Skip to content

Releases: e2b-dev/runtime

Release list

2026.30

2026.30 Latest
Latest

Choose a tag to compare

View all tags
@jakubno jakubno released this 10 Sep 09:26
2026.30
f32ee8a

What's Changed

API

Compatibility Notes

  • Remove deprecated E2B access-token authentication, its management endpoints, and the access_tokens table. Clients must use API keys or supported JWT authentication — by @tvi in 4580311, 110fa5b
  • Remove database read-replica support — by @jakubno in 23ada3e

Features

  • Add sandbox-list sorting by start time, a startedAfter filter, and filtering by template ID or alias — by @drankou in e6de33c
  • Add sandbox workload identity configuration through iam.tokens, with token definitions preserved across pause, resume, and fork. Admission is feature-gated — by @gm-e2b in 13ddb3d
  • Add feature-gated /secrets create, list, get, update, and delete operations backed by a configured secrets-store service. Responses return metadata, not secret values — by @gm-e2b in d42174c, 3b56826
  • Add dynamic log routing with primary and shadow destinations, plus ClickHouse-backed sandbox and build log reads. Support LOGS_READ_CONFIG as a fallback for deployments without LaunchDarkly and make LOKI_URL optional — by @rguliyev and @svalleru in 1b19a3b, 8006b78
  • Add explicit filesystem-only resume through memory: false on resume/connect, behind fs-only-resume-api. This cold-boots from disk without deleting the stored memory snapshot; disk recovery has crash-recovery semantics — by @bchalios in 8614ec4, 8a3f69d
  • Add optional CPU-model restrictions for filesystem-only snapshots and orchestrator-release filtering for sandbox placement — by @jakubno in 744a2b0, 631be3d
  • Add cluster registration, stable registration IDs, project assignment lookup, replay-safe assignment/detachment, and authenticated cluster management operations — by @matthewlouisbrockman in 65d37cd, 54693ff, 7378b89, b0a9d73
  • Add guarded cluster cleanup and teardown-readiness checks. Release soft-deleted references during cluster deletion while preserving template/build history — by @matthewlouisbrockman in 7c417f4, a8bd47a
  • Add administrative passthrough for remote-cluster node-pool management — by @sitole in 8fda5b9
  • Expose team running-sandbox counts and outstanding node work through administrative APIs — by @dobrac and @jakubno in fcc2edb, 6cd3e5f

Improvements

  • Add machine-readable error_code values and differentiated HTTP statuses for placement failures, surface detailed failure reasons, and include template/build IDs in create errors — by @tomassrnka and @e2b-harness[bot] in c426430, 063aa20, 1bbdd06
  • Share batched sandbox-store scanning and bound store/reconciliation Redis MGET commands to 256 keys — by @jakubno and @wj-e2b in 2d3e4f9, 5e0480d, a23fe66
  • Add user-agent and SDK integration attribution, flat team_id properties, and egress-proxy usage to product analytics — by @mishushakov, @beran-t, and @arkamar in d83be18, 97ea2bd, 1fe4959
  • Support explicit analytics-collector ports and configurable TLS — by @tvi in 6d41cb5
  • Unify service discovery behind shared backend interfaces and support combined orchestrator discovery across schedulers — by @dobrac in 455db4a, 8a1c824, 9cb80f4
  • Track node reachability independently of node status and narrow running-sandbox synchronization payloads — by @jakubno in 315e1bf, cbcb146

Bug Fixes

  • Reject non-positive timeouts on sandbox create, resume, and fork — by @chill-czar in 5a4b631
  • Expose pagination, sandbox-count, and rate-limit response headers through CORS — by @mishushakov in e832b1e
  • Discover local orchestrators as template builders when they provide the template-manager service — by @tvi in 9ea005a
  • Finish snapshot builds and record terminal template-build status after client disconnects; mark snapshot builds failed when pause is rejected — by @arkamar and @jakubno in 0159f8c, 8586a66, 42f6997
  • Pin sandbox removal to the intended execution and make routing-catalog deletion an atomic compare-and-delete — by @jakubno and @tomassrnka in c29ee26, 2a0c0af
  • Stop retrying pause on already-killing sandboxes and stagger Redis lock-release retries — by @dobrac and @wj-e2b in eef64c7, c7241e3
  • Rebuild template aliases on the team's current cluster — by @matthewlouisbrockman in b74dbb6
  • Deregister nodes whose gRPC connections have shut down — by @jakubno in a3200fe
  • Retain ineligible Nomad nodes during node-pool downscaling — by @wj-e2b in 4f8269a

