microsandbox-rb 0.9.0 → 0.9.2

checksums.yaml

@@ -1,7 +1,7 @@
 ---
 SHA256:
-  metadata.gz: 3395a95418c2c6e159365140455797f0b40318aa585aea8b0b4ac0b93f521957
-  data.tar.gz: e39164f8143656a0f069720f3359e133bffe2cb5438146dab3b3e629abbe9647
+  metadata.gz: 69a06d8d3c54bdd0339a3149904ac906377ddcc3aa295725548ceac20001b1ae
+  data.tar.gz: ca7b9c5ed1ca3d35bec0b2229db7f1f229b58964f89c48e386e187d8d7bb0dd4
 SHA512:
-  metadata.gz: d07ddd920c69d73c86372176745047ed27c515a5ba3dd30bb1c9fe5ddcf2de39009dc670d1f44965d38ea6c8399e84224640e51fe4caf792f40291ab49befbe1
-  data.tar.gz: 2eb6879b20289edbcebf80eee934bfd81d176bf6f8e3c577f3da21d8e987e15315db486c612f5f1bd8fa296a35ba4f3244e293496116bce321ae7bd9a9201530
+  metadata.gz: 4d11c9b6a98de5c66b4d0fda89d7b8efe3610d68408e96664707f150cb358bb3ca9e6550acf684e12e9989cf70211a79a45b7dc5603f4d6b0861be41c4528690
+  data.tar.gz: dfe032911a9207ba074a47bc9065c0e78f45537b4b3fd9d8059f9e08def6211c35e6a5fcfd93ebc26fe9f7dda818924d298274c7d99d91ee00cfc63b61c44865

data/CHANGELOG.md

@@ -6,6 +6,55 @@ All notable changes to this gem are documented here. The format is based on
 microsandbox runtime it embeds; each release notes the upstream runtime tag it
 wraps, and the README's Versioning section keeps the full gem→runtime map.
 
+## [0.9.2] - 2026-07-08
+
+Adopts upstream runtime **`v0.6.2` → `v0.6.3`**. No Ruby API change; the
+native glue moves to the explicit-backend variants of a few SDK calls that
+went "ambient config" upstream (#1091).
+
+### Fixed
+
+- **DNS no longer advertises unreachable address families to the guest**
+  (upstream #1083): on hosts without a working IPv6 route the sandbox is
+  IPv4-only, but the DNS forwarder previously still returned real AAAA
+  records, so v6-preferring resolvers inside the guest (gRPC/c-ares
+  foremost) tried IPv6 first and failed with unreachable-network errors.
+  AAAA queries in a v4-only sandbox (and A queries in a v6-only one) now
+  synthesize an empty NOERROR answer, steering guests to the usable family.
+  Also normalizes IPv4-mapped IPv6 addresses for policy/rebind/resolved-
+  hostname checks.
+
+### Changed
+
+- **Embedded runtime is now `v0.6.3`** (`Microsandbox::RUNTIME_VERSION` /
+  `Microsandbox.runtime_version`). Also inherited: upstream TLS interception
+  scopes upstream-certificate verification per destination (#1073).
+- Native glue adapted to the upstream v0.6.3 SDK surface (#1091 restored
+  "ambient local config" as the public shape): `Image.get/list/inspect/
+  remove/prune` and `all_sandbox_metrics` now call the explicit
+  `*_local(backend, …)` variants, and the resolved-`msb`-path probe uses the
+  `LocalConfig#resolve_msb_path` method form. Behavior is identical — the
+  gem already held an explicit local backend at every call site.
+
+## [0.9.1] - 2026-07-03
+
+Adopts upstream runtime **`v0.6.1` → `v0.6.2`**. The upstream SDK crate's public
+API is unchanged in this release — the only surface change attempted upstream (a
+`disk_size` builder rename, #983) was reverted before the release cut (#1078) —
+so this is a pure runtime bump with no Ruby API change.
+
+### Changed
+
+- **Embedded runtime is now `v0.6.2`** (`Microsandbox::RUNTIME_VERSION` /
+  `Microsandbox.runtime_version`). Upstream improvements inherited by the gem:
+  - **Faster image loads and pulls** (upstream #1075): an early cache gate skips
+    already-imported layers and OCI layer decompression switches to zlib-rs.
+    Inherited transitively through the SDK crate's `microsandbox-image`
+    dependency, so `Sandbox.create` image pulls benefit directly.
+  - `msb` CLI polish (terminal-aware help colors, aligned `doctor` runtime
+    diagnostics, image-load progress) ships in the prebuilt runtime binary but
+    does not affect the Ruby API surface.
+
 ## [0.9.0] - 2026-06-29
 
