Skip to content

Releases: e2b-dev/infra

Release list

2026.29

2026.29 Latest
Latest

Choose a tag to compare

View all tags
@jakubno jakubno released this 28 Jul 13:17
2026.29
557445f
This commit was created on GitHub.com and signed with GitHub’s verified signature.
GPG key ID: B5690EEEBB952194
Verified
Learn about vigilant mode.

What’s Changed

API

Features

Improvements

Dashboard

Features

Improvements

Orchestrator

Features

  • Ensure requested free disk space before finalizing template builds by @gm-e2b in #3249
  • Add NetworkAssignHook for sandbox lifecycle extensions by @rguliyev in #3290
  • Add per-role storage URLs and an environment-independent storage library by @dobrac in #3246

Improvements

  • Serialize sandbox updates by @jakubno in #3250
  • Trace slow disk resize operations during template builds by @gm-e2b in #3298

Bug Fixes

Sandbox Runtime (envd)

Bug Fixes

  • Avoid Start deadlock after request cancellation by @arkamar in #3256
  • Never report failed envd command streams as successful by @arkamar in #3281

Improvements

  • Make MultiplexedChannel.Fork return a receive-only channel by @arkamar in #3257

Full Changelog:
2026.28...2026.29

Assets 2
Loading

2026.28

2026.28

Choose a tag to compare

View all tags
@jakubno jakubno released this 09 Jul 15:18
2026.28
fda7bef
This commit was created on GitHub.com and signed with GitHub’s verified signature.
GPG key ID: B5690EEEBB952194
Verified
Learn about vigilant mode.

What's Changed

API

Features

  • Add per-team sandbox events TTL limits based on tier and addons by @jakubno in #3181
  • Discover orchestrators via Nomad services by @wj-e2b in #3176

Improvements

Bug Fixes

  • Handle corrupted sandbox stop times by @jakubno in #3203
  • Prevent uint64 underflow in node allocated metrics by @jakubno in #3216
  • Heal sandboxes missing from the eviction index by @jakubno in #3199

Orchestrator

Features

  • Add support for compressed uploads to AWS storage by @dobrac in #3113

Improvements

  • Add -force-reboot to resume-build for cold-booting memory snapshot builds by @arkamar in #3208
  • Introduce a shared compressed upload framework and storage limiter by @dobrac in #3232

Bug Fixes

  • Unpack OCI layers in a chroot, matching Docker daemon behavior by @jakubno in #3215
  • Fix compressed upload and cache correctness issues by @dobrac in #3231

Storage

Improvements

Bug Fixes

Testing

  • Add server-backed GCS storage tests using Testcontainers by @dobrac in #3233

Sandbox runtime (envd)

Improvements

  • Use constant-time comparison for signature validation by @AdaAibaby in #3145

Bug Fixes

  • Use WithoutCancel for the CA cleanup goroutine context by @arkamar in #3207
  • Stop misleading CA installation cancellation errors during rapid /init calls by @arkamar in #3206

Full Changelog:
2026.27...2026.28

Loading

2026.27

2026.27

Choose a tag to compare

View all tags
@jakubno jakubno released this 09 Jul 15:14
2026.27
3fa2aeb
This commit was created on GitHub.com and signed with GitHub’s verified signature.
GPG key ID: B5690EEEBB952194
Verified
Learn about vigilant mode.

What's Changed

API

Features

Improvements

  • Deprecate access token authentication in the OpenAPI specification by @huv1k in #3084

Bug Fixes

  • Use the correct error variable in processCustomErrors by @AdaAibaby in #3135
  • Prevent WrapContextAsUserError from misclassifying internal timeouts as user cancellations by @AdaAibaby in #3155

Dashboard

Features

  • Add a LaunchDarkly-gated ClickHouse read switcher by @rguliyev in #3111
  • Flag sandboxes that are past data retention by @huv1k in #3102

Bug Fixes

  • Set Ory external_id only after the bootstrap commit by @drankou in #3133

Orchestrator

Features

Improvements

  • Share sandbox artifact names across components by @wj-e2b in #3117
  • Introduce StartType for sandbox start types by @arkamar in #3124
  • Add additional storage logging by @jakubno in #3126
  • Add OpenTelemetry instrumentation to the AWS S3 storage client by @dobrac in #3172

Bug Fixes

  • Sanitize OCI pull errors by @dobrac in #3096
  • Log missing egress proxy during startup reclaim instead of silently defaulting by @wj-e2b in #3116
  • Scope rootfs hashes to the provision default by @dobrac in #3129
  • Start envd.service after systemd-tmpfiles-setup by @dobrac in #3130
  • Deschedule a flaky eviction-loop race in tests by @wj-e2b in #3173
  • Allow the build-cache threshold flag to exceed its fallback value by @wj-e2b in #3175
  • Fix chunk readiness in P2P → compressed transitions by @levb in #3185
  • Revert the legacy-ancestor pending diff header change by @levb in #3141
  • Fix upload metadata path races by @dobrac in #3115
  • Fix runaway blob file_type metric attribute values by @levb in #3150

