rejected as a changed request body (#1253).
Fixed paused sandboxes not returning a timeout (end_at=0) in Info / List queries (#1801).
Fixed an explicit timeout passed to Connect not taking effect for already-running sandboxes; a shorter timeout no longer shortens an existing longer deadline, and the Python SDK now passes the parameter through (#1352).
Fixed PVM detection: the upstream PVM ABI removed the CPUID signature, so detection now relies on the MSR list supported by KVM, compatible with both old and new ABIs (#1781).
Fixed a kernel panic when PVM guests booted on Intel hosts because GMI sm3/sm4 probing was misdetected (#1725).
Fixed resume failing after pause on ARM (Could not restore GICv3ITS state): the vgic state save was incorrectly optimized to all zeros by the compiler (#1658).

Networking & Security

Fixed sandboxes having a guest MTU larger than the node uplink NIC under overlay CNI, which left the network broken out of the box: guest MTU now follows the node NIC automatically (it only decreases), and can be pinned with cubeNode.network.mtu (#1674).

Deployment & Upgrade

Fixed the CUBE_SANDBOX_CUBE_EGRESS_IMAGE environment variable not being updated in .one-click.env for one-click deployments (#1788).
Fixed CubeOps failing to connect when the MySQL password contains special characters; invalid configuration now fails at startup (#1617).
Fixed one-click install failing silently on snap-packaged Docker; it now tells users to switch to docker-ce (#1789).
Fixed inconsistent Redis logical-DB configuration across components in one-click deployments, which made CubeOps write metrics to the wrong database (#1705).
Fixed PVM installation failing on Ubuntu (#1770).
Fixed the template artifact cache not being movable to the data disk on its own (#1675).
Fixed CubeS3lvol being pinned to CPU0/CPU1 by default; another CPU is now picked automatically when unconfigured (#1713).

Other

Fixed PostgreSQL template-alias duplicate errors being misclassified by error text and occasional template status publish failures; classification now uses SQLSTATE (#1724).
Fixed compatibility issues in the cubebench CPU topology report (#1757).
Added an Ubuntu desktop sandbox example and integration guide (#1746).
Added an OpenCode integration: a plugin hook redirects bash into the sandbox so commands no longer run directly on the developer's machine (#1238).
Added a CI status page (#1737).
Corrected the PVM expansion: Pagetable-based, not Parallel (#1772).
Added a documentation security warning: injecting credentials over HTTP is unsafe, limited to controlled internal networks; prefer HTTPS (#1818).

Open source →

Additional notes

title: v0.7.2 — 2026.09.23

2026.09.23 Release v0.7.2

CubeSandbox 0.7.2 引入了 3 个核心特性以及多个功能增强与问题修复。共计 56 个提交，来自 29 位贡献者。

🎯 核心特性

跨机恢复读取性能大幅提升

S3 后端跨机恢复的沙箱，磁盘数据按需从 S3 拉取；本版本对这条读路径做了系统性优化：

新增整对象本地缓存：S3 上的不可变数据对象在节点本地留存，恢复后的反复读取、以及再次导入同一份快照，都直接命中本地缓存，不再回源。
恢复期间读放大得到缓解：零散的小块读合并为整对象 GET，并限制并发拉取预算。
在默认 MinIO 环境下，跨机恢复 / 从快照创建进入 running 不到 1 秒。

新增 JuiceFS 卷插件

新增 JuiceFS 存储插件：沙箱可挂载 JuiceFS 文件系统作为持久卷，具备完整 POSIX 语义。

Guest 空闲内存自动回收

沙箱内的空闲内存自动回收到宿主机：节点内存占用随沙箱实际用量动态回落，单节点可承载更多沙箱。

✨ 功能增强

模板与存储

S3lvol 热升级：解决升级 CubeS3lvol 存储组件时，沙箱内出现 EIO 的问题。
组件仓库与模板产物存储支持本地文件系统（#1749）：组件仓库与模板产物可选择存放在 S3 / 本地磁盘 / PVC / NFS。
增量快照修复（#1343）：修复增量快照的数据丢失问题。
暂停 / 快照路径 virtiofs 提速（#1748）：优化暂停前的状态准备流程。
Cubelet 支持配置模板安装路径，可将大体积模板迁往数据盘（#1675）。
CubeS3lvol 新增 object cache 功能，跨机恢复时有相同对象读取会优先命中本地 object cache，object cache 和 dest cache 共享本地 cache 存储空间（#1756）。

生命周期与控制面

sandbox.connect 支持 timeout 参数（#1352）。

部署与运行时

K8s 部署的 cube-node 默认改用 hostNetwork（#1815）：cube-node Pod 重建不再销毁网络命名空间，节点上所有沙箱的网络不再随之中断。存量集群切换需先排空计算节点并显式确认（hostNetworkChangeAck），全新安装不受影响。
沙箱冷启动提速（#1694）：关闭 guest 内核中与业务无关的 RAID6 PQ 启动基准测试。

Web UI / CubeOps / 其他

移除旧 E2B SDK 引用，Python SDK 命令执行统一走 envd Connect RPC（#1786）。
Python SDK 的 run_code（E2B 兼容代码解释器接口）现在也能读到创建沙箱时注入的环境变量（#1323），与 commands.run 行为一致；需使用新增的 sandbox-code 示例镜像。

🐛 Bug 修复

生命周期与沙箱

修复制作模板时内存快照和镜像快照状态不一致的问题（#1760）。
修复删除模板删除后已有快照不可用的问题（#1763）。
修复并发构建镜像时任务永久停留在 BUILT 状态，数据库连接超时的竞态问题（#1802）。
修复快照创建请求重试被误判为请求内容变化而拒绝的问题（#1253）。
修复暂停中的沙箱 Info / List 查询不返回超时时间（end_at=0）的问题（#1801）。
修复 Connect 显式传入的超时时间对已运行沙箱不生效的问题；更短的超时不会缩短已有的更长时限，Python SDK 补齐该参数（#1352）。
修复 PVM 识别问题：上游 PVM ABI 移除了 CPUID 签名，改为通过 KVM 支持的 MSR 列表判定，新旧 ABI 兼容（#1781）。
修复 PVM guest 在 Intel 宿主上启动时因 GMI sm3/sm4 探测误判而内核 panic 的问题（#1725）。
修复 ARM 平台暂停后恢复失败（Could not restore GICv3ITS state）的问题：vgic 状态保存被编译器错误优化为全零（#1658）。

网络与安全

修复 overlay CNI 下沙箱 guest MTU 大于节点上行网卡、开箱即网络不通的问题：guest MTU 默认自动跟随节点网卡（只降不升），可用 cubeNode.network.mtu 固定（#1674）。

部署与升级

修复一键部署下 CUBE_SANDBOX_CUBE_EGRESS_IMAGE 环境变量未正确更新到 .one-click.env 的问题（#1788）。
修复 CubeOps 配置 MySQL 密码含特殊字符时连接失败的问题；错误配置现在启动即报错（#1617）。
修复一键安装在 snap 版 Docker 上静默失败的问题，现在会直接提示改用 docker-ce（#1789）。
修复一键部署下各组件 Redis 逻辑库配置不一致、CubeOps 指标写错库的问题（#1705）。
修复 Ubuntu 上安装 PVM 失败的问题（#1770）。
修复模板产物缓存无法单独迁移到数据盘的问题（#1675）。
修复 s3lvol 默认绑死 CPU0/CPU1 的问题，未配置时自动选用其他 CPU（#1713）。

其他

修复 PostgreSQL 下模板别名重复错误按错误文本误判、模板状态发布偶发失败的问题，改按 SQLSTATE 精确分类（#1724）。
修复 cubebench CPU 拓扑报告的兼容性问题（#1757）。
新增 Ubuntu 桌面沙箱示例与集成指南（#1746）。
新增 OpenCode 集成方案：通过插件钩子把 bash 重定向进沙箱，避免命令直接落在开发机上（#1238）。
新增 CI 状态页（#1737）。
修正 PVM 的展开说明：Pagetable-based，而非 Parallel（#1772）。
文档新增安全警示：HTTP 方式注入凭据不安全，仅限受控内网使用，建议优先 HTTPS（#1818）。

v0.7.111 Sept 2026Deprecated2 sources agree

Fixed the Web UI runtime config page showing deprecated settings ( #1573 ).

2026.09.11 Release v0.7.1

CubeSandbox 0.7.1 introduces 1 major feature along with multiple enhancements and bug fixes. 70 commits from 24 contributors.

🎯 Major Features

End-to-end high availability for Cube control-plane services

A standalone template-center service enables multi-replica CubeMaster deployment.
The lifecycle management service now supports active/standby deployment.

✨ Enhancements

Templates & Storage

Snapshot support for Host Mount and Volume Plugin: snapshot, restore, rollback, and clone now work for sandboxes with external mounts (#1654, #1656).
Standalone CubeTemplateCenter: template build / delete / reclaim is split out of CubeMaster into an independently scalable multi-replica service. Build artifacts are persisted to S3/MinIO (AWS S3 compatible). Also fixes long-standing issues around concurrent build races, inconsistent artifact table names, and ephemeral local-disk storage (#1659).
Faster same-bucket cross-node snapshot restore (#1663): restoring a snapshot from the same bucket now uses object-storage server-side copy, which is significantly faster. Also improves delayed-delete reclamation and adds snapshot cancellation.

Lifecycle & Control Plane

CLM now supports active/standby disaster recovery.
Running sandboxes no longer block snapshot deletion (#1620): deleting a still-referenced snapshot takes effect immediately; underlying storage is reclaimed after the last reference is released.

Security

virtiofsd hardening (#1612): after a directory whitelist is set, root-directory mutation operations are rejected, as are forged readdirplus requests.

Deployment & Runtime

CubeS3lvol on Kubernetes (#1637): use the S3 backend for cross-node pause/resume and snapshots in K8s deployments.
One-click deployment supports external PostgreSQL (#1644): choose MySQL / PostgreSQL via CUBE_DATABASE_DRIVER and connect to a self-managed database instance.
CubeS3lvol is now opt-in (#1622, #1633): set [cow.s3] enable = true (or ONE_CLICK_ENABLE_S3LVOL=1 for one-click deploy); it is disabled by default. Also fixes the switch not taking effect during one-click upgrades. Upgrade note: nodes that were using S3 without an explicit setting must enable it after upgrade.
Unified Helm Redis logical-DB config (#1638): new top-level redis.db applies to CubeMaster / CubeProxy / CLM, so multiple clusters sharing one Redis instance can isolate logical databases per cluster.

Web UI / CubeOps / Other

cubemastercli batch template deletion (#1549): tpl delete accepts multiple template IDs in one call.

🐛 Bug Fixes

Lifecycle & Sandbox

Fixed sandboxes set to never expire (NEVER_TIMEOUT) being immediately treated as expired (#1401).
Fixed invalid CPU / memory specs in create requests being treated as 0, allowing sandboxes to bypass node resource filters and be scheduled onto any node (#1463).
Fixed a new timeout passed on Resume being discarded, so the sandbox kept its pre-pause timeout (#862).
Fixed snapshots after an S3-backend restore falling back to a full memory dump; snapshots stay incremental (#1688).
Fixed no log output from cubecli logs for sandboxes created from a template (#1616).
Fixed template creation hanging indefinitely when a compute node is unresponsive; added a configurable timeout (default 300 seconds) (#994).
Fixed gRPC connections not being closed promptly after a node is taken offline or deleted (#1585).
Fixed S3 volume mount failures with newer s3fs (1.97+ / FUSE3) (#1647).

Networking & Security

Fixed the transparent proxy returning 504 after 60 seconds when talking to slow-TTFB upstreams such as LLMs; proxy send/receive timeout is now 2 hours (#1655).
Fixed CubeEgress failures caused by oversized credential values injected via network rules; the per-entry injection limit is aligned with E2B at 2048 bytes (#1606).
Fixed TAP device names silently truncated past the kernel length limit, causing network device lookup failures (#1552).
Fixed intermittent Cubelet network-plugin init failures on K8s when the gateway ARP cache is not ready early in node startup (#1609).
Image-registry credentials no longer appear in component logs (#1600).

Deployment & Upgrade

Fixed Helm upgrades failing because Redis StatefulSet PVC labels changed (#1604).
Fixed global.imageRegistry overwriting explicitly configured private / third-party registry addresses (#1605).
Fixed helm test pods remaining Pending on tainted nodes (#1388).
Fixed Terraform deployments skipping validation and template creation when node queries returned 0 healthy nodes (#1602).
Fixed CubeOps ignoring the logical-DB number when using a standalone Redis config, which hid node metrics and caused scheduling-metric update timeouts (#1607).
Fixed lowercase log-level values (e.g. info) not taking effect and falling back to DEBUG (#1597).
Fixed builder image builds failing on Ubuntu 20.04 (#1588).

Other

Node / Python SDK: fixed command execution never returning when timeout is 0 or NEVER_TIMEOUT (#1485).
Fixed cubeopscli reporting a hardcoded 0.1.0 version and the version subcommand being unavailable (#1596).
Fixed cubemastercli version producing no output by default (#1657).
Fixed the Web UI runtime config page showing deprecated settings (#1573).

