release-1.1.0

First stable release of the unified umbrella release line: one platform version — `1.1.0` — covers server, component images, charts, CLI, and every published SDK, cut from one commit and pinned in a signed BOM (versioning starts at `1.1.0`; `1.0.0` was already consumed by legacy releases, so the line skips it by design per the umbrella governance OSEP). Everyone on a legacy per-component version should upgrade; legacy tag namespaces are frozen. Because this is the first umbrella cut, sections carry different baselines — the controller jumps from its May `v0.2.0` release, ingress from July, the JavaScript/C#/Go SDKs from their July releases — so those sections list several months of changes at once.

## Highlights

- First unified umbrella release: every artifact ships at `1.1.0` from tag `release-1.1.0`, with a Sigstore-signed BOM as the digest authority
- First release of the Fast Sandbox integration: a Firecracker microVM runtime behind the FastPath fleets backend, with pause/resume, ingress FastPath routing, and fsb template management in all five SDKs
- Snapshot persistence gains an opt-in PostgreSQL store with multi-process HA and a SQLite migration command, and sandboxes gain preStart/periodic lifecycle hooks

## Server

- Add the FastPath fleets lifecycle backend: create, renew, delete, and status mapping served through FastPath v2, plus end-to-end fsb pause/resume with async 202 semantics and UID fencing ([#1703](https://github.com/opensandbox-group/OpenSandbox/pull/1703) [#1844](https://github.com/opensandbox-group/OpenSandbox/pull/1844))
- Converge snapshot status via a per-namespace watch instead of blocking polls, and add fast-sandbox snapshot support ([#1846](https://github.com/opensandbox-group/OpenSandbox/pull/1846))
- Add an opt-in PostgreSQL snapshot store with pooled connections and CAS semantics, a one-shot `migrate-snapshots` command for moving SQLite records, and multi-process HA coordination for snapshot create/recovery/delete on Kubernetes ([#1653](https://github.com/opensandbox-group/OpenSandbox/pull/1653) [#1670](https://github.com/opensandbox-group/OpenSandbox/pull/1670) [#1724](https://github.com/opensandbox-group/OpenSandbox/pull/1724))
- Transport sandbox lifecycle hooks (OSEP-0020): create requests accept `preStart` and `periodic` hooks, validated and serialized into a reserved environment variable for Kubernetes workloads; the Docker provider rejects lifecycle requests for now ([#1589](https://github.com/opensandbox-group/OpenSandbox/pull/1589) [#1542](https://github.com/opensandbox-group/OpenSandbox/pull/1542))
- Implement a stable, scoped diagnostics API over the existing log/event collectors with `logs:container|all` and `events:runtime|lifecycle|all` scopes, explicit warnings on partial scopes, `400 DIAGNOSTICS_SCOPE_UNSUPPORTED` for unknown scopes, and backward-compatible plain-text responses ([#1553](https://github.com/opensandbox-group/OpenSandbox/pull/1553))
- Export generic HTTP request metrics (request rate, error rate, latency) from the server over OTLP, complementing the SDK-reported create-duration histogram ([#1561](https://github.com/opensandbox-group/OpenSandbox/pull/1561))
- Reject unsupported gVisor (`runsc`) snapshots before persistence with `409 SNAPSHOT::UNSUPPORTED_RUNTIME` ([#1720](https://github.com/opensandbox-group/OpenSandbox/pull/1720))
- Support independent resource requests/limits for the Kubernetes egress sidecar via `[egress.resources]` ([#1620](https://github.com/opensandbox-group/OpenSandbox/pull/1620)), add `[egress] otlp_endpoint` so the sidecar exports metrics to an OpenTelemetry collector on both runtimes ([#1753](https://github.com/opensandbox-group/OpenSandbox/pull/1753)), pause and resume the sidecar together with the sandbox ([#1441](https://github.com/opensandbox-group/OpenSandbox/pull/1441)), make the sidecar readiness wait configurable via `[egress] timeout_seconds` ([#1522](https://github.com/opensandbox-group/OpenSandbox/pull/1522)), and inject `OPENSANDBOX_EGRESS_SANDBOX_ID` server-side so sidecar telemetry can no longer be spoofed by request env ([#1381](https://github.com/opensandbox-group/OpenSandbox/pull/1381))
- Honor `image.auth` in create requests for the agent-sandbox provider with per-sandbox pull secrets that are garbage-collected with the Sandbox CR ([#1789](https://github.com/opensandbox-group/OpenSandbox/pull/1789))
- Source OSEP-0011 secure-access signing keys from the `OPENSANDBOX_SECURE_ACCESS_KEYS` environment variables or a Kubernetes Secret instead of plaintext chart values ([#1445](https://github.com/opensandbox-group/OpenSandbox/pull/1445))
- Make the reverse proxy's internal resolution configurable with `[proxy] resolve_internal` for deployments that cannot route to Docker bridge IPs ([#1631](https://github.com/opensandbox-group/OpenSandbox/pull/1631))
- Raise the `preStart.timeoutSeconds` limit from 300 to 10800 seconds across the server API, execd, and SDKs ([#1637](https://github.com/opensandbox-group/OpenSandbox/pull/1637))
- Add Docker-runtime-wide `sandbox_env` and `sandbox_binds` configuration, giving Docker parity with the Kubernetes pod template for fleet-wide CA bundles, proxies, and mounts ([#1303](https://github.com/opensandbox-group/OpenSandbox/pull/1303))