NFS cleanup

Improvements

  • Rewrite clean-nfs-cache to reduce memory usage and improve statistics by @levb in #3118

Bug Fixes

  • Exclude zombie entries from clean-nfs-cache delete age calculations by @levb in #3191

New Contributors

Full Changelog:
2026.26...2026.27

Loading

2026.26

2026.26

Choose a tag to compare

View all tags
@jakubno jakubno released this 09 Jul 15:06
2026.26
4d47148
This commit was created on GitHub.com and signed with GitHub’s verified signature.
GPG key ID: B5690EEEBB952194
Verified
Learn about vigilant mode.

What's Changed

API

Features

  • Add paginated GET /v2/templates endpoint by @huv1k in #3059

Improvements

  • Pin resume retries to the node where a previous resume timed out by @jakubno in #3066

Bug Fixes

  • Parse pause request bodies regardless of Content-Length by @bchalios in #3056

Orchestrator

Features

  • Enforce soft-delete consumers for the storage index by @ValentaTomas in #3034
  • Track and report the last sandbox status change timestamp by @jakubno in #2980
  • Add opt-in DSCP marking for sandbox egress (SANDBOX_EGRESS_DSCP) by @tomassrnka in #3039
  • Enable graceful sandbox drain on shutdown by @wj-e2b in #3069
  • Enable graceful template-build drain on shutdown by @wj-e2b in #3079
  • Improve read-path telemetry by @levb in #3063
  • Harvest resume-prefetch traces during pause by @kalyazin in #3067
  • Add resume-build -gdb support for guest kernel debugging by @kalyazin in #3040
  • Add DISABLE_STARTUP_RECLAIM configuration flag by @wj-e2b in #3081
  • Detect and clean up leaked sandbox cgroups by @wj-e2b in #3086
  • Inspect and disconnect connected NBD devices by @wj-e2b in #3087

Improvements

  • Always include execution metrics in sandbox webhook events by @AdaAibaby in #2852
  • Wire filesystem-only snapshots into the control plane by @bchalios in #3027
  • Enable filesystem-only snapshots for auto-pause by @bchalios in #3055
  • Make build-reserved-disk-space-mb default to 256 MB by @arkamar in #3065
  • Move envd timeout configuration behind a feature flag by @jakubno in #3068
  • Fold soft-delete dataPath into the source model by @levb in #3046
  • Stamp provenance metadata on uploaded objects, including headers by @ValentaTomas in #3033

Bug Fixes

  • Require envd 0.6.3 for cgroup freeze support by @arkamar in #3050
  • Prevent NBD read-loop stalls on WRITE_ZEROES (behind a feature flag) by @kalyazin in #3048
  • Seed legacy-ancestor in pending diff headers by @levb in #3075

Client Proxy

Improvements

Dashboard

Features

Full Changelog:
2026.25...2026.26

Loading

2026.25

2026.25

Choose a tag to compare

View all tags
@jakubno jakubno released this 09 Jul 14:25
2026.25
ea2663e
This commit was created on GitHub.com and signed with GitHub’s verified signature.
GPG key ID: B5690EEEBB952194
Verified
Learn about vigilant mode.

What's Changed

API

Bug Fixes

  • Try to place workloads on nodes that support the requested volume type by @djeebus in #3013

Orchestrator

Features

  • Collapse envd's heap into 2 MiB hugepages before pause to reduce cold-resume page faults by @kalyazin in #2997
  • Use memfd and background copy by default by @bchalios in #3011
  • Introduce filesystem-only snapshots by @bchalios in #2995
  • Split hugepage collapse statistics into real migrations vs. already-huge pages by @kalyazin in #3021
  • Speed up guest cold boot by @bchalios in #3020
  • Use FIFREEZE before creating filesystem snapshots by @bchalios in #3019

Improvements

  • Improve diagnostics for node placement failures by @djeebus in #3031
  • Consolidate I/O reader wrappers by @levb in #2570

Bug Fixes

  • Resolve remaining P2P, compression, and V5 issues by @levb in #3015
  • Tolerate missing headers for legacy templates by @levb in #3026
  • Fix main build by @levb in #3029
  • Start envd.service after local-fs.target by @levb in #3043

Template Builder

Improvements

Bug Fixes

  • Verify that CAs added during build are included in the boot certificate archive by @bchalios in #3025

Full Changelog:
2026.24...2026.25

Loading

2026.24

2026.24

Choose a tag to compare

View all tags
@dobrac dobrac released this 15 Jun 21:44
2026.24
bf52a4b
This commit was created on GitHub.com and signed with GitHub’s verified signature.
GPG key ID: B5690EEEBB952194
Verified
Learn about vigilant mode.

