--- url: https://cubesandbox.com/changelog/v0.7.2.md --- ## 2026.09.23 Release v0.7.2 CubeSandbox 0.7.2 introduces 3 major features along with multiple enhancements and bug fixes. 56 commits from 29 contributors. ### 🎯 Major Features #### Much faster cross-node restore reads Sandboxes restored cross-node on the S3 backend read disk data from S3 on demand; this release optimizes that read path systematically: * New whole-object local cache: immutable data objects on S3 are kept on the local node, so repeated reads after a restore — and re-importing the same snapshot — hit the local cache instead of going back to S3. * Reduced read amplification during restore: scattered small reads are coalesced into whole-object GETs, and the concurrent fetch budget is capped. * With the default MinIO setup, cross-node restore / create-from-snapshot reaches running in under 1 second. #### New JuiceFS volume plugin New JuiceFS storage plugin: sandboxes can mount a JuiceFS filesystem as a persistent volume, with full POSIX semantics. #### Automatic reclaim of idle guest memory Idle memory inside sandboxes is reclaimed back to the host: node memory usage falls back dynamically with the real usage of the sandboxes, so a single node can host more sandboxes. ### ✨ Enhancements #### Templates & Storage * S3lvol hot upgrade: fixes the EIO errors seen inside sandboxes when upgrading the CubeS3lvol storage component. * Local-filesystem storage for component repositories and template artifacts (#1749): component repositories and template artifacts can be stored on S3 / local disk / PVC / NFS. * Incremental snapshot fix (#1343): fixed data loss in incremental snapshots. * Faster virtiofs on the pause / snapshot path (#1748): optimized the state preparation flow before pause. * Cubelet can configure the template install path, allowing large templates to be moved to the data disk (#1675). * CubeS3lvol object cache: identical objects read during a cross-node restore are served from the local object cache first, and the object cache and dest cache share the same local cache storage (#1756). #### Lifecycle & Control Plane * `sandbox.connect` supports a `timeout` parameter (#1352). #### Deployment & Runtime * cube-node now runs on the host network by default in K8s deployments (#1815): recreating the cube-node Pod no longer destroys the network namespace, so the network of every sandbox on the node stays up. Switching an existing cluster requires draining compute nodes and explicit confirmation (`hostNetworkChangeAck`); fresh installs are unaffected. * Faster sandbox cold start (#1694): disabled the RAID6 PQ startup benchmark in the guest kernel, which is unrelated to workloads. #### Web UI / CubeOps / Other * Removed the legacy E2B SDK reference; Python SDK command execution now goes through the `envd` Connect RPC (#1786). * The Python SDK's `run_code` (E2B-compatible code-interpreter interface) can now read environment variables injected at sandbox creation (#1323), matching the behavior of `commands.run`; the new sandbox-code example image is required. ### 🐛 Bug Fixes #### Lifecycle & Sandbox * Fixed inconsistent memory-snapshot and image-snapshot state when building a template (#1760). * Fixed existing snapshots becoming unusable after a template was deleted (#1763). * Fixed a race where concurrent image builds left tasks stuck in `BUILT` with database connection timeouts (#1802). * Fixed snapshot creation retries being rejected as a changed request body (#1253). * Fixed paused sandboxes not returning a timeout (`end_at=0`) in Info / List queries (#1801). * Fixed an explicit timeout passed to Connect not taking effect for already-running sandboxes; a shorter timeout no longer shortens an existing longer deadline, and the Python SDK now passes the parameter through (#1352). * Fixed PVM detection: the upstream PVM ABI removed the CPUID signature, so detection now relies on the MSR list supported by KVM, compatible with both old and new ABIs (#1781). * Fixed a kernel panic when PVM guests booted on Intel hosts because GMI sm3/sm4 probing was misdetected (#1725). * Fixed resume failing after pause on ARM (`Could not restore GICv3ITS state`): the vgic state save was incorrectly optimized to all zeros by the compiler (#1658). #### Networking & Security * Fixed sandboxes having a guest MTU larger than the node uplink NIC under overlay CNI, which left the network broken out of the box: guest MTU now follows the node NIC automatically (it only decreases), and can be pinned with `cubeNode.network.mtu` (#1674). #### Deployment & Upgrade * Fixed the `CUBE_SANDBOX_CUBE_EGRESS_IMAGE` environment variable not being updated in `.one-click.env` for one-click deployments (#1788). * Fixed CubeOps failing to connect when the MySQL password contains special characters; invalid configuration now fails at startup (#1617). * Fixed one-click install failing silently on snap-packaged Docker; it now tells users to switch to `docker-ce` (#1789). * Fixed inconsistent Redis logical-DB configuration across components in one-click deployments, which made CubeOps write metrics to the wrong database (#1705). * Fixed PVM installation failing on Ubuntu (#1770). * Fixed the template artifact cache not being movable to the data disk on its own (#1675). * Fixed CubeS3lvol being pinned to CPU0/CPU1 by default; another CPU is now picked automatically when unconfigured (#1713). #### Other * Fixed PostgreSQL template-alias duplicate errors being misclassified by error text and occasional template status publish failures; classification now uses SQLSTATE (#1724). * Fixed compatibility issues in the cubebench CPU topology report (#1757). * Added an Ubuntu desktop sandbox example and integration guide (#1746). * Added an OpenCode integration: a plugin hook redirects bash into the sandbox so commands no longer run directly on the developer's machine (#1238). * Added a CI status page (#1737). * Corrected the PVM expansion: Pagetable-based, not Parallel (#1772). * Added a documentation security warning: injecting credentials over HTTP is unsafe, limited to controlled internal networks; prefer HTTPS (#1818).