- Breaking: migrate the agent-sandbox provider and ingress informer to `agents.x-k8s.io/v1beta1` required by agent-sandbox v1.0.0, creating workloads with `operatingMode: Running` and `service: true`; see Upgrade & Compatibility ([#1763](https://github.com/opensandbox-group/OpenSandbox/pull/1763))
- Support pool-only sandbox creation (`poolRef` without entrypoint) instead of rejecting it with HTTP 400, scheduling the execd-start task per allocation ([#1729](https://github.com/opensandbox-group/OpenSandbox/pull/1729)), fail fast on exhausted namespace ResourceQuotas by surfacing the Sandbox CR's admission rejection ([#1752](https://github.com/opensandbox-group/OpenSandbox/pull/1752)), and surface pool back-pressure as HTTP 429 `KUBERNETES::POOL_CAPACITY_EXHAUSTED` with `Retry-After` instead of a generic readiness timeout ([#1581](https://github.com/opensandbox-group/OpenSandbox/pull/1581))
- Propagate template container `securityContext` into generated pods ([#1564](https://github.com/opensandbox-group/OpenSandbox/pull/1564)), honor the PVC `readOnly` flag on the volume source and not just the mount ([#1246](https://github.com/opensandbox-group/OpenSandbox/pull/1246)), allow mixed read-only `subPath` mounts from a shared PVC ([#1440](https://github.com/opensandbox-group/OpenSandbox/pull/1440)), reject `networkPolicy` combined with `extensions.poolRef` ([#1319](https://github.com/opensandbox-group/OpenSandbox/pull/1319)), and patch PVC owner references through the supported strategic-merge path ([#1538](https://github.com/opensandbox-group/OpenSandbox/pull/1538))
- Make the informer-backed cache the only Kubernetes read path by removing the `informer_enabled` flag, and expire stale informer entries when a watch stops delivering ([#1926](https://github.com/opensandbox-group/OpenSandbox/pull/1926) [#1534](https://github.com/opensandbox-group/OpenSandbox/pull/1534))
- Reserve Docker host ports in-process between probing and container start, and retry container creation when the probed port conflicts at Docker bind time ([#1666](https://github.com/opensandbox-group/OpenSandbox/pull/1666) [#1715](https://github.com/opensandbox-group/OpenSandbox/pull/1715))
- Map completed agent-sandbox pods to terminal states ([#1643](https://github.com/opensandbox-group/OpenSandbox/pull/1643)), report `Failed` when a pooled sandbox task fails ([#1663](https://github.com/opensandbox-group/OpenSandbox/pull/1663)), keep direct responses out of the informer cache ([#1674](https://github.com/opensandbox-group/OpenSandbox/pull/1674)), resolve agent-sandbox server-proxy endpoints from `status.podIPs` with IPv6 bracketing ([#1424](https://github.com/opensandbox-group/OpenSandbox/pull/1424)), and use the public state in invalid-resume errors ([#1586](https://github.com/opensandbox-group/OpenSandbox/pull/1586))
- Handle websocket close semantics: map abnormal upstream closures and relay client closes with a legal status code ([#1642](https://github.com/opensandbox-group/OpenSandbox/pull/1642) [#1731](https://github.com/opensandbox-group/OpenSandbox/pull/1731))
- Fix HTTP proxy fidelity: preserve repeated response headers without duplicating Uvicorn's own ([#1858](https://github.com/opensandbox-group/OpenSandbox/pull/1858) [#1471](https://github.com/opensandbox-group/OpenSandbox/pull/1471)), forward the query string unchanged ([#1902](https://github.com/opensandbox-group/OpenSandbox/pull/1902)), rewrite root-relative redirects to stay on the proxy path ([#1516](https://github.com/opensandbox-group/OpenSandbox/pull/1516)), release backend responses when clients abort mid-stream ([#1488](https://github.com/opensandbox-group/OpenSandbox/pull/1488)), stop leaking the ingress routing header on server-proxied endpoints ([#1503](https://github.com/opensandbox-group/OpenSandbox/pull/1503)), and generate unique OpenAPI operation IDs ([#1634](https://github.com/opensandbox-group/OpenSandbox/pull/1634))
- Improve proxy diagnostics: identify backend connection failures ([#1675](https://github.com/opensandbox-group/OpenSandbox/pull/1675)) and describe transparent proxy responses in the spec ([#1701](https://github.com/opensandbox-group/OpenSandbox/pull/1701))
- Preserve the egress auth token on internal proxy requests to port 18080 across Docker and Kubernetes ([#1880](https://github.com/opensandbox-group/OpenSandbox/pull/1880))
- Route Compose proxying through host port mappings ([#1698](https://github.com/opensandbox-group/OpenSandbox/pull/1698))
- Fix Docker runtime edges: skip a missing IPv6 sysctl in Kubernetes init ([#1721](https://github.com/opensandbox-group/OpenSandbox/pull/1721)), use the supported `no-new-privileges` separator ([#1383](https://github.com/opensandbox-group/OpenSandbox/pull/1383)), detect Podman when resolving the Docker host IP ([#1806](https://github.com/opensandbox-group/OpenSandbox/pull/1806)), reject invalid ([#1742](https://github.com/opensandbox-group/OpenSandbox/pull/1742)) and non-finite ([#1568](https://github.com/opensandbox-group/OpenSandbox/pull/1568)) resource limits, and honor `[docker].host_ip` when the server itself runs in a container bound to loopback ([#1918](https://github.com/opensandbox-group/OpenSandbox/pull/1918))
- Define the missing `SandboxErrorCodes.INTERNAL_ERROR` so PVC auto-create failures return a proper 500 ([#1447](https://github.com/opensandbox-group/OpenSandbox/pull/1447)), and report the deployed version consistently across the API, package metadata, and chart ([#1439](https://github.com/opensandbox-group/OpenSandbox/pull/1439))