Open source →

Additional notes

title: v0.7.1 — 2026.09.11

2026.09.11 Release v0.7.1

CubeSandbox 0.7.1 引入了 1 个核心特性以及多个功能增强与问题修复。共计 70 个提交，来自 24 位贡献者。

🎯 核心特性

Cube 控制面服务支持全链路高可用

独立模板中心服务，使得 CubeMaster 可多副本部署。
生命周期管理服务支持主备模式部署。

✨ 功能增强

模板与存储

Snapshot 支持 Host Mount 与 Volume Plugin：支持对包含外部挂载的沙箱执行快照、恢复、回滚和克隆（#1654，#1656）。
独立模板中心 CubeTemplateCenter：模板构建 / 删除 / 回收从 CubeMaster 拆分为独立可多副本部署，构建产物持久化到 S3/MinIO（兼容 AWS S3），并修复并发构建竞态、artifact 表名不一致与本地盘存储易失等长期问题（#1659）。
跨机快照同桶恢复提速（#1663）：从同一桶恢复快照改走对象存储服务端拷贝，速度显著提升；同时完善延迟删除的回收，新增快照取消能力。

生命周期与控制面

CLM 支持主备容灾。
运行中的沙箱不再阻止快照删除（#1620）：删除仍被引用的快照立即生效，底层存储在最后一个引用释放后自动回收。

安全

virtiofsd 安全加固（#1612）：设置目录白名单后拒绝针对根目录的变更操作，并拒绝伪造的 readdirplus 请求。

部署与运行时

K8s 支持部署 CubeS3lvol（#1637）：可在 K8s 上使用 S3 后端的跨节点暂停恢复与快照。
一键部署支持外部 PostgreSQL（#1644）：通过 CUBE_DATABASE_DRIVER 选择 MySQL / PostgreSQL，接入自建数据库实例。
CubeS3lvol 改为显式开启（#1622、#1633）：需设置 [cow.s3] enable = true（一键部署用 ONE_CLICK_ENABLE_S3LVOL=1），默认关闭；同时修复一键部署升级时该开关不生效的问题。升级注意：此前未显式配置但实际在使用 S3 的节点，升级后需显式开启。
Helm 统一 Redis 逻辑库配置（#1638）：新增顶层 redis.db，统一作用于 CubeMaster / CubeProxy / CLM；多套集群共享同一 Redis 时可按集群隔离逻辑库。

Web UI / CubeOps / 其他

cubemastercli 批量删除模板（#1549）：tpl delete 支持一次传入多个模板 ID。

🐛 Bug 修复

生命周期与沙箱

修复沙箱设置为永不过期（NEVER_TIMEOUT）后被立即判定为已过期的问题（#1401）。
修复创建请求中非法的 CPU / 内存规格被按 0 处理，导致沙箱绕过节点资源过滤、可被调度到任意节点的问题（#1463）。
修复恢复（Resume）时传入的新超时时间被丢弃、沙箱仍沿用暂停前超时的问题（#862）。
修复 S3 后端恢复后再创建快照退化为全量内存导出的问题，快照保持增量（#1688）。
修复基于模板创建的沙箱无法查看日志（cubecli logs 无输出）的问题（#1616）。
修复计算节点无响应时模板创建可能无限卡住的问题，增加超时控制（默认 300 秒，可配置）（#994）。
修复节点下线 / 删除后对应 gRPC 连接未及时关闭的问题（#1585）。
修复新版 s3fs（1.97+ / FUSE3）下 S3 卷挂载失败的问题（#1647）。

网络与安全

修复经透明代理访问 LLM 等慢首包上游时，超过 60 秒即被 504 断开的问题；代理收发超时提升至 2 小时（#1655）。
修复网络规则注入过大的凭据值导致 CubeEgress 异常的问题；单条注入上限与 E2B 对齐为 2048 字节（#1606）。
修复 TAP 设备名超过内核长度限制被静默截断，导致网络设备查找失败的问题（#1552）。
修复节点启动初期网关 ARP 缓存未就绪导致 Cubelet 网络插件初始化偶发失败的问题（K8s 部署下）（#1609）。
镜像仓库访问凭据不再出现在组件日志中（#1600）。

部署与升级

修复 Helm 升级时 Redis StatefulSet 因 PVC 标签变化而失败的问题（#1604）。
修复 global.imageRegistry 误改写显式指定的私有 / 第三方镜像仓库地址的问题（#1605）。
修复 helm test 测试 Pod 在带 taint 节点上一直 Pending 的问题（#1388）。
修复 Terraform 部署时节点查询失败（健康节点数为 0）导致校验与模板创建被跳过的问题（#1602）。
修复 CubeOps 使用独立 Redis 配置时逻辑库编号不生效，导致节点指标不可见、调度指标更新超时的问题（#1607）。
修复日志级别配置为小写（如 info）时不生效、回落到 DEBUG 的问题（#1597）。
修复 Ubuntu 20.04 上构建 builder 镜像失败的问题（#1588）。

其他

Node / Python SDK：修复命令执行传入 0 或 NEVER_TIMEOUT 超时后请求永不返回的问题（#1485）。
修复 cubeopscli 版本号显示错误（硬编码 0.1.0）及 version 子命令不可用的问题（#1596）。
修复 cubemastercli version 命令默认无输出的问题（#1657）。
修复 Web UI 运行配置页展示已废弃配置项的问题（#1573）。

v0.7.028 Aug 20262 sources agree

CubeSandbox 0.7.0 introduces 4 major features along with multiple enhancements and bug fixes. 239 commits from 57 contributors.

2026.08.28 Release v0.7.0

CubeSandbox 0.7.0 introduces 4 major features along with multiple enhancements and bug fixes. 239 commits from 57 contributors.

🎯 Major Features

Cross-Node Pause & Resume

With an S3 backend, sandboxes support pause/resume across nodes as well as creating sandboxes from snapshots. This feature is currently in preview.

Component Multi-Versioning

Newly created templates and snapshots now record the versions of the components they depend on. After components on compute nodes are upgraded, historical templates and snapshots remain usable, and upgrades no longer affect pause/resume of existing instances — improving stability for running workloads.

Network Subsystem Refactor: Faster Sandbox Network Provisioning

Architecture: fewer components to deploy — the network-agent component is merged into Cubelet, reducing inter-process RPC calls during sandbox creation; TAP device lifecycle management is redesigned to prevent network rules from leaking across sandboxes, reducing attack surface.
Performance: optimized the eBPF network policy provisioning path, significantly reducing sandbox creation latency for sandboxes with network rules; removed unnecessary netlink dump operations so that creating new TAP devices under high concurrency remains stable when idle TAP devices are exhausted.

Separation of Control Plane and Operations

Architecturally, operations capabilities are split out of CubeMaster. Node management logic now lives in CubeOps, which supports multi-replica deployment and ships the cubeopscli tool.

✨ Enhancements

Templates & Storage

CubeS3lvol COW (#1490): besides the local XFS COW engine, cubecow now supports remote snapshot storage on S3 object storage, enabling cross-node pause/resume and snapshot cloning.
Private HTTP image registry support (#1369): pull images from HTTP image registries to build templates.
Built-in MinIO as the default S3 volume backend (#1408): MinIO is deployed by default as the S3 backend for the volume feature and cross-node pause/resume. Users can also specify their own S3 backend.

Lifecycle & Control Plane

Node deletion (#1202): support removing a node from the cluster so it no longer participates in scheduling.

Networking & Security Proxy

Network subsystem refactor: NetworkAgent is fully embedded into Cubelet, streamlining the network provisioning flow.
Support dynamically updating network policies for running sandboxes.
CubeEgress L7 forwarding rules now support custom ports.
CubeVS learns MAC addresses within the same subnet, avoiding black-holed traffic in non-hairpin networks.
CubeProxy supports a custom management port and the gRPC protocol.

SDK

Volume support: the Go (#1269) and Node (#1277) SDKs add Volume CRUD and volumeMounts, bringing all three languages to parity.
Full template alias support: build-time aliases (#1119) and alias management for existing templates (#1120), covering Go / Node / Python.
Go SDK user-level file view (#1348): Files.ForUser isolates file access by user identity.
Node SDK runtime timeout (#1251): Sandbox.setTimeout(timeout) supports NEVER_TIMEOUT.
Python SDK sandbox scheduling scope (#1144): Sandbox.create(distribution_scope=...) explicitly specifies the nodes/zones a sandbox can be placed on.
Go SDK private sandbox dataplane fix (#1185): RunCode / Commands / Files / PTY now correctly pass through the TrafficAccessToken.
Node SDK auth header fix (#1360): an Authorization header explicitly set by the caller (including lowercase variants) is no longer overridden by the SDK's default apiKey.
Clone snapshot deferred cleanup across all three SDKs (#1095): reference counting ensures the temporary snapshot is deleted only after all clones are destroyed.

Deployment & Runtime

Configurable log rotation policy (#1339): users can adjust cubelet's log rotation policy via the configuration file.
Kernel / guest images published as separate artifacts (#1324): releases no longer rebuild the kernel and guest images; fixed versions are pulled from dedicated kernel-release-* / guest-image-* releases.

Web UI / CubeOps / Other

CubeOps: node management moved into this module; new cubeopscli tool for node management, replacing the cubemastercli node subcommands; two-replica deployment supported by default (#1384, #1494).
Web UI: node isolation/unisolation and node operation history viewing (#1384).

🐛 Bug Fixes

Lifecycle & Sandbox

Fixed sandbox state inconsistency, zombie processes, and deletion failures caused by failed pause/resume (#978, #985, #1137, #1274).
Fixed snapshot performance issues (#1300, #1504).
Fixed a template cache data race during concurrent sandbox creation (#1366).

Networking & Security

Fixed sandbox state anomalies caused by TAP device recovery failures during pause/resume and node restarts (#930, #987, #1207).

Other

Fixed log rotation configuration not taking effect (#1289).
Expanded the Python SDK compatibility end-to-end tests with coverage for the filesystem, rollback & cloning, online timeout updates, abnormal lifecycles, and advanced template parameters (#1226).

📚 Documentation

New K8s deployment guide covering compute-node cube-node rebuild constraints and hostNetwork guidance (#1495).
Community pages (#1344, #1364): sponsors and contributors wall added to the README.

Open source →

Additional notes

Go SDK 0.7.0 — auto-generated from go-sdk-v0.7.0

Open source →

Additional notes

title: v0.7.0 — 2026.08.28

2026.08.28 Release v0.7.0

CubeSandbox 0.7.0 引入了4个核心特性以及多个功能增强与问题修复。共计 239 个提交，来自 57 位贡献者。

🎯 核心特性

跨机暂停恢复

基于S3后端存储支持跨机的pause/resume以及基于snapshot创建沙箱，该功能目前是预览版本。

组件多版本

新建的模板、快照会包含所依赖的组件版本信息，后续在计算节点组件升级后，历史的模板、快照仍然可以使用，升级也不再影响已有实例的pause、resume，存量业务稳定性更有保障。

网络子系统重构，加速沙箱网络创建流程

架构优化：减少组件部署，将 network-agent 组件合并进 Cubelet，减少沙箱创建流程中的进程间 RPC 调用；重构 TAP 设备生命周期管理，避免网络规则跨沙箱泄露，减少边界风险
性能优化：优化 eBPF 网络策略下发路径，大幅降低带有网络规则的沙箱创建延迟；减少不必要的 netlink dump 操作，当空闲 TAP 设备耗尽后，保障高并发创建新 TAP 设备的稳定性

控制面/运维架构分离

在架构上，将运维能力从CubeMaster中分离。把节点管理逻辑独立到CubeOps中，支持多副本部署，提供cubeopscli工具。

✨ 功能增强

模板与存储

CubeS3lvol COW (#1490): cubecow在原本的本地XFS cow引擎之外，新增支持基于对象存储S3的远程快照存储，支持跨节点的暂停恢复和快照克隆。
私有 HTTP 镜像仓库支持(#1369)：支持从http镜像仓库拉镜像来做模板
内置 MinIO 作为默认 S3 卷后端(#1408)：默认部署minio作为s3后端，用于volume功能、跨机暂停恢复。同时，用户也可自行指定s3后端。

生命周期与控制面

新增节点删除功能（#1202）：支持从集群中删除节点，使其不再参与调度。

网络与安全代理

网络子系统重构，将 NetworkAgent 整体嵌入 Cubelet，优化网络创建流程
支持运行中的沙箱动态更新网络策略
CubeEgress 七层转发规则支持自定义端口
CubeVS 同子网 MAC 地址学习，避免非 hairpin 网络通信黑洞
CubeProxy 支持自定义管理端口，支持 gRPC 协议

SDK

Volume 能力补齐：Go（#1269）与 Node（#1277）SDK 新增 Volume CRUD 与 volumeMounts 挂载，三语言能力拉齐。
模板别名完整支持：构建时别名（#1119）与现有模板别名管理（#1120），覆盖 Go / Node / Python。
Go SDK 用户级文件视图（#1348）：Files.ForUser 按用户身份隔离文件访问。
Node SDK 运行时 timeout（#1251）：Sandbox.setTimeout(timeout) 支持 NEVER_TIMEOUT。
Python SDK 沙箱调度范围（#1144）：Sandbox.create(distribution_scope=...) 显式指定沙箱可放置的节点/区域。
Go SDK 私有沙箱数据面修复（#1185）：RunCode / Commands / Files / PTY 正确透传 TrafficAccessToken。
Node SDK 认证头修复（#1360）：调用方显式传入的 Authorization（含小写形式）不再被 SDK 默认 apiKey 覆盖。
三语言 SDK clone 快照延迟清理（#1095）：引用计数，所有 clone 销毁后才删除临时快照。

部署与运行时

日志轮转策略可配置(#1339)：用户可通过配置文件调整cubelet的日志轮转策略。
内核 / guest 镜像产物独立发布(#1324): 版本发布不再重新编译内核和 guest 镜像,而是从专用的 kernel-release-* / guest-image-* Release 拉取固定版本

Web UI / CubeOps / 其他

CubeOps：节点管理能力移至本模块；新增cubeopscli工具管理节点功能并移除cubemastercli node子工具；默认支持双副本部署；（#1384、#1494）
Web UI：提供节点隔离/解除隔离功能；提供查看节点操作记录功能；（#1384）

🐛 Bug 修复

生命周期与沙箱

修复暂停/恢复失败引发的沙箱状态不一致、僵尸进程及删除异常等问题（#978，#985，#1137，#1274）
修复快照性能问题（#1300，#1504）
修复并发创建沙箱时的模板缓存数据竞争(#1366)

网络与安全

修复暂停/恢复及节点重启场景下，TAP 设备恢复异常导致沙箱状态异常等问题（#930，#987，#1207）

其他

修复日志轮转配置失效（#1289）
扩展 Python SDK 兼容性端到端测试，新增文件系统、回滚与克隆、在线超时更新、异常生命周期及高级模板参数等场景的覆盖（#1226）

📚 新增文档

新增K8s 部署方式的计算节点 cube-node 重建约束与 hostNetwork 指引(#1495)
社区页面(#1344、#1364): README 新增赞助者与贡献者墙。

Open source →

v0.6.024 Jul 2026Security2 sources agree

CVE-2026-24834 / CVE-2026-47243 fixes ( #1066 ).

