v0.7.0

2026.08.28 Release v0.7.0

CubeSandbox 0.7.0 introduces 4 major features along with multiple enhancements and bug fixes. 239 commits from 57 contributors.

🎯 Major Features

Cross-Node Pause & Resume

With an S3 backend, sandboxes support pause/resume across nodes as well as creating sandboxes from snapshots. This feature is currently in preview.

Component Multi-Versioning

• Newly created templates and snapshots now record the versions of the components they depend on. After components on compute nodes are upgraded, historical templates and snapshots remain usable, and upgrades no longer affect pause/resume of existing instances — improving stability for running workloads.

Network Subsystem Refactor: Faster Sandbox Network Provisioning

• Architecture: fewer components to deploy — the network-agent component is merged into Cubelet, reducing inter-process RPC calls during sandbox creation; TAP device lifecycle management is redesigned to prevent network rules from leaking across sandboxes, reducing attack surface.
• Performance: optimized the eBPF network policy provisioning path, significantly reducing sandbox creation latency for sandboxes with network rules; removed unnecessary netlink dump operations so that creating new TAP devices under high concurrency remains stable when idle TAP devices are exhausted.

Separation of Control Plane and Operations

Architecturally, operations capabilities are split out of CubeMaster. Node management logic now lives in CubeOps, which supports multi-replica deployment and ships the cubeopscli tool.

✨ Enhancements

Templates & Storage

• CubeS3lvol COW (#1490): besides the local XFS COW engine, cubecow now supports remote snapshot storage on S3 object storage, enabling cross-node pause/resume and snapshot cloning.
• Private HTTP image registry support (#1369): pull images from HTTP image registries to build templates.
• Built-in MinIO as the default S3 volume backend (#1408): MinIO is deployed by default as the S3 backend for the volume feature and cross-node pause/resume. Users can also specify their own S3 backend.

Lifecycle & Control Plane

• Node deletion (#1202): support removing a node from the cluster so it no longer participates in scheduling.

Networking & Security Proxy

• Network subsystem refactor: NetworkAgent is fully embedded into Cubelet, streamlining the network provisioning flow.
• Support dynamically updating network policies for running sandboxes.
• CubeEgress L7 forwarding rules now support custom ports.
• CubeVS learns MAC addresses within the same subnet, avoiding black-holed traffic in non-hairpin networks.
• CubeProxy supports a custom management port and the gRPC protocol.

SDK

• Volume support: the Go (#1269) and Node (#1277) SDKs add Volume CRUD and volumeMounts, bringing all three languages to parity.
• Full template alias support: build-time aliases (#1119) and alias management for existing templates (#1120), covering Go / Node / Python.
• Go SDK user-level file view (#1348): Files.ForUser isolates file access by user identity.
• Node SDK runtime timeout (#1251): Sandbox.setTimeout(timeout) supports NEVER_TIMEOUT.
• Python SDK sandbox scheduling scope (#1144): Sandbox.create(distribution_scope=...) explicitly specifies the nodes/zones a sandbox can be placed on.
• Go SDK private sandbox dataplane fix (#1185): RunCode / Commands / Files / PTY now correctly pass through the TrafficAccessToken.
• Node SDK auth header fix (#1360): an Authorization header explicitly set by the caller (including lowercase variants) is no longer overridden by the SDK's default apiKey.
• Clone snapshot deferred cleanup across all three SDKs (#1095): reference counting ensures the temporary snapshot is deleted only after all clones are destroyed.

Deployment & Runtime

• Configurable log rotation policy (#1339): users can adjust cubelet's log rotation policy via the configuration file.
• Kernel / guest images published as separate artifacts (#1324): releases no longer rebuild the kernel and guest images; fixed versions are pulled from dedicated kernel-release-* / guest-image-* releases.

Web UI / CubeOps / Other

• CubeOps: node management moved into this module; new cubeopscli tool for node management, replacing the cubemastercli node subcommands; two-replica deployment supported by default (#1384, #1494).
• Web UI: node isolation/unisolation and node operation history viewing (#1384).

🐛 Bug Fixes

Lifecycle & Sandbox

• Fixed sandbox state inconsistency, zombie processes, and deletion failures caused by failed pause/resume (#978, #985, #1137, #1274).
• Fixed snapshot performance issues (#1300, #1504).
• Fixed a template cache data race during concurrent sandbox creation (#1366).

Networking & Security

• Fixed sandbox state anomalies caused by TAP device recovery failures during pause/resume and node restarts (#930, #987, #1207).

Other

• Fixed log rotation configuration not taking effect (#1289).
• Expanded the Python SDK compatibility end-to-end tests with coverage for the filesystem, rollback & cloning, online timeout updates, abnormal lifecycles, and advanced template parameters (#1226).

📚 Documentation

• New K8s deployment guide covering compute-node cube-node rebuild constraints and hostNetwork guidance (#1495).
• Community pages (#1344, #1364): sponsors and contributors wall added to the README.