 Adopts upstream runtime **`v0.5.10` → `v0.6.1`** (spanning the upstream `v0.6.0`

data/Cargo.lock

@@ -1697,6 +1697,7 @@ checksum = "843fba2746e448b37e26a819579957415c8cef339bf08564fe8b7ddbd959573c"
 dependencies = [
  "crc32fast",
  "miniz_oxide",
+ "zlib-rs",
 ]
 
 [[package]]
@@ -2974,8 +2975,8 @@ dependencies = [
 
 [[package]]
 name = "microsandbox"
-version = "0.6.1"
-source = "git+https://github.com/superradcompany/microsandbox?tag=v0.6.1#868ac5a8f04fadca357b377537e7a5740a856509"
+version = "0.6.3"
+source = "git+https://github.com/superradcompany/microsandbox?tag=v0.6.3#7121a8c3385252d9a9ec83677fea5a49a475cdb2"
 dependencies = [
  "anyhow",
  "astral-tokio-tar",
@@ -3028,8 +3029,8 @@ dependencies = [
 
 [[package]]
 name = "microsandbox-agent-client"
-version = "0.6.1"
-source = "git+https://github.com/superradcompany/microsandbox?tag=v0.6.1#868ac5a8f04fadca357b377537e7a5740a856509"
+version = "0.6.3"
+source = "git+https://github.com/superradcompany/microsandbox?tag=v0.6.3#7121a8c3385252d9a9ec83677fea5a49a475cdb2"
 dependencies = [
  "ciborium",
  "microsandbox-protocol",
@@ -3041,8 +3042,8 @@ dependencies = [
 
 [[package]]
 name = "microsandbox-db"
-version = "0.6.1"
-source = "git+https://github.com/superradcompany/microsandbox?tag=v0.6.1#868ac5a8f04fadca357b377537e7a5740a856509"
+version = "0.6.3"
+source = "git+https://github.com/superradcompany/microsandbox?tag=v0.6.3#7121a8c3385252d9a9ec83677fea5a49a475cdb2"
 dependencies = [
  "async-trait",
  "sea-orm",
@@ -3053,8 +3054,8 @@ dependencies = [
 
 [[package]]
 name = "microsandbox-filesystem"
-version = "0.6.1"
-source = "git+https://github.com/superradcompany/microsandbox?tag=v0.6.1#868ac5a8f04fadca357b377537e7a5740a856509"
+version = "0.6.3"
+source = "git+https://github.com/superradcompany/microsandbox?tag=v0.6.3#7121a8c3385252d9a9ec83677fea5a49a475cdb2"
 dependencies = [
  "libc",
  "microsandbox-utils",
@@ -3066,8 +3067,8 @@ dependencies = [
 
 [[package]]
 name = "microsandbox-image"
-version = "0.6.1"
-source = "git+https://github.com/superradcompany/microsandbox?tag=v0.6.1#868ac5a8f04fadca357b377537e7a5740a856509"
+version = "0.6.3"
+source = "git+https://github.com/superradcompany/microsandbox?tag=v0.6.3#7121a8c3385252d9a9ec83677fea5a49a475cdb2"
 dependencies = [
  "astral-tokio-tar",
  "async-compression",
@@ -3092,8 +3093,8 @@ dependencies = [
 
 [[package]]
 name = "microsandbox-metrics"
-version = "0.6.1"
-source = "git+https://github.com/superradcompany/microsandbox?tag=v0.6.1#868ac5a8f04fadca357b377537e7a5740a856509"
+version = "0.6.3"
+source = "git+https://github.com/superradcompany/microsandbox?tag=v0.6.3#7121a8c3385252d9a9ec83677fea5a49a475cdb2"
 dependencies = [
  "chrono",
  "libc",
@@ -3104,8 +3105,8 @@ dependencies = [
 
 [[package]]
 name = "microsandbox-migration"
-version = "0.6.1"
-source = "git+https://github.com/superradcompany/microsandbox?tag=v0.6.1#868ac5a8f04fadca357b377537e7a5740a856509"
+version = "0.6.3"
+source = "git+https://github.com/superradcompany/microsandbox?tag=v0.6.3#7121a8c3385252d9a9ec83677fea5a49a475cdb2"
 dependencies = [
  "sea-orm-migration",
  "serde_json",
@@ -3113,8 +3114,8 @@ dependencies = [
 