2026.07.24 Release v0.6.0

CubeSandbox 0.6.0 continues to strengthen core capabilities for production deployment and operations.
This release introduces 6 major features along with multiple enhancements and bug fixes. 92 commits from 31 contributors.

🎯 Major Features

Kubernetes Deployment: Deploy Cube Control Plane and Compute Nodes on K8s

Deploy CubeSandbox control-plane components and compute nodes directly onto Tencent Cloud TKE, standard Kubernetes, or k3s clusters via Helm Chart. Perform rolling upgrades, canary releases, and other operations using standard Kubernetes practices. For details, see the Kubernetes Deployment Guide.

::: warning Preview
Kubernetes deployment is currently in preview. Advanced capabilities such as seamless upgrades are still under active development. Feedback is welcome.
:::

E2B-Compatible Volume Framework

Introduces an E2B-compatible Volume framework that lets users plug in custom backend storage while remaining compatible with the E2B standard. Provides four hooks — Create / Destroy / Attach / Detach — and two plugin forms: Binary and RPC. This release includes Volume lifecycle management, sandbox–Volume binding APIs, and supporting SDK and cubemastercli capabilities. For details, see the Volume Plugin Guide.

Template Aliases

Support setting an alias when creating a template, and creating sandboxes by specifying that alias.

Note: Aliases can only be set at template creation time; existing templates cannot have aliases added or changed. Specifying an alias when creating a sandbox is currently supported only in the Python SDK; other SDKs will follow soon.

Configurable Host for Inbound Sandbox Requests

Allow configuring the Host header forwarded to the sandbox (instead of the default <port>-<sandboxId>.<domain>), improving compatibility with Host-based services inside the sandbox. The new network.maskRequestHost parameter can be set when creating a sandbox to specify the Host forwarded to in-sandbox services (for example localhost:${PORT}, which expands to localhost:3000 when accessing port 3000), so applications that rely on Host for routing, validation, or callbacks work correctly.

Compute Node Isolation

Support isolating a compute node at the scheduling layer so operators can log in for maintenance, upgrades, and troubleshooting. After isolation, no new sandboxes are scheduled to that node; existing sandboxes continue to run unaffected.

Isolate a node with cubemastercli node isolate <node-id>, and lift isolation with the unisolate subcommand. For details, see Node Isolation.

CubeOps Operations Service: Decouple Ops & Web Console Logic from CubeAPI

Web console capabilities are split out of the CubeAPI module into a standalone CubeOps service, making CubeAPI lighter and more extensible.

✨ Enhancements

SDK

Go SDK PTY (#815): Improved interactive terminal capabilities.
Python SDK X-API-Key coverage (#995): Carry X-API-Key on all request paths.
Go SDK Connect protocol frames and dataplane fixes (#828, #941): process.Process/Start, exit-0 end event parsing, encode deduplication, and dataplane defect fixes.
Short sandbox ID prefix resolution (#697): CubeMaster / Cubelet support short ID prefix resolution for easier ops and troubleshooting.

Templates & Storage

Templates can enable the ivshmem device (#858).
cubemastercli UX improvements (#891): Better experience for tpl info / delete / redo.
New cubemastercli volume-related subcommands (#1077).

Lifecycle & Control Plane

CLM state sync (#956): Stronger sandbox lifecycle state consistency; control-plane pause/resume actions are synced to the dataplane.
Async CubeProxy state push (#1044): Push with backoff retries to reduce sync-push jitter.
Skip capacity checks for delete-triggered auto-resume (#1015): Prevent resume on the delete path from being wrongly blocked by capacity checks.
Schema migration toggle (#1037, #1076): New CUBE_AUTO_MIGRATION env var to skip automatic DB migration at startup for controlled upgrades.
Support deleting sandboxes that are in the paused state.

Networking & Security Proxy

CubeEgress MITM leaf certificate SAN (#948): Write subjectAltName on leaf certificates for better TLS verification compatibility.
Return 403 on traffic token validation failure (#1053): Align with E2B and avoid confusion with other error codes.
CubeProxy Redis hostname resolver (#714): Correctly resolve Redis hostnames.
Disable gzip on Connect streams (#1083): Prevent streaming RPCs from being broken by compression.

Deployment & Runtime

PostgreSQL metadata backend (#674, #1000): CubeMaster DAO layer supports PostgreSQL.
Switch in-sandbox cgroup from v1 to v2 (#899).
Cubelet state tmpfs supports dynamic expansion (#1008).

Web UI / CubeOps / Other

Improved compute-node component version inventory reporting (#1020).
CubeMaster HTTP APIs now handled with the gin framework (#922).

🐛 Bug Fixes

Lifecycle & Sandbox

Nested host-mount mount order: apply configuration in user-specified order (#946).
Periodic compute-node health sync (#730): Avoid inconsistency between health state and the scheduling view.
WebUI: Converge to a 404 terminal state after sandbox timeout cleanup (#1036); eliminate session invalidation risk (#1048).

Security & Validation

CVE-2026-24834 / CVE-2026-47243 fixes (#1066).
Stronger image reference validation (#868): Prevent parameter injection.
PVM kernel update (#937): Address security vulnerabilities.

📚 Documentation

Kubernetes deployment guide (#1067 and others): EN/ZH install / architecture / upgrade / FAQ.
Node isolation guide (#1093).
Volume plugin guide and COS examples (#997, #1089).
Component troubleshooting guide (#968).

Open source →

Additional notes

Go SDK 0.6.0 — auto-generated from go-sdk-v0.6.0

Open source →

Additional notes

title: v0.6.0 — 2026.07.24

2026.07.24 Release v0.6.0

CubeSandbox 0.6.0 面向生产部署与运维持续增强关键能力。当前版本引入了 6 个核心特性以及多个功能增强与问题修复。共计 92 个提交，来自 31 位贡献者。

🎯 核心特性

K8s 部署：支持在 K8s 中部署 Cube 的控制面组件及计算节点

支持通过 Helm Chart，将 CubeSandbox 的控制面组件和计算节点直接部署到腾讯云 TKE、标准 K8s 或 k3s 集群中。可通过标准 K8s 运维方式执行组件滚动升级、灰度发布等操作。关于 K8s 部署的详细信息请参考 K8s 部署指南。

::: warning 预览版本 K8s 部署功能当前处于预览阶段，平滑升级等高级功能仍在积极开发中，欢迎体验和反馈。 :::

兼容 E2B 标准的 Volume 框架

新引入兼容 E2B 标准的 Volume 框架，在兼容 E2B 标准的前提下允许用户以插件形式自定义后端存储方案。提供 Create/Destroy/Attach/Detach 四个 HOOK 点，以及 Binary/RPC 两种插件形态。当前版本提供 Volume 生命周期管理、沙箱绑定 Volume 相关 API、配套 SDK 与 cubemastercli 能力。详细信息请参考 Volume 插件文档。

支持模板别名

支持在创建模板时为模板设置别名，并通过指定别名创建沙箱。

说明：别名只能在创建模板时设置，不支持为已有模板修改别名。当前仅 Python SDK 支持指定别名创建沙箱，其他 SDK 后续即将支持。

支持配置沙箱入向请求的 Host

允许配置请求转发至沙箱时的 Host（而非默认的 <port>-<sandboxId>.<domain>），更好地兼容沙箱内基于 Host 的服务。新增 network.maskRequestHost 参数，可在创建沙箱时指定转发给沙箱内服务的 Host（例如 localhost:${PORT}，访问 3000 端口时展开为 localhost:3000），以便兼容依赖 Host 做路由、校验或回调的应用。

支持计算节点隔离

支持从调度层面“隔离”某个计算节点，便于运维时登录节点进行维护、升级和排查问题。计算节点被隔离后，将不会调度新的沙箱到该节点，存量沙箱运行不受影响。

可通过 cubemastercli node isolate <node-id> 进行节点隔离，通过 unisolate 子命令解除隔离，详细用法请参考节点相关操作。

CubeOps 运维服务：将运维 & Web 控制台逻辑从 CubeAPI 模块中解耦

Web 控制台相关能力从 CubeAPI 模块中剥离，独立为 CubeOps 服务，使 CubeAPI 更轻量、更具可扩展性。

✨ 功能增强

SDK

Go SDK PTY (#815)：优化交互式终端能力。
Python SDK X-API-Key 认证补齐 (#995)：全路径请求携带 X-API-Key。
Go SDK Connect 协议帧与数据面修复 (#828, #941)：process.Process/Start、exit-0 end 事件解析，以及 encode 去重与数据面缺陷修复。
短沙箱 ID 前缀解析 (#697)：CubeMaster / Cubelet 支持短 ID 前缀解析，运维与排障更方便。

模板与存储

模板支持启用 ivshmem 设备 (#858)。
cubemastercli 用户体验优化 (#891)：tpl info / delete / redo 命令体验优化。
新增 cubemastercli volume 相关子命令 (#1077)。

生命周期与控制面

CLM 状态同步 (#956)：增强沙箱生命周期状态一致性，控制面的暂停/恢复动作会同步给数据面。
CubeProxy 状态推送异步化 (#1044)：带退避重试，降低同步推送抖动。
删除触发的 auto-resume 跳过资源容量检查 (#1015)：避免 delete 路径上的 resume 被容量检查误拦。
Schema 迁移开关 (#1037, #1076)：新增 CUBE_AUTO_MIGRATION 环境变量，可跳过启动期数据库自动迁移，便于受控升级。
支持删除处于暂停状态的沙箱。

网络与安全代理

CubeEgress MITM 叶子证书 SAN (#948)：叶子证书写入 subjectAltName，改善 TLS 校验兼容性。
Traffic token 校验失败返回 403 (#1053)：对齐 E2B，避免与其他错误码混淆。
CubeProxy Redis hostname resolver (#714)：正确解析 Redis 主机名。
Connect 流禁用 gzip (#1083)：避免流式 RPC 被压缩破坏。

部署与运行时

PostgreSQL 元数据后端 (#674, #1000)：CubeMaster DAO 层支持 PostgreSQL。
沙箱内从 cgroup v1 改为 cgroup v2 (#899)。
Cubelet state tmpfs 支持动态扩容 (#1008)。

Web UI / CubeOps / 其他

计算节点组件版本清单上报优化 (#1020)。
CubeMaster HTTP 接口改为使用 gin 框架处理 (#922)。

🐛 Bug 修复

生命周期与沙箱

嵌套 host-mount 挂载顺序：按用户指定顺序进行配置 (#946)。
计算节点健康状态周期性同步 (#730)：避免健康状态与调度视图不一致。
WebUI：沙箱超时清理后收敛 404 终态 (#1036)，消除会话失效风险 (#1048)。

安全与校验

CVE-2026-24834 / CVE-2026-47243 修复 (#1066)。
镜像引用校验强化 (#868)：防止参数注入。
PVM kernel 内核更新 (#937)：解决安全漏洞。

📚 新增文档

Kubernetes 部署指南（#1067 等）：中英文安装 / 架构 / 升级 / FAQ。
节点隔离指南 (#1093)。
Volume 插件指南与 COS 示例 (#997, #1089)。
组件排障指引 (#968)。

v0.5.111 Jul 20262 sources agree

CubeSandbox 0.5.1 is a production follow-up to 0.5.0, hardening AutoPause, ARM64, and cluster deployment for real-world scale. Headline items: a stand

2026.07.10 Release v0.5.1

CubeSandbox 0.5.1 is a production follow-up to 0.5.0, hardening AutoPause, ARM64, and cluster deployment for real-world scale. Headline items: a standalone cube-lifecycle-manager control-plane service (extracted from the CubeProxy sidecar so CubeProxy can scale horizontally), a three-value timeout semantics refactor with server-side defaults and NEVER_TIMEOUT, and host-mount path allowlisting to close arbitrary host bind-mounts. The release also fixes ARM64 64 KB page snapshot integrity and substantially improves egress policy / TAP recycle reliability. 59 commits from 18 contributors.

🎯 Major Features

cube-lifecycle-manager: Standalone AutoPause Coordinator

Splits the former in-image cube-proxy-sidecar into a standalone control-plane service — cube-lifecycle-manager (CLM) — so CubeProxy can run multiple replicas without a single-instance sidecar bottleneck.

Standalone deploy: CLM is wired into cube-sandbox-control.target; one-click and TencentCloud Terraform deployments both include it.
Redis service discovery: each CubeProxy replica registers its admin endpoint in Redis; CLM discovers live replicas and coordinates auto-pause / auto-resume with no static replica list.
Protocol compatibility: wire protocol, Redis schema, and SDK behavior are unchanged; existing AutoPause / AutoResume semantics are preserved.
TencentCloud Terraform (#814): control plane gains a cube-lifecycle-manager Deployment; supports TENCENTCLOUD_CUBE_PROXY_REPLICAS multi-replica plus CLM replica count / discovery refresh / admin token knobs.

Three-Value Timeout Semantics + Server-Side Default

Unifies sandbox idle-timeout semantics (E2B-aligned) and moves the "not set" vs "explicit default" decision from SDK / CubeAPI down to CubeMaster.