## SDKs

- Default code-interpreter creation to a strict health check in every language: `CodeInterpreter` now blocks until both execd and the Jupyter kernel gateway are verified ready ([#1754](https://github.com/opensandbox-group/OpenSandbox/pull/1754))
- Add sandbox lifecycle hook models (OSEP-0020) to the API spec and every SDK, with consistent validation aligned to the server's authoritative ranges ([#1588](https://github.com/opensandbox-group/OpenSandbox/pull/1588) [#1605](https://github.com/opensandbox-group/OpenSandbox/pull/1605))
- Wait for endpoint publication when connecting or creating, fixing connections that raced endpoint propagation ([#1751](https://github.com/opensandbox-group/OpenSandbox/pull/1751) [#1830](https://github.com/opensandbox-group/OpenSandbox/pull/1830))
- Resolve the execd and egress endpoints in parallel during create/connect/resume, roughly halving startup endpoint latency ([#1531](https://github.com/opensandbox-group/OpenSandbox/pull/1531))
- Protect the tenant API key: JavaScript and C# no longer forward `OPEN-SANDBOX-API-KEY` to execd/egress in direct data-plane mode ([#1691](https://github.com/opensandbox-group/OpenSandbox/pull/1691))
- Bound readiness polling sleeps across all SDKs ([#1734](https://github.com/opensandbox-group/OpenSandbox/pull/1734) [#1747](https://github.com/opensandbox-group/OpenSandbox/pull/1747) [#1745](https://github.com/opensandbox-group/OpenSandbox/pull/1745) [#1748](https://github.com/opensandbox-group/OpenSandbox/pull/1748) [#1744](https://github.com/opensandbox-group/OpenSandbox/pull/1744))
- Reject invalid inputs: negative readiness polling intervals in Python and JavaScript ([#1826](https://github.com/opensandbox-group/OpenSandbox/pull/1826)), negative session and command timeouts in Python ([#1726](https://github.com/opensandbox-group/OpenSandbox/pull/1726) [#1733](https://github.com/opensandbox-group/OpenSandbox/pull/1733)), negative log cursors in Go and JavaScript ([#1835](https://github.com/opensandbox-group/OpenSandbox/pull/1835) [#1836](https://github.com/opensandbox-group/OpenSandbox/pull/1836)), and a negative code-interpreter polling interval in Go ([#1885](https://github.com/opensandbox-group/OpenSandbox/pull/1885))
- Bring JavaScript, C#, and Go to parity with the Python and Kotlin SDKs: background runs in isolated sessions ([#1456](https://github.com/opensandbox-group/OpenSandbox/pull/1456)), execd-as-init request support ([#1474](https://github.com/opensandbox-group/OpenSandbox/pull/1474)), and pool allocation summaries ([#1481](https://github.com/opensandbox-group/OpenSandbox/pull/1481))
- Add fsb (fast-sandbox) template management to every sandbox SDK ([#1877](https://github.com/opensandbox-group/OpenSandbox/pull/1877) [#1895](https://github.com/opensandbox-group/OpenSandbox/pull/1895) [#1894](https://github.com/opensandbox-group/OpenSandbox/pull/1894) [#1898](https://github.com/opensandbox-group/OpenSandbox/pull/1898) [#1897](https://github.com/opensandbox-group/OpenSandbox/pull/1897))
- Fail fast on readiness auth errors in Python ([#1782](https://github.com/opensandbox-group/OpenSandbox/pull/1782)) and handle an unset `volume.host` safely ([#1659](https://github.com/opensandbox-group/OpenSandbox/pull/1659))
- Document snapshots and isolated sessions in the Python, JavaScript, Kotlin, C#, and Go SDK references, and fix non-compiling README snippets in Kotlin and Go ([#1863](https://github.com/opensandbox-group/OpenSandbox/pull/1863) [#1854](https://github.com/opensandbox-group/OpenSandbox/pull/1854) [#1870](https://github.com/opensandbox-group/OpenSandbox/pull/1870) [#1856](https://github.com/opensandbox-group/OpenSandbox/pull/1856) [#1876](https://github.com/opensandbox-group/OpenSandbox/pull/1876) [#1888](https://github.com/opensandbox-group/OpenSandbox/pull/1888))

### Python

- Align the client pool with Kotlin: `warmup_create_qps`, staged readiness, leader-epoch fencing, and opt-in OpenTelemetry warmup tracing ([#1889](https://github.com/opensandbox-group/OpenSandbox/pull/1889) [#1697](https://github.com/opensandbox-group/OpenSandbox/pull/1697))
- Preserve replacement endpoint fetches when an earlier cache fetch completes out of order ([#1567](https://github.com/opensandbox-group/OpenSandbox/pull/1567)), and keep pool cleanup running when `acquire()` is cancelled mid-renewal ([#1938](https://github.com/opensandbox-group/OpenSandbox/pull/1938))
- Preserve Unicode separators in SSE data ([#1444](https://github.com/opensandbox-group/OpenSandbox/pull/1444))
- Carry the API key on execd requests per `use_server_proxy` ([#1687](https://github.com/opensandbox-group/OpenSandbox/pull/1687))
- MCP: constrain the SDK to MCP 1.x with a guard and migrate the sandbox server to the MCP 2.x API ([#1725](https://github.com/opensandbox-group/OpenSandbox/pull/1725) [#1737](https://github.com/opensandbox-group/OpenSandbox/pull/1737)), add a `--use-server-proxy` option ([#1509](https://github.com/opensandbox-group/OpenSandbox/pull/1509)), and expose streamable HTTP host/port options ([#1929](https://github.com/opensandbox-group/OpenSandbox/pull/1929))

