2026.12

What’s Changed

API

Features

• Add rate limiter by @jakubno in #2157
• Dynamic egress network rule updates for running sandboxes by @levb in #2074

Improvements

• Set limits per DB operations by @jakubno in #2134
• Add auth attributes by @jakubno in #2120
• Record client cancellations as 499 in metrics by @dobrac in #2159
• Validate allowed network IPs configuration by @dobrac in #2150

Bug Fixes

• Return 408 instead of 503 on timeout and reorder middleware by @dobrac in #2132
• Fix race conditions in eviction by @jakubno in #2100

---

Orchestrator

Improvements

• Add local filesystem upload endpoint for build cache storage by @arkamar in #2097
• Add ScalingDown status by @jakubno in #2146
• Simplify sandbox map cleanup flow by @jakubno in #2104
• Improve envd init logs by @jakubno in #2154
• Add more sandbox metadata by @jakubno in #2174

Bug Fixes

• Don’t cache failed reads in Chunker by @jakubno in #2143
• Prevent caching truncated data in NFS cache by @dobrac in #2144

---

Sandbox Runtime (envd)

Features

• Add hard memory limits (memory.max) to user and PTY cgroups by @arkamar in #2073
• Support raw body file uploads by @mishushakov in #2067

Bug Fixes

• Handle race condition in EnsureDirs for concurrent uploads by @mishushakov in #2096

---

Volumes

Improvements

• Switch from jailing to chroot/umount/pivotroot by @djeebus in #2091

---

New Contributors

• @chencjcj made their first contribution in #2094

---

Full Changelog:
2026.11...2026.12