Deprecation Notice: Legacy Verifier

Warning

The Legacy Verifier component (backed by the Supabase Legacy JWT secret) is deprecated and scheduled for removal. If you currently rely on legacy HS256 authentication, plan your migration to OIDC-backed auth now to avoid disruption.

What's Changing

The Legacy Verifier authenticates requests using HS256 (HMAC with SHA-256), where JWT signatures are produced from a single shared secret. Because every party that can verify a token must also hold the secret capable of minting one, this model is difficult to scale securely and increases the blast radius if the secret is ever leaked.

To improve security across the product, we are moving away from Legacy HS256 toward OIDC-backed authentication, which uses asymmetric signing and standardized identity flows.

Why

  • Shared-secret risk — HS256 relies on a shared secret for both signing and verification, so a single leak compromises both issuing and verifying tokens.
  • Stronger, standards-based security — OIDC uses asymmetric keys and well-established discovery/rotation mechanisms, reducing the risk of secret sprawl.
  • A clearer long-term path — Consolidating on OIDC lets us invest in a single, well-supported auth surface for all users.

Recommended Path Forward

Many current auth features are not part of the OIDC spec. While we are actively investigating raw OIDC support, we recommend the following at this time:

  • JWTs issued by Ory Hydra — an OAuth 2.0 and OpenID Connect provider for issuing tokens.
  • User identities maintained by Ory Kratos — an identity and user management system.

We believe this open-source auth toolkit provides the best path forward for supporting better authentication for all users, bridging the gap between legacy features and a fully OIDC-based future.

What’s Changed

API

Features

  • Add SOCKS5 egress proxy on sandbox network config (BYOP) by @arkamar in #2642

Improvements

  • Make volume signing config an optional dependency by @sitole in #2956

Bug Fixes

  • Support snapshots for non-default clusters by @sitole in #2947

Dashboard API

Features

Improvements

  • Resolve billing creator context via profile providers and deprecate dual user profile provider by @ben-fornefeld in #2967

Bug Fixes

Authentication & Identity

Features

Improvements

  • Return only client message from auth middleware by @sitole in #2946

Orchestrator

Features

Performance

Bug Fixes

Storage & Build Artifacts

Features

Improvements

Bug Fixes

  • Use 512-byte units for stat.Blocks in FileSize by @levb in #2949
  • Fix upload header synchronization for P2P compression by @levb in #2919
  • Adapt inspect-build validate to new Chunker upstream API by @ValentaTomas in #2989

Sandbox Runtime (envd)

Features

Improvements

Bug Fixes

Infrastructure & IaC

Features

ClickHouse & Events

Features

  • Implement multi-cluster fan-out for events and stats by @rguliyev in #2925

Full Changelog:
2026.23...2026.24

Contributors

levb, dobrac, and 12 other contributors
Loading

2026.23

2026.23

Choose a tag to compare

View all tags
@jakubno jakubno released this 22 Jun 09:32
2026.23
dfc8a20
This commit was created on GitHub.com and signed with GitHub’s verified signature.
GPG key ID: B5690EEEBB952194
Verified
Learn about vigilant mode.

What’s Changed

API

Improvements

Bug Fixes

Dashboard API

Features

Improvements

Database

Improvements

Orchestrator

Features

Performance

Improvements

Bug Fixes

Storage & Build Artifacts

Features

Performance

Bug Fixes

Infrastructure & IaC

Features

  • Add argocd-apps GCS bucket by @tvi in #2888
  • Enable Nomad memory oversubscription by @sitole in #2917
  • Support extra API instance groups on Nomad LB backend by @tvi in #2909

Performance

Improvements

Dependencies

Bug Fixes

  • Revert removal of no_cgroups flag deprecated in Nomad 1.8+ by @sitole in #2887
  • Migrate moved Terraform resources by @dobrac in #2891

Full Changelog:
2026.22...2026.23

Contributors

djeebus, tvi, and 10 other contributors
Loading

2026.22

2026.22

Choose a tag to compare

View all tags
@jakubno jakubno released this 29 May 05:26
2026.22
56ac610
This commit was created on GitHub.com and signed with GitHub’s verified signature.
GPG key ID: B5690EEEBB952194
Verified
Learn about vigilant mode.

