2026.09.11 Release v0.7.1

CubeSandbox 0.7.1 introduces 1 major feature along with multiple enhancements and bug fixes. 70 commits from 24 contributors.

🎯 Major Features

End-to-end high availability for Cube control-plane services

• A standalone template-center service enables multi-replica CubeMaster deployment.
• The lifecycle management service now supports active/standby deployment.

✨ Enhancements

Templates & Storage

• Snapshot support for Host Mount and Volume Plugin: snapshot, restore, rollback, and clone now work for sandboxes with external mounts (#1654, #1656).
• Standalone CubeTemplateCenter: template build / delete / reclaim is split out of CubeMaster into an independently scalable multi-replica service. Build artifacts are persisted to S3/MinIO (AWS S3 compatible). Also fixes long-standing issues around concurrent build races, inconsistent artifact table names, and ephemeral local-disk storage (#1659).
• Faster same-bucket cross-node snapshot restore (#1663): restoring a snapshot from the same bucket now uses object-storage server-side copy, which is significantly faster. Also improves delayed-delete reclamation and adds snapshot cancellation.

Lifecycle & Control Plane

• CLM now supports active/standby disaster recovery.
• Running sandboxes no longer block snapshot deletion (#1620): deleting a still-referenced snapshot takes effect immediately; underlying storage is reclaimed after the last reference is released.

Security

• virtiofsd hardening (#1612): after a directory whitelist is set, root-directory mutation operations are rejected, as are forged readdirplus requests.

Deployment & Runtime

• CubeS3lvol on Kubernetes (#1637): use the S3 backend for cross-node pause/resume and snapshots in K8s deployments.
• One-click deployment supports external PostgreSQL (#1644): choose MySQL / PostgreSQL via CUBE_DATABASE_DRIVER and connect to a self-managed database instance.
• CubeS3lvol is now opt-in (#1622, #1633): set [cow.s3] enable = true (or ONE_CLICK_ENABLE_S3LVOL=1 for one-click deploy); it is disabled by default. Also fixes the switch not taking effect during one-click upgrades. Upgrade note: nodes that were using S3 without an explicit setting must enable it after upgrade.
• Unified Helm Redis logical-DB config (#1638): new top-level redis.db applies to CubeMaster / CubeProxy / CLM, so multiple clusters sharing one Redis instance can isolate logical databases per cluster.

Web UI / CubeOps / Other

• cubemastercli batch template deletion (#1549): tpl delete accepts multiple template IDs in one call.

🐛 Bug Fixes

Lifecycle & Sandbox

• Fixed sandboxes set to never expire (NEVER_TIMEOUT) being immediately treated as expired (#1401).
• Fixed invalid CPU / memory specs in create requests being treated as 0, allowing sandboxes to bypass node resource filters and be scheduled onto any node (#1463).
• Fixed a new timeout passed on Resume being discarded, so the sandbox kept its pre-pause timeout (#862).
• Fixed snapshots after an S3-backend restore falling back to a full memory dump; snapshots stay incremental (#1688).
• Fixed no log output from cubecli logs for sandboxes created from a template (#1616).
• Fixed template creation hanging indefinitely when a compute node is unresponsive; added a configurable timeout (default 300 seconds) (#994).
• Fixed gRPC connections not being closed promptly after a node is taken offline or deleted (#1585).
• Fixed S3 volume mount failures with newer s3fs (1.97+ / FUSE3) (#1647).

Networking & Security

• Fixed the transparent proxy returning 504 after 60 seconds when talking to slow-TTFB upstreams such as LLMs; proxy send/receive timeout is now 2 hours (#1655).
• Fixed CubeEgress failures caused by oversized credential values injected via network rules; the per-entry injection limit is aligned with E2B at 2048 bytes (#1606).
• Fixed TAP device names silently truncated past the kernel length limit, causing network device lookup failures (#1552).
• Fixed intermittent Cubelet network-plugin init failures on K8s when the gateway ARP cache is not ready early in node startup (#1609).
• Image-registry credentials no longer appear in component logs (#1600).

Deployment & Upgrade

• Fixed Helm upgrades failing because Redis StatefulSet PVC labels changed (#1604).
• Fixed global.imageRegistry overwriting explicitly configured private / third-party registry addresses (#1605).
• Fixed helm test pods remaining Pending on tainted nodes (#1388).
• Fixed Terraform deployments skipping validation and template creation when node queries returned 0 healthy nodes (#1602).
• Fixed CubeOps ignoring the logical-DB number when using a standalone Redis config, which hid node metrics and caused scheduling-metric update timeouts (#1607).
• Fixed lowercase log-level values (e.g. info) not taking effect and falling back to DEBUG (#1597).
• Fixed builder image builds failing on Ubuntu 20.04 (#1588).

Other

• Node / Python SDK: fixed command execution never returning when timeout is 0 or NEVER_TIMEOUT (#1485).
• Fixed cubeopscli reporting a hardcoded 0.1.0 version and the version subcommand being unavailable (#1596).
• Fixed cubemastercli version producing no output by default (#1657).
• Fixed the Web UI runtime config page showing deprecated settings (#1573).