### JavaScript

- Add a client-side `SandboxPool` aligned with Kotlin: staged warmup, FIFO idle acquisition, lifecycle fencing, and optional Redis-backed distributed state ([#1716](https://github.com/opensandbox-group/OpenSandbox/pull/1716) [#1875](https://github.com/opensandbox-group/OpenSandbox/pull/1875))
- Bound pool readiness checks and align pool warmup resources with Python ([#1793](https://github.com/opensandbox-group/OpenSandbox/pull/1793) [#1909](https://github.com/opensandbox-group/OpenSandbox/pull/1909)), and always make the final warmup attempt when the initial delay is capped by the readiness deadline ([#1927](https://github.com/opensandbox-group/OpenSandbox/pull/1927))
- Allow aborting `Sandbox.create()` and `Sandbox.connect()` via `AbortSignal`, with background cleanup after cancellation ([#1685](https://github.com/opensandbox-group/OpenSandbox/pull/1685))
- Stop background SSE streams on the complete event ([#1532](https://github.com/opensandbox-group/OpenSandbox/pull/1532)), include response bodies in client error messages ([#1496](https://github.com/opensandbox-group/OpenSandbox/pull/1496)), drop readiness network hints ([#1493](https://github.com/opensandbox-group/OpenSandbox/pull/1493)), and escape the multipart filename on streamed uploads ([#1862](https://github.com/opensandbox-group/OpenSandbox/pull/1862))

### Kotlin

- Add structured exceptions for sandbox-not-found and capacity-exceeded outcomes plus a typed exception for proxy backend-connection failures ([#1667](https://github.com/opensandbox-group/OpenSandbox/pull/1667) [#1683](https://github.com/opensandbox-group/OpenSandbox/pull/1683))
- Send an empty egress array instead of null ([#1630](https://github.com/opensandbox-group/OpenSandbox/pull/1630))

### C#

- Add fsb (fast-sandbox) template CRUD to the sandbox SDK ([#1898](https://github.com/opensandbox-group/OpenSandbox/pull/1898))

### Go

- Merge `poolredis` into the parent Go module; the import path is unchanged ([#1903](https://github.com/opensandbox-group/OpenSandbox/pull/1903))
- Add a `SandboxPoolManager` with fence/tombstone parity ([#1525](https://github.com/opensandbox-group/OpenSandbox/pull/1525))
- Release idle sandboxes with bounded concurrency and bound completion-driven pool reconcile ([#1475](https://github.com/opensandbox-group/OpenSandbox/pull/1475) [#1494](https://github.com/opensandbox-group/OpenSandbox/pull/1494))
- Stop capping SSE event lines at 4 MiB ([#1881](https://github.com/opensandbox-group/OpenSandbox/pull/1881))

## Controller

The controller section carries everything since the last standalone controller release (`k8s/controller/v0.2.0`, May 2026).

- Stabilize pool scheduling: a capacity predicate in pool-assign, a fix for pool scale expectations getting stuck, and scaling stabilization ([#1143](https://github.com/opensandbox-group/OpenSandbox/pull/1143) [#906](https://github.com/opensandbox-group/OpenSandbox/pull/906) [#1425](https://github.com/opensandbox-group/OpenSandbox/pull/1425))
- Add lifecycle hooks to the task schedule ([#420](https://github.com/opensandbox-group/OpenSandbox/pull/420)) and emit Kubernetes events for BatchSandbox and Pool lifecycle ([#1099](https://github.com/opensandbox-group/OpenSandbox/pull/1099))
- Support opt-in PVC deletion together with sandboxes via the Pool recycle strategy ([#880](https://github.com/opensandbox-group/OpenSandbox/pull/880))
- Add a containerd socket path flag to the controller ([#859](https://github.com/opensandbox-group/OpenSandbox/pull/859))
- Rework the image committer: a reusable `pkg/imagecommitter` interface with a containerd-native default implementation, source-registry authentication, self-signed/plain-HTTP transport policy, and an operator-controlled Job template overlay ([#1431](https://github.com/opensandbox-group/OpenSandbox/pull/1431)), plus pull secrets for authenticated registry proxies ([#1300](https://github.com/opensandbox-group/OpenSandbox/pull/1300))
- Add QEMU VMState pause/resume support in the Kubernetes runtime path ([#1584](https://github.com/opensandbox-group/OpenSandbox/pull/1584))
- Sync Kata guests before snapshot commit and fall back to stopped snapshot containers ([#1356](https://github.com/opensandbox-group/OpenSandbox/pull/1356))
- Sync SandboxSnapshot RBAC ([#1088](https://github.com/opensandbox-group/OpenSandbox/pull/1088)) and add the missing `pods/log` permission to the server ClusterRole ([#1211](https://github.com/opensandbox-group/OpenSandbox/pull/1211))
- Export low-cardinality Pool and BatchSandbox capacity gauges over OTLP/HTTP from the elected controller, computed from actual Pod specs ([#1651](https://github.com/opensandbox-group/OpenSandbox/pull/1651))
- Helm: default the server deployment to one active replica ([#1723](https://github.com/opensandbox-group/OpenSandbox/pull/1723)), allow configuring the server Service type ([#1628](https://github.com/opensandbox-group/OpenSandbox/pull/1628)), expose the controller-runtime metrics endpoint in the controller chart ([#1331](https://github.com/opensandbox-group/OpenSandbox/pull/1331)), add scheduling/tolerations fields for the server and ingress-gateway Deployments ([#1245](https://github.com/opensandbox-group/OpenSandbox/pull/1245) [#1235](https://github.com/opensandbox-group/OpenSandbox/pull/1235)), roll the server Deployment on `config.toml` changes via a checksum annotation ([#1473](https://github.com/opensandbox-group/OpenSandbox/pull/1473)), render `imagePullSecrets` on the ingress-gateway Deployment ([#1236](https://github.com/opensandbox-group/OpenSandbox/pull/1236)), allow extra env vars on the ingress-gateway container ([#1333](https://github.com/opensandbox-group/OpenSandbox/pull/1333)), sync the missing Pool CRD strategy fields into the chart CRD ([#1337](https://github.com/opensandbox-group/OpenSandbox/pull/1337)), remove the dead `networkPolicy` block ([#1243](https://github.com/opensandbox-group/OpenSandbox/pull/1243)), guard empty `extraVolumes`/`extraVolumeMounts` rendering ([#1244](https://github.com/opensandbox-group/OpenSandbox/pull/1244)), fix the `containerdSocketPath` CrashLoopBackOff against controller v0.2.x and bump the umbrella chart to 0.2.2 ([#1557](https://github.com/opensandbox-group/OpenSandbox/pull/1557)), and source secure-access keys from a Secret ([#1445](https://github.com/opensandbox-group/OpenSandbox/pull/1445))
- Restructure all charts under `manifests/charts/` ([#1857](https://github.com/opensandbox-group/OpenSandbox/pull/1857))
- Release stranded BatchSandbox finalizers when the referenced Pool is missing or terminating, and stop recreating an idle task scheduler after cleanup ([#1657](https://github.com/opensandbox-group/OpenSandbox/pull/1657))
- Fail sandbox recovery when the executor status is unknown, fail the sandbox when the main container terminates without restart while the Pod stays `Running`, and propagate terminal Pod failures to sandbox status ([#1599](https://github.com/opensandbox-group/OpenSandbox/pull/1599) [#1741](https://github.com/opensandbox-group/OpenSandbox/pull/1741) [#1722](https://github.com/opensandbox-group/OpenSandbox/pull/1722))
- Fix pool reconciliation: compare replica counts by value, trigger reconcile when `poolRef` changes, and stop attributing failures of already-deleting Pods ([#1779](https://github.com/opensandbox-group/OpenSandbox/pull/1779) [#1794](https://github.com/opensandbox-group/OpenSandbox/pull/1794) [#1828](https://github.com/opensandbox-group/OpenSandbox/pull/1828))
- Improve controller logging and performance ([#919](https://github.com/opensandbox-group/OpenSandbox/pull/919))

