v0.7.0

[fslongjin]

---

title: v0.7.0 — 2026.08.28

2026.08.28 Release v0.7.0

CubeSandbox 0.7.0 introduces 4 major features along with multiple enhancements and bug fixes. 239 commits from 57 contributors.

🎯 Major Features

Cross-Node Pause & Resume

With an S3 backend, sandboxes support pause/resume across nodes as well as creating sandboxes from snapshots. This feature is currently in preview.

Component Multi-Versioning

• Newly created templates and snapshots now record the versions of the components they depend on. After components on compute nodes are upgraded, historical templates and snapshots remain usable, and upgrades no longer affect pause/resume of existing instances — improving stability for running workloads.

Network Subsystem Refactor: Faster Sandbox Network Provisioning

• Architecture: fewer components to deploy — the network-agent component is merged into Cubelet, reducing inter-process RPC calls during sandbox creation; TAP device lifecycle management is redesigned to prevent network rules from leaking across sandboxes, reducing attack surface.
• Performance: optimized the eBPF network policy provisioning path, significantly reducing sandbox creation latency for sandboxes with network rules; removed unnecessary netlink dump operations so that creating new TAP devices under high concurrency remains stable when idle TAP devices are exhausted.

Separation of Control Plane and Operations

Architecturally, operations capabilities are split out of CubeMaster. Node management logic now lives in CubeOps, which supports multi-replica deployment and ships the cubeopscli tool.

✨ Enhancements

Templates & Storage

• CubeS3lvol COW (feat(CubeS3lvol): add a remote COW based on S3 #1490): besides the local XFS COW engine, cubecow now supports remote snapshot storage on S3 object storage, enabling cross-node pause/resume and snapshot cloning.
• Private HTTP image registry support (feat(cubemaster): support plain HTTP registries via http:// image ref prefix #1369): pull images from HTTP image registries to build templates.
• Built-in MinIO as the default S3 volume backend (feat: add bundled MinIO S3 volume backend #1408): MinIO is deployed by default as the S3 backend for the volume feature and cross-node pause/resume. Users can also specify their own S3 backend.

Lifecycle & Control Plane

• Node deletion (feat(cubemaster): support safe node deletion #1202): support removing a node from the cluster so it no longer participates in scheduling.

Networking & Security Proxy

• Network subsystem refactor: NetworkAgent is fully embedded into Cubelet, streamlining the network provisioning flow.
• Support dynamically updating network policies for running sandboxes.
• CubeEgress L7 forwarding rules now support custom ports.
• CubeVS learns MAC addresses within the same subnet, avoiding black-holed traffic in non-hairpin networks.
• CubeProxy supports a custom management port and the gRPC protocol.

SDK

• Volume support: the Go (feat(sdk/go): add Volume API (CRUD + volumeMounts) #1269) and Node (feat(node-sdk): add volume support  #1277) SDKs add Volume CRUD and volumeMounts, bringing all three languages to parity.
• Full template alias support: build-time aliases (feat(sdk): supplement Go/Python/Node SDK support for template alias #1119) and alias management for existing templates (feat: set alias on an existing template #1120), covering Go / Node / Python.
• Go SDK user-level file view (feat(sdk/go): add user-scoped filesystem views #1348): Files.ForUser isolates file access by user identity.
• Node SDK runtime timeout (fix(Node SDK): Add SetTimeout() to Node SDK #1251): Sandbox.setTimeout(timeout) supports NEVER_TIMEOUT.
• Python SDK sandbox scheduling scope (feat(python-sdk): expose distribution scope for sandbox creation #1144): Sandbox.create(distribution_scope=...) explicitly specifies the nodes/zones a sandbox can be placed on.
• Go SDK private sandbox dataplane fix (fix(go sdk): send traffic access token on private sandbox data-plane requests #1185): RunCode / Commands / Files / PTY now correctly pass through the TrafficAccessToken.
• Node SDK auth header fix (fix(sdk/node): handle case-insensitive Authorization header in controlFetch #1360): an Authorization header explicitly set by the caller (including lowercase variants) is no longer overridden by the SDK's default apiKey.
• Clone snapshot deferred cleanup across all three SDKs (fix(sdk): defer clone snapshot cleanup until last sandbox kill #1095): reference counting ensures the temporary snapshot is deleted only after all clones are destroyed.

Deployment & Runtime

• Configurable log rotation policy (feat(cubelog): configurable roll policy via config.toml #1339): users can adjust cubelet's log rotation policy via the configuration file.
• Kernel / guest images published as separate artifacts (build(workflows): pin kernel/guest release assets in dedicated releases #1324): releases no longer rebuild the kernel and guest images; fixed versions are pulled from dedicated kernel-release-* / guest-image-* releases.

Web UI / CubeOps / Other

• CubeOps: node management moved into this module; new cubeopscli tool for node management, replacing the cubemastercli node subcommands; two-replica deployment supported by default (feat(CubeOps): migrate node management to CubeOps #1384, fix(cubemaster): evict node cache only after sustained empty syncs #1494).
• Web UI: node isolation/unisolation and node operation history viewing (feat(CubeOps): migrate node management to CubeOps #1384).

🐛 Bug Fixes

Lifecycle & Sandbox

• Fixed sandbox state inconsistency, zombie processes, and deletion failures caused by failed pause/resume ([Bug Report] sandbox status execption #978, [Bug Report] CubeMaster 状态不一致导致沙箱暂停/恢复死循环、僵尸沙箱及清理程序失败 #985, [Bug Report]Resume a long-paused sandbox instance fails with VM status inconsistency error #1137, [Bug Report] Intermittent failure to resume/delete sandboxes after long-running pause (VM state deadlock) #1274).
• Fixed snapshot performance issues (fix(envd): avoid separate stderr FIFO for terminal probe #1300, fix(cubelet): reuse cached envd version for snapshots #1504).
• Fixed a template cache data race during concurrent sandbox creation (fix(cubelet): clone run templates so concurrent flows stop mutating the cache #1366).

Networking & Security

• Fixed sandbox state anomalies caused by TAP device recovery failures during pause/resume and node restarts ([Bug Report] network-agent 重启后,重启前创建的存量沙箱数据面集体永久失效(控制面仍报 running) #930, [Bug Report] Pressure-test cleanup cannot batch-delete paused sandboxes: 130593 and OpenTap resume failure #987, [Bug Report] v0.5.1: paused sandboxes cannot resume after control-plane restart (persistent TAP EBUSY) #1207).

Other

• Fixed log rotation configuration not taking effect ([Bug Report] CubeMaster ignores file_size/file_num log rotation settings #1289).
• Expanded the Python SDK compatibility end-to-end tests with coverage for the filesystem, rollback & cloning, online timeout updates, abnormal lifecycles, and advanced template parameters (test(e2e): expand Python SDK compatibility coverage #1226).

📚 Documentation

• New K8s deployment guide covering compute-node cube-node rebuild constraints and hostNetwork guidance (docs(k8s): document cube-node recreation constraint and hostNetwork guidance #1495).
• Community pages (doc: add sponsors and contributors #1344, docs: Add contributors wall #1364): sponsors and contributors wall added to the README.

---

This discussion was created from the release v0.7.0.