Starstruk Logo MarkStarstruk

docker/egress/v1.0.11

opensandbox-group/OpenSandboxdocker/egress/v1.0.11May 13, 2026by Pangjiping

AI Summary

This release addresses DNS-related signal handling issues in the egress component and adds configuration options for lazy connections and insecure upstream TLS verification.

Key Highlights

  • Fixed 'context canceled' errors during DNS resolution by using detached contexts.
  • Added `connection_strategy=lazy` to mitmproxy to defer upstream connections.
  • Added `OPENSANDBOX_EGRESS_MITMPROXY_SSL_INSECURE` environment variable for IP-based connections.

New Features

  • Added `connection_strategy=lazy` to mitmproxy
  • Added `OPENSANDBOX_EGRESS_MITMPROXY_SSL_INSECURE` environment variable

Full Release Notes

## What's New

### 🐛 Bug Fixes

- Decouple DNS-resolved nftables operations from the signal context. Previously `onResolved` captured the shutdown signal context, so every DNS-triggered `AddResolvedIPs` call would fail with "context canceled" after SIGTERM — even when the process was still alive. Now uses a detached 5-second timeout context for DNS-triggered nft ops, clears the callback before proxy shutdown, and uses a detached background context (30s timeout) for `ApplyStatic` so a disconnected HTTP client can't corrupt nftables state mid-script. (#871)

- Add `connection_strategy=lazy` to mitmproxy, deferring upstream connection until the full request is received. Avoids establishing useless connections for requests that get intercepted or filtered. Also add `OPENSANDBOX_EGRESS_MITMPROXY_SSL_INSECURE` environment variable (default `false`, secure). When set to `true`, enables `ssl_insecure=true` to skip upstream TLS certificate verification — useful when clients connect to services by IP address directly and Go HTTP clients don't send SNI, causing mitmproxy upstream verification to fail with "Certificate verify failed: IP address mismatch". (#860)

## 👥 Contributors

Thanks to these contributors ❤️

- @Pangjiping

---
- Docker Hub: opensandbox/egress:v1.0.11
- Aliyun Registry: sandbox-registry.cn-zhangjiakou.cr.aliyuncs.com/opensandbox/egress:v1.0.11