Value	Meaning
Omitted (`None` / `nil`)	Cluster `default_timeout_insec`; if unset or ≤0 → never timeout
`NEVER_TIMEOUT` (`-1`)	Never reclaim on idle
`0`	Immediate timeout (reclaimed on the first idle sweep)
`N > 0`	Idle TTL = N seconds

SDK: Go / Python CreateOptions.Timeout become optional pointers; Create / Connect / Resume no longer inject a hard-coded default. Expose NeverTimeout / NEVER_TIMEOUT sentinels.
CubeAPI / CubeMaster: timeout fields are Option / *int, preserving "unset"; EndAt follows three-value rules (-1 → no deadline).
RPC deadline decoupled from idle TTL: new create_timeout_insec (default 300s) bounds only the create/scheduling RPC.
CLM sweeper: skip reclaim when TimeoutSeconds < 0; immediate reclaim at == 0; legacy nil falls back to DefaultIdleTimeout.
Runtime adjustment: Python / Go SDKs add set_timeout() / SetTimeout(), including NEVER_TIMEOUT (#743, #850). Web UI can pass timeout on sandbox create (#798).

Host-Mount Path Allowlist Hardening

Host-mount previously accepted any absolute path, letting sandboxes bind-mount arbitrary host directories. Paths are now restricted to configurable prefixes (default /data/shared/), with filepath.Clean neutralizing .. traversal; / is explicitly forbidden in config (#756).

Persistent-storage docs updated (path restriction, permissions, multi-tenant isolation, multi-node shared storage); examples aligned to the default prefix (#768).

✨ Enhancements

SDK

Node.js / TypeScript SDK (preview) (#792): adds @cubesandbox/sdk aligned with the Python / Go surface; still under validation — use with caution in production.
Python / Go set_timeout (#743, #850): E2B-aligned; CubeAPI / CubeMaster accept -1 (NEVER_TIMEOUT) and reject other negatives.
Go SDK allowOut guard alignment (#802): AllowPublicTraffic=false is no longer treated as deny-all; matches CubeAPI (deny-all only when AllowInternetAccess=false or denyOut contains 0.0.0.0/0).

Networking & Egress

CubeEgress credential injection on plain HTTP (#726): allows inject against HTTP-only upstreams. The security boundary is that sandbox code never sees the secret, not that egress→upstream must be TLS.
CubeEgress transparent-proxy IP from sandbox CIDR (#851): no longer hard-codes 192.168.0.1; derives the first usable IP from CUBE_SANDBOX_NETWORK_CIDR so custom sandbox networks get correct TPROXY / OpenResty listen addresses.
Minimum TTL for DNS-learned egress entries: clamp learned allow entries to ≥300s so short DNS TTLs do not cause reconnect denials.
Skip policy re-check for established CubeEgress sessions: CubeVS skips egress policy re-evaluation for existing TCP sessions so DNS expiry does not break live connections; policy check folded into create_nat_session with per-session caching.
Always replay default deny on replace: replace / flush always replays private / link-local default deny entries so create and replace policy shapes stay consistent.

Deployment & Installer

CubeProxy pre-published multi-arch images (#849): one-click pulls TCR multi-arch images instead of building on-host; supports MIRROR=cn|int and airgap local-cache fallback.
Component image release pipeline (#795): release-docker-images.yml pushes multi-arch component images to GHCR / TCR; bump-image.sh is the single source of truth for hard-coded tags.
CubeMaster Dockerfile (#813, #824): unified Docker build args / context and ARG scoping fixes; CubeAPI Dockerfile switched to single-shot build with safety gates (#854).
One-click dnsmasq fallback (#740): optional script-owned dnsmasq when systemd-resolved is absent and NetworkManager's dnsmasq plugin never spawns, restoring cube.app resolution.
Anchored cubelet config patching (#776): sed replacements anchored at line start so updating CUBE_SANDBOX_NETWORK_CIDR cannot rewrite an empty cube_router_cidr.

Web UI / AgentHub / Other

CubeAPI lifecycle snake_case (#772): accepts Python-style lifecycle.on_timeout / lifecycle.auto_resume, avoiding silent fallback to kill / no-resume.
AgentHub OpenClaw bind=lan (#769): force gateway bind to lan so cube-proxy can reach it via tap IP (auto could resolve to loopback).
ARM64 runtime hardening (#807): dirty-bitmap granularity uses host page size (fixes severely incomplete snapshots on 64 KB pages and 200% CPU on restore); aarch64 vCPU falls back to PMU-less init when the host lacks PMUv3.
Dev-env QEMU 10.x (#713): explicit -drive if=none + -device virtio-blk-pci fixes empty-drive errors on QEMU 10.2.2+.

🐛 Bug Fixes

Lifecycle & Sandboxes

Idempotent resume (#817): already-Running sandboxes return an "already in target state" signal (treated as success by CLM), distinct from truly non-resumable states.
404 on delete missing sandbox (#759): CubeAPI / CubeMaster map missing-sandbox deletes to NotFound.
Stable sandbox list order (#762): sort by creation time descending with SandboxID tie-break so WebUI / SDK refreshes no longer reshuffle.
Preserve template network rules & resource defaults (#581): keep egress rules when creating templates from images; retain the first CPU/memory validation error; request-side overrides win under first-match-wins.

Networking & Data Plane

Safe TAP recycle (network-agent): do not return TAPs to the pool until cleanup and pool prep succeed; failed cleanup keeps residual policy off the reusable pool; clear policy / DNS allow state before reuse to prevent cross-sandbox leakage.
Go SDK envd port (#821): envd RPCs (commands / files / filesystem / PTY) route to port 49983 instead of Jupyter 49999; only RunCode / /execute stays on Jupyter.

Other

Example host-mount paths (#768): examples and docs use /data/shared/... to match the default allowlist.

📚 Documentation

ARM64 support announcement blog (#866): bilingual InfoQ-style post on the joint Arm multi-arch effort.
Pi Agent integration guide (#701): bilingual docs + runnable example (pause/resume, network policy, credential injection).
Lifecycle / quota docs (#739): ARM64 install notes and lifecycle quota documentation.
Persistent storage guide (#756): host-mount path restriction, permissions, multi-tenant isolation, multi-node shared storage.
Roadmap (#731): roadmap added to README and docs site.
v0.5.0 release materials (#770, #781): release blog and feature copy updates; Quickstart notes Multi-Arch image availability (#806).
Dev skills & doc hygiene (#788, #789): Claude Code run-dev skill; i18n sync checks and change-driven doc audit rules.

⚙️ Engineering Improvements

Platform-suffixed versions in matrix checks (#747).
PVM guest build trigger tightened (#819): only on version tags.
Image tag bumps: one-click / Terraform defaults synced through v0.5.1-rc* candidates (#826, #867).
Python SDK version bump to 0.5.0 (#818).
CubeAPI dead-code cleanup (#796) and other small engineering tidy-ups.

Note: Web Example Center (#615) was merged and immediately reverted (#778); it is not part of this release.

Open source →

Additional notes

title: v0.5.1 — 2026.07.10

2026.07.10 Release v0.5.1

CubeSandbox 0.5.1 是一次面向生产落地的跟进发布，在 0.5.0 的 AutoPause / ARM64 / 集群部署基线上补齐关键能力与稳定性。本版本重点包括：cube-lifecycle-manager 独立控制面服务（从 CubeProxy sidecar 拆出，支持 CubeProxy 多副本扩展）、三值 timeout 语义重构（服务端默认 + NEVER_TIMEOUT / 立即超时 / TTL），以及 host-mount 路径白名单安全加固。同时修复 ARM64 64KB 页场景下的快照完整性问题，并显著提升出向策略与 TAP 回收的可靠性。共计 59 个提交，来自 18 位贡献者。

🎯 核心特性

cube-lifecycle-manager：AutoPause 协调器独立化

将原先内嵌在 CubeProxy 镜像中的 cube-proxy-sidecar 拆分为独立控制面服务 cube-lifecycle-manager（CLM），使 CubeProxy 可多副本水平扩展，而不再依赖单实例 sidecar。

独立部署：CLM 作为独立服务接入 cube-sandbox-control.target；一键安装与腾讯云 Terraform 部署均已纳入。
Redis 服务发现：CubeProxy 各副本将 admin endpoint 注册到 Redis；CLM 通过注册表发现全部在线副本并协调 auto-pause / auto-resume，无需静态配置副本列表。
协议兼容：Wire protocol、Redis schema、SDK 行为保持不变；现有 AutoPause / AutoResume 语义不受影响。
腾讯云 Terraform (#814)：控制面新增 cube-lifecycle-manager Deployment；支持 TENCENTCLOUD_CUBE_PROXY_REPLICAS 多副本，以及 CLM 副本数 / discovery refresh / admin token 等配置项。

三值 Timeout 语义 + 服务端默认

统一沙箱 idle timeout 语义，与 E2B 对齐，并将「未设置」与「显式默认值」区分开——默认超时决策从 SDK / CubeAPI 下沉到 CubeMaster。

取值	含义
省略（`None` / `nil`）	由集群 `default_timeout_insec` 决定；未配置或 ≤0 时视为永不超时
`NEVER_TIMEOUT`（`-1`）	永不因 idle 回收
`0`	立即超时（首次 idle sweep 即回收）
`N > 0`	idle TTL = N 秒

SDK：Go / Python 的 CreateOptions.Timeout 改为可选指针；Create / Connect / Resume 不再自动填入硬编码默认值。暴露 NeverTimeout / NEVER_TIMEOUT sentinel。
CubeAPI / CubeMaster：timeout 字段改为 Option / *int，透传「未设置」；EndAt 按三值语义计算（-1 → 无截止时间）。
RPC 截止与 idle TTL 解耦：新增 create_timeout_insec（默认 300s）仅约束创建调度 RPC，不再与沙箱 idle TTL 混用。
CLM sweeper：TimeoutSeconds < 0 跳过回收；== 0 立即回收；旧数据 nil 回退到 DefaultIdleTimeout。
运行时调整：Python / Go SDK 新增 set_timeout() / SetTimeout()，支持将运行中沙箱改为 NEVER_TIMEOUT (#743, #850)。Web UI 创建沙箱时可传入 timeout (#798)。

Host-Mount 路径白名单安全加固

此前 host-mount 接受任意绝对路径，沙箱可 bind-mount 宿主机任意目录。现改为可配置前缀白名单（默认 /data/shared/），并用 filepath.Clean 消除 .. 路径穿越；配置中显式禁止根路径 / (#756)。

配套更新持久化存储指南（路径限制、权限、多租户隔离、多节点共享存储），示例路径对齐默认前缀 (#768)。

✨ 功能增强

SDK

Node.js / TypeScript SDK（预览） (#792)：新增 @cubesandbox/sdk，API 面与 Python / Go 对齐；尚在验证中，生产使用请谨慎。
Python / Go set_timeout (#743, #850)：对齐 E2B API；CubeAPI / CubeMaster 接受 -1（NEVER_TIMEOUT），拒绝其他负值。
Go SDK allowOut 校验对齐 (#802)：不再将 AllowPublicTraffic=false 误判为 deny-all；与 CubeAPI 一致，仅在 AllowInternetAccess=false 或 denyOut 含 0.0.0.0/0 时视为全拒绝。

网络与 Egress

CubeEgress 明文 HTTP 凭据注入 (#726)：允许对纯 HTTP 上游注入凭据。安全边界是沙箱代码看不到密钥，而非要求 egress→upstream 必须 TLS。
CubeEgress 透明代理 IP 随 CIDR 推导 (#851)：不再硬编码 192.168.0.1；从 CUBE_SANDBOX_NETWORK_CIDR 取网段首个可用 IP，自定义沙箱网段时 TPROXY / OpenResty 监听地址正确。
DNS 学习条目最小 TTL：对 DNS 学到的 egress allow 条目施加最小 300s TTL，避免短 TTL 导致重连被误拒。
已建立会话跳过策略重检：CubeVS 对已存在的 CubeEgress TCP 会话跳过 egress 策略重检，避免 DNS 记录过期打断活跃连接；策略检查折叠进 create_nat_session，按会话缓存结果。
默认 deny 基线统一回放：replace / flush 路径始终回放私网 / link-local 默认 deny 条目，create 与 replace 策略形态一致。

部署与安装器

CubeProxy 预发布多架构镜像 (#849)：一键部署改为从 TCR 拉取预构建 multi-arch 镜像，不再本机构建；支持 MIRROR=cn|int 与 airgap 本地缓存回退。
组件镜像发布流水线 (#795)：新增 release-docker-images.yml，向 GHCR / TCR 推送 multi-arch 组件镜像；bump-image.sh 统一管理硬编码镜像标签。
CubeMaster Dockerfile (#813, #824)：统一 Docker build args / context，修复 ARG 作用域；CubeAPI Dockerfile 改为单次构建并加安全门禁 (#854)。
一键 DNS dnsmasq 回退 (#740)：无 systemd-resolved 且 NetworkManager dnsmasq 插件未拉起子进程时，可选由脚本自管 dnsmasq，避免 cube.app 解析失败。
Cubelet 配置 patch 锚定 (#776)：sed 替换锚定行首，避免改 CUBE_SANDBOX_NETWORK_CIDR 时误改空的 cube_router_cidr。

Web UI / AgentHub / 其他

CubeAPI lifecycle snake_case (#772)：接受 lifecycle.on_timeout / lifecycle.auto_resume 等 Python 风格字段名，避免静默落到 kill / 无 resume。
AgentHub OpenClaw bind=lan (#769)：强制 gateway 绑定 lan，确保 cube-proxy 可通过 tap IP 访问，避免 auto 落到 loopback。
ARM64 运行时加固 (#807)：dirty bitmap 粒度改用宿主机页大小（修复 64KB 页上快照严重不完整、恢复后 200% CPU）；aarch64 vCPU 在无 PMUv3 主机上自动回退无 PMU 初始化。
开发环境 QEMU 10.x (#713)：显式 -drive if=none + -device virtio-blk-pci，修复 QEMU 10.2.2+ 的空 drive 错误。