## Execd

- Support native `argv` command execution in `/command` (literal arguments without shell parsing, environment-aware executable resolution), wired through all five SDKs ([#1760](https://github.com/opensandbox-group/OpenSandbox/pull/1760))
- Add a runtime-init handshake: `POST /init` applies a one-shot RuntimeBinding (authoritative sandbox id, token hash, envs, lifecycle config, telemetry attributes) with `GET /ready` reporting readiness, moving identity out of image build time ([#1871](https://github.com/opensandbox-group/OpenSandbox/pull/1871)); fast-sandbox restores can rebind a restored runtime via `preserveRuntimeState` ([#1946](https://github.com/opensandbox-group/OpenSandbox/pull/1946))
- Execute the runtime side of sandbox lifecycle hooks (OSEP-0020): `preStart` gates the user entrypoint, non-overlapping `periodic` hooks run through the init-reaper-aware process path, with fail-closed TERM/KILL watchdogs and atomic lifecycle config persistence ([#1587](https://github.com/opensandbox-group/OpenSandbox/pull/1587))
- Fix `EXECD_ENVS` handling with lossless dotenv-style round-tripping and apply the env file to bash session env and cwd expansion ([#1893](https://github.com/opensandbox-group/OpenSandbox/pull/1893) [#1868](https://github.com/opensandbox-group/OpenSandbox/pull/1868))
- Drop the `fsync` from the task-create critical path that could stall sandbox startup for seconds on congested block devices ([#1614](https://github.com/opensandbox-group/OpenSandbox/pull/1614))
- Bound command output retention ([#1710](https://github.com/opensandbox-group/OpenSandbox/pull/1710)), clamp background log cursors to the end of the log ([#1708](https://github.com/opensandbox-group/OpenSandbox/pull/1708)), and avoid re-reading unfinished command output ([#1746](https://github.com/opensandbox-group/OpenSandbox/pull/1746))
- Validate command `cwd` against request-scoped environment variables ([#1611](https://github.com/opensandbox-group/OpenSandbox/pull/1611)), make `bootstrap.sh` readable by non-root workload users ([#1619](https://github.com/opensandbox-group/OpenSandbox/pull/1619)), and stop PTY creation from appending a success body after an error ([#1603](https://github.com/opensandbox-group/OpenSandbox/pull/1603))
- Reclaim stale overlay upper dirs at startup ([#1784](https://github.com/opensandbox-group/OpenSandbox/pull/1784))
- Skip credential switches for same-identity uid/gid requests ([#1809](https://github.com/opensandbox-group/OpenSandbox/pull/1809))
- Surface NSS trust prerequisites ([#1712](https://github.com/opensandbox-group/OpenSandbox/pull/1712))
- Shorten the default SSE drain timeout ([#1840](https://github.com/opensandbox-group/OpenSandbox/pull/1840))

