2026.11.12 Release v0.8.0

This release ships 8 major features along with numerous enhancements and bug fixes — 128 PRs from 46 contributors.

⭐ Highlights

• New JuiceFS COW storage backend (preview): built on JuiceFS, it enables sharing templates across nodes, resuming a paused sandbox on a different node, and booting from a snapshot on a different node.
• New FS-only snapshot capability: snapshot only the sandbox filesystem to cut storage costs.
• New sandbox restart policies: automatically restart a sandbox when the service inside it crashes.
• Scheduler plugin system: customize how sandboxes are scheduled across the cluster via CEL expressions or external scheduler plugins.
• Further extended E2B SDK compatibility: now supports E2B SDK 2.51.0 and later. See E2B API Compatibility and Differences for details.
• Sandbox metrics and log collection: view sandbox metrics in Prometheus, Grafana, and other monitoring tools.

🎯 Major Features

Extensible scheduler plugin system & scheduling quality evaluation framework

• Customize sandbox scheduling with built-in plugins, CEL expressions, or external gRPC plugins, letting you adjust cluster scheduling behavior more flexibly and dynamically.
• A new scheduling quality evaluation framework simulates cluster topology and load, so you can quickly measure how a scheduling policy performs during development — bin-packing efficiency, fragmentation, herding, scheduling latency, and more.

JuiceFS COW storage backend

• Built on JuiceFS, it enables sharing templates across nodes, resuming a paused sandbox on a different node, and booting from a snapshot on a different node. It supports a variety of metadata engines such as Redis, MySQL, and TiKV, and object stores such as MinIO and Tencent Cloud COS. (#2085)

Filesystem-only snapshots

• Snapshot only the sandbox filesystem to reduce snapshot storage costs. You can also cold-start new sandboxes from an FS-only snapshot. (#2145)

Automatic sandbox restart when the in-sandbox service crashes

• You can now set a restart policy on a sandbox: if the service inside it fails, the sandbox is automatically restarted on the same node.

Sandbox-to-sandbox access via port mapping

• Sandboxes can reach each other through port mapping on their host nodes. Any TCP-based service can use this path — it is not limited to CubeProxy's HTTP/HTTPS/gRPC.
• Sandboxes on the same node can talk the same way via hairpin networking.
• Besides CubeProxy's HTTP/gRPC, one sandbox can now access another through port mapping — a Layer-4 TCP channel that supports any TCP-based application. Both options work for same-node and cross-node sandbox communication.

Volume framework: passing user-private data

• The volume framework can now carry user-private data, which can be used for business logic such as authentication and bucketing. (#2136)

Improved sandbox and cluster observability

• Collects sandbox resource metrics and logs, ships default dashboard configurations, and supports additional visualization tools, so you can plug into your existing monitoring and logging systems such as Prometheus and Grafana. This gives production deployments unified observability for both day-to-day monitoring and troubleshooting. (#2183)

✨ Enhancements

Scheduling & Resource Management

• New template-level sandbox QoS: cap the network bandwidth, packet rate, disk throughput, and IOPS of sandboxes created from a given template, so a single sandbox cannot eat up the host's resources or degrade co-located sandboxes. (#1174)
• Node overcommit configuration: can now be set from both the CLI and the Web UI. A new node-side resident process, ops-agent, receives configuration commands from CubeOps and updates the Cubelet config file. (#1870)
• Faster sandbox creation: fixed a slowdown in concurrent sandbox creation on CPUs from vendors such as AMD, caused by the sandbox resource-collection mechanism reading cgroups. (#2073)

SDK & E2B Compatibility

• Added support for the E2B /v2/sandboxes and /v2/sandboxes/{id}/connect endpoints. Users on E2B SDK 2.51.0 and later can now create and connect to sandboxes directly, with no adapter layer needed. (#1800)
• The Python / Node / Go SDKs now offer the E2B-compatible Sandbox.fork API. (#1649)
• Snapshots can now be deleted by snapshot ID or name. (#1987)
• Sandbox responses for create / get / list / connect / fork now include the template alias. (#2062)
• The snapshot list can now be filtered by snapshot name or ID. (#2151)
• The Python / Node / Go SDKs now offer Sandbox.is_running. (#2159)

Templates & Storage

• Configurable artifact distribution concurrency: tune how many nodes CubeMaster pushes rootfs artifacts to in parallel, based on your network bandwidth and cluster size. (#1973)
• Snapshot chain improvements: derived snapshots on the same node now share a single parent snapshot; the write path is optimized with shared memory; snapshots are automatically warmed up when used; and validation during restart, hot upgrades, and checkpoint restores has been tightened. (#1996)
• cubemastercli tpl delete now takes a --force flag: clean up template-deletion tasks that are stuck or in a bad build state, forcibly removing the template metadata and its artifact copies on every node. (#2038)
• Templates can now be created with an explicit storage backend via the SDK/API. (#2039)
• Templates can specify the run-as user: choose which user (by UID or name) sandboxes run as when created from the template. (#2072)
• Optimized ext4 image storage and download. (#1885)

Lifecycle & Control Plane

• Improved vsock connection management. (#1925)
• Optimized the sandbox details API, reducing query overhead. (#2092)