Dashboard and Project Management

Features

Read more
Assets 2
Loading

2026.29

2026.29

Choose a tag to compare

View all tags
@jakubno jakubno released this 28 Jul 13:17
2026.29
557445f
This commit was created on GitHub.com and signed with GitHub’s verified signature.
GPG key ID: B5690EEEBB952194
Verified
Learn about vigilant mode.

What’s Changed

API

Features

Improvements

Dashboard

Features

Improvements

Orchestrator

Features

  • Ensure requested free disk space before finalizing template builds by @gm-e2b in #3249
  • Add NetworkAssignHook for sandbox lifecycle extensions by @rguliyev in #3290
  • Add per-role storage URLs and an environment-independent storage library by @dobrac in #3246

Improvements

  • Serialize sandbox updates by @jakubno in #3250
  • Trace slow disk resize operations during template builds by @gm-e2b in #3298

Bug Fixes

Sandbox Runtime (envd)

Bug Fixes

  • Avoid Start deadlock after request cancellation by @arkamar in #3256
  • Never report failed envd command streams as successful by @arkamar in #3281

Improvements

  • Make MultiplexedChannel.Fork return a receive-only channel by @arkamar in #3257

Full Changelog:
2026.28...2026.29

Loading

2026.28

2026.28

Choose a tag to compare

View all tags
@jakubno jakubno released this 09 Jul 15:18
2026.28
fda7bef
This commit was created on GitHub.com and signed with GitHub’s verified signature.
GPG key ID: B5690EEEBB952194
Verified
Learn about vigilant mode.

What's Changed

API

Features

  • Add per-team sandbox events TTL limits based on tier and addons by @jakubno in #3181
  • Discover orchestrators via Nomad services by @wj-e2b in #3176

Improvements

Bug Fixes

  • Handle corrupted sandbox stop times by @jakubno in #3203
  • Prevent uint64 underflow in node allocated metrics by @jakubno in #3216
  • Heal sandboxes missing from the eviction index by @jakubno in #3199

Orchestrator

Features

  • Add support for compressed uploads to AWS storage by @dobrac in #3113

Improvements

  • Add -force-reboot to resume-build for cold-booting memory snapshot builds by @arkamar in #3208
  • Introduce a shared compressed upload framework and storage limiter by @dobrac in #3232

Bug Fixes

  • Unpack OCI layers in a chroot, matching Docker daemon behavior by @jakubno in #3215
  • Fix compressed upload and cache correctness issues by @dobrac in #3231

Storage

Improvements

Bug Fixes

Testing

  • Add server-backed GCS storage tests using Testcontainers by @dobrac in #3233

Sandbox runtime (envd)

Improvements

  • Use constant-time comparison for signature validation by @AdaAibaby in #3145

Bug Fixes

  • Use WithoutCancel for the CA cleanup goroutine context by @arkamar in #3207
  • Stop misleading CA installation cancellation errors during rapid /init calls by @arkamar in #3206

Full Changelog:
2026.27...2026.28

Loading

2026.27

2026.27

Choose a tag to compare

View all tags
@jakubno jakubno released this 09 Jul 15:14
2026.27
3fa2aeb
This commit was created on GitHub.com and signed with GitHub’s verified signature.
GPG key ID: B5690EEEBB952194
Verified
Learn about vigilant mode.