## Networking

### egress

- Fleet profile **[EXPERIMENTAL]**: multi-sandbox egress control plane with per-subject credential vaults, shared MITM data plane with per-subject DNAT and subject-aware active vault, DoH-443 blocking with a blocklist, per-sandbox netns OUTPUT rules with connection refresh, and a fastlet Sandbox Actions handler protocol replacing file observation ([#1595](https://github.com/opensandbox-group/OpenSandbox/pull/1595) [#1608](https://github.com/opensandbox-group/OpenSandbox/pull/1608) [#1633](https://github.com/opensandbox-group/OpenSandbox/pull/1633) [#1678](https://github.com/opensandbox-group/OpenSandbox/pull/1678))
- Credential-bound TLS interception foundation **[EXPERIMENTAL]**: host selector, request-weighted TLS shadow observations, and the revision snapshot pipeline (transaction receiver, coordinator, Unix transport, receiver endpoint, decision snapshots, validation, process-session provisioning, bootstrap, and outcome reconciliation, lifecycle wiring) — groundwork only, not enabled by default ([#1775](https://github.com/opensandbox-group/OpenSandbox/pull/1775) [#1777](https://github.com/opensandbox-group/OpenSandbox/pull/1777) [#1791](https://github.com/opensandbox-group/OpenSandbox/pull/1791) [#1800](https://github.com/opensandbox-group/OpenSandbox/pull/1800) [#1812](https://github.com/opensandbox-group/OpenSandbox/pull/1812) [#1834](https://github.com/opensandbox-group/OpenSandbox/pull/1834) [#1839](https://github.com/opensandbox-group/OpenSandbox/pull/1839) [#1845](https://github.com/opensandbox-group/OpenSandbox/pull/1845) [#1850](https://github.com/opensandbox-group/OpenSandbox/pull/1850) [#1867](https://github.com/opensandbox-group/OpenSandbox/pull/1867) [#1892](https://github.com/opensandbox-group/OpenSandbox/pull/1892) [#1915](https://github.com/opensandbox-group/OpenSandbox/pull/1915))
- Make Credential Vault create/patch/delete immediately visible to the next intercepted flow (replacing the 0.5s cache window), and add opt-in strict scope enforcement rejecting bindings without method/path matches or with host-wide `/*` paths ([#1755](https://github.com/opensandbox-group/OpenSandbox/pull/1755) [#1762](https://github.com/opensandbox-group/OpenSandbox/pull/1762))
- Support kernels without xtables compat and IPv6 transports with a native nftables redirect backend (`OPENSANDBOX_EGRESS_REDIRECT_BACKEND`), and renew timed nft elements atomically ([#1861](https://github.com/opensandbox-group/OpenSandbox/pull/1861) [#1786](https://github.com/opensandbox-group/OpenSandbox/pull/1786))
- Cut DNS read amplification in domain revalidation ([#1808](https://github.com/opensandbox-group/OpenSandbox/pull/1808)), revalidate observed domain addresses ([#1804](https://github.com/opensandbox-group/OpenSandbox/pull/1804)), log a warning on DNS denies ([#1807](https://github.com/opensandbox-group/OpenSandbox/pull/1807)), and shrink the DNS upstream ejection window so unhealthy resolvers recover faster ([#1943](https://github.com/opensandbox-group/OpenSandbox/pull/1943))
- Drain webhooks during bounded Docker deletion so egress shutdown cannot hang sandbox deletion ([#1827](https://github.com/opensandbox-group/OpenSandbox/pull/1827))
- Report the sidecar's own resource usage from its cgroup ([#1411](https://github.com/opensandbox-group/OpenSandbox/pull/1411))

### ingress

- Add fleets FastPath routing with tenant-scoped `(namespace, sandbox_id, port)` resolution, HMAC-bound route scopes, and short-lived route caching ([#1577](https://github.com/opensandbox-group/OpenSandbox/pull/1577))
- Observe upstream network readiness with a bounded shadow assessment exposed at `/status.ok/network-readiness` ([#1693](https://github.com/opensandbox-group/OpenSandbox/pull/1693))
- Add OpenTelemetry metrics instrumentation (OSEP-0010): request count/duration, routing resolution, proxy-type counters, and system CPU/memory plus active-connection gauges ([#1181](https://github.com/opensandbox-group/OpenSandbox/pull/1181))
- Migrate the WebSocket proxy off the archived `gorilla/websocket` to `coder/websocket` and fix `Connection` header token-list detection ([#1822](https://github.com/opensandbox-group/OpenSandbox/pull/1822))
- Verify route signatures with a constant-time comparison ([#1417](https://github.com/opensandbox-group/OpenSandbox/pull/1417))
- Eliminate an SSE ping goroutine race and a proxy error leak ([#1216](https://github.com/opensandbox-group/OpenSandbox/pull/1216))
- Serve only intentionally registered routes by replacing `http.DefaultServeMux` with a dedicated mux ([#1224](https://github.com/opensandbox-group/OpenSandbox/pull/1224))
- Shared egress/ingress telemetry: honor `OTEL_SDK_DISABLED=true` and `OTEL_METRICS_EXPORTER=none` and respect caller-chosen metric temporality ([#1783](https://github.com/opensandbox-group/OpenSandbox/pull/1783))

## Fast Sandbox

First release with [fast-sandbox](https://github.com/opensandbox-group/fast-sandbox): an external, template-backed sandbox platform that provisions sandboxes as Firecracker microVMs from golden-image templates, exposed to clients through a FastPath v2 gRPC control plane ([#1558](https://github.com/opensandbox-group/OpenSandbox/pull/1558) [#1559](https://github.com/opensandbox-group/OpenSandbox/pull/1559)). OpenSandbox's server, ingress, execd, and SDKs integrate with it as the `fast-sandbox` runtime provider. The upstream source this release builds against is pinned at `manifests/third-party/fast-sandbox.commit` (`d51fa69`, first pinned `1a420a22`, [#1899](https://github.com/opensandbox-group/OpenSandbox/pull/1899)); from that commit the release builds the Firecracker-scope image family only — `fsb-controller`, `fsb-fastlet`, `fsb-fastlet-proxy`, `fsb-janitor`, `fsb-firecracker-runtime`, `fsb-sandboxtemplate-builder` — and vendors its CRDs, deployable with the new `fast-sandbox` Helm chart ([#1869](https://github.com/opensandbox-group/OpenSandbox/pull/1869))

