v0.7.1

[fslongjin]

2026.09.11 Release v0.7.1

CubeSandbox 0.7.1 introduces 1 major feature along with multiple enhancements and bug fixes. 70 commits from 24 contributors.

🎯 Major Features

End-to-end high availability for Cube control-plane services

• A standalone template-center service enables multi-replica CubeMaster deployment.
• The lifecycle management service now supports active/standby deployment.

✨ Enhancements

Templates & Storage

• Snapshot support for Host Mount and Volume Plugin: snapshot, restore, rollback, and clone now work for sandboxes with external mounts (feat(host-mount): support snapshot restore and cloning #1654, feat(snapshot): support snapshot for volumn plugin  #1656).
• Standalone CubeTemplateCenter: template build / delete / reclaim is split out of CubeMaster into an independently scalable multi-replica service. Build artifacts are persisted to S3/MinIO (AWS S3 compatible). Also fixes long-standing issues around concurrent build races, inconsistent artifact table names, and ephemeral local-disk storage (feat(templatecenter): introduce standalone CubeTemplateCenter service #1659).
• Faster same-bucket cross-node snapshot restore (s3lvol: pending-delete, derived exports, and faster same-bucket ingest #1663): restoring a snapshot from the same bucket now uses object-storage server-side copy, which is significantly faster. Also improves delayed-delete reclamation and adds snapshot cancellation.

Lifecycle & Control Plane

• CLM now supports active/standby disaster recovery.
• Running sandboxes no longer block snapshot deletion (feat(cubemaster): support deleting snapshots while sandboxes are running #1620): deleting a still-referenced snapshot takes effect immediately; underlying storage is reclaimed after the last reference is released.

Security

• virtiofsd hardening (Security optimizations for virtiofsd #1612): after a directory whitelist is set, root-directory mutation operations are rejected, as are forged readdirplus requests.

Deployment & Runtime

• CubeS3lvol on Kubernetes (feat(s3lvol,k8s): optional s3lvol sidecar in the cube-node Big Pod #1637): use the S3 backend for cross-node pause/resume and snapshots in K8s deployments.
• One-click deployment supports external PostgreSQL (feat(one-click): support external PostgreSQL via CUBE_DATABASE_DRIVER #1644): choose MySQL / PostgreSQL via CUBE_DATABASE_DRIVER and connect to a self-managed database instance.
• CubeS3lvol is now opt-in (fix(cubelet): skip s3lvol init unless opted in via [cow.s3] enable #1622, fix(one-click): honor ONE_CLICK_ENABLE_S3LVOL enable/disable on upgrade #1633): set [cow.s3] enable = true (or ONE_CLICK_ENABLE_S3LVOL=1 for one-click deploy); it is disabled by default. Also fixes the switch not taking effect during one-click upgrades. Upgrade note: nodes that were using S3 without an explicit setting must enable it after upgrade.
• Unified Helm Redis logical-DB config (feat(chart): wire top-level redis.db for Master, Proxy, and LCM #1638): new top-level redis.db applies to CubeMaster / CubeProxy / CLM, so multiple clusters sharing one Redis instance can isolate logical databases per cluster.

Web UI / CubeOps / Other

• cubemastercli batch template deletion (feat(cubemastercli): support deleting multiple templates #1549): tpl delete accepts multiple template IDs in one call.

🐛 Bug Fixes

Lifecycle & Sandbox

• Fixed sandboxes set to never expire (NEVER_TIMEOUT) being immediately treated as expired (fix(cubemaster): return zero EndAt for NeverTimeout sandbox #1401).
• Fixed invalid CPU / memory specs in create requests being treated as 0, allowing sandboxes to bypass node resource filters and be scheduled onto any node (cubemaster: stop shadowing err when parsing container resource quantities #1463).
• Fixed a new timeout passed on Resume being discarded, so the sandbox kept its pre-pause timeout (fix(cubemaster): sync timeout metadata after resume #862).
• Fixed snapshots after an S3-backend restore falling back to a full memory dump; snapshots stay incremental (fix(s3): keep pause package after Resume so Snapshot stays incremental #1688).
• Fixed no log output from cubecli logs for sandboxes created from a template (fix(shim): restore RPC log forward after template create #1616).
• Fixed template creation hanging indefinitely when a compute node is unresponsive; added a configurable timeout (default 300 seconds) (fix(cubemaster): add configurable AppSnapshot RPC timeout #994).
• Fixed gRPC connections not being closed promptly after a node is taken offline or deleted (fix(grpcconn): match full and prefixed keys in CloseWorkerConn #1585).
• Fixed S3 volume mount failures with newer s3fs (1.97+ / FUSE3) (fix(volume-s3): remove s3fs -ononempty mount flag #1647).

Networking & Security

• Fixed the transparent proxy returning 504 after 60 seconds when talking to slow-TTFB upstreams such as LLMs; proxy send/receive timeout is now 2 hours (fix(cube-egress): raise transparent proxy timeouts to 2h #1655).
• Fixed CubeEgress failures caused by oversized credential values injected via network rules; the per-entry injection limit is aligned with E2B at 2048 bytes (CubeEgress: Cap inject secrets at 2048 bytes and grow policy_store #1606).
• Fixed TAP device names silently truncated past the kernel length limit, causing network device lookup failures (fix(cubelet): name sandbox TAPs after IPv4 and reject oversize names #1552).
• Fixed intermittent Cubelet network-plugin init failures on K8s when the gateway ARP cache is not ready early in node startup (cubelet plugin init failure when gateway ARP cache is not yet populated  #1609).
• Image-registry credentials no longer appear in component logs (refactor(proto): unify gRPC protos into shared pkgs/proto module #1600).

Deployment & Upgrade

• Fixed Helm upgrades failing because Redis StatefulSet PVC labels changed (fix(chart): use stable labels for redis PVC volumeClaimTemplates #1604).
• Fixed global.imageRegistry overwriting explicitly configured private / third-party registry addresses (fix(chart): rewrite imageRegistry only for official Cube TCR hosts #1605).
• Fixed helm test pods remaining Pending on tainted nodes (fix(k8s): make helm test pods schedulable and probe CubeProxy healthz #1388).
• Fixed Terraform deployments skipping validation and template creation when node queries returned 0 healthy nodes (fix(terraform): query cube-ops nodes via CLB and fix jq syntax #1602).
• Fixed CubeOps ignoring the logical-DB number when using a standalone Redis config, which hid node metrics and caused scheduling-metric update timeouts (fix(cubeops): support configurable Redis database selection #1607).
• Fixed lowercase log-level values (e.g. info) not taking effect and falling back to DEBUG (fix(cubelog): accept case-insensitive log levels #1597).
• Fixed builder image builds failing on Ubuntu 20.04 (fix(builder): directly configure llvm-14 apt repository on Ubuntu 20.04 #1588).

Other

• Node / Python SDK: fixed command execution never returning when timeout is 0 or NEVER_TIMEOUT (fix(sdk): do not send a non-positive Connect-Timeout-Ms for a command #1485).
• Fixed cubeopscli reporting a hardcoded 0.1.0 version and the version subcommand being unavailable (fix(cubeopscli): report build-injected version instead of hardcoded 0.1.0 #1596).
• Fixed cubemastercli version producing no output by default (fix(cubemastercli): align version command output #1657).
• Fixed the Web UI runtime config page showing deprecated settings (fix(web&&cubeops): drop stale CubeAPI config fields from CubeOps /config #1573).

---

This discussion was created from the release v0.7.1.