docker/egress/v1.0.4

opensandbox-group/OpenSandboxdocker/egress/v1.0.4Mar 30, 2026by Pangjiping

AI Summary

This release focuses on refining egress policy management by adding persistence options and fixing timeout and interval conflicts in nft rules.

Key Highlights

Persist egress policy to local file by env
Clamp nft element timeouts to 60–360s
Normalize nft intervals to avoid conflicts

New Features

Egress policy file persistence
nft timeout clamping
nft interval normalization

Full Release Notes

## What's New

### ✨ Features
- persist egress policy to local file by env `OPENSANDBOX_EGRESS_POLICY_FILE` (#525)

### 🐛 Bug Fixes
- Clamp nft element timeouts to 60–360s (was 60–300s) so the upper bound still matches a 300s DNS TTL cap plus slack; raise dyn_allow_* set timeout to 360s (#595)
- Avoid nft "conflicting intervals" when static allow/deny lists overlap (e.g. CGNAT + host inside). Add normalizeNFTIntervalSet to drop strictly contained prefixes before add element (#595)

## 👥 Contributors

Thanks to these contributors ❤️

- @Pangjiping

---
- Docker Hub: opensandbox/egress:v1.0.4
- Aliyun Registry: sandbox-registry.cn-zhangjiakou.cr.aliyuncs.com/opensandbox/egress:v1.0.4