microsandbox-rb 0.7.0 → 0.8.0

checksums.yaml

@@ -1,7 +1,7 @@
 ---
 SHA256:
-  metadata.gz: 158469a5ebe84ee4863c2a141cbeb486407bfc5ee05866be9005f9aee3bd249d
-  data.tar.gz: ef08b6519ac87f66c20f704e4c55590f56b3d6c05fa01ab6f9187db46f8b43af
+  metadata.gz: 06dc745a315d5d79f21e702032d45a984dbf53110e3375bb560de9cb008866d6
+  data.tar.gz: 9168ece64600356ce88ed3c3ed42cc88f4354f3619abfdc32fabd578745cf6c4
 SHA512:
-  metadata.gz: d63ed9d45bdf68fb2f8352927412b23debd45e5e011f30a835fd2e75bae206e2ce19d1875c6099ce72c808c7d5e05e62a459f81794589e090ab837b9541d5da7
-  data.tar.gz: '09a726c22f8b12ecb0d575f0c4e20ce446aa5761cf5ed8cc15155a6b567e7ee867c4f95545a9595f786b88ec2f6dbd75b1bfe721fb629025ce8bfc19aa63fda0'
+  metadata.gz: d8fed4d0957be541dd5de600dd24386ff7b62d9933e45e244a49200185989cb8427279c80234038a4355aee296fdc96ec1cd5738e4bcf3fae48b27388f7dcad5
+  data.tar.gz: 9310a3b2d3a0322e701bc85cbfe6b820576b4254c3d49099bbfcab07690421c1e2d9705d0106e1d2931fb3516a0d462401758d5393552810427a6891ed6fc79e

data/CHANGELOG.md

@@ -8,6 +8,48 @@ wraps, and the README's Versioning section keeps the full gem→runtime map.
 
 ## [Unreleased]
 
+## [0.8.0] - 2026-06-25
+
+Adopts upstream runtime **`v0.5.10`** (up from the `v0.5.8` that `0.7.0` shipped).
+Runtime-only bump — no public Ruby API change.
+
+### Runtime
+
+- **Adopted upstream `v0.5.10`** — the `microsandbox`/`microsandbox-network` git
+  deps and `Microsandbox::RUNTIME_VERSION` now pin `v0.5.10`. This is the runtime
+  bump originally attempted against `v0.5.9` during the `0.7.0` cycle and reverted:
+  upstream's `v0.5.9` git tag predated its own crate-version bump, so the prebuilt
+  runtime-provisioning path (`PREBUILT_VERSION = env!("CARGO_PKG_VERSION")`)
+  resolved to `0.5.8` and downloaded a `msb` that rejected the new `--config-fd`
+  flag the SDK unconditionally passes — every `Sandbox.create` died at boot.
+  Upstream chose not to re-tag (most package registries forbid republishing a tag)
+  and instead cut a clean **`v0.5.10`** whose tag carries the matching crate
+  version `0.5.10` (upstream
+  [#1029](https://github.com/superradcompany/microsandbox/issues/1029)). The bump
+  carries the following upstream changes:
+  - **Heartbeat no longer reclaims busy sandboxes** (upstream #1011). The host
+    watchdog is now idle-detection only — a healthy sandbox with an active (or
+    briefly starved) `exec` session is never killed for a stale heartbeat, the
+    way it could be before.
+  - **Launch config moved off the process argv** (upstream #1006). Bulky and
+    secret-bearing config (the network blob, env) is handed to the sandbox over
+    an inherited, unlinked-tempfile fd instead of `--`-flags, so it no longer
+    leaks into `ps` / `/proc/<pid>/cmdline`.
+
+### Changed
+
+- **Directory bind mounts now carry a default 4 GiB guest-write quota**
+  (upstream #1020). Any `volumes:` entry that binds a host directory (e.g.
+  `volumes: { "/out" => "/host/out" }`) is given a `DEFAULT_BIND_QUOTA_MIB`
+  (4096 MiB) guest-write budget by the v0.5.10 runtime when no explicit quota is
+  set, so a sandbox can no longer fill the host disk through a bind mount. This
+  is a **behavior change**: a workload that wrote more than 4 GiB to a bind mount
+  under the `v0.5.8` runtime (`0.7.0`) will now fail with `ENOSPC`. The gem does
+  not yet expose a per-bind quota override (named-volume `Volume.create` accepts
+  `quota_mib:`, but the inline bind-mount path does not) — that escape hatch is a
+  tracked follow-up. Until then, route large-write mounts through a named volume
+  with an explicit `quota_mib:`.
+
 ## [0.7.0] - 2026-06-23
 