 [[package]]
 name = "microsandbox-network"
-version = "0.6.1"
-source = "git+https://github.com/superradcompany/microsandbox?tag=v0.6.1#868ac5a8f04fadca357b377537e7a5740a856509"
+version = "0.6.3"
+source = "git+https://github.com/superradcompany/microsandbox?tag=v0.6.3#7121a8c3385252d9a9ec83677fea5a49a475cdb2"
 dependencies = [
  "base64",
  "bytes",
@@ -3155,8 +3156,8 @@ dependencies = [
 
 [[package]]
 name = "microsandbox-protocol"
-version = "0.6.1"
-source = "git+https://github.com/superradcompany/microsandbox?tag=v0.6.1#868ac5a8f04fadca357b377537e7a5740a856509"
+version = "0.6.3"
+source = "git+https://github.com/superradcompany/microsandbox?tag=v0.6.3#7121a8c3385252d9a9ec83677fea5a49a475cdb2"
 dependencies = [
  "chrono",
  "ciborium",
@@ -3170,8 +3171,8 @@ dependencies = [
 
 [[package]]
 name = "microsandbox-runtime"
-version = "0.6.1"
-source = "git+https://github.com/superradcompany/microsandbox?tag=v0.6.1#868ac5a8f04fadca357b377537e7a5740a856509"
+version = "0.6.3"
+source = "git+https://github.com/superradcompany/microsandbox?tag=v0.6.3#7121a8c3385252d9a9ec83677fea5a49a475cdb2"
 dependencies = [
  "bytes",
  "chrono",
@@ -3201,8 +3202,8 @@ dependencies = [
 
 [[package]]
 name = "microsandbox-types"
-version = "0.6.1"
-source = "git+https://github.com/superradcompany/microsandbox?tag=v0.6.1#868ac5a8f04fadca357b377537e7a5740a856509"
+version = "0.6.3"
+source = "git+https://github.com/superradcompany/microsandbox?tag=v0.6.3#7121a8c3385252d9a9ec83677fea5a49a475cdb2"
 dependencies = [
  "chrono",
  "serde",
@@ -3213,8 +3214,8 @@ dependencies = [
 
 [[package]]
 name = "microsandbox-utils"
-version = "0.6.1"
-source = "git+https://github.com/superradcompany/microsandbox?tag=v0.6.1#868ac5a8f04fadca357b377537e7a5740a856509"
+version = "0.6.3"
+source = "git+https://github.com/superradcompany/microsandbox?tag=v0.6.3#7121a8c3385252d9a9ec83677fea5a49a475cdb2"
 dependencies = [
  "dirs",
  "libc",
@@ -3226,7 +3227,7 @@ dependencies = [
 
 [[package]]
 name = "microsandbox_rb"
-version = "0.9.0"
+version = "0.9.2"
 dependencies = [
  "chrono",
  "futures",
@@ -3300,9 +3301,9 @@ dependencies = [
 
 [[package]]
 name = "msb-imago"
-version = "0.1.0"
+version = "0.1.1"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "16db000f7280d4c8a78b8b95f64a41006d447fd116ecd69d984d93774cb85d09"
+checksum = "c3077f41d73d78575dd706fcb626778eea7942ab2f1402ec040a4e11badc5dfa"
 dependencies = [
  "async-trait",
  "bincode",
@@ -7418,6 +7419,12 @@ dependencies = [
  "syn",
 ]
 
+[[package]]
+name = "zlib-rs"
+version = "0.6.5"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "5431d5661c32445236631278f27946e444ddafe4684cac70b185272d4f9c52d5"
+
 [[package]]
 name = "zmij"
 version = "1.0.21"

data/DESIGN.md

@@ -106,7 +106,7 @@ out (air-gapped hosts that provision out of band). libkrunfw is `dlopen`'d by
 
 `ext/microsandbox/Cargo.toml` depends on the core crate via a **pinned git tag**
 (`microsandbox` / `microsandbox-network`, pinned to the same tag as
-`Microsandbox::RUNTIME_VERSION` — currently `v0.6.1`), so the gem builds anywhere
+`Microsandbox::RUNTIME_VERSION` — currently `v0.6.2`), so the gem builds anywhere
 — CI, `rake-compiler-dock` release containers, and end-user source installs —
 without an adjacent checkout. For fast local development against a sibling
 microsandbox checkout, copy `.cargo/config.toml.example` to `.cargo/config.toml`
@@ -211,7 +211,7 @@ create options, full mount options (tmpfs/disk + stat-virtualization/
 host-permissions), and snapshot inspection (`open`/`list_dir`/`reindex`).
 