🐛 Bug 修复

生命周期与沙箱

Resume 幂等 (#817)：沙箱已处于 Running 时返回可识别的「已在目标状态」信号（CLM 视为成功），不再与真正不可 resume 的状态混为同一错误。
删除不存在沙箱返回 404 (#759)：CubeAPI / CubeMaster 对缺失沙箱的 delete 映射为 NotFound。
沙箱列表稳定排序 (#762)：按创建时间降序 + SandboxID 打破平局，避免 WebUI / SDK 刷新时顺序跳动。
模板网络规则与资源默认值保留 (#581)：从镜像创建模板时保留 egress 规则；CPU/内存同时超限时保留首个校验错误；请求侧 override 在 first-match-wins 下优先生效。

网络与数据面

TAP 回收安全（network-agent）：清理与池准备完成前不归还 TAP；失败清理路径不把带残留策略的 TAP 放回池；复用前清理策略 / DNS allow 状态，避免跨沙箱泄漏。
Go SDK envd 端口 (#821)：envd RPC（commands / files / filesystem / PTY）改走 49983，不再误打到 Jupyter 端口 49999；仅 RunCode//execute 仍走 Jupyter。

其他

示例 host-mount 路径对齐 (#768)：示例与文档路径改为 /data/shared/...，匹配默认白名单。

📚 文档

ARM64 支持公告博客 (#866)：中英文 InfoQ 风格发布稿，介绍与 Arm 联合推进的多架构能力。
Pi Agent 集成指南 (#701)：中英文集成文档 + 可运行示例（pause/resume、网络策略、凭据注入）。
生命周期 / 配额文档 (#739)：补充 ARM64 安装说明与 lifecycle 配额相关文档。
持久化存储指南 (#756)：host-mount 路径限制、权限、多租户隔离、多节点共享存储。
Roadmap (#731)：README 与文档站增加 roadmap。
v0.5.0 发布相关 (#770, #781)：发布博客与特性描述更新；Quickstart 注明 Multi-Arch 镜像可用性 (#806)。
开发技能与文档规范 (#788, #789)：Claude Code run-dev skill；i18n 同步检查与变更驱动文档审计规则。

⚙️ 工程改进

版本矩阵允许平台后缀 (#747)：版本检查兼容带平台后缀的版本号。
PVM guest 构建触发收紧 (#819)：仅在 version tag 时触发 pvm-guest 构建。
镜像标签 bump：发布候选过程中多次同步 one-click / Terraform 默认镜像至 v0.5.1-rc* (#826, #867)。
Python SDK 版本 bump 至 0.5.0 (#818)。
CubeAPI 死代码清理 (#796) 及其他小范围工程整理。

说明：Web Example Center（#615）曾合入后随即回滚（#778），不包含在本版本交付中。

v0.5.03 Jul 2026

CubeSandbox 0.5.0 带来了四大核心特性：AutoPause/AutoResume 沙箱生命周期自动化（闲置沙箱自动暂停并在请求到达时毫秒级唤醒）、ARM64 (aarch64) 全栈原生支持（从 hypervisor 到 CI/CD 的完整适配）、腾讯云 Terraform 一键集群

title: v0.5.0 — 2026.07.03

2026.07.03 Release v0.5.0

CubeSandbox 0.5.0 带来了四大核心特性：AutoPause/AutoResume 沙箱生命周期自动化（闲置沙箱自动暂停并在请求到达时毫秒级唤醒）、ARM64 (aarch64) 全栈原生支持（从 hypervisor 到 CI/CD 的完整适配）、腾讯云 Terraform 一键集群部署（生产级 IaC 部署方案），以及网络安全性增强（入向流量令牌鉴权、CubeEgress 启动期 Fail-Closed、出向策略路由）。其他重要更新包括：纯 Go 原生 rootfs 导出管线（绕过 Docker/skopeo/umoci，显著降低内存与构建时间开销）、快照运行时锁重构（消除高并发回滚死锁）、镜像 uid/gid 保留修复（修复非 root 镜像权限问题）、E2B SDK 对齐（完整的文件系统与 PTY API），以及一键升级模式（三路配置合并）。共计 116 个提交，来自 26 位贡献者。

🎯 核心特性

AutoPause / AutoResume：沙箱生命周期自动化

Agent 工作流中的沙箱大部分时间处于闲置状态——等待用户输入、回调、或 RL 的下一轮 rollout。AutoPause/AutoResume 让平台自动暂停闲置沙箱，并在新请求到达时原地唤醒，将物理资源在闲置期间完全释放。这是一个平台侧承担、per-sandbox 粒度的能力，语义与 E2B 的 lifecycle 参数对齐。

AutoPause 机制：新增的 cube-proxy-sidecar 组件内建 sweeper，通过 CubeProxy 的 log_phase.lua 上报的 last_active 时间戳跟踪沙箱活跃状态。当 idle >= timeout_seconds 时，sweeper 通过 CubeMaster → Cubelet 触发暂停：将 MicroVM 的完整状态（内存 + 文件系统）快照到 /data/cubelet/root/pausevm/<sandbox>，然后关闭沙箱。BootstrapWarmup 窗口可防止 sidecar 刚启动时的误暂停。
AutoResume 机制：当数据面请求到达已暂停的沙箱时，CubeProxy 的 sandbox_state.lua 门控拦截请求，向 sidecar 的 /internal/resume 发起内部子请求。Sidecar 通过 CubeMaster → Cubelet → containerd 驱动恢复流程，从暂停快照中原地恢复 VM。数据面请求会阻塞等待恢复完成（受 nginx proxy_read_timeout 约束）。同沙箱的并发恢复请求在进程内合并（singleflight 模式）；跨副本协调通过 Redis SETNX 分布式锁。
可配置资源释放比例 (#553)：节点级配置 host.quota.paused_resource_release_ratio（float [0, 1]，默认 0）控制暂停沙箱向调度器释放多少 CPU/内存配额。设为 1.0 时，暂停资源全部释放，实现最大调度密度；设为 0 时，保留完整配额，确保恢复链路绝对可靠。恢复前会进行本地准入检查——若节点容量不足，返回 HTTP 409 并附带精确的容量诊断信息。
入向流量令牌门控 (#639)：以 network.allow_public_traffic=false 创建的沙箱会获得一个 per-sandbox 的 traffic_access_token（UUID v4）。CubeProxy 在每个入站请求（包括冷路径和缓存命中路径）强制校验此令牌，缺失或错误令牌返回 HTTP 403。令牌值在所有日志中均被脱敏。兼容 e2b-traffic-access-token 和 cube-traffic-access-token 两种请求头。
Kill 路径：on_timeout="kill" 的沙箱走闲置超时 Kill 路径（task.Kill）。新增 POST /cube/sandbox/timeout 和 POST /cube/sandbox/refresh API，暴露 end_at 实现确定性的生命周期管理。CubeProxy 门控对 killing/killed 状态返回 410 Gone。

新增文件：CubeProxy/sidecar/（Go 二进制——sweeper、resumer、registry、stream consumer、last-active poller、Redis 协调）；CubeProxy Lua 模块（sandbox_state.lua、admin_phase.lua）；CubeMaster 生命周期端点；Cubelet pause/resume RPC。

ARM64 (aarch64) 全栈原生支持

CubeSandbox 现已支持在 ARM64 主机上全栈原生运行，覆盖 hypervisor、guest agent、shim、网络（BPF）、构建系统、CI/CD 和部署工具。这是 Arm 工程团队与 Cube 项目组的深度联合研发成果，项目状态已从可行性验证推进到正式 Enablement。

Hypervisor 适配 (4dc72757)：SysCtrl 设备（guest 到 host 的信号通道：关机、重启、vsock-ready）从 PIO 端口 I/O（x86 专用）重写为 MMIO 内存映射 I/O，在 mmio_bus 的 LEGACY_SYS_CTRL_MAPPED_IO_START 地址注册。KVM 寄存器访问（get_one_reg）适配上游 API 变更。Seccomp 过滤规则按 ARM64 系统调用号差异对齐（SYS_lstat vs SYS_fstatat/SYS_newfstatat）。热迁移功能保持 x86_64 专属。
Guest Agent (cb5706a8)：RPC 就绪信号从 x86 的 ioperm() + PIO 端口写入（端口 0x680）改为 ARM64 的 /dev/mem 在物理地址 0x0903_0000（SysCtrl MMIO 区域）处 mmap + ptr::write_volatile。构建目标自动检测宿主机架构。
CubeShim (fe3044cf, 4feab884)：内核命令行按架构自适应——console=ttyAMA0,115200（ARM PL011 UART）vs console=hvc0（virtio-console）。x86 专用参数（no_timer_check、noreplace-smp）通过 #[cfg(target_arch = "x86_64")] 条件编译。Seccomp 白名单对齐：ARM64 上 SYS_mkdir → SYS_mkdirat；补充缺失的 SYS_faccessat2（ARM64 glibc 路径解析所用）。
BPF / CubeNet (cb263f24)：BPF //go:generate 指令中的硬编码 -target amd64 替换为 -target $GOARCH。按架构提供 vmlinux.h（amd64 + arm64 BTF 导出）。BPF 目标文件改为构建时生成；预编译 .o 文件从 git 中移除。需要 clang ≥ 14（已通过 apt.llvm.org 加入构建镜像）。
Multi-Arch 镜像构建 (c6bb3762, 475b4885)：Dockerfile.builder 通过 TARGETARCH 参数化 Go、protoc、Rust 工具链下载。CubeEgress、CubeAPI 和 envd 镜像支持 Multi-Arch Manifest List。容器化 make guest-kernel 目标支持本地和交叉构建，使用架构特定的内核配置（kernel-oc9.x86_64.config、kernel-oc9.aarch64.config）。
CI/CD (#720)：Builder image、VMLinux、one-click release 工作流均产出分架构制品。Release 工作流拆分为 release_amd64 和 release_arm64 两个 Job，分别在原生 Runner 运行，上传到同一个 GitHub Release。
部署 (cb52bc72)：开发环境（run_vm.sh）自动检测架构——ARM64 使用 machine virt + UEFI 固件（qemu-efi-aarch64）。Release 打包脚本按架构选择合适的 mkcert 二进制。
已知限制（已在文档中标明）：PVM（嵌套 KVM）仅支持 x86_64；ARM64 需使用裸金属物理机原生 KVM。热迁移仅支持 x86_64。

腾讯云 Terraform 集群化部署

一套面向腾讯云的生产级、一键式 Terraform IaC 集群部署方案。只需一份 release bundle，执行 create.sh 作为唯一入口，即可自动拉起完整的 CubeSandbox 集群——包含受管控制面、高可用中间件和弹性计算节点。

基础设施自动编排 (#629)：Terraform 自动创建私有 VPC（10.0.0.0/16）及按可用区的子网、NAT 网关（含弹性公网 IP）、安全组、以及一台跳板机（jumpserver）。云上托管服务自动创建：
- MySQL（TencentDB 8.0）：多可用区半同步复制，4GB 内存 / 200GB 磁盘，创建 cube 应用账号及数据库级权限。
- Redis（TencentDB 7.0）：标准主从架构，可配置内存（默认 1GB），密码保护。
- CFS（云文件存储）：NFS 共享文件系统，供 cube-master 多副本挂载共享持久化存储（/data/CubeMaster/storage），ReadWriteMany 模式。可选——开启后启用多副本高可用模式。
- TCR（腾讯云容器镜像服务）：私有容器镜像仓库，VPC 内网链路打通，按部署创建命名空间，生成长期访问凭证。
TKE 控制面 (#629)：托管 Kubernetes 集群（v1.34.1，GlobalRouter 网络，containerd 运行时），apiserver 仅限内网。四项控制面组件以 Deployment + CLB Service 形式部署：
- cube-master：共享 CFS NFS 卷，CubeEgress 中间人 CA（ECDSA P-256，Terraform 自动生成），内网 CLB 端口 8089。
- cube-api：公网 CLB 端口 3000，通过集群 DNS 代理到 cube-master。
- cube-proxy：公网 CLB 端口 80/443，Redis 和 TLS 凭证以 Secret 注入。
- cube-webui：公网 CLB 端口 80，nginx 反向代理到 cube-api 和 cube-proxy。
可配置副本数 (#658)：cubemaster_replicas、cube_api_replicas、cube_proxy_replicas、cube_webui_replicas 变量（POC 模式默认 1 副本）。当 TENCENTCLOUD_USE_CFS=true 时，cube-master 支持多副本高可用，副本数同时驱动 spec.replicas 和调度器并发分配。
弹性计算节点：私有 VPC 内可配置一台或多台 CVM 实例（PVM 或裸金属），通过 TKE 节点池弹性扩缩容。默认 1 节点，支持自定义数量和实例规格。
一键升级模式 (#538)：install.sh --mode=upgrade 自动检测已有安装，执行三路 .env 配置合并（新默认值 + 旧自定义值 + 显式覆盖值），fail-fast 预检（磁盘空间、语义化版本兼容性、CIDR 冲突），并在任何破坏性操作前备份配置。用户自定义修改被保留，密钥值在 diff 报告中脱敏但在实际合并文件中保留。
外部 MySQL/Redis 支持 (#514)：一键安装器支持通过 CUBE_EXTERNAL_MYSQL_* / CUBE_EXTERNAL_REDIS_* 变量接入已有的外部 MySQL 和 Redis 实例。本地 Docker 容器被 mask，所有组件（CubeMaster、CubeAPI、CubeProxy）使用外部端点。
其他安装器改进：废弃 CUBE_PROXY_HOST_PORT，拆分为 CUBE_PROXY_HTTP_PORT / CUBE_PROXY_HTTPS_PORT (#588)。移除手动 SQL 初始化，改用 CubeMaster 内嵌 goose migration (#628)。CubeEgress 集成到计算节点启动流程 (#707)。改进外部依赖兼容性（Shell 安全的 env 持久化、redis-cli 超时兼容检测）(#673)。腾讯云部署配置了 cubelet 上报间隔与多节点调度器评分 (b8f22421)。镜像默认值更新为 v0.5.0 标签 (#719)。

