v0.7.10

October 23, 2026 · GitHub release · All changes

New features

Pull public images despite stale credentials in Go. A stale docker login on the host could make every pull from that registry fail, even for public images. WithRegistryAnonymous() skips stored credentials for that pull. Rust and TypeScript already supported anonymous pulls. Go sandbox reference

sb, err := m.CreateSandbox(ctx, "app",
    m.WithImage("ghcr.io/org/public-image:latest"),
    m.WithRegistryAnonymous(),
)

Fixes

Secret policies from Node and Go modify(). SecretModifySpec now accepts substitution, violation action, TLS identity, and placeholder-host settings, matching Python. Previously, Node silently dropped these fields, so a secret added through modify() was substituted in every header. Policy edits on a running sandbox need a restart or next start. Rotate secrets
Disk-root sandboxes no longer leave a temporary bootstrap directory on the host after each run.
Custom filesystem backends supplied through the Rust runtime configuration are now registered with the VM.
Updated dependencies behind security alerts and removed secret values from example output.