components/execd 1.1.0

What's New

✨ Features

• execd as sandbox init (OSEP-0018). execd can now run as PID 1: single reaper with a managedProcess abstraction on every launch path, signal forwarding (TERM/HUP/USR1/USR2/WINCH), entrypoint-owned exit-code propagation, and a subreaper fallback for the Pool path. Opt-in via EXECD_INIT=1 (injected by the server's runtime.execd_run_as_init for Docker/K8s Batch/Agent/Pool); classic topology unchanged and default off. (#1474)

• Pre-exec hardening floor. The new opensandbox-launcher native helper applies env strip → KEEPCAPS → bounding-set trim → no_new_privs → identity drop → seccomp → execve; [landlock] adds a filesystem allowlist (fail-open below ABI/kernel 5.13, reported as unsupported). GET /v1/isolated/capabilities gains a hardening object with per-layer state; every layer degrades fail-open. (#1474)

• eBPF observation variant. execd-ebpf (CGO + cilium/ebpf) hooks exec/connect/privilege with CO-RE, scoped to the sandbox cgroup, emitting a rotating JSONL audit; needs kernel ≥5.10 with BTF. The default image is unchanged. (#1474 #1562)

• preStart and periodic lifecycle hooks (OSEP-0020). CreateSandboxRequest.lifecycle is transported to the sandbox via the internal OPEN_SANDBOX_LIFECYCLE env (Kubernetes; the Docker provider rejects lifecycle requests). execd starts HTTP before preStart, runs non-overlapping periodic hooks through the reaper-aware managed-process path, and only releases the user process after preStart succeeds. Config persists at $HOME/.execd/lifecycle.toml, with EXECD_LIFECYCLE_CONFIG as exact override; bootstrap sync and preStart shutdown are fail-closed with TERM/KILL watchdogs, and internal transport vars are stripped from user code. API models aligned across Go/Python/JS/Kotlin/C# SDKs. (#1587 #1588 #1589)

🐛 Bug Fixes

• In-namespace signals no longer leak into /command in init mode. kill -HUP 1 previously killed whatever /command was running (signal: hangup); signals are now owned by the init forwarder only. (#1546)

• PTY creation failure emitted a second success body. POST /pty now stops immediately after the error response instead of appending a success body and a nonexistent session id. (#1603)

• cwd validation now honors request-scoped envs. Foreground/background /command requests can use a cwd variable from their own envs map instead of being rejected with 400. (#1611)

• Non-root workloads could not start: /bootstrap.sh normalized to 0755. A deployed image carried bootstrap.sh as 0751 root:root, sending images with a non-root default user (e.g. admin) into CrashLoopBackOff before hooks ran. The image build now forces exec bits on execd/execd-ebpf/opensandbox-supervisor/bootstrap.sh regardless of checkout permissions. (#1619 #1606)

• preStart timeout raised from 300s to 10800s (3h). periodic.timeoutSeconds stays at 300s; product policy bounds are now enforced Server-side only, with execd keeping just a technical overflow guard. (#1637)

📦 Misc

• OSEP-0018 coverage closed out: server-path and Kubernetes hardening e2e (ConfigMap-carried isolation TOML, no server logic change), PTY-under-hardening, bwrap + init-reaper integration, custom [seccomp]/keep_capabilities policy, EXECD_INIT↔TOML drift pin, K8s Restart recycle against init-mode pods, runtime-initiated stop, and an execd-ebpf bare-container smoke (doubles as kernel-5.10 validation). Test redundancy and dead code trimmed (-359 lines). (#1554 #1555 #1562 #1574)

• OTLP endpoint auto-allow shipped in the shared components (egress honors OTEL_EXPORTER_OTLP_METRICS_ENDPOINT/OTEL_EXPORTER_OTLP_ENDPOINT; PTY viewer read loop refactored along the way). (#1504)

• Lifecycle hook guide with timing diagram and per-SDK creation examples; SDK client-side timeout validation aligned with the Server. (#1605)

👥 Contributors

Thanks to these contributors ❤️

• @Gujiassh
• @jianpingpei
• @Pangjiping

---

• Docker Hub: opensandbox/execd:v1.1.0
• Aliyun Registry: sandbox-registry.cn-zhangjiakou.cr.aliyuncs.com/opensandbox/execd:v1.1.0
• GHCR: ghcr.io/opensandbox-group/opensandbox/execd:v1.1.0