新增文件：deploy/one-click/terraform/tencentcloud/（create.sh、destroy.sh、main.tf、variables.tf、tke-addons.tf、outputs.tf、lib-state-sync.sh、env.example）；docs/guide/tencentcloud-terraform-deploy.md（中英文各一份）。

网络安全增强

入向、出向、数据面三个维度的关键网络安全补丁。

Per-sandbox 流量访问令牌 (#639)：已在 AutoPause/AutoResume 章节详述。CubeProxy 在 AllowPublicTraffic=false 时对每个入向请求强制校验 traffic_access_token，缺失或错误返回 403。令牌值不会被记录到任何日志中。
CubeEgress 启动期 Fail-Closed (c5f811d8)：在 CubeEgress 启动期间、L7 策略尚未从 CubeMaster 加载完毕时（bootstrap_status ≠ "ready"），CubeEgress 对所有非审计类流量返回 403，而非此前的 Fail-Open 放行行为。这消除了沙箱出向流量在 Egress 重启窗口内绕过所有域名/SNI/方法/路径控制的敞口。
策略路由 / cube-router (7c514e9d)：可选的 cube-router 内核 dummy 网卡允许沙箱出向流量走宿主机 Linux 路由栈，而非被硬性重定向到主网卡。流量可从任意可路由设备（eth0、eth1、GRE 隧道、VXLAN、WireGuard）发出，无缝对接现有网络基础设施。已有的 CubeEgress L7 策略、DNS 白名单和端口映射全部保留。
BPF TCP 校验和修复 (7c2dd1ff)：修复跨节点端口映射沙箱回包 TCP 校验和错误。snat_tcp() 函数在仅 TCP 端口值变化的情况下错误使用了 BPF_F_PSEUDO_HDR 参数，导致多节点部署下校验和损坏。
from_world 清理 (5b919466)：移除 loopback 接口上无效的 from_world TC filter 挂载，减少不必要的 eBPF 挂载点。
宿主机服务访问 (48d080e6)：沙箱到宿主机自身 IP 的出向流量现在通过 BPF 快捷路径转发，允许沙箱内代码访问宿主机上的本地服务。
网络安全加固指南 (#663)：中英文运维安全指南，覆盖控制面默认攻击面、绑定策略（私有网卡 vs 防火墙白名单）、CubeAPI 认证回调的 path+method 双重校验、以及 TLS/凭证轮换指引。

✨ 功能增强

SDK

E2B 文件系统 API 对齐 (#678)：Go 和 Python SDK 现已实现完整的 E2B 文件系统 API：list、stat、exists、remove、rename、mkdir、watch。含全面集成测试。
Python SDK PTY API (250d248a)：Python SDK 新增完整 PTY（伪终端）接口——create、connect、kill、send_stdin、resize，通过 PtyHandle 迭代器提供流式输出。直接通过 httpx 与 envd 的 Connect-JSON RPC 通信，不依赖 e2b Python 包。
Python SDK E2B network.rules 转换 (#568)：兼容 E2B 的 per-host {transform: {headers: {...}}} 凭据注入格式，翻译为 CubeEgress L7 action.inject 规则。使用 E2B per-host 凭据注入的代码可零改动切换。
Python SDK 双重编码修复 (#572)：修复执行日志和错误的双重编码问题。

性能

纯 Go 原生 rootfs 导出 (#558)：无守护进程、纯 Go 实现的 rootfs 导出管线，完全绕过 Docker、skopeo 和 umoci。核心优化包括并发预取、loop 挂载流式写入 ext4 块设备、逐层解压即删除策略，显著降低了峰值内存占用与构建时间开销。默认启用。
VirtIO Block 性能 (#575)：在 Hypervisor 的 virtio-blk 设备中启用 VIRTIO_BLK_F_SEG_MAX（多段请求）和 VIRTIO_RING_F_INDIRECT_DESC（间接描述符），fio 基准测试中顺序写入吞吐从 2888 MiB/s 提升至 3293 MiB/s。

模板管理

镜像拉取进度 TUI (#580)：基于 Redis 持久化的实时拉取进度跟踪。新增 template watch 和 template build-watch CLI 命令，提供交互式 bubbletea TUI（显示下载速度、逐层完成度、步骤清单），非 TTY 终端自动降级为纯文本输出。
模板列表暴露最新 Job ID (#546)：模板列表和详情 API 暴露每个模板的最新 create/rebuild job ID。Web UI 在查看有活跃（running/pending/building）job 的模板时自动打开构建日志。
制品资源泄漏修复 (#631)：引入 t_cube_artifact_node_placement 表，独立于 Replica 生命周期跟踪节点级制品放置。周期性制品 GC，以 MySQL GET_LOCK 保证高可用协调。加固 CubeMaster、Cubelet、CubeAPI 级联清理链路。AgentHub 快照级联清理增加路径穿越保护。

Web UI

模板创建重构 (#675)：全新的多步骤模板创建表单，支持镜像源选择、实例规格配置、网络设置和高级选项。改进了表单校验和字段组织。

AgentHub

LLM 环境变量回退移除 (#602)：所有 AgentHub LLM 密钥和设置现在仅存储在数据库中，使用按安装实例的 CSPRNG 生成主密钥加密。环境变量回退路径全部移除。一键升级脚本主动删除过时的环境变量密钥。decrypt_or_passthrough 对不可解密的负载采取 Fail-Closed 策略。
助理状态持久化 (#582)：认证信息、OpenClaw 运行时状态、模板继承关系和快照恢复行为持久化到数据库。包含 bcrypt 密码哈希、企微 Secret 解密、认证入口限流。支持数字助理的备份/恢复和安全克隆。

部署与安装器

一键升级模式 (#538)：已在集群部署章节详述。--mode=upgrade + 三路 env 合并 + 升级前备份 + fail-fast 预检。
外部 MySQL/Redis (#514)：已在集群部署章节详述。支持接入已有外部数据库实例。
CUBE_PROXY 端口拆分 (#588)：CUBE_PROXY_HOST_PORT 废弃；拆分为 CUBE_PROXY_HTTP_PORT（默认 80）和 CUBE_PROXY_HTTPS_PORT（默认 443）。
静态编译 (#583)：cube-api、cubemaster 和 cubemastercli 现为完全静态二进制（Go CGO_ENABLED=0 / Rust musl 目标），消除宿主机 glibc 依赖和版本偏差风险。
内嵌 Migration (#628)：移除手动 SQL 初始化；CubeMaster 内嵌 goose migration 自动处理单节点种子数据。消除控制节点对 mysql 客户端的依赖。
CubeEgress 计算节点集成 (#707)：CubeEgress 集成到计算节点启动和停止脚本，Egress 策略执行覆盖所有节点。
resolvectl 兼容 (#703)：容忍旧版本 systemd（v240 以下）缺少 resolvectl default-route，防止 RHEL 8.3 等系统安装失败。

基础设施

Redis Key 统一 (#609)：所有 Redis Key 集中在 pkg/base/rediskey 中，采用统一命名规范。移除读写/元数据连接池分离，简化为单连接池，降低多节点部署配置复杂度。
Migration 身份固化 (#620)：三层防线防止 migration 静默跳过：新 migration 必须使用 14 位 UTC 时间戳前缀（而非整数序号），支持乱序应用（out-of-order），以及启动时 SHA-256 内容指纹校验。CI 强制禁止修改已合入的 migration 文件。
节点标签管理 API (#633)：POST /nodes/{id}/labels 和 DELETE /nodes/{id}/labels 端点用于管理员标签管理。K8s 兼容命名（DNS1123 子域名前缀），SELECT FOR UPDATE 竞争保护，每节点 64 标签上限，系统保留命名空间保护（kubernetes.io、beta.kubernetes.io、cube.cloud.tencentcloud.com）。
envd 版本上报 (#650)：实际采集到的 envd 版本作为沙箱注解传播，使 E2B SDK 能根据真实运行时版本进行特性门控，替代硬编码的版本常量。
可配置 HTTP 监听地址 (#662)：CUBEMASTER_HTTP_BIND 使 HTTP 监听地址可配置，支持绑定到私有网卡以进行网络安全加固。
腾讯云调度器评分 (b8f22421)：多节点调度器评分配置 real_time_weighted_average 插件，平衡 mvm_num、local_create_num、cpu_usage、quota_mem_usage 权重。priority_select_num 动态上限为 min(compute_node_count, 3)。

🐛 Bug 修复

以下修复针对 v0.4.0 中存在的问题：

高并发回滚死锁修复 (#693)：快照运行时活跃绑定重构为独立的 t_cube_snapshot_runtime_active 表，引入沙箱级和资源级分布式锁，从根本上消除了 MySQL 1213 死锁错误。
镜像 uid/gid 保留修复 (#671、#608)：两个互补的镜像权限保留修复：
- Native Export 路径 (#671)：移除 WithNoSameOwner() 选项——此前该选项会将所有文件的 uid/gid 压缩为提取用户，破坏镜像原始权限。
- Template Center (#608)：umoci unpack --rootless 现在仅在 euid ≠ 0 时传递（root 身份运行时不再传递）。Docker-export 回退路径增加 --same-owner --numeric-owner。修复 Browser 沙箱中 Chromium profile 写入失败和 CDP 不可达、以及 Python 镜像 envd exec 因 /home/user 权限导致 EACCES 的问题。
Hostdir 挂载超时保护 (#691)：Hostdir bind 和 remount 操作通过有界子进程执行，每步 3 秒超时。此前，卡住的 NFS 等宿主机挂载点会导致沙箱创建无限期阻塞。
CubeProxy envd 流式缓冲修复 (#647)：对 envd 服务端流式端点禁用 nginx 响应缓冲。此前 nginx 会缓存早期的流帧，破坏后台命令和 Watch 流的即时返回语义。
MSI-X Table/PBA 鲁棒性加固 (#619)：VMM 中 MSI-X table/PBA 读写路径上 guest 可触发的 panic 替换为优雅错误处理。恶意或有缺陷的 guest 不再能通过无效 MSI-X 访问导致 VMM 进程崩溃。
CubeProxy 实现细节泄露修复 (#653)：移除暴露内部故障码的 X-Cube-Retcode 响应头和 $cube_retcode 访问日志字段。错误响应统一为不透明 HTTP 状态码 + 标准 JSON Body，防止通过区分错误码枚举沙箱 ID 或探测基础设施弱点。
Auth Callback 方法转发 (#315)：X-Request-Method 现在转发到认证回调，实现（路径 + 方法）粒度的鉴权。此前，仅路径白名单无法区分同一路径的 GET 和 DELETE 操作，只读凭证可访问破坏性端点。
CubeEgress 计算节点 CA 刷新 (#614)：计算节点上的 CubeEgress 现在从 CubeMaster 刷新中间人 CA，修复主节点 CA 轮换后的 CA 不匹配问题。
模板信息回填 (#594)：回填模板详情响应中缺失的 created_at 和 image_info 字段。
快照删除 Job 清理 (#559)：快照删除后清理孤儿 job 行，防止失效构建 job 引用。
跨副本节点状态同步 (#542)：启动 Nodemeta 定期重载协程，实现跨副本节点状态同步，修复多副本 CubeMaster 部署中节点状态过期问题。
BPF 内层 Map BTF (#595)：CubeVS 内层 map 现在带 BTF key/value 创建，修复高版本内核上的 BPF map 兼容性。
一键安装根目录加固 (#649)：移除可配置的安装根路径；安装前缀安全性断言加强，防止误擦除系统目录。
一键安装 MIRROR 持久化 (#622)：MIRROR 环境变量持久化到 .one-click.env，确保重启后镜像仓库选择一致。
一键安装相同 CIDR 重装 (#586)：区分相同 CIDR 重装与 CIDR 变更场景，使用 systemd 优雅停止服务。
一键安装计算节点 Quickcheck 启动竞态 (#637)：计算节点启动后检查容错短暂启动竞态。
一键安装 DATABASE_URL 持久化 (#611)：DATABASE_URL 持久化到本地 MySQL 的安装和 systemd 启动路径。
Python SDK 流式文件体 (377a99dc)：IPOverrideTransport 中请求体拷贝前先缓冲，修复 multipart 上传失败。
CubeProxy 日志清理 (#593)：移除 CubeProxy 中的无效日志字段和失效后端桩代码。
envd 命令环境变量传递修复 (#566)：修复通过 commands.run 启动 envd 时 create-time 环境变量丢失的问题。
Sandbox Preview 路由修复 (#570)：修复缺失的 /cube/sandbox/preview 路由处理器，此前 cubemastercli tpl render 会静默失败。
一键升级 Bundle 完整性修复 (#597)：修复一键升级包中缺失 scripts/common/ 目录导致升级预检脚本不可用的问题。
Template 创建 Cube CA 转发修复 (#652)：修复创建模板时 with_cube_ca 参数未正确转发的问题，确保客户端能够控制是否将 CubeEgress 根 CA 注入模板 rootfs。
腾讯云部署 semver 辅助函数 (#587)：增加 semver_compare 和 version_lt 函数，确保升级决策逻辑正确。