 A large parity release closing the binding gaps an audit against the upstream

data/Cargo.lock

@@ -3003,8 +3003,8 @@ dependencies = [
 
 [[package]]
 name = "microsandbox"
-version = "0.5.8"
-source = "git+https://github.com/superradcompany/microsandbox?tag=v0.5.8#47d0cdf1ef3b4b41885eb3efd67b759fd5540e9e"
+version = "0.5.10"
+source = "git+https://github.com/superradcompany/microsandbox?tag=v0.5.10#a62c4e45da7320e89aafc44b8a44fc74ec49fb53"
 dependencies = [
  "anyhow",
  "astral-tokio-tar",
@@ -3056,8 +3056,8 @@ dependencies = [
 
 [[package]]
 name = "microsandbox-agent-client"
-version = "0.5.8"
-source = "git+https://github.com/superradcompany/microsandbox?tag=v0.5.8#47d0cdf1ef3b4b41885eb3efd67b759fd5540e9e"
+version = "0.5.10"
+source = "git+https://github.com/superradcompany/microsandbox?tag=v0.5.10#a62c4e45da7320e89aafc44b8a44fc74ec49fb53"
 dependencies = [
  "ciborium",
  "microsandbox-protocol",
@@ -3069,8 +3069,8 @@ dependencies = [
 
 [[package]]
 name = "microsandbox-db"
-version = "0.5.8"
-source = "git+https://github.com/superradcompany/microsandbox?tag=v0.5.8#47d0cdf1ef3b4b41885eb3efd67b759fd5540e9e"
+version = "0.5.10"
+source = "git+https://github.com/superradcompany/microsandbox?tag=v0.5.10#a62c4e45da7320e89aafc44b8a44fc74ec49fb53"
 dependencies = [
  "async-trait",
  "sea-orm",
@@ -3081,8 +3081,8 @@ dependencies = [
 
 [[package]]
 name = "microsandbox-filesystem"
-version = "0.5.8"
-source = "git+https://github.com/superradcompany/microsandbox?tag=v0.5.8#47d0cdf1ef3b4b41885eb3efd67b759fd5540e9e"
+version = "0.5.10"
+source = "git+https://github.com/superradcompany/microsandbox?tag=v0.5.10#a62c4e45da7320e89aafc44b8a44fc74ec49fb53"
 dependencies = [
  "libc",
  "microsandbox-utils",
@@ -3094,8 +3094,8 @@ dependencies = [
 
 [[package]]
 name = "microsandbox-image"
-version = "0.5.8"
-source = "git+https://github.com/superradcompany/microsandbox?tag=v0.5.8#47d0cdf1ef3b4b41885eb3efd67b759fd5540e9e"
+version = "0.5.10"
+source = "git+https://github.com/superradcompany/microsandbox?tag=v0.5.10#a62c4e45da7320e89aafc44b8a44fc74ec49fb53"
 dependencies = [
  "astral-tokio-tar",
  "async-compression",
@@ -3120,8 +3120,8 @@ dependencies = [
 
 [[package]]
 name = "microsandbox-metrics"
-version = "0.5.8"
-source = "git+https://github.com/superradcompany/microsandbox?tag=v0.5.8#47d0cdf1ef3b4b41885eb3efd67b759fd5540e9e"
+version = "0.5.10"
+source = "git+https://github.com/superradcompany/microsandbox?tag=v0.5.10#a62c4e45da7320e89aafc44b8a44fc74ec49fb53"
 dependencies = [
  "chrono",
  "libc",
@@ -3131,8 +3131,8 @@ dependencies = [
 