## Misc

- CLI: add Credential Vault management commands ([#1027](https://github.com/opensandbox-group/OpenSandbox/pull/1027)), report pause request acceptance ([#1537](https://github.com/opensandbox-group/OpenSandbox/pull/1537)), pass native argv to `command run` without shell quoting ([#1829](https://github.com/opensandbox-group/OpenSandbox/pull/1829)), preserve local files when downloads fail, and restore downloads to devices and named pipes ([#1820](https://github.com/opensandbox-group/OpenSandbox/pull/1820) [#1847](https://github.com/opensandbox-group/OpenSandbox/pull/1847))
- node-agent: add durable sandbox log collection and a compile-time multi-Source architecture (isolated Source state, event multiplexing, acknowledgement routing) ([#1435](https://github.com/opensandbox-group/OpenSandbox/pull/1435) [#1656](https://github.com/opensandbox-group/OpenSandbox/pull/1656)), and add an opt-in eBPF `syscalls` Source emitting ordered NDJSON syscall records to file/OSS sinks with least-privilege Helm capabilities ([#1682](https://github.com/opensandbox-group/OpenSandbox/pull/1682))
- Images: publish component images to GHCR alongside Docker Hub and ACR ([#1161](https://github.com/opensandbox-group/OpenSandbox/pull/1161)) and document registry provenance with digest-pinning verification guidance ([#1339](https://github.com/opensandbox-group/OpenSandbox/pull/1339))
- Move the code-interpreter sandbox image to the standalone opensandbox-group/sandbox-images repository; the image keeps versioning independently of the umbrella ([#1796](https://github.com/opensandbox-group/OpenSandbox/pull/1796))
- Resolve Dependabot security alerts and bump vulnerable dependencies: grpc, containerd, ebpf-go, cel-go, x/crypto, x/net, vitest, js-yaml, fast-uri, @humanfs/node, selinux, postcss, anyio, and otel-go ([#1545](https://github.com/opensandbox-group/OpenSandbox/pull/1545) [#1736](https://github.com/opensandbox-group/OpenSandbox/pull/1736) [#1838](https://github.com/opensandbox-group/OpenSandbox/pull/1838) [#1390](https://github.com/opensandbox-group/OpenSandbox/pull/1390) [#1250](https://github.com/opensandbox-group/OpenSandbox/pull/1250) [#1385](https://github.com/opensandbox-group/OpenSandbox/pull/1385) [#1467](https://github.com/opensandbox-group/OpenSandbox/pull/1467) [#1921](https://github.com/opensandbox-group/OpenSandbox/pull/1921))
- Docs: refresh the architecture overview, add the contributor advancement process, publish the OSEP set (pause/resume, resilient SDK transport, lifecycle hooks, multi-sandbox egress, TLS interception, execd-as-init, node-agent collection), add isolation-session, client-pool, and secure-access guides, extend the Claude Code and Codex CLI examples and add Deep Agents and OpenCode examples, use pip/uv install tabs, clarify pooled sandbox readiness, refresh SDK capability pages, and trim the README ([#1848](https://github.com/opensandbox-group/OpenSandbox/pull/1848) [#1761](https://github.com/opensandbox-group/OpenSandbox/pull/1761) [#1896](https://github.com/opensandbox-group/OpenSandbox/pull/1896) [#1149](https://github.com/opensandbox-group/OpenSandbox/pull/1149) [#1368](https://github.com/opensandbox-group/OpenSandbox/pull/1368) [#1542](https://github.com/opensandbox-group/OpenSandbox/pull/1542) [#1592](https://github.com/opensandbox-group/OpenSandbox/pull/1592) [#1714](https://github.com/opensandbox-group/OpenSandbox/pull/1714) [#1394](https://github.com/opensandbox-group/OpenSandbox/pull/1394) [#1428](https://github.com/opensandbox-group/OpenSandbox/pull/1428) [#1346](https://github.com/opensandbox-group/OpenSandbox/pull/1346) [#1352](https://github.com/opensandbox-group/OpenSandbox/pull/1352) [#1349](https://github.com/opensandbox-group/OpenSandbox/pull/1349) [#1774](https://github.com/opensandbox-group/OpenSandbox/pull/1774) [#1803](https://github.com/opensandbox-group/OpenSandbox/pull/1803) [#1797](https://github.com/opensandbox-group/OpenSandbox/pull/1797) [#1535](https://github.com/opensandbox-group/OpenSandbox/pull/1535) [#1544](https://github.com/opensandbox-group/OpenSandbox/pull/1544) [#1727](https://github.com/opensandbox-group/OpenSandbox/pull/1727) [#1821](https://github.com/opensandbox-group/OpenSandbox/pull/1821) [#1696](https://github.com/opensandbox-group/OpenSandbox/pull/1696) [#1728](https://github.com/opensandbox-group/OpenSandbox/pull/1728) [#1852](https://github.com/opensandbox-group/OpenSandbox/pull/1852) [#1912](https://github.com/opensandbox-group/OpenSandbox/pull/1912))
- Scripts: bootstrap a source-built fast-sandbox integration environment with source-built server and ingress ([#1756](https://github.com/opensandbox-group/OpenSandbox/pull/1756) [#1769](https://github.com/opensandbox-group/OpenSandbox/pull/1769))
- CI/release: enforce repository and release safeguards (tag immutability, protected release environment, scoped required checks) ([#1274](https://github.com/opensandbox-group/OpenSandbox/pull/1274)), gate release approval on the consistency scan and make the umbrella release idempotent ([#1911](https://github.com/opensandbox-group/OpenSandbox/pull/1911)), render the BOM from channel templates and publish images directly to release tags ([#1920](https://github.com/opensandbox-group/OpenSandbox/pull/1920) [#1925](https://github.com/opensandbox-group/OpenSandbox/pull/1925)), stop auto-bumping the server chart on release ([#1646](https://github.com/opensandbox-group/OpenSandbox/pull/1646)), pass the gateway route mode in e2e chart values ([#1874](https://github.com/opensandbox-group/OpenSandbox/pull/1874)), and remove the verify-license workflow ([#1813](https://github.com/opensandbox-group/OpenSandbox/pull/1813))
- Update code copyright to The OpenSandbox Authors across remaining components ([#1878](https://github.com/opensandbox-group/OpenSandbox/pull/1878) [#1945](https://github.com/opensandbox-group/OpenSandbox/pull/1945) [#1942](https://github.com/opensandbox-group/OpenSandbox/pull/1942) [#1890](https://github.com/opensandbox-group/OpenSandbox/pull/1890))

