docker/ingress/v1.0.8

opensandbox-group/OpenSandboxdocker/ingress/v1.0.8Jun 22, 2026by Pangjiping

AI Summary

The ingress component gains OTLP endpoint auto-discovery and improves WebSocket proxy header forwarding to prevent token drops.

Key Highlights

OTLP endpoint auto-discovery from node IP when no explicit endpoint is configured
WebSocket proxy forwards all headers via blacklist approach
Fixes `X-EXECD-ACCESS-TOKEN` being silently dropped in PTY WebSocket connections

New Features

OTLP endpoint auto-discovery from node IP
WebSocket proxy forwards all headers (fixing dropped tokens)

Full Release Notes

## What's New

### ✨ Features

- **OTLP endpoint auto-discovery from node IP** — When no `OTEL_EXPORTER_OTLP_METRICS_ENDPOINT` or `OTEL_EXPORTER_OTLP_ENDPOINT` is configured, ingress now resolves the node IP from the `HOST_IP` env var (then `/etc/hostinfo` as fallback) and points the OTLP/HTTP exporter at `<node-ip>:4318` over plaintext. This lets ingress emit metrics in environments where only a node IP is available, without requiring callers to template the full endpoint URL. (#963)

### 🐛 Bug Fixes

- **WebSocket proxy forwards all headers** — Replaced the hardcoded header whitelist (`Origin`, `Sec-WebSocket-Protocol`, `Cookie`) with a blacklist approach that forwards all headers except hop-by-hop (RFC 7230 §6.1) and dialer-managed WebSocket handshake headers. This fixes `X-EXECD-ACCESS-TOKEN` being silently dropped, which caused execd to return 401 on PTY WebSocket connections through ingress URI mode. (#1058)

## 👥 Contributors

Thanks to these contributors ❤️

- @Pangjiping

---
- Docker Hub: opensandbox/ingress:v1.0.8
- Aliyun Registry: sandbox-registry.cn-zhangjiakou.cr.aliyuncs.com/opensandbox/ingress:v1.0.8