 A few **secondary** upstream knobs remain unexposed (a genuine binding gap, not
-upstream-gated — they exist at the pinned `v0.6.1` runtime): per-published-port host
+upstream-gated — they exist at the pinned `v0.6.2` runtime): per-published-port host
 **bind address** (ports always bind loopback), network **interface overrides**,
 and inline **named-volume create-mode** (pre-create with `Volume.create`, then
 mount with `{ named: }`). These slot in module-by-module exactly as the existing

data/README.md

@@ -215,7 +215,7 @@ end
 
 ```ruby
 Microsandbox::Sandbox.create("obs", image: "public.ecr.aws/docker/library/alpine:latest") do |sb|
-  # On the v0.6.1 runtime the metrics slot goes live a beat after create returns,
+  # On v0.6.x runtimes the metrics slot goes live a beat after create returns,
   # so `metrics` can briefly raise "no live metrics slot" right after boot —
   # retry for a few hundred ms rather than treating the first failure as fatal.
   m = sb.metrics                       # => Microsandbox::Metrics
@@ -393,8 +393,8 @@ change diverged the two numbers — the gem version is **not** a reliable indica
 of the embedded runtime version. To learn which runtime a build wraps, ask it:
 
 ```ruby
-Microsandbox::VERSION          # => "0.9.0"  (the gem's own version)
-Microsandbox.runtime_version   # => "v0.6.1"  (the embedded upstream runtime tag)
+Microsandbox::VERSION          # => "0.9.2"  (the gem's own version)
+Microsandbox.runtime_version   # => "v0.6.3"  (the embedded upstream runtime tag)
 ```
 
 | Gem version | Upstream runtime | Notes |
@@ -411,6 +411,8 @@ Microsandbox.runtime_version   # => "v0.6.1"  (the embedded upstream runtime tag
 | `0.8.1`  | `v0.5.10` | gem-only: re-provision a stale local runtime; per-bind-mount `quota_mib:` override |
 | `0.8.2`  | `v0.5.10` | gem-only: redact secrets from errors, typed snapshot errors, panic-free durations, fat-gem loader + `extconf` preflight fixes, threading/streaming docs |
 | `0.9.0`  | `v0.6.1` | adopts upstream `v0.6.0`+`v0.6.1` (zombie-runtime wait fix, secret substitution through CONNECT proxies, stale-sandbox cleanup); upstream public API is additive — no Ruby surface change |
+| `0.9.1`  | `v0.6.2` | adopts upstream `v0.6.2` (faster image loads/pulls via early cache gate + zlib-rs); upstream API unchanged — no Ruby surface change |
+| `0.9.2`  | `v0.6.3` | adopts upstream `v0.6.3` (v4-only sandboxes stop advertising AAAA DNS answers — fixes guest gRPC/c-ares preferring unreachable IPv6; scoped upstream TLS verification); glue moves to `*_local` SDK variants — no Ruby surface change |
 
 **Going forward** — the gem version moves on its own semver track and no longer
 mirrors the upstream tag:

data/ext/microsandbox/Cargo.toml

@@ -6,8 +6,8 @@ name = "microsandbox_rb"
 description = "Ruby SDK native extension for microsandbox — secure, fast microVM-based sandboxing."
 # Must equal Microsandbox::VERSION (lib/microsandbox/version.rb) — Native.version
 # returns this via env!("CARGO_PKG_VERSION") and version_spec.rb asserts equality.
-# The core-crate dependency below stays pinned at its own tag (v0.6.1).
-version = "0.9.0"
+# The core-crate dependency below stays pinned at its own tag (v0.6.3).
+version = "0.9.2"
 authors = ["Super Rad Company <development@superrad.company>"]
 repository = "https://github.com/superradcompany/microsandbox"
 license = "Apache-2.0"
@@ -35,8 +35,8 @@ rb-sys = "0.9"
 # `.cargo/config.toml.example`). "ssh" matches the feature set the Python/Node
 # SDKs ship with; default features add "prebuilt" (provisions msb + libkrunfw at
 # build time), "net", and "keyring".
-microsandbox = { git = "https://github.com/superradcompany/microsandbox", tag = "v0.6.1", default-features = true, features = ["ssh"] }
-microsandbox-network = { git = "https://github.com/superradcompany/microsandbox", tag = "v0.6.1" }
+microsandbox = { git = "https://github.com/superradcompany/microsandbox", tag = "v0.6.3", default-features = true, features = ["ssh"] }
+microsandbox-network = { git = "https://github.com/superradcompany/microsandbox", tag = "v0.6.3" }
 
