server/v0.2.1

## What's New

### ✨ Features

- **Burstable QoS via `resourceRequests`** — new optional `resourceRequests` field on `CreateSandboxRequest` lets callers set Kubernetes resource requests separately from limits, enabling Burstable QoS class sandboxes. Fully backward compatible: omitting the field preserves existing `requests == limits` (Guaranteed QoS) behavior. API spec and Pydantic schema updated; server-side threading through providers will follow. (#1074)

- **Egress sidecar env injection** — `OPENSANDBOX_EGRESS_*` prefixed environment variables in `CreateSandboxRequest.env` are now automatically routed to the egress sidecar container instead of the main sandbox container. This allows configuring egress behavior (e.g. transparent MITM proxy) without API/SDK changes — just use the existing `env` field with the prefix convention. Reserved internal vars (`OPENSANDBOX_EGRESS_RULES`, `OPENSANDBOX_EGRESS_MODE`, `OPENSANDBOX_EGRESS_TOKEN`) are blocked with HTTP 400. (#1069)

- **Bubblewrap (bwrap) filesystem isolation for execd** — new `pkg/isolation/` package adds a bubblewrap-based filesystem isolation layer for execd. Includes bwrap argv builder, startup probe, upper directory management, seccomp profile loading, and env var overrides for isolation flags. bwrap is now statically compiled (musl-gcc) and injected via init container alongside execd. CI smoke test validates the build on ubuntu-latest. Diff/commit support deferred to Phase 2 (returns 503). (#1008)

### 🐛 Bug Fixes

- **gVisor + networkPolicy now rejected** — gVisor lacks the iptables `nat` table required by the egress sidecar's DNS redirect. Previously this combination silently failed (egress sidecar CrashLoopBackOff). Now returns HTTP 400 with a clear error message. Compatibility matrix and troubleshooting docs updated. (#1070)

- **Internal K8s proxy endpoint resolution fixed** — `resolve_internal=True` was not honored for Kubernetes server-proxy endpoint resolution, causing requests to go through gateway ingress formatting instead of returning the sandbox pod IP directly. Fixed with regression test coverage. (#1107)

- **Egress sidecar runtime volume always mounted** — the `/opt/opensandbox` shared volume is now mounted on the egress sidecar unconditionally, not only when `credential_proxy_enabled=True`. Previously, enabling manual MITM (`OPENSANDBOX_EGRESS_MITMPROXY_TRANSPARENT=true` via env) without credential proxy meant the CA cert was written to an unmounted filesystem, causing sandbox startup timeouts. (#1072)

### 🔒 Security

- **Dependency upgrades for CVE remediation** — pinned `fastapi>=0.137.0`, `starlette>=1.3.1`, `python-multipart>=0.0.30` to fix hostname poisoning, form DoS, parameter smuggling, and method dispatch vulnerabilities. Also bumped `js-yaml` to 4.2.0 (quadratic DoS) and `vite` to 6.4.3 (`server.fs.deny` bypass, NTLMv2 hash disclosure). Addresses ~16 open Dependabot alerts. (#1102)

### 📦 Misc

- **Docs**: streamlined `server/AGENTS.md` and `DEVELOPMENT.md`, added `server/CLAUDE.md` symlink. (#1100)

## 👥 Contributors

Thanks to these contributors ❤️

- @Gujiassh
- @Pangjiping

---

- PyPI: opensandbox-server==0.2.1
- Docker Hub: opensandbox/server:v0.2.1
- Aliyun Registry: sandbox-registry.cn-zhangjiakou.cr.aliyuncs.com/opensandbox/server:v0.2.1