What's Changed

API

Features

Improvements

  • Deprecate access token authentication in the OpenAPI specification by @huv1k in #3084

Bug Fixes

  • Use the correct error variable in processCustomErrors by @AdaAibaby in #3135
  • Prevent WrapContextAsUserError from misclassifying internal timeouts as user cancellations by @AdaAibaby in #3155

Dashboard

Features

  • Add a LaunchDarkly-gated ClickHouse read switcher by @rguliyev in #3111
  • Flag sandboxes that are past data retention by @huv1k in #3102

Bug Fixes

  • Set Ory external_id only after the bootstrap commit by @drankou in #3133

Orchestrator

Features

Improvements

  • Share sandbox artifact names across components by @wj-e2b in #3117
  • Introduce StartType for sandbox start types by @arkamar in #3124
  • Add additional storage logging by @jakubno in #3126
  • Add OpenTelemetry instrumentation to the AWS S3 storage client by @dobrac in #3172

Bug Fixes

  • Sanitize OCI pull errors by @dobrac in #3096
  • Log missing egress proxy during startup reclaim instead of silently defaulting by @wj-e2b in #3116
  • Scope rootfs hashes to the provision default by @dobrac in #3129
  • Start envd.service after systemd-tmpfiles-setup by @dobrac in #3130
  • Deschedule a flaky eviction-loop race in tests by @wj-e2b in #3173
  • Allow the build-cache threshold flag to exceed its fallback value by @wj-e2b in #3175
  • Fix chunk readiness in P2P → compressed transitions by @levb in #3185
  • Revert the legacy-ancestor pending diff header change by @levb in #3141
  • Fix upload metadata path races by @dobrac in #3115
  • Fix runaway blob file_type metric attribute values by @levb in #3150

NFS cleanup

Improvements

  • Rewrite clean-nfs-cache to reduce memory usage and improve statistics by @levb in #3118

Bug Fixes

  • Exclude zombie entries from clean-nfs-cache delete age calculations by @levb in #3191

New Contributors

Full Changelog:
2026.26...2026.27

Loading

2026.26

2026.26

Choose a tag to compare

View all tags
@jakubno jakubno released this 09 Jul 15:06
2026.26
4d47148
This commit was created on GitHub.com and signed with GitHub’s verified signature.
GPG key ID: B5690EEEBB952194
Verified
Learn about vigilant mode.

What's Changed

API

Features

  • Add paginated GET /v2/templates endpoint by @huv1k in #3059

Improvements

  • Pin resume retries to the node where a previous resume timed out by @jakubno in #3066

Bug Fixes

  • Parse pause request bodies regardless of Content-Length by @bchalios in #3056

Orchestrator

Features

  • Enforce soft-delete consumers for the storage index by @ValentaTomas in #3034
  • Track and report the last sandbox status change timestamp by @jakubno in #2980
  • Add opt-in DSCP marking for sandbox egress (SANDBOX_EGRESS_DSCP) by @tomassrnka in #3039
  • Enable graceful sandbox drain on shutdown by @wj-e2b in #3069
  • Enable graceful template-build drain on shutdown by @wj-e2b in #3079
  • Improve read-path telemetry by @levb in #3063
  • Harvest resume-prefetch traces during pause by @kalyazin in #3067
  • Add resume-build -gdb support for guest kernel debugging by @kalyazin in #3040
  • Add DISABLE_STARTUP_RECLAIM configuration flag by @wj-e2b in #3081
  • Detect and clean up leaked sandbox cgroups by @wj-e2b in #3086
  • Inspect and disconnect connected NBD devices by @wj-e2b in #3087

Improvements

  • Always include execution metrics in sandbox webhook events by @AdaAibaby in #2852
  • Wire filesystem-only snapshots into the control plane by @bchalios in #3027
  • Enable filesystem-only snapshots for auto-pause by @bchalios in #3055
  • Make build-reserved-disk-space-mb default to 256 MB by @arkamar in #3065
  • Move envd timeout configuration behind a feature flag by @jakubno in #3068
  • Fold soft-delete dataPath into the source model by @levb in #3046
  • Stamp provenance metadata on uploaded objects, including headers by @ValentaTomas in #3033

Bug Fixes

  • Require envd 0.6.3 for cgroup freeze support by @arkamar in #3050
  • Prevent NBD read-loop stalls on WRITE_ZEROES (behind a feature flag) by @kalyazin in #3048
  • Seed legacy-ancestor in pending diff headers by @levb in #3075

Client Proxy

Improvements

Dashboard

Features

Full Changelog:
2026.25...2026.26

Loading

2026.25

2026.25

Choose a tag to compare

View all tags
@jakubno jakubno released this 09 Jul 14:25
2026.25
ea2663e
This commit was created on GitHub.com and signed with GitHub’s verified signature.
GPG key ID: B5690EEEBB952194
Verified
Learn about vigilant mode.

