docker/egress/v1.1.5

opensandbox-group/OpenSandboxdocker/egress/v1.1.5Jul 27, 2026by Pangjiping

AI Summary

Experimental support for intercepting extra TCP ports is added, alongside fixes for npm scoped packages and DNS stability under deny overlays.

Key Highlights

Intercept extra TCP ports beyond 80/443 (experimental)
npm scoped packages no longer 403 under Credential Vault
DNS survives deny.always overlays containing 127.0.0.0/8

New Features

Extra TCP ports interception via environment variable
npm scoped package fixes
DNS survival under Docker loopback deny rules
Purge stale mitmproxy CA on startup
CVE patches for Go dependencies

Full Release Notes

## What's New

### ✨ Features

- **Intercept extra TCP ports beyond 80/443 (experimental).** New env var `OPENSANDBOX_EGRESS_MITMPROXY_EXTRA_PORTS` (comma-separated) appends extra destination ports to the transparent-mitm REDIRECT rule, with fail-closed validation. Note: extra ports are decrypted and logged but not yet matched against credential bindings. (#1379)

### 🐛 Bug Fixes

- **npm scoped packages no longer 403 under Credential Vault.** A single-layer `%2f` (e.g. `/@scope%2fname`) is now allowed, while `%2f` that crosses a credential binding boundary — plus nested encodings, backslashes, and dot-segments — is still rejected. (#1369)

- **DNS survives `deny.always` overlays containing `127.0.0.0/8`.** In `dns+nft` mode, DNS redirected to `127.0.0.1:15353` is now accepted before the deny sets, so a loopback deny rule no longer breaks sandbox DNS under Docker. (#1380)

- **Purge stale mitmproxy CA on startup.** egress now erases the exported CA early in startup so a co-restarting agent doesn't install a stale CA, fixing `unable to get local issuer certificate` on HTTPS from the agent. (#1371)

### 🔒 Security

- **CVE patches for Go dependencies.** `grpc` → v1.82.1 (xDS RBAC / HTTP/2) and `postcss` → 8.5.11 (#1385); `x/net` → v0.55.0 (HTML parser DoS) and `x/crypto` → v0.52.0 (13 SSH advisories), bringing modules to Go 1.25. (#1250)

### 📦 Misc

- **License headers.** Added missing Apache 2.0 headers to fix the `verify-license` CI workflow. (#1313)

## 👥 Contributors

Thanks to these contributors ❤️

- @LorenzoRD2003
- @Pangjiping

---
- Docker Hub: opensandbox/egress:v1.1.5
- Aliyun Registry: sandbox-registry.cn-zhangjiakou.cr.aliyuncs.com/opensandbox/egress:v1.1.5
- GHCR: ghcr.io/opensandbox-group/opensandbox/egress:v1.1.5