2026.07.24 Release v0.6.0
CubeSandbox 0.6.0 continues to strengthen core capabilities for production deployment and operations.
This release introduces 6 major features along with multiple enhancements and bug fixes. 92 commits from 31 contributors.
🎯 Major Features
Kubernetes Deployment: Deploy Cube Control Plane and Compute Nodes on K8s
Deploy CubeSandbox control-plane components and compute nodes directly onto Tencent Cloud TKE, standard Kubernetes, or k3s clusters via Helm Chart. Perform rolling upgrades, canary releases, and other operations using standard Kubernetes practices. For details, see the Kubernetes Deployment Guide.
::: warning Preview
Kubernetes deployment is currently in preview. Advanced capabilities such as seamless upgrades are still under active development. Feedback is welcome.
:::
E2B-Compatible Volume Framework
Introduces an E2B-compatible Volume framework that lets users plug in custom backend storage while remaining compatible with the E2B standard. Provides four hooks — Create / Destroy / Attach / Detach — and two plugin forms: Binary and RPC. This release includes Volume lifecycle management, sandbox–Volume binding APIs, and supporting SDK and cubemastercli capabilities. For details, see the Volume Plugin Guide.
Template Aliases
Support setting an alias when creating a template, and creating sandboxes by specifying that alias.
Note: Aliases can only be set at template creation time; existing templates cannot have aliases added or changed. Specifying an alias when creating a sandbox is currently supported only in the Python SDK; other SDKs will follow soon.
Configurable Host for Inbound Sandbox Requests
Allow configuring the Host header forwarded to the sandbox (instead of the default <port>-<sandboxId>.<domain>), improving compatibility with Host-based services inside the sandbox. The new network.maskRequestHost parameter can be set when creating a sandbox to specify the Host forwarded to in-sandbox services (for example localhost:${PORT}, which expands to localhost:3000 when accessing port 3000), so applications that rely on Host for routing, validation, or callbacks work correctly.
Compute Node Isolation
Support isolating a compute node at the scheduling layer so operators can log in for maintenance, upgrades, and troubleshooting. After isolation, no new sandboxes are scheduled to that node; existing sandboxes continue to run unaffected.
Isolate a node with cubemastercli node isolate <node-id>, and lift isolation with the unisolate subcommand. For details, see Node Isolation.
CubeOps Operations Service: Decouple Ops & Web Console Logic from CubeAPI
Web console capabilities are split out of the CubeAPI module into a standalone CubeOps service, making CubeAPI lighter and more extensible.
✨ Enhancements
SDK
- Go SDK PTY (#815): Improved interactive terminal capabilities.
- Python SDK X-API-Key coverage (#995): Carry X-API-Key on all request paths.
- Go SDK Connect protocol frames and dataplane fixes (#828, #941): process.Process/Start, exit-0 end event parsing, encode deduplication, and dataplane defect fixes.
- Short sandbox ID prefix resolution (#697): CubeMaster / Cubelet support short ID prefix resolution for easier ops and troubleshooting.
Templates & Storage
- Templates can enable the ivshmem device (#858).
- cubemastercli UX improvements (#891): Better experience for
tpl info/delete/redo. - New cubemastercli volume-related subcommands (#1077).
Lifecycle & Control Plane
- CLM state sync (#956): Stronger sandbox lifecycle state consistency; control-plane pause/resume actions are synced to the dataplane.
- Async CubeProxy state push (#1044): Push with backoff retries to reduce sync-push jitter.
- Skip capacity checks for delete-triggered auto-resume (#1015): Prevent resume on the delete path from being wrongly blocked by capacity checks.
- Schema migration toggle (#1037, #1076): New
CUBE_AUTO_MIGRATIONenv var to skip automatic DB migration at startup for controlled upgrades. - Support deleting sandboxes that are in the paused state.
Networking & Security Proxy
- CubeEgress MITM leaf certificate SAN (#948): Write subjectAltName on leaf certificates for better TLS verification compatibility.
- Return 403 on traffic token validation failure (#1053): Align with E2B and avoid confusion with other error codes.
- CubeProxy Redis hostname resolver (#714): Correctly resolve Redis hostnames.
- Disable gzip on Connect streams (#1083): Prevent streaming RPCs from being broken by compression.
Deployment & Runtime
- PostgreSQL metadata backend (#674, #1000): CubeMaster DAO layer supports PostgreSQL.
- Switch in-sandbox cgroup from v1 to v2 (#899).
- Cubelet state tmpfs supports dynamic expansion (#1008).
Web UI / CubeOps / Other
- Improved compute-node component version inventory reporting (#1020).
- CubeMaster HTTP APIs now handled with the gin framework (#922).
🐛 Bug Fixes
Lifecycle & Sandbox
- Nested host-mount mount order: apply configuration in user-specified order (#946).
- Periodic compute-node health sync (#730): Avoid inconsistency between health state and the scheduling view.
- WebUI: Converge to a 404 terminal state after sandbox timeout cleanup (#1036); eliminate session invalidation risk (#1048).
Security & Validation
- CVE-2026-24834 / CVE-2026-47243 fixes (#1066).
- Stronger image reference validation (#868): Prevent parameter injection.
- PVM kernel update (#937): Address security vulnerabilities.