What’s Changed

API

Performance

  • Wake reservation waiters through Redis pub/sub instead of 20ms polling by @jakubno in #2729

Improvements

  • Add kill_reason to sandbox.lifecycle.killed observability events by @rguliyev in #2833
  • Enforce blocked teams through allowlist-based flow by @drankou in #2757

Dashboard API

Improvements

Authentication & Identity

Improvements

  • Allow HTTP OIDC issuers on loopback hosts by @tvi in #2812

Orchestrator

Performance

Improvements

Bug Fixes

  • Remove unnecessary empty Content-Type header from envd PostInit handler by @AdaAibaby in #2800
  • Resolve UFFD prefault/close race condition by @kalyazin in #2830

Sandbox Runtime

Features

  • Freeze user cgroups across pause/resume to keep envd /init responsive by @ValentaTomas in #2688

New Contributors

Full Changelog:
2026.21...2026.22

Loading

2026.21

2026.21

Choose a tag to compare

View all tags
@jakubno jakubno released this 21 May 16:03
2026.21
fe7bd8d
This commit was created on GitHub.com and signed with GitHub’s verified signature.
GPG key ID: B5690EEEBB952194
Verified
Learn about vigilant mode.

What’s Changed

API

Features

  • Add template manager status logging by @tvi in #2647
  • Distinguish joined vs regular requests in metrics by @jakubno in #2699

Improvements

  • Replace per-release goroutines with shared publish worker by @jakubno in #2668
  • Add configurable max concurrent evictions via feature flag by @jakubno in #2727
  • Enforce one default team per user via unique partial index by @jakubno in #2621

Bug Fixes

  • Keep API alive until in-flight requests complete by @jakubno in #2708

Auth

Features

  • Add OIDC auth provider support for API and Dashboard API by @tvi in #2673
  • Allow unconfigured AUTH_PROVIDER_CONFIG by @tvi in #2716

Improvements

Orchestrator

Features

Improvements

Bug Fixes

Template Manager

Improvements

  • Add less, nftables, iputils-ping, and jq to base provisioning by @arkamar in #2736

Bug Fixes

Sandbox Runtime (envd)

Improvements

Bug Fixes

Infrastructure & IaC

Features

  • Support custom VPC and subnet configuration for cluster image builds by @sitole in #2633
  • Support new Traefik internal entrypoint by @djeebus in #2714

Improvements

Tooling & Developer Experience

Dependencies

New Contributors

Full Changelog:
2026.20...2026.21

Loading

2026.20

2026.20

Choose a tag to compare

View all tags
@jakubno jakubno released this 14 May 15:38
2026.20
8cf1795
This commit was created on GitHub.com and signed with GitHub’s verified signature.
GPG key ID: B5690EEEBB952194
Verified
Learn about vigilant mode.

What’s Changed

API

Features

  • Add singleflight per sandbox with concurrency cap and in-flight gauge by @jakubno in #2625
  • Add Kubernetes service discovery for orchestrator and temp services by @tvi in #2602

Improvements

  • Add admin endpoint cluster ID filter for node listing by @sitole in #2641
  • Introduce pluggable service-discovery interface by @tvi in #2601
  • Clean up stale Redis indexes while on memory backend by @jakubno in #2619 + #2640
  • Log terminal template build failures by @tvi in #2646

Bug Fixes

  • Re-register api-grpc Consul service as alias of api-internal-grpc by @jakubno in #2631
  • Reduce Redis lock polling by @dobrac in #2594
  • Downgrade team-limit build errors to warnings and dedupe logs by @jakubno in #2635
  • Use uncancelable context for sandbox removal completion by @jakubno in #2655

Orchestrator

Features

Improvements

  • Add per-snapshot dirty/empty/total byte metrics at creation time by @ValentaTomas in #2649
  • Make startingSandboxes limit configurable via feature flag by @jakubno in #2622
  • Implement zapcore.Core directly in buildlogger by @tvi in #2614

Bug Fixes

  • Resolve base path per-call from live FrameTable in peerclient by @levb in #2585
  • Fix recovery bug in pkg/nfsproxy/recovery by @tvi in #2606
  • Increase storage gRPC connections to 8 for compression workloads by @levb in #2644
  • Use exponential buckets for snapshot byte histograms by @ValentaTomas in #2651

Sandbox Runtime (envd)

Bug Fixes

  • Wait for stream sender goroutine to prevent nil-pointer panic on disconnect by @arkamar in #2596
  • Fix fan-out data race when subscriber disconnects mid-iteration by @arkamar in #2643
  • Discard output when no subscriber is connected by @arkamar in #2639
  • Make envd build and tests pass on macOS by @tvi in #2605

Infrastructure

Features

  • Enable teeing OTEL collector metrics to OTEL router via feature flag by @wj-e2b in #2600

Full Changelog:
2026.19...2026.20

Loading