docker/execd/v1.0.20

## What's New

### ✨ Features

- **Filesystem isolation with bubblewrap (bwrap).** New `pkg/isolation/` package adds a `bubblewrap`-based filesystem isolation layer for sandbox command execution. Includes an `Isolator` interface, bwrap argv builder, startup probe, upper directory management, and seccomp loading. The bwrap binary is now statically built (musl-gcc) and injected into the execd container image via init container alongside execd itself. Configurable via isolation flags (`upper root`, `max bytes`, `diff max bytes`, `allowed writable`) with env var overrides. Diff/commit support deferred to Phase 2 (returns 503). Includes a CI smoke test validating static linking and bwrap namespace creation. (#1008)

### 🐛 Bug Fixes

- **False command failures from global signal interference resolved.** `execd` could report a successfully-executed command as `CommandExecError` when `cmd.Wait()` returned a spurious `ECHILD` ("waitid: no child processes"). Root cause: `signal.Notify(signals)` with no signal list captured ALL signals (including SIGCHLD/SIGURG used by Go runtime for child reaping and async preemption), and `signal.Reset()` was process-global, racing across concurrent commands. Now uses an explicit signal set with `signal.Stop()` for scoped cleanup, and ignores spurious `ECHILD` from `Wait()` when the child already ran to completion. (#1042)

- **Auto-created parent directories now inherit owner/group.** When uploading a file to a path whose parent directories don't exist, `resolveUploadTarget` now propagates `owner`/`group` metadata to each newly created parent directory via the new `MkdirAllWithOwnership` helper. Pre-existing directories are left untouched. The `MakeDir` API also uses this helper for consistent behavior during multi-level directory creation. (#1075)

### 📖 Documentation

- **DEVELOPMENT.md rewritten.** Reduced from 598 to 99 lines — removed generic Go boilerplate and fixed all code examples from Beego to Gin to match the current codebase (migrated in v1.0.3). (#1071)

- **Missing `EXECD_ACCESS_TOKEN` env var documented.** The README env var table now includes `EXECD_ACCESS_TOKEN`, which `parser.go` defines but was previously undocumented. (#1071)

- **Docs site links updated.** execd component docs updated as part of the VitePress docs site restructure — fixed broken cross-references and aligned with the new section-based information architecture. (#1090)

## 👥 Contributors

Thanks to these contributors ❤️

- @LavenderQAQ
- @ninan-nn
- @Pangjiping

---
- Docker Hub: opensandbox/execd:v1.0.20
- Aliyun Registry: sandbox-registry.cn-zhangjiakou.cr.aliyuncs.com/opensandbox/execd:v1.0.20