docker/egress/v1.1.5

milvus-io/milvusdocker/egress/v1.1.5Jul 27, 2026by Pangjiping

AI Summary

The egress component gains experimental support for intercepting extra TCP ports and fixes critical bugs regarding npm scoped packages and DNS handling. It also patches security vulnerabilities in Go dependencies.

Key Highlights

Experimental support for intercepting extra TCP ports beyond 80/443
Fixed npm scoped package access under Credential Vault
Patched security vulnerabilities in Go dependencies (grpc, postcss, x/net, x/crypto)
Fixed DNS loopback deny issues

New Features

Intercept extra TCP ports (experimental)
Credential Vault placeholder substitutions
DNS survives deny.always overlays

Full Release Notes

## What's New

### ✨ Features

- **Intercept extra TCP ports beyond 80/443 (experimental).** New env var `OPENSANDBOX_EGRESS_MITMPROXY_EXTRA_PORTS` (comma-separated) appends extra destination ports to the transparent-mitm REDIRECT rule, with fail-closed validation. Note: extra ports are decrypted and logged but not yet matched against credential bindings. (#1379)

### 🐛 Bug Fixes

- **npm scoped packages no longer 403 under Credential Vault.** A single-layer `%2f` (e.g. `/@scope%2fname`) is now allowed, while `%2f` that crosses a credential binding boundary — plus nested encodings, backslashes, and dot-segments — is still rejected. (#1369)

- **DNS survives `deny.always` overlays containing `127.0.0.0/8`.** In `dns+nft` mode, DNS redirected to `127.0.0.1:15353` is now accepted before the deny sets, so a loopback deny rule no longer breaks sandbox DNS under Docker. (#1380)

- **Purge stale mitmproxy CA on startup.** egress now erases the exported CA early in startup so a co-restarting agent doesn't install a stale CA, fixing `unable to get local issuer certificate` on HTTPS from the agent. (#1371)

### 🔒 Security

- **CVE patches for Go dependencies.** `grpc` → v1.82.1 (xDS RBAC / HTTP/2) and `postcss` → 8.5.11 (#1385); `x/net` → v0.55.0 (HTML parser DoS) and `x/crypto` → v0.52.0 (13 SSH advisories), bringing modules to Go 1.25. (#1250)

### 📦 Misc

- **License headers.** Added missing Apache 2.0 headers to fix the `verify-license` CI workflow. (#1313)

## 👥 Contributors

Thanks to these contributors ❤️

- @LorenzoRD2003
- @Pangjiping

---
- Docker Hub: opensandbox/egress:v1.1.5
- Aliyun Registry: sandbox-registry.cn-zhangjiakou.cr.aliyuncs.com/opensandbox/egress:v1.1.5
- GHCR: ghcr.io/opensandbox-group/opensandbox/egress:v1.1.5