Skip to main content
Released this week: v0.6.18

​
New features

Strict hostname policy mode Network policies can now fail closed when a hostname allow rule fires but microsandbox cannot inspect the request authority. In strict mode, hostname-based allows still work for plaintext HTTP and TLS-intercepted HTTPS. Non-intercepted HTTPS is denied when only a hostname rule would have allowed it. IP, CIDR, group, and default allows are unaffected. Strict mode is opt-in and enforced before the outbound TCP connection is dialed.
See Hostname rules and HTTPS and --net-strict. Other features
  • Forward-compatible cloud requests. The cloud API now ignores unknown fields in network and runtime settings from newer SDKs while preserving defaults, required-field checks, and validation of recognized values. SDKs and the cloud service can ship on independent release cadences without breaking existing clients.

​
Bug fixes

  • HTTP host policy checks now match the hostname that the policy allowed, closing a gap where a mismatched Host header could bypass a hostname-based allow rule.
  • /dev/stdin, /dev/stdout, and /dev/stderr are now created during guest initialization alongside /dev/fd. Commands such as printf 'echo hello\n' | bash /dev/stdin work inside sandboxes, and existing entries are preserved when initialization runs again.