 [[package]]
 name = "microsandbox-migration"
-version = "0.5.8"
-source = "git+https://github.com/superradcompany/microsandbox?tag=v0.5.8#47d0cdf1ef3b4b41885eb3efd67b759fd5540e9e"
+version = "0.5.10"
+source = "git+https://github.com/superradcompany/microsandbox?tag=v0.5.10#a62c4e45da7320e89aafc44b8a44fc74ec49fb53"
 dependencies = [
  "sea-orm-migration",
  "serde_json",
@@ -3140,8 +3140,8 @@ dependencies = [
 
 [[package]]
 name = "microsandbox-network"
-version = "0.5.8"
-source = "git+https://github.com/superradcompany/microsandbox?tag=v0.5.8#47d0cdf1ef3b4b41885eb3efd67b759fd5540e9e"
+version = "0.5.10"
+source = "git+https://github.com/superradcompany/microsandbox?tag=v0.5.10#a62c4e45da7320e89aafc44b8a44fc74ec49fb53"
 dependencies = [
  "base64",
  "bytes",
@@ -3180,8 +3180,8 @@ dependencies = [
 
 [[package]]
 name = "microsandbox-protocol"
-version = "0.5.8"
-source = "git+https://github.com/superradcompany/microsandbox?tag=v0.5.8#47d0cdf1ef3b4b41885eb3efd67b759fd5540e9e"
+version = "0.5.10"
+source = "git+https://github.com/superradcompany/microsandbox?tag=v0.5.10#a62c4e45da7320e89aafc44b8a44fc74ec49fb53"
 dependencies = [
  "chrono",
  "ciborium",
@@ -3195,8 +3195,8 @@ dependencies = [
 
 [[package]]
 name = "microsandbox-runtime"
-version = "0.5.8"
-source = "git+https://github.com/superradcompany/microsandbox?tag=v0.5.8#47d0cdf1ef3b4b41885eb3efd67b759fd5540e9e"
+version = "0.5.10"
+source = "git+https://github.com/superradcompany/microsandbox?tag=v0.5.10#a62c4e45da7320e89aafc44b8a44fc74ec49fb53"
 dependencies = [
  "bytes",
  "chrono",
@@ -3225,8 +3225,8 @@ dependencies = [
 
 [[package]]
 name = "microsandbox-types"
-version = "0.5.8"
-source = "git+https://github.com/superradcompany/microsandbox?tag=v0.5.8#47d0cdf1ef3b4b41885eb3efd67b759fd5540e9e"
+version = "0.5.10"
+source = "git+https://github.com/superradcompany/microsandbox?tag=v0.5.10#a62c4e45da7320e89aafc44b8a44fc74ec49fb53"
 dependencies = [
  "chrono",
  "serde",
@@ -3237,8 +3237,8 @@ dependencies = [
 
 [[package]]
 name = "microsandbox-utils"
-version = "0.5.8"
-source = "git+https://github.com/superradcompany/microsandbox?tag=v0.5.8#47d0cdf1ef3b4b41885eb3efd67b759fd5540e9e"
+version = "0.5.10"
+source = "git+https://github.com/superradcompany/microsandbox?tag=v0.5.10#a62c4e45da7320e89aafc44b8a44fc74ec49fb53"
 dependencies = [
  "dirs",
  "libc",
@@ -3249,7 +3249,7 @@ dependencies = [
 