📚 文档

ARM64 部署指南 (64931ff2)：所有部署指南（快速入门、裸金属、开发环境、多节点、自构建）更新中英文，增加架构特定说明，标注 ARM64 PVM 限制。
网络安全加固指南 (#663)：中英文运维安全指南，覆盖控制面攻击面、绑定策略、认证回调配置、TLS/凭证指引。
腾讯云 Terraform 部署指南 (ae81121d)：中英文完整 Terraform 集群部署指南。
快照/克隆/回滚深度解析 (#680)：中英文技术深度解析博客，介绍快照、克隆和回滚机制。
沙箱日志指南 (#692)：新增 cubecli logs 使用指南及示例。
多节点调度器评分指引 (#672)：配置多节点调度器评分以实现工作负载均衡分布的指引。
Host Mount 权限修复 (#560)：Host Mount 权限处理说明文档。
v0.4.0 发布博客 (#585)：中英文版本发布公告和 Agent 友好服务技术博客。
网络深度解析博客 (#627)：中英文 CubeSandbox 网络技术深度解析。
README 优化 (#640、#666、#646)：产品亮点、v0.4 展示、基准测试报告链接、架构图更新、主页标语优化。
文档优化 (#665)：交叉文档链接修复、快照/回滚/克隆侧边栏导航、本地化文档流保持 (#668、#664)。
安装指南链接 (#475、#466)：基准测试博客中增加安装指南引导，安装错误消息中增加问题排查链接。

⚙️ 工程改进

Multi-Arch CI (#720)：Builder image、VMLinux、one-click release 工作流均支持 amd64 + arm64，产生分架构制品和 Multi-Arch Manifest。
Python SDK 发布工作流 (#700)：GitHub Actions 工作流，由 python-sdk-v* 标签触发 PyPI 发布。版本交叉校验（tag vs pyproject.toml vs __init__.py），智能变更检测（跳过无变化的发布），twine check 验证。
Cubelet 上报默认间隔 (#722)：上报告间隔默认值改为 1s，提供更灵敏的指标。
CI Release 工作流加固 (#724)：为 gh release 命令添加 --repo 参数，确保正确的仓库指向。

Open source →

Additional notes

title: v0.5.0 — 2026.07.03

2026.07.03 Release v0.5.0

CubeSandbox 0.5.0 introduces AutoPause/AutoResume, a platform-level sandbox lifecycle automation that transparently suspends idle sandboxes and resumes them on-demand on the next dataplane request. This release also delivers ARM64 (aarch64) native support across the entire stack — from hypervisor to CI/CD — a TencentCloud Terraform cluster deployer for production-grade one-click deployment, and network security hardening with per-sandbox traffic access tokens, CubeEgress fail-closed bootstrap, and policy-routing egress. Additional highlights include a pure-Go native rootfs export pipeline that bypasses Docker, skopeo, and umoci entirely, a snapshot runtime locking refactor to eliminate high-concurrency deadlocks, image uid/gid preservation fixes for non-root container images, E2B SDK alignment with complete filesystem and PTY APIs, and a one-click upgrade mode with three-way config merge. 116 commits from 26 contributors.

🎯 Major Features

AutoPause / AutoResume: Sandbox Lifecycle Automation

Sandboxes in agent workflows spend most of their time idle — waiting for user input, callbacks, or the next RL rollout cycle. AutoPause/AutoResume lets the platform automatically suspend idle sandboxes and instantly wake them on the next incoming request, releasing physical host resources during idle periods. This is implemented as a platform-side, per-sandbox capability with semantics aligned to the E2B lifecycle parameter.

AutoPause mechanism: A sweeper in the new cube-proxy-sidecar (under CubeProxy/sidecar/) tracks sandbox activity via last_active timestamps reported by CubeProxy's log_phase.lua. When idle >= timeout_seconds, the sidecar triggers a pause through CubeMaster → Cubelet, which snapshots the full VM state (memory + filesystem) to /data/cubelet/root/pausevm/<sandbox>, then shuts down the MicroVM. A configurable BootstrapWarmup window prevents premature pausing during sidecar startup.
AutoResume mechanism: When a dataplane request arrives for a paused sandbox, CubeProxy's sandbox_state.lua gate intercepts it and fires an internal sub-request to the sidecar's /internal/resume. The sidecar drives a resume RPC through CubeMaster → Cubelet → containerd, which restores the VM from the pause snapshot. The dataplane request blocks until resume completes (bound by nginx proxy_read_timeout). Concurrent resumes for the same sandbox are coalesced in-process (singleflight pattern); cross-replica coordination uses Redis SETNX locks.
Configurable resource release ratio (#553): A node-level configuration host.quota.paused_resource_release_ratio (float [0, 1], default 0) controls how much CPU/memory quota paused sandboxes release back to the scheduler. At ratio 1.0, all quota is released for maximum node density; at ratio 0, paused sandboxes retain full quota (guaranteed resume). Before resuming, a local admission check verifies the node has capacity — if not, the resume is rejected with HTTP 409 and a precise capacity diagnostic.
Traffic access token gating (#639): Sandboxes created with network.allow_public_traffic=false receive a per-sandbox traffic_access_token (UUID v4). CubeProxy enforces this token on every inbound request (both cold-path and cache-hit), returning HTTP 403 for missing or mismatched tokens. Token values are redacted from all logs. Accepts both e2b-traffic-access-token and cube-traffic-access-token headers.
Kill-path lifecycle: Sandboxes with on_timeout="kill" go through an idle timeout kill path with task.Kill. New POST /cube/sandbox/timeout and POST /cube/sandbox/refresh APIs expose end_at for deterministic lifecycle management. The CubeProxy gate returns 410 Gone for killing/killed sandboxes.

New files: CubeProxy/sidecar/ (Go binary — sweeper, resumer, registry, stream consumer, last-active poller, Redis coordination); CubeProxy Lua modules (sandbox_state.lua, admin_phase.lua); CubeMaster lifecycle endpoints; Cubelet pause/resume RPCs.

ARM64 (aarch64) Native Support

CubeSandbox now runs natively on ARM64 hosts, spanning the hypervisor, guest agent, shim, networking (BPF), build system, CI/CD, and deployment tooling. The work was a deep collaboration between Arm engineering and the Cube project team, progressing from feasibility to formal enablement.

Hypervisor port (4dc72757): The SysCtrl device (guest-to-host signaling for shutdown, reboot, vsock-ready) was rewritten from PIO (x86-only) to MMIO for ARM64, registered on the mmio_bus at LEGACY_SYS_CTRL_MAPPED_IO_START. KVM register access (get_one_reg) was updated for a changed upstream API signature. Seccomp rules were aligned for ARM64 syscall number differences (SYS_lstat vs SYS_fstatat/SYS_newfstatat). Live migration support remains x86_64-gated.
Guest agent (cb5706a8): The RPC readiness signal changed from x86 ioperm() + PIO port write (port 0x680) to ARM64 /dev/mem mmap at physical address 0x0903_0000 (SysCtrl MMIO region) with ptr::write_volatile. Build target auto-detected from host arch.
CubeShim (fe3044cf, 4feab884): Kernel command line adapted per architecture — console=ttyAMA0,115200 (ARM PL011 UART) vs console=hvc0 (virtio-console). x86-only mitigations (no_timer_check, noreplace-smp) gated to #[cfg(target_arch = "x86_64")]. Seccomp allow-lists aligned: SYS_mkdir → SYS_mkdirat on ARM64; added missing SYS_faccessat2 for glibc path resolution on ARM64.
BPF / CubeNet (cb263f24): Hardcoded -target amd64 in BPF //go:generate directives replaced with -target $GOARCH. Per-architecture vmlinux.h headers (amd64 + arm64 BTF dumps). BPF object files regenerated at build time; prebuilt .o files removed from git. Requires clang ≥ 14 (added to builder image via apt.llvm.org).
Multi-arch builds (c6bb3762, 475b4885): Dockerfile.builder parameterized with TARGETARCH for Go, protoc, and Rust toolchain downloads. CubeEgress, CubeAPI, and envd images support multi-arch manifest lists. A containerized make guest-kernel target supports both native and cross builds with architecture-specific kernel configs (kernel-oc9.x86_64.config, kernel-oc9.aarch64.config).
CI/CD (#720): Builder image, VMLinux, and one-click release workflows all produce per-architecture artifacts. Release workflow split into release_amd64 and release_arm64 jobs running on native runners; both upload to the same GitHub Release.
Deployment (cb52bc72): Dev environment (run_vm.sh) auto-detects architecture — ARM64 uses machine virt with UEFI firmware (qemu-efi-aarch64). Release bundle script packages per-architecture mkcert binaries.
Known limitations (documented): PVM (nested KVM) is x86_64-only; ARM64 requires bare-metal with native KVM. Live migration is x86_64-only.

TencentCloud Terraform Cluster Deployer

A production-grade, one-click cluster deployment for TencentCloud driven entirely by Terraform IaC. From a single release bundle and create.sh entry point, the deployer provisions a full CubeSandbox cluster with managed control plane, HA middleware, and elastic compute nodes.

Infrastructure provisioning (#629): Terraform provisions a private VPC (10.0.0.0/16) with per-zone subnets, NAT Gateway with EIP, security groups, and a bastion jumpserver. Managed cloud services are automatically created:
- MySQL (TencentDB 8.0): Multi-AZ with semi-sync replication, 4 GB / 200 GB, application account cube with database-level privileges.
- Redis (TencentDB 7.0): Standard master/replica architecture, configurable memory (default 1 GB), password-protected.
- CFS (Cloud File Storage): NFS share for cube-master's shared persistent storage (/data/CubeMaster/storage), mounted ReadWriteMany across replicas. Optional — enables multi-replica HA mode.
- TCR (Tencent Container Registry): Private registry with VPC peering, namespace per deployment, long-lived access token.
TKE control plane (#629): Managed Kubernetes cluster (v1.34.1, GlobalRouter, containerd) with intranet-only apiserver. Four control-plane components deployed as Deployments with CLB Services:
- cube-master: Shared CFS NFS volume for template/snapshot/runtime state. CubeEgress MITM CA (ECDSA P-256, Terraform-generated). Internal CLB on port 8089.
- cube-api: Public CLB on port 3000, proxies to cube-master via cluster DNS.
- cube-proxy: Public CLB on ports 80/443, with Redis and TLS Secrets.
- cube-webui: Public CLB on port 80, nginx reverse-proxying to cube-api and cube-proxy.
Configurable replicas (#658): cubemaster_replicas, cube_api_replicas, cube_proxy_replicas, cube_webui_replicas variables (default 1 for POC mode). When TENCENTCLOUD_USE_CFS=true, cube-master multi-replica HA is enabled with cubemaster_replicas driving both spec.replicas and scheduler concurrency apportionment.
Elastic compute nodes: Configurable CVM instances (PVM or bare-metal) in private VPC, auto-scaling via TKE node pool. Default 1 node, configurable count and instance types.
One-click upgrade mode (#538): install.sh --mode=upgrade detects existing installations, performs three-way .env config merge (new defaults + old customizations + explicit overrides), runs fail-fast preflight checks (disk space, semver compatibility, CIDR conflict), and backs up configuration before any destructive change. User customizations are preserved; secrets are redacted in the diff report but retained in the actual merged file.
External MySQL/Redis (#514): One-click installer supports pointing at pre-existing external MySQL and Redis instances via CUBE_EXTERNAL_MYSQL_* / CUBE_EXTERNAL_REDIS_* variables. Local Docker containers are masked, and all components (CubeMaster, CubeAPI, CubeProxy) are configured to use the external endpoints.
Other installer improvements: CUBE_PROXY_HOST_PORT deprecated, split into CUBE_PROXY_HTTP_PORT / CUBE_PROXY_HTTPS_PORT (#588). Manual SQL seed removed in favor of CubeMaster embedded migrations (#628). CubeEgress integrated into compute node startup (#707). Improved external dependency compatibility with shell-safe env persistence and redis-cli timeout detection (#673). Cubelet reporting interval and scheduler scoring configured for multi-node TencentCloud deployments (b8f22421). Image defaults updated to v0.5.0 tags (#719).

New files: deploy/one-click/terraform/tencentcloud/ (create.sh, destroy.sh, main.tf, variables.tf, tke-addons.tf, outputs.tf, lib-state-sync.sh, env.example); docs/guide/tencentcloud-terraform-deploy.md (EN + ZH).

Network Security Hardening

Three critical patches for sandbox network security: inbound access control, outbound fail-closed, and policy-routing egress.

Per-sandbox traffic access token (#639): Described in AutoPause/AutoResume above. CubeProxy enforces traffic_access_token on every inbound request when AllowPublicTraffic=false, returning 403 for missing/bad tokens. Token values are never logged.
CubeEgress fail-closed bootstrap (c5f811d8): During CubeEgress startup, before L7 policies are loaded from CubeMaster (bootstrap_status ≠ "ready"), the proxy now returns 403 for all non-audit traffic instead of the previous fail-open behavior. This eliminates the security gap where sandbox outbound traffic could bypass all host/SNI/method/path controls during a restart window.
Route-aware egress / cube-router (7c514e9d): An optional cube-router kernel dummy device allows sandbox outbound traffic to enter the Linux host routing stack instead of being hard-redirected to the primary NIC. Traffic can leave through any routable device (eth0, eth1, GRE tunnels, VXLAN, WireGuard), enabling seamless integration with existing multi-NIC and VPN network infrastructure. Existing CubeEgress L7 policy, DNS allow-list, and port mapping are all preserved.
BPF TCP checksum fix (7c2dd1ff): Fixed invalid TCP checksums on cross-node port-mapped sandbox replies. The snat_tcp() function was incorrectly using BPF_F_PSEUDO_HDR when only the TCP port had changed, causing checksum corruption on multi-node deployments.
from_world cleanup (5b919466): Removed ineffective from_world TC filter attachment on the loopback interface, reducing unnecessary eBPF hook points.
Host service access (48d080e6): Sandbox outbound traffic to the host's own IP is now redirected via BPF shortcut, enabling sandboxed code to reach host-local services.
Network hardening guide (#663): New bilingual documentation covering default control-plane attack surface, binding strategies (private NIC vs firewall whitelisting), CubeAPI auth callback with path+method validation, and TLS/credential rotation guidance.