What's Changed

API

Bug Fixes

  • Try to place workloads on nodes that support the requested volume type by @djeebus in #3013

Orchestrator

Features

  • Collapse envd's heap into 2 MiB hugepages before pause to reduce cold-resume page faults by @kalyazin in #2997
  • Use memfd and background copy by default by @bchalios in #3011
  • Introduce filesystem-only snapshots by @bchalios in #2995
  • Split hugepage collapse statistics into real migrations vs. already-huge pages by @kalyazin in #3021
  • Speed up guest cold boot by @bchalios in #3020
  • Use FIFREEZE before creating filesystem snapshots by @bchalios in #3019

Improvements

  • Improve diagnostics for node placement failures by @djeebus in #3031
  • Consolidate I/O reader wrappers by @levb in #2570

Bug Fixes

  • Resolve remaining P2P, compression, and V5 issues by @levb in #3015
  • Tolerate missing headers for legacy templates by @levb in #3026
  • Fix main build by @levb in #3029
  • Start envd.service after local-fs.target by @levb in #3043

Template Builder

Improvements

Bug Fixes

  • Verify that CAs added during build are included in the boot certificate archive by @bchalios in #3025

Full Changelog:
2026.24...2026.25

Loading

2026.24

2026.24

Choose a tag to compare

View all tags
@dobrac dobrac released this 15 Jun 21:44
2026.24
bf52a4b
This commit was created on GitHub.com and signed with GitHub’s verified signature.
GPG key ID: B5690EEEBB952194
Verified
Learn about vigilant mode.

Deprecation Notice: Legacy Verifier

Warning

The Legacy Verifier component (backed by the Supabase Legacy JWT secret) is deprecated and scheduled for removal. If you currently rely on legacy HS256 authentication, plan your migration to OIDC-backed auth now to avoid disruption.

What's Changing

The Legacy Verifier authenticates requests using HS256 (HMAC with SHA-256), where JWT signatures are produced from a single shared secret. Because every party that can verify a token must also hold the secret capable of minting one, this model is difficult to scale securely and increases the blast radius if the secret is ever leaked.

To improve security across the product, we are moving away from Legacy HS256 toward OIDC-backed authentication, which uses asymmetric signing and standardized identity flows.

Why

  • Shared-secret risk — HS256 relies on a shared secret for both signing and verification, so a single leak compromises both issuing and verifying tokens.
  • Stronger, standards-based security — OIDC uses asymmetric keys and well-established discovery/rotation mechanisms, reducing the risk of secret sprawl.
  • A clearer long-term path — Consolidating on OIDC lets us invest in a single, well-supported auth surface for all users.

Recommended Path Forward

Many current auth features are not part of the OIDC spec. While we are actively investigating raw OIDC support, we recommend the following at this time:

  • JWTs issued by Ory Hydra — an OAuth 2.0 and OpenID Connect provider for issuing tokens.
  • User identities maintained by Ory Kratos — an identity and user management system.

We believe this open-source auth toolkit provides the best path forward for supporting better authentication for all users, bridging the gap between legacy features and a fully OIDC-based future.

What’s Changed

API

Features

  • Add SOCKS5 egress proxy on sandbox network config (BYOP) by @arkamar in #2642

Improvements

  • Make volume signing config an optional dependency by @sitole in #2956

Bug Fixes

  • Support snapshots for non-default clusters by @sitole in #2947

Dashboard API

Features

Improvements

  • Resolve billing creator context via profile providers and deprecate dual user profile provider by @ben-fornefeld in #2967

Bug Fixes

Authentication & Identity

Features

Improvements

  • Return only client message from auth middleware by @sitole in #2946

Orchestrator

Features

Performance

Bug Fixes

Storage & Build Artifacts

Features

Improvements

Bug Fixes

  • Use 512-byte units for stat.Blocks in FileSize by @levb in #2949
  • Fix upload header synchronization for P2P compression by @levb in #2919
  • Adapt inspect-build validate to new Chunker upstream API by @ValentaTomas in #2989

Sandbox Runtime (envd)

Features

Improvements

Bug Fixes

Infrastructure & IaC

Features

ClickHouse & Events

Features

  • Implement multi-cluster fan-out for events and stats by @rguliyev in #2925

Full Changelog:
2026.23...2026.24

Contributors

levb, dobrac, and 12 other contributors
Loading

2026.23

2026.23

Choose a tag to compare

View all tags
@jakubno jakubno released this 22 Jun 09:32
2026.23
dfc8a20
This commit was created on GitHub.com and signed with GitHub’s verified signature.
GPG key ID: B5690EEEBB952194
Verified
Learn about vigilant mode.

