docker/execd/1.1.0

## What's New

### ✨ Features

- **execd as sandbox init (OSEP-0018).** execd can now run as PID 1: single reaper with a `managedProcess` abstraction on every launch path, signal forwarding (TERM/HUP/USR1/USR2/WINCH), entrypoint-owned exit-code propagation, and a subreaper fallback for the Pool path. Opt-in via `EXECD_INIT=1` (injected by the server's `runtime.execd_run_as_init` for Docker/K8s Batch/Agent/Pool); classic topology unchanged and default off. (#1474)

- **Pre-exec hardening floor.** The new `opensandbox-launcher` native helper applies env strip → KEEPCAPS → bounding-set trim → `no_new_privs` → identity drop → seccomp → execve; `[landlock]` adds a filesystem allowlist (fail-open below ABI/kernel 5.13, reported as `unsupported`). `GET /v1/isolated/capabilities` gains a `hardening` object with per-layer state; every layer degrades fail-open. (#1474)

- **eBPF observation variant.** `execd-ebpf` (CGO + cilium/ebpf) hooks exec/connect/privilege with CO-RE, scoped to the sandbox cgroup, emitting a rotating JSONL audit; needs kernel ≥5.10 with BTF. The default image is unchanged. (#1474 #1562)

- **`preStart` and `periodic` lifecycle hooks (OSEP-0020).** `CreateSandboxRequest.lifecycle` is transported to the sandbox via the internal `OPEN_SANDBOX_LIFECYCLE` env (Kubernetes; the Docker provider rejects lifecycle requests). execd starts HTTP before `preStart`, runs non-overlapping `periodic` hooks through the reaper-aware managed-process path, and only releases the user process after `preStart` succeeds. Config persists at `$HOME/.execd/lifecycle.toml`, with `EXECD_LIFECYCLE_CONFIG` as exact override; bootstrap sync and preStart shutdown are fail-closed with TERM/KILL watchdogs, and internal transport vars are stripped from user code. API models aligned across Go/Python/JS/Kotlin/C# SDKs. (#1587 #1588 #1589)

### 🐛 Bug Fixes

- **In-namespace signals no longer leak into `/command` in init mode.** `kill -HUP 1` previously killed whatever `/command` was running (`signal: hangup`); signals are now owned by the init forwarder only. (#1546)

- **PTY creation failure emitted a second success body.** `POST /pty` now stops immediately after the error response instead of appending a success body and a nonexistent session id. (#1603)

- **`cwd` validation now honors request-scoped envs.** Foreground/background `/command` requests can use a `cwd` variable from their own `envs` map instead of being rejected with 400. (#1611)

- **Non-root workloads could not start: `/bootstrap.sh` normalized to `0755`.** A deployed image carried `bootstrap.sh` as `0751 root:root`, sending images with a non-root default user (e.g. `admin`) into CrashLoopBackOff before hooks ran. The image build now forces exec bits on `execd`/`execd-ebpf`/`opensandbox-supervisor`/`bootstrap.sh` regardless of checkout permissions. (#1619 #1606)

- **`preStart` timeout raised from 300s to 10800s (3h).** `periodic.timeoutSeconds` stays at 300s; product policy bounds are now enforced Server-side only, with execd keeping just a technical overflow guard. (#1637)

### 📦 Misc

- **OSEP-0018 coverage closed out**: server-path and Kubernetes hardening e2e (ConfigMap-carried isolation TOML, no server logic change), PTY-under-hardening, bwrap + init-reaper integration, custom `[seccomp]`/`keep_capabilities` policy, `EXECD_INIT`↔TOML drift pin, K8s Restart recycle against init-mode pods, runtime-initiated stop, and an `execd-ebpf` bare-container smoke (doubles as kernel-5.10 validation). Test redundancy and dead code trimmed (-359 lines). (#1554 #1555 #1562 #1574)

- **OTLP endpoint auto-allow shipped in the shared components** (egress honors `OTEL_EXPORTER_OTLP_METRICS_ENDPOINT`/`OTEL_EXPORTER_OTLP_ENDPOINT`; PTY viewer read loop refactored along the way). (#1504)

- **Lifecycle hook guide** with timing diagram and per-SDK creation examples; SDK client-side timeout validation aligned with the Server. (#1605)

## 👥 Contributors

Thanks to these contributors ❤️

- @Gujiassh
- @jianpingpei
- @Pangjiping

---
- Docker Hub: opensandbox/execd:v1.1.0
- Aliyun Registry: sandbox-registry.cn-zhangjiakou.cr.aliyuncs.com/opensandbox/execd:v1.1.0
- GHCR: ghcr.io/opensandbox-group/opensandbox/execd:v1.1.0