server/v0.1.12

## What's New

### ⚠️ Breaking Changes

- **`allowed_host_paths` defaults to deny-all** — Previously, when `[storage].allowed_host_paths` was empty or unset, the server allowed all host path mounts into sandboxes, creating a sandbox escape vulnerability (closes #750). This release flips the default to deny all host mounts. Users who need the legacy behavior must explicitly set `allowed_host_paths = ["/"]` as a temporary compatibility measure. Additionally, the server now requires explicit startup confirmation when `api_key` is unset. (#751)

### ✨ Features

- **Windows Sandbox**
  - windows server by dockur/windows (#712)
  - resolves a port exposure logic error affecting Windows sandbox containers and egress network scenarios. (#733)
  - Windows container support for BatchSandbox Kubernetes workloads. (#752)
- propagate opensandbox.extensions. to Pod annotations — Extensions with the `opensandbox.extensions.` prefix are now automatically copied to Kubernetes Pod annotations with the `opensandbox.io/extensions.` (#772)
- **GPU resource limits now honored across both runtimes**
  - **Docker**: mapped to `DeviceRequest(count=N, capabilities=[["gpu"]])`. (#775)
  - **Kubernetes**: translated to the canonical extended resource `nvidia.com/gpu`, enabling the NVIDIA device plugin to schedule GPU pods. (#782)

### 🐛 Bug Fixes
- Inject X-Forwarded-* headers for proxied HTTP requests — When proxying HTTP requests to a user sandbox via `use_server_proxy`, the server now injects `X-Forwarded-Proto`, `X-Forwarded-Host`, and `X-Forwarded-For` headers. Previously, web apps inside the sandbox (VS Code, Jupyter, OAuth callbacks) had no way to determine the original scheme, host, or client IP, causing broken HTTPS redirects and incorrect absolute URL generation. Uses `setdefault` semantics for upstream proxy chain safety. (#777)
- Honor `server.eip` for proxied endpoint URLs — When `use_server_proxy=true`, the server now uses the configured `server.eip` to generate externally reachable proxy endpoints instead of returning internal `base_url` addresses. Falls back to existing behavior when `eip` is unset. (#747)

### 📦 Misc

- bump `execd` to v1.0.13 with config template, documentation, and test updates (#763)
- chore(deps): bump python-dotenv from 1.2.1 to 1.2.2 in /server (#784)

## 👥 Contributors

Thanks to these contributors ❤️

- @bytkim
- @wangdengshan
- @504097723
- @Pangjiping
- @ninan-nn

---

- PyPI: opensandbox-server==0.1.12
- Docker Hub: opensandbox/server:v0.1.12
- Aliyun Registry: sandbox-registry.cn-zhangjiakou.cr.aliyuncs.com/opensandbox/server:v0.1.12