Networking

• DNS resolution moved into the control plane, simplifying the data plane implementation. (#1640)
• Sandboxes can now use the Kubernetes cluster DNS directly. (#1741)
• CubeVS observability improved: per-sandbox network metrics can now be exported. (#1889)
• CubeProxy can now forward requests carrying E2b-Sandbox-* headers. (#1952)
• CubeEgress L7 rules now support the * match-all wildcard. (#2001)

Runtime

• vsock throughput improved by 60%+: enabling VIRTIO_RING_F_EVENT_IDX skips the extra interrupts the guest doesn't need, lifting bidirectional throughput from ~5.7 Gbps to ~9.3 Gbps. (#1862)
• Slightly faster snapshot restore for ARM sandboxes by cutting the number of unnecessary ioctls. (#1865)
• Guest kernel log output on ARM/x86 is now consistently redirected to virtio-console, reducing cold-start overhead. (#1992)

Deployment & Upgrade

• Kubernetes deployments can now use image registries with private CAs: just set trustedCACerts in the Helm chart and image pulls work as usual. (#1995)
• The control plane now natively supports Redis Cluster.
• Faster startup for compute-node components. (#2058)

Web UI / CubeOps

• The Web UI template page now has a Snapshots tab. (#1968)
• The Web UI now also shows template aliases and the backing storage backend. (#2006)
• cubeopscli can now display heterogeneous node groups across hierarchy levels. (#2174)

🐛 Bug Fixes

SDK

• Fixed a parsing error in the SDK files.read API. (#1571)
• The SDKs now support HTTP request timeouts. (#2052)
• Fixed terminal display issues in cubecli. (#2057)
• Now compatible with the E2B SDK's state and metadata parameters for filtering the sandbox list. (#2181)
• Template creation is faster: the envd version is now fetched after the template is created. (#1803)

Lifecycle & Sandbox

• Sandboxes now get a second health check during template creation. (#1541)
• Fixed a sandbox panic caused by excessive sandbox logging. (#1779)
• Fixed exited sandboxes being misreported as running. (#1814)
• Fixed the snapshot list's default limit not matching the documented value. (#1832)
• Batch-fixed how virtual devices — virtual disks, NICs, memory hotplug, vsock, serial ports, and more — handle malformed input, along with several edge cases in snapshot restore. (#1873)
• Fixed a panic during concurrent volume activation and deletion that poisoned the name_index lock and broke subsequent volume operations. (#1981)
• Fixed an occasional panic caused by concurrent gRPC connection-pool shutdown. (#1990)
• Querying a deleted sandbox's details now returns 404 instead of 500. (#1988)
• virtiofsd's getxattr now reads xattrs through /proc/self/fd instead of reopening the file, avoiding an extra open/close on s3fs that canceled out O_TRUNC and produced incorrect file lengths. (#2002)
• On ARM64, booting a guest with an ELF-format vmlinux kernel now fails immediately with an error pointing to the required arch/arm64/boot/Image. (#2032)
• Fixed connecting to an exited sandbox being misreported as successful. (#2033)
• Fixed a shim leak when sandbox creation fails. (#2040)
• Fixed an occasional sandbox creation failure. (#2054)
• Fixed Cubelet's handling of guest_workload metric period resets after sandbox pause/resume, preventing stale cached periods from interrupting monitoring data. (#2155)
• Fixed auto-pause not working when multiple CLM instances are deployed. (#2157)

Networking & Security

• Fixed the non-host-network K8s deployment scripts mistakenly using the Pod IP for CubeProxy. (#1921, #2115)
• Cubelet now mounts TAP hooks and cleans up leftover TAPs asynchronously during startup, speeding up node boot. (#1993)
• Optimized CubeVS forwarding and unified how sandboxes access services on the same node. (#2007)
• CubeEgress network service scripts improved to support different versions of iproute2. (#2034)
• Security hardening: the platform no longer forcibly disables no_new_privs on containers. (#2061)
• CubeEgress now forwards WebSocket upgrade headers. (#2128)
• CubeEgress audit logs can now print the sandbox ID. (#2131)

Templates & Storage

• Fixed an underlying assertion failure in cubes3lvol crash recovery: parent-child relationships are now recorded before an unfinished child snapshot is deleted, so crash recovery no longer trips an SPDK assertion crash. (#2124)

Deployment & Upgrade

• CubeShim and CubeVMM logs are now rotated automatically.
• pvm-host removed the kmem_cache mechanism and now always uses the stable TSC clock source to support pvm-guest time synchronization. (#1955)
• Self-built pvm-host now signs all of its modules, preventing some Ubuntu systems from getting stuck in the initramfs rescue shell after a reboot.
• The CoreDNS deployed by the one-click installation now answers AAAA resolution requests. (#2075)

Web UI / CubeOps

• Fixed AgentHub sandbox creation failing when no template was specified. (#1334)
• Fixed pagination not working in the sandbox list. (#1830)
• Fixed cubeopscli failing silently on errors. (#2135)

Other

• Fixed the health check reporting an incorrect sandbox count. (#2030)

📚 Documentation

• Expanded the CubeSandbox & E2B compatibility documentation.
• Added a nightly quality status page.
• Updated cube-bench results for v0.7.3 on Intel 8255C bare metal with the oc9 kernel (6.6.119-53.6). (#2084)
• Added a troubleshooting guide: when a compute node's clock lags the control node by more than 15 seconds, the node can be falsely flagged as heartbeat-expired and become unschedulable. (#2084) (#2087)
• Added offline deployment documentation.
• Added liveness probe examples to the docs. (#2185)