docker/egress/v1.1.5

pq-yang/MatAnyone2docker/egress/v1.1.5Jul 27, 2026by Pangjiping

AI Summary

Adds experimental support for intercepting extra TCP ports in egress and patches security vulnerabilities in Go dependencies.

Key Highlights

Intercept extra TCP ports beyond 80/443 (experimental)
CVE patches for Go dependencies (grpc, x/net, x/crypto)
Fixes for npm scoped packages under Credential Vault

New Features

Intercept extra TCP ports via `OPENSANDBOX_EGRESS_MITMPROXY_EXTRA_PORTS`
Purge stale mitmproxy CA on startup
DNS survives `deny.always` overlays containing `127.0.0.0/8`

Full Release Notes

## What's New

### ✨ Features

- **Intercept extra TCP ports beyond 80/443 (experimental).** New env var `OPENSANDBOX_EGRESS_MITMPROXY_EXTRA_PORTS` (comma-separated) appends extra destination ports to the transparent-mitm REDIRECT rule, with fail-closed validation. Note: extra ports are decrypted and logged but not yet matched against credential bindings. (#1379)

### 🐛 Bug Fixes

- **npm scoped packages no longer 403 under Credential Vault.** A single-layer `%2f` (e.g. `/@scope%2fname`) is now allowed, while `%2f` that crosses a credential binding boundary — plus nested encodings, backslashes, and dot-segments — is still rejected. (#1369)

- **DNS survives `deny.always` overlays containing `127.0.0.0/8`.** In `dns+nft` mode, DNS redirected to `127.0.0.1:15353` is now accepted before the deny sets, so a loopback deny rule no longer breaks sandbox DNS under Docker. (#1380)

- **Purge stale mitmproxy CA on startup.** egress now erases the exported CA early in startup so a co-restarting agent doesn't install a stale CA, fixing `unable to get local issuer certificate` on HTTPS from the agent. (#1371)

### 🔒 Security

- **CVE patches for Go dependencies.** `grpc` → v1.82.1 (xDS RBAC / HTTP/2) and `postcss` → 8.5.11 (#1385); `x/net` → v0.55.0 (HTML parser DoS) and `x/crypto` → v0.52.0 (13 SSH advisories), bringing modules to Go 1.25. (#1250)

### 📦 Misc

- **License headers.** Added missing Apache 2.0 headers to fix the `verify-license` CI workflow. (#1313)

## 👥 Contributors

Thanks to these contributors ❤️

- @LorenzoRD2003
- @Pangjiping

---
- Docker Hub: opensandbox/egress:v1.1.5
- Aliyun Registry: sandbox-registry.cn-zhangjiakou.cr.aliyuncs.com/opensandbox/egress:v1.1.5
- GHCR: ghcr.io/opensandbox-group/opensandbox/egress:v1.1.5