docker/egress/v1.1.7

opensandbox-group/OpenSandboxdocker/egress/v1.1.7Aug 21, 2026by Pangjiping

AI Summary

The egress sidecar now auto-allow OTLP endpoints and fixes Vault path checks to respect bindings. Code cleanup was also performed.

Key Highlights

Auto-allow OTLP endpoint egress for metrics
Vault path checks now scoped to matching bindings
Dead code, stale docs, and ineffective tests pruned

New Features

Auto-allow OTLP endpoint injection
Vault binding scope check
Code cleanup (removed unused functions, fixed docs)

Full Release Notes

## What's New

### ✨ Features

- **Auto-allow OTLP endpoint egress.** The egress sidecar's own metric export was blocked by its deny-all policy. `OTEL_EXPORTER_OTLP_METRICS_ENDPOINT` (preferred) or `OTEL_EXPORTER_OTLP_ENDPOINT` is now parsed at startup and injected as an always-allow rule — domains resolved via the DNS proxy, IPs into the static nft allow sets. The rule survives policy updates and reloads; `deny.always` still takes precedence. Host-scoped, no per-port enforcement. (#1504)

### 🐛 Bug Fixes

- **Vault path checks now scoped to matching bindings.** Requests with nested percent-encoded separators (e.g. double-encoded package URLs) were 403'd locally even when no credential could be injected. Binding selection now runs first; unmatched requests pass through unchanged, fail-closed behavior for credentialed requests is preserved. (#1485)

### 📦 Misc

- **Dead code, stale docs, ineffective tests pruned.** Removed unused `UpstreamHost()`, `RegisterFunc`, `nftables.NewManager()`; fixed Dockerfile and `docs/components/egress.md` drift; trimmed verbose comments; dropped duplicate test assertions. No public spec/SDK changes. (#1593)

## 👥 Contributors

Thanks to these contributors ❤️

- @Pangjiping
- @jwx0925

---
- Docker Hub: opensandbox/egress:v1.1.7
- Aliyun Registry: sandbox-registry.cn-zhangjiakou.cr.aliyuncs.com/opensandbox/egress:v1.1.7
- GHCR: ghcr.io/opensandbox-group/opensandbox/egress:v1.1.7