What’s Changed

API

Improvements

Bug Fixes

Dashboard API

Features

Improvements

Database

Improvements

Orchestrator

Features

Performance

Improvements

Bug Fixes

Storage & Build Artifacts

Features

Performance

Bug Fixes

Infrastructure & IaC

Features

  • Add argocd-apps GCS bucket by @tvi in #2888
  • Enable Nomad memory oversubscription by @sitole in #2917
  • Support extra API instance groups on Nomad LB backend by @tvi in #2909

Performance

Improvements

Dependencies

Bug Fixes

  • Revert removal of no_cgroups flag deprecated in Nomad 1.8+ by @sitole in #2887
  • Migrate moved Terraform resources by @dobrac in #2891

Full Changelog:
2026.22...2026.23

Contributors

djeebus, tvi, and 10 other contributors
Loading

2026.22

2026.22

Choose a tag to compare

View all tags
@jakubno jakubno released this 29 May 05:26
2026.22
56ac610
This commit was created on GitHub.com and signed with GitHub’s verified signature.
GPG key ID: B5690EEEBB952194
Verified
Learn about vigilant mode.

What’s Changed

API

Performance

  • Wake reservation waiters through Redis pub/sub instead of 20ms polling by @jakubno in #2729

Improvements

  • Add kill_reason to sandbox.lifecycle.killed observability events by @rguliyev in #2833
  • Enforce blocked teams through allowlist-based flow by @drankou in #2757

Dashboard API

Improvements

Authentication & Identity

Improvements

  • Allow HTTP OIDC issuers on loopback hosts by @tvi in #2812

Orchestrator

Performance

Improvements

Bug Fixes

  • Remove unnecessary empty Content-Type header from envd PostInit handler by @AdaAibaby in #2800
  • Resolve UFFD prefault/close race condition by @kalyazin in #2830

Sandbox Runtime

Features

  • Freeze user cgroups across pause/resume to keep envd /init responsive by @ValentaTomas in #2688

New Contributors

Full Changelog:
2026.21...2026.22

Loading

2026.21

2026.21

Choose a tag to compare

View all tags
@jakubno jakubno released this 21 May 16:03
2026.21
fe7bd8d
This commit was created on GitHub.com and signed with GitHub’s verified signature.
GPG key ID: B5690EEEBB952194
Verified
Learn about vigilant mode.

What’s Changed

API

Features

  • Add template manager status logging by @tvi in #2647
  • Distinguish joined vs regular requests in metrics by @jakubno in #2699

Improvements

  • Replace per-release goroutines with shared publish worker by @jakubno in #2668
  • Add configurable max concurrent evictions via feature flag by @jakubno in #2727
  • Enforce one default team per user via unique partial index by @jakubno in #2621

Bug Fixes

  • Keep API alive until in-flight requests complete by @jakubno in #2708

Auth

Features

  • Add OIDC auth provider support for API and Dashboard API by @tvi in #2673
  • Allow unconfigured AUTH_PROVIDER_CONFIG by @tvi in #2716

Improvements

Orchestrator

Features

Improvements

Bug Fixes

Template Manager

Improvements

  • Add less, nftables, iputils-ping, and jq to base provisioning by @arkamar in #2736

Bug Fixes

Sandbox Runtime (envd)

Improvements

Bug Fixes

Infrastructure & IaC

Features

  • Support custom VPC and subnet configuration for cluster image builds by @sitole in #2633
  • Support new Traefik internal entrypoint by @djeebus in #2714

Improvements

Tooling & Developer Experience

Dependencies

New Contributors

Full Changelog:
2026.20...2026.21

Loading