✨ Enhancements

SDK

E2B filesystem API alignment (#678): Go and Python SDKs now implement the full E2B filesystem API surface: list, stat, exists, remove, rename, mkdir, and watch. Comprehensive integration tests included.
Python SDK PTY APIs (250d248a): Complete PTY (pseudo-terminal) interface added to the Python SDK — create, connect, kill, send_stdin, resize — with streaming output via PtyHandle iterator. Speaks envd's Connect-JSON RPC directly; no dependency on e2b Python packages.
Python SDK E2B network.rules transforms (#568): Compatibility with E2B's per-host {transform: {headers: {...}}} credential injection shape, translated into CubeEgress L7 action.inject rules. Drop-in replacement for codebases using E2B's per-host credential injection.
Python SDK double-encoding fix (#572): Execution logs and errors are no longer double-encoded, fixing corrupted output display.

Performance

Pure-Go native rootfs export (#558): A daemonless, pure-Go rootfs export pipeline that bypasses Docker, skopeo, and umoci entirely. Features concurrent prefetch, loop-mount streaming directly into ext4 block devices, and a "decompress-and-delete" strategy that significantly reduces peak memory and build time compared to the previous skopeo/umoci pipeline. Enabled by default.
VirtIO block performance (#575): Enables VIRTIO_BLK_F_SEG_MAX (multi-segment requests) and VIRTIO_RING_F_INDIRECT_DESC (indirect descriptors) in the hypervisor's virtio-blk device, improving sequential write throughput from 2888 MiB/s to 3293 MiB/s (fio benchmark).

Template Management

Image pull progress TUI (#580): Real-time pull progress tracking with Redis-backed persistence. New template watch and template build-watch CLI commands provide an interactive bubbletea TUI showing live metrics (download speed, per-layer completion, step-by-step checklist), with plain-text fallback on non-TTY terminals.
Latest job ID in template list (#546): Template list and detail APIs now expose each template's latest create/rebuild job ID. The Web UI automatically opens build logs when viewing a template with an active (running/pending/building) job.
Artifact resource leak fixes (#631): Introduces t_cube_artifact_node_placement table for node-level artifact tracking independent of replica lifecycle. Periodic artifact GC with MySQL GET_LOCK for HA coordination. Hardened cascade cleanup across CubeMaster, Cubelet, and CubeAPI. AgentHub snapshot cascade cleanup with path traversal protection.

Web UI

Template creation overhaul (#675): New multi-step template creation form with image source selection, instance type configuration, network settings, and advanced options. Improved validation and field organization.

AgentHub

LLM env-var fallback removal (#602): All AgentHub LLM secrets and settings now live exclusively in the database, encrypted with a per-installation CSPRNG-generated master key. Environment variable fallback paths are eliminated. The one-click upgrade script actively deletes obsolete env keys. decrypt_or_passthrough now fails closed for undecryptable payloads.
Assistant state persistence (#582): Authentication, OpenClaw runtime state, template inheritance, and snapshot recovery behavior are now persisted in the database. Includes bcrypt-based auth, WeCom secret decryption, rate limiting on auth entrypoints. Enables backup/restore and safe cloning of digital assistants.

Deployment & Installer

One-click upgrade mode (#538): Detailed in Terraform section above. --mode=upgrade with three-way env merge, pre-upgrade backup, and fail-fast preflights.
External MySQL/Redis (#514): Detailed above. Support for pointing one-click installer at pre-existing external database instances.
CUBE_PROXY port split (#588): CUBE_PROXY_HOST_PORT deprecated; CUBE_PROXY_HTTP_PORT (default 80) and CUBE_PROXY_HTTPS_PORT (default 443) provide separate HTTP/HTTPS control.
Static builds (#583): cube-api, cubemaster, and cubemastercli are now fully static binaries (CGO_ENABLED=0 / musl target), eliminating host glibc dependency and preventing version-skew failures.
Embedded migrations (#628): Manual SQL seed removed; CubeMaster embedded goose migrations own single-node seed rows. Eliminates mysql client dependency on control nodes.
CubeEgress compute integration (#707): CubeEgress integrated into compute node startup/down scripts, extending egress policy enforcement to all nodes.
resolvectl compatibility (#703): Tolerates missing resolvectl default-route on older systemd (pre-v240), preventing install failures on RHEL 8.3 and similar distributions.

Infrastructure

Redis key unification (#609): All Redis keys centralized in pkg/base/rediskey with consistent naming. Read/write pool separation dropped in favor of a single pool, simplifying multi-node deployment configuration.
Migration identity hardening (#620): Three-layer defense against silent migration skipping: 14-digit UTC timestamp prefixes for new migrations, out-of-order application support, and SHA-256 content fingerprinting with startup verification. CI enforces immutability of already-merged migration files.
Node label management API (#633): POST /nodes/{id}/labels and DELETE /nodes/{id}/labels endpoints for admin-managed labels. Kubernetes-compatible naming (DNS1123 subdomain prefix), SELECT FOR UPDATE race protection, 64-label limit, system-reserved namespace protection (kubernetes.io, beta.kubernetes.io, cube.cloud.tencentcloud.com).
envd version reporting (#650): Collected envd versions propagated as sandbox annotations, enabling E2B SDK feature gating against real runtime versions instead of a hardcoded constant.
Configurable HTTP bind (#662): CUBEMASTER_HTTP_BIND makes the HTTP listen address configurable, supporting private-NIC binding for network security hardening.
TencentCloud scheduler scoring (b8f22421): Multi-node scheduler scoring with real_time_weighted_average plugin balancing mvm_num, local_create_num, cpu_usage, and quota_mem_usage. priority_select_num dynamically capped at min(compute_node_count, 3).

🐛 Bug Fixes

These fixes address issues present in v0.4.0:

High-concurrency rollback deadlock (#693): Snapshot runtime active binding refactored into a dedicated t_cube_snapshot_runtime_active table with sandbox-level and resource-level distributed locks. Eliminates MySQL 1213 deadlock errors.
Image uid/gid squashing (#671, #608): Two complementary fixes for image ownership preservation:
- Native export path (#671): Removed WithNoSameOwner() option, which was squashing all file uid/gid to the extracting user, breaking image ownership.
- Template center (#608): umoci unpack --rootless now only passed when euid ≠ 0 (not when running as root). Docker-export fallback uses --same-owner --numeric-owner. Fixes Chromium profile write failures and CDP unreachability in browser sandboxes, and envd exec EACCES on /home/user for Python images.
Hung hostdir mounts (#691): Hostdir bind and remount operations now run through a bounded 3-second timeout subprocess. Previously, stale NFS mounts or other hung filesystems would block sandbox creation indefinitely.
CubeProxy envd streaming buffering (#647): Nginx response buffering disabled for envd server-streaming endpoints. Previously, nginx buffered early stream frames, breaking immediate-return semantics for background commands and watch streams.
MSI-X table/PBA hardening (#619): Guest-triggered panics in the VMM's MSI-X table/PBA read/write paths replaced with graceful error handling. A malicious or buggy guest can no longer crash the VMM process via invalid MSI-X accesses.
CubeProxy implementation detail leakage (#653): Removed X-Cube-Retcode response header and $cube_retcode access-log field that exposed internal failure-mode codes. Errors now return opaque HTTP status codes with uniform JSON bodies, preventing sandbox ID enumeration and infrastructure probing.
Auth callback method forwarding (#315): X-Request-Method now forwarded to auth callbacks alongside X-Request-Path, enabling fine-grained (path + method) authorization. Previously, a read-only credential could access destructive endpoints on the same path.
envd command env propagation (#566): Fixed create-time environment variables being dropped when starting envd via commands.run.
Sandbox preview route (#570): Fixed missing /cube/sandbox/preview route handler that caused cubemastercli tpl render to silently fail.
One-click upgrade bundle integrity (#597): Fixed missing scripts/common/ directory in upgrade bundles that broke preflight validation scripts for the upgrade feature (#538).
Template creation Cube CA forwarding (#652): Fixed with_cube_ca parameter not being forwarded when creating templates, ensuring clients can control whether the CubeEgress root CA is baked into template rootfs.
CubeEgress compute CA refresh (#614): CubeEgress on compute nodes now refreshes its MITM CA from CubeMaster, fixing CA mismatch after master rotation.
Template info backfill (#594): Backfilled missing created_at and image_info fields in template detail responses.
Snapshot delete job cleanup (#559): Cleaned orphaned job rows after snapshot deletion, preventing stale build job references.
Cross-replica node sync (#542): Periodic reload goroutine started for nodemeta cross-replica synchronization, fixing stale node state in multi-replica CubeMaster deployments.
BPF inner map BTF key/value (#595): CubeVS inner maps now created with BTF key/value, fixing BPF map compatibility on newer kernels.
One-click install root enforce (#649): Configurable install root paths removed; install prefix safety assertion hardened to prevent accidental system directory wipes.
One-click MIRROR persistence (#622): MIRROR env now persisted to .one-click.env for consistent image registry selection across restarts.
One-click same-CIDR reinstall (#586): Distinguishes same-CIDR reinstall from CIDR change, uses systemd to stop services cleanly.
One-click compute quickcheck race (#637): Post-start compute node checks now tolerant of transient startup races.
One-click DATABASE_URL persistence (#611): DATABASE_URL now persisted for local MySQL in install and systemd start paths.
Python SDK streaming body (377a99dc): Request bodies buffered before copying in IPOverrideTransport, fixing multipart upload failures.
CubeProxy log cleanup (#593): Dead log fields and faulty-backend stubs removed from CubeProxy.
TencentCloud deployer semver helpers (#587): semver_compare and version_lt functions added for correct upgrade decision logic.

📚 Documentation

ARM64 deployment guides (64931ff2): All deployment guides (quickstart, bare-metal, dev environment, multi-node, self-build) updated in EN + ZH with architecture-specific instructions. ARM64 PVM limitation documented.
Network hardening guide (#663): Bilingual operational security guide covering control-plane attack surface, binding strategies, auth callback configuration, and TLS/credential guidance.
TencentCloud Terraform deploy guide (ae81121d): Full deployment guide (EN + ZH) for the Terraform cluster deployer.
Snapshot/clone/rollback deep-dive (#680): Technical deep-dive blog post on snapshot, clone, and rollback mechanisms (EN + ZH).
Sandbox logs guide (#692): New cubecli logs usage guide with examples.
Multi-node scheduler scoring (#672): Guidance on configuring multi-node scheduler scoring for balanced workload distribution.
Host mount permission fixes (#560): Documentation explaining host mount permission handling.
v0.4.0 release blog posts (#585): Release announcement and agent-friendly-service posts (EN + ZH).
Network deep-dive blog (#627): Technical deep-dive on CubeSandbox networking (EN + ZH).
README improvements (#640, #666, #646): Product highlights, v0.4 showcase, benchmark report links, architecture diagram update, homepage tagline refinement.
Documentation optimization (#665): Cross-documentation link fixes, sidebar navigation for snapshot-rollback-clone, localized docs flow preservation (#668, #664).
Install guide links (#475, #466): Installation guide callouts in benchmark posts, troubleshooting links in install error messages.

⚙️ Engineering Improvements

Multi-arch CI (#720): Builder image, VMLinux, and one-click release workflows all support amd64 + arm64 with per-architecture artifacts and multi-arch manifests.
Python SDK publish workflow (#700): GitHub Actions workflow for PyPI publishing triggered by python-sdk-v* tags. Version cross-validation (tag vs pyproject.toml vs __init__.py), smart change detection to skip unchanged publishes, and twine check validation.
Cubelet reporting default (#722): Reporting interval default changed to 1s for more responsive metrics.
CI release workflow hardening (#724): --repo flag added to gh release commands for correct repository targeting.

github.com/TencentCloud/CubeSandbox

Release timeline

Releases

2026.09.24 Release v0.7.2

🎯 Major Features

Much faster cross-node restore reads

New JuiceFS volume plugin

Automatic reclaim of idle guest memory

✨ Enhancements

Templates & Storage

Lifecycle & Control Plane

Deployment & Runtime

Web UI / CubeOps / Other

🐛 Bug Fixes

Lifecycle & Sandbox

Networking & Security

Deployment & Upgrade

Other

title: v0.7.2 — 2026.09.23

2026.09.23 Release v0.7.2

🎯 核心特性

跨机恢复读取性能大幅提升

新增 JuiceFS 卷插件

Guest 空闲内存自动回收

✨ 功能增强

模板与存储

生命周期与控制面

部署与运行时

Web UI / CubeOps / 其他

🐛 Bug 修复

生命周期与沙箱

网络与安全

部署与升级

其他

2026.09.11 Release v0.7.1

🎯 Major Features

End-to-end high availability for Cube control-plane services

✨ Enhancements

Templates & Storage

Lifecycle & Control Plane

Security

Deployment & Runtime

Web UI / CubeOps / Other

🐛 Bug Fixes

Lifecycle & Sandbox

Networking & Security

Deployment & Upgrade

Other

title: v0.7.1 — 2026.09.11

2026.09.11 Release v0.7.1

🎯 核心特性

Cube 控制面服务支持全链路高可用

✨ 功能增强

模板与存储

生命周期与控制面

安全

部署与运行时

Web UI / CubeOps / 其他

🐛 Bug 修复

生命周期与沙箱

网络与安全

部署与升级

其他

2026.08.28 Release v0.7.0

🎯 Major Features

Cross-Node Pause & Resume

Component Multi-Versioning

Network Subsystem Refactor: Faster Sandbox Network Provisioning

Separation of Control Plane and Operations

✨ Enhancements

Templates & Storage

Lifecycle & Control Plane

Networking & Security Proxy

SDK

Deployment & Runtime

Web UI / CubeOps / Other

🐛 Bug Fixes

Lifecycle & Sandbox

Networking & Security

Other