 [[package]]
 name = "microsandbox_rb"
-version = "0.7.0"
+version = "0.8.0"
 dependencies = [
  "chrono",
  "futures",

data/README.md

@@ -383,8 +383,8 @@ change diverged the two numbers — the gem version is **not** a reliable indica
 of the embedded runtime version. To learn which runtime a build wraps, ask it:
 
 ```ruby
-Microsandbox::VERSION          # => "0.6.0"  (the gem's own version)
-Microsandbox.runtime_version   # => "v0.5.8"  (the embedded upstream runtime tag)
+Microsandbox::VERSION          # => "0.8.0"  (the gem's own version)
+Microsandbox.runtime_version   # => "v0.5.10"  (the embedded upstream runtime tag)
 ```
 
 | Gem version | Upstream runtime | Notes |
@@ -396,6 +396,8 @@ Microsandbox.runtime_version   # => "v0.5.8"  (the embedded upstream runtime tag
 | `0.5.11` | `v0.5.8` | gem-only revision |
 | `0.5.12` | `v0.5.8` | gem-only revision |
 | `0.6.0`  | `v0.5.8` | gem version decoupled from the upstream tag; adds `runtime_version` |
+| `0.7.0`  | `v0.5.8` | SDK parity release (large binding-gap closure) |
+| `0.8.0`  | `v0.5.10` | adopts upstream `v0.5.10` (idle-only heartbeat, config-fd hardening, **4 GiB default bind-mount quota**); supersedes the reverted `v0.5.9` attempt |
 
 **Going forward** — the gem version moves on its own semver track and no longer
 mirrors the upstream tag:

data/ext/microsandbox/Cargo.toml

@@ -6,8 +6,8 @@ name = "microsandbox_rb"
 description = "Ruby SDK native extension for microsandbox — secure, fast microVM-based sandboxing."
 # Must equal Microsandbox::VERSION (lib/microsandbox/version.rb) — Native.version
 # returns this via env!("CARGO_PKG_VERSION") and version_spec.rb asserts equality.
-# The core-crate dependency below stays pinned at its own tag (v0.5.8).
-version = "0.7.0"
+# The core-crate dependency below stays pinned at its own tag (v0.5.10).
+version = "0.8.0"
 authors = ["Super Rad Company <development@superrad.company>"]
 repository = "https://github.com/superradcompany/microsandbox"
 license = "Apache-2.0"
@@ -35,8 +35,8 @@ rb-sys = "0.9"
 # `.cargo/config.toml.example`). "ssh" matches the feature set the Python/Node
 # SDKs ship with; default features add "prebuilt" (provisions msb + libkrunfw at
 # build time), "net", and "keyring".
-microsandbox = { git = "https://github.com/superradcompany/microsandbox", tag = "v0.5.8", default-features = true, features = ["ssh"] }
-microsandbox-network = { git = "https://github.com/superradcompany/microsandbox", tag = "v0.5.8" }
+microsandbox = { git = "https://github.com/superradcompany/microsandbox", tag = "v0.5.10", default-features = true, features = ["ssh"] }
+microsandbox-network = { git = "https://github.com/superradcompany/microsandbox", tag = "v0.5.10" }
 
 # Async core bridged to Ruby's synchronous API via a blocking tokio runtime.
 tokio = { version = "1", features = ["rt-multi-thread", "sync", "time"] }

data/lib/microsandbox/version.rb

@@ -8,12 +8,12 @@ module Microsandbox
   # Versioning section of the README for the full gem-to-runtime map. Must equal
   # the native ext's Cargo crate version (`Native.version`), enforced by
   # spec/unit/version_spec.rb.
-  VERSION = "0.7.0"
+  VERSION = "0.8.0"
 
   # The upstream microsandbox runtime release this gem build embeds — the `tag`
   # pinned on the `microsandbox`/`microsandbox-network` git deps in
   # ext/microsandbox/Cargo.toml. Exposed at runtime as
   # {Microsandbox.runtime_version}. spec/unit/version_spec.rb asserts it stays in
   # sync with the Cargo tag so it can't silently drift out of date.
-  RUNTIME_VERSION = "v0.5.8"
+  RUNTIME_VERSION = "v0.5.10"
 end

metadata

@@ -1,7 +1,7 @@
 --- !ruby/object:Gem::Specification
 name: microsandbox-rb
 version: !ruby/object:Gem::Version
-  version: 0.7.0
+  version: 0.8.0
 platform: ruby
 authors:
 - ya-luotao