## Upgrade & Compatibility

- Breaking: the agent-sandbox provider and ingress require `agents.x-k8s.io/v1beta1` (agent-sandbox v1.0.0); install the beta CRDs/controller before upgrading — see the migration guide in [#1763](https://github.com/opensandbox-group/OpenSandbox/pull/1763)
- Breaking for chart users: charts moved to `manifests/charts/` ([#1857](https://github.com/opensandbox-group/OpenSandbox/pull/1857))
- Config: the beta `informer_enabled` flag was removed; the informer-backed cache is now the only Kubernetes read path (it was already the default, so remove the key when upgrading) ([#1926](https://github.com/opensandbox-group/OpenSandbox/pull/1926))
- Behavior change: code-interpreter creation blocks until strictly ready by default ([#1754](https://github.com/opensandbox-group/OpenSandbox/pull/1754)); set the previous lenient behavior explicitly if you depend on it
- Behavior change: lifecycle hooks are validated at create time and rejected on the Docker provider in this release ([#1589](https://github.com/opensandbox-group/OpenSandbox/pull/1589))
- Go module: `poolredis` is merged into the parent module `github.com/alibaba/OpenSandbox/sdks/sandbox/go` with the import path unchanged; a single companion tag now versions both ([#1903](https://github.com/opensandbox-group/OpenSandbox/pull/1903))
- Images: `opensandbox/<component>:release-1.1.0` (all three registries)
- Packages: server / CLI / SDKs all at `1.1.0`
- Charts: render from this tag (`helm template ./manifests/charts/opensandbox`)
- Kubernetes: supported range v1.21 – v1.34 (charts declare `kubeVersion: ">=1.21.1-0"`)
- Skew: server ↔ CLI/SDK same line supported; ±1 minor warns

## 👥 Contributors

Thanks to these contributors ❤️

- @7487
- @aGallea
- @akshar27
- @alahaiyo
- @AyushSonuu
- @bcfre
- @bcho
- @BigVan
- @bleakbelladonnals
- @Borda
- @changren-wcr
- @cwj2001
- @DanielXuuuuu
- @Dasen-CAI
- @dcaminos
- @Dev-next-gen
- @ekrasnoyarov
- @Elioooon
- @FAUST-BENCHOU
- @Federaffo
- @fengcone
- @ferponse
- @gegemeimingzi
- @GodBlf
- @Gujiassh
- @hi-neason
- @hittyt
- @hpliStartAgain
- @HUAN2022A
- @jianpingpei
- @jiawen7777
- @Joey777210
- @Junaid-PK
- @jwx0925
- @khandar-william
- @kittimzhe
- @korcan-kai
- @Kuang-xianxin
- @KXHXK
- @L4XB
- @lizhengfeng101
- @LorenzoRD2003
- @luffy0x
- @Luzhanpeng23
- @lyydsheep
- @mameikagou
- @MannXo
- @MaxFreedomPollard
- @mengdehong
- @MGuardia10
- @mpu
- @Mubelotix
- @mythic-p
- @ninan-nn
- @Pangjiping
- @ruirui6946
- @ryanzhang-oss
- @shenshouer
- @Spground
- @tea-artist
- @TuGou-a
- @vedmaka
- @vinkiYu
- @wakqasahmed
- @wangzhiyuan-pixel
- @wlmvp
- @wuzhihui1123
- @y4ney
- @yanpgwang
- @Yeaury
- @Zeeshan-Chaudhry
- @zhangfane
- @zpzjzj

## Artifacts

- BOM: [docs/releases/1.1.0.yaml](https://github.com/opensandbox-group/OpenSandbox/blob/release-1.1.0/docs/releases/1.1.0.yaml)
- Images: `opensandbox/<component>:release-1.1.0` (Docker Hub / GHCR / ACR)
- Packages: PyPI ×5, npm ×2, Maven Central ×5, NuGet ×2 — all at `1.1.0`
- Go module: `github.com/alibaba/OpenSandbox/sdks/sandbox/go@v1.1.0`

## Installation

```bash
# Platform (Kubernetes) — render the chart at this tag and apply
git clone https://github.com/opensandbox-group/OpenSandbox
git checkout release-1.1.0
helm dependency build manifests/charts/opensandbox  # package file:// sub-charts (not committed)
helm template ./manifests/charts/opensandbox | kubectl apply -f -
# or point your GitOps platform (Argo / Flux) at the repo path + tag

# SDKs
pip install opensandbox==1.1.0            # Python
npm install @alibaba-group/opensandbox@1.1.0   # JavaScript
# Kotlin/JVM: implementation("com.alibaba.opensandbox:sandbox:1.1.0")
dotnet add package Alibaba.OpenSandbox --version 1.1.0
go get github.com/alibaba/OpenSandbox/sdks/sandbox/go@v1.1.0

# Run the server locally
uvx opensandbox-server==1.1.0
```