 # Async core bridged to Ruby's synchronous API via a blocking tokio runtime.
 tokio = { version = "1", features = ["rt-multi-thread", "sync", "time"] }

data/ext/microsandbox/src/image.rs

@@ -82,12 +82,12 @@ fn report_to_hash(report: ImagePruneReport) -> RHash {
 }
 
 fn get(reference: String) -> Result<RHash, Error> {
-    let handle = with_local_backend(async |local| Image::get(local, &reference).await)?;
+    let handle = with_local_backend(async |local| Image::get_local(local, &reference).await)?;
     Ok(handle_to_hash(&handle))
 }
 
 fn list() -> Result<RArray, Error> {
-    let handles = with_local_backend(async |local| Image::list(local).await)?;
+    let handles = with_local_backend(async |local| Image::list_local(local).await)?;
     let arr = ruby().ary_new();
     for h in handles.iter() {
         arr.push(handle_to_hash(h))?;
@@ -96,16 +96,16 @@ fn list() -> Result<RArray, Error> {
 }
 
 fn inspect(reference: String) -> Result<RHash, Error> {
-    let detail = with_local_backend(async |local| Image::inspect(local, &reference).await)?;
+    let detail = with_local_backend(async |local| Image::inspect_local(local, &reference).await)?;
     Ok(detail_to_hash(detail))
 }
 
 fn remove(reference: String, force: bool) -> Result<(), Error> {
-    with_local_backend(async |local| Image::remove(local, &reference, force).await)
+    with_local_backend(async |local| Image::remove_local(local, &reference, force).await)
 }
 
 fn prune() -> Result<RHash, Error> {
-    let report = with_local_backend(async |local| Image::prune(local).await)?;
+    let report = with_local_backend(async |local| Image::prune_local(local).await)?;
     Ok(report_to_hash(report))
 }
 

data/ext/microsandbox/src/lib.rs

@@ -34,7 +34,7 @@ fn version() -> String {
 /// helpers (Python/Node/Go).
 fn all_sandbox_metrics() -> Result<RHash, Error> {
     let map = backend::with_local_backend(async |local| {
-        microsandbox::sandbox::all_sandbox_metrics(local).await
+        microsandbox::sandbox::all_sandbox_metrics_local(local).await
     })?;
     let hash = runtime::ruby().hash_new();
     for (name, metrics) in &map {
@@ -113,7 +113,7 @@ fn resolved_msb_path() -> Result<String, Error> {
             available_when: "with the local backend".into(),
         })
     })?;
-    let path = microsandbox::config::resolve_msb_path(local.config()).map_err(error::to_ruby)?;
+    let path = local.config().resolve_msb_path().map_err(error::to_ruby)?;
     Ok(path.to_string_lossy().into_owned())
 }
 

data/lib/microsandbox/sandbox.rb

@@ -931,7 +931,7 @@ module Microsandbox
     #
     # Raises a {Microsandbox::Error} ("sandbox N has no live metrics slot") when
     # called in the brief window right after {Sandbox.create} returns, before the
-    # runtime has registered the sandbox's metrics slot. On the `v0.6.1` runtime
+    # runtime has registered the sandbox's metrics slot. On `v0.6.x` runtimes
     # the spawn handshake no longer blocks create until the first sample is
     # written, so the slot goes live a beat *after* boot (within a few hundred
     # milliseconds); retry for that window rather than treating the first failure

data/lib/microsandbox/version.rb

@@ -8,12 +8,12 @@ module Microsandbox
   # Versioning section of the README for the full gem-to-runtime map. Must equal
   # the native ext's Cargo crate version (`Native.version`), enforced by
   # spec/unit/version_spec.rb.
-  VERSION = "0.9.0"
+  VERSION = "0.9.2"
 
   # The upstream microsandbox runtime release this gem build embeds — the `tag`
   # pinned on the `microsandbox`/`microsandbox-network` git deps in
   # ext/microsandbox/Cargo.toml. Exposed at runtime as
   # {Microsandbox.runtime_version}. spec/unit/version_spec.rb asserts it stays in
   # sync with the Cargo tag so it can't silently drift out of date.
-  RUNTIME_VERSION = "v0.6.1"
+  RUNTIME_VERSION = "v0.6.3"
 end

metadata

@@ -1,7 +1,7 @@
 --- !ruby/object:Gem::Specification
 name: microsandbox-rb
 version: !ruby/object:Gem::Version
-  version: 0.9.0
+  version: 0.9.2
 platform: ruby
 authors:
 - ya-luotao