Starstruk Logo MarkStarstruk

docker/code-interpreter/v1.1.0

knavesec/CredMasterdocker/code-interpreter/v1.1.0Jun 11, 2026by Pangjiping

AI Summary

This release relocates code-interpreter paths to a dedicated directory and adds cryptographic signing for Docker images. It also improves kernel compatibility and reduces cold-start times by optimizing startup scripts.

Key Highlights

  • Migrated code-interpreter paths from `/opt/opensandbox` to `/opt/code-interpreter`
  • Images are now signed with Sigstore/cosign keyless signing and published with GitHub attestations
  • Added seccomp-based fallback from `clone3` to `clone` for better kernel compatibility
  • Reduced cold-start time by skipping repeated `tslab` installations

Breaking Changes

  • Migrated code-interpreter paths from `/opt/opensandbox` to `/opt/code-interpreter`

New Features

  • Image signing with Sigstore/cosign for authenticity and integrity verification
  • Seccomp-based `clone3` fallback in execd
  • Reduced Docker build context size with Dockerfile.dockerignore
  • Optimized startup script to skip repeated package installations

Full Release Notes

## What's New

### ⚠️ Breaking Changes
- **Migrate code-interpreter paths from `/opt/opensandbox` to `/opt/code-interpreter`** — all code-interpreter entrypoint, env script, and log paths have moved from `/opt/opensandbox/` to `/opt/code-interpreter/`. Consumers who hardcode the entrypoint `/opt/opensandbox/code-interpreter.sh` must update to `/opt/code-interpreter/code-interpreter.sh`. Users who pin a specific tag (e.g., `v1.0.2`) are unaffected — existing tagged images remain immutable. See the full migration guide in (#1012)

### ✨ Features
- **Sign and attest release artifacts** — code-interpreter Docker images are now signed with Sigstore/cosign keyless signing and published with GitHub attestations. Supports verification of image authenticity and integrity. (#827)
- **Add seccomp-based clone3 fallback in execd** — inside the sandbox, execd now falls back from `clone3` to `clone` when the seccomp profile blocks `clone3`, improving compatibility with older kernels and restrictive seccomp policies. (#518)

### 🐛 Bug Fixes
- **Skip repeated tslab install on startup** — the code-interpreter startup script now checks whether `tslab` and its Jupyter kernelspecs are already installed before re-running `npm install -g tslab` and `tslab install`, reducing cold-start time for pre-built images. (#960)

### 📦 Misc
- **Add Dockerfile.dockerignore to reduce build context** — shrinks the Docker build context sent to the builder, speeding up image builds. (#718)

## 👥 Contributors

Thanks to these contributors ❤️

- @Pangjiping
- @Gujiassh
- @hittyt

---
- Docker Hub: opensandbox/code-interpreter:v1.1.0
- Aliyun Registry: sandbox-registry.cn-zhangjiakou.cr.aliyuncs.com/opensandbox/code-interpreter:v1.1.0