All pull requests

Pull requests

• chore(sdk/go): deprecate the in-tree Go SDK and drop its CI gate

  #5245·rhuss opened Nov 4, 2026Contributor·6 of 8 tasks·

  ·
  1

  1

• fix(server): bound Postgres pool waits and retry startup connect

  #5244·FrostGod opened Nov 4, 2026Collaborator·5 of 7 tasks·

  ·
  1

  2

• feat(tracing): show boundary connection time during sandbox startup

  area:runtimetest:e2etopic:observability
  #5243·shiju-nv opened Nov 4, 2026Collaborator·4 of 6 tasks·

  ·
  1

  1

• refactor(testkit): type the cleanup hook keys

  area:buildtopic:testing
  #5240·elezar opened Nov 4, 2026Member·

  ·

• fix(server): keep old runtime status from failing sandbox restarts

  area:platform
  #5237·shiju-nv opened Nov 4, 2026Collaborator·4 of 6 tasks·

  ·
  1

• feat(compute): show workload OS, architecture, and execution restrictions

  area:driverstest:e2e
  #5236·shiju-nv opened Nov 4, 2026Collaborator·9 tasks done·

  ·
  1

  2

• fix(startup): show why the runtime or workload failed to start

  area:runtimetest:e2e
  #5235·shiju-nv opened Nov 4, 2026Collaborator·5 of 6 tasks·

  ·
  2

• fix(supervisor): reject live filesystem policy changes that cannot take effect

  area:runtimetest:e2e
  #5234·shiju-nv opened Nov 4, 2026Collaborator·5 of 6 tasks·

  ·
  1

  2

• perf(sandbox): cut broker round trips on the mediated socket path

  #5233·EmilienM opened Nov 4, 2026Contributor·6 of 7 tasks·

  ·
  1

  1

• fix(sandbox): document unsafe blocks and enforce SAFETY comments with clippy

  #5232·EmilienM opened Nov 4, 2026Contributor·2 of 3 tasks·

  ·
  1

  1

• fix(sandbox): run external TCP connect identity work off the broker thread

  #5231·EmilienM opened Nov 4, 2026Contributor·6 tasks done·

  ·
  1

  1

• refactor(sdk)!: unify wait_ready and make it succeed only on Ready

  #5226·elezar opened Nov 3, 2026Member·4 of 5 tasks·

  ·
  1

  4

• fix(supervisor): reread resolv.conf for policy DNS upstreams

  #5224·ericcurtin opened Nov 3, 2026Contributor·5 of 6 tasks·

  ·
  1

  6

• fix(sandbox): keep idle execs and disconnect freezes off the shared blocking pool

  #5217·EmilienM opened Nov 3, 2026Contributor·5 of 6 tasks·

  ·
  1

  2

• fix(sandbox): prebuild seccomp filters before fork and report Landlock degradation from the parent

  #5216·EmilienM opened Nov 3, 2026Contributor·4 of 6 tasks·

  ·
  1

  2

• feat(observability): add enforcement correlation primitives

  #5214·afourniernv opened Nov 3, 2026·6 of 8 tasks·

  ·
  1

• perf(identity): bound per-connect procfs work in binary identity resolution

  #5213·EmilienM opened Nov 3, 2026Contributor·4 of 6 tasks·

  ·
  1

  3

• fix(sandbox): make mediated signal, scheduling, and limit calls behave natively

  #5212·EmilienM opened Nov 3, 2026Contributor·6 tasks done·

  ·
  1

  3

• fix(sandbox): keep serving through transient accept errors

  #5211·EmilienM opened Nov 3, 2026Contributor·6 of 8 tasks·

  ·
  1

  3

• fix(sandbox): harden managed-children registry and workload launcher

  #5209·EmilienM opened Nov 3, 2026Contributor·4 of 6 tasks·

  ·
  1

  2

• fix(server): keep stopped sandboxes stopped after late driver updates

  test:e2e
  #5204·shiju-nv opened Nov 3, 2026Collaborator·4 of 6 tasks·

  ·
  1

• docs(rfc): propose moving the desktop drivers to a separate repository

  rfc
  #5202·elezar opened Nov 3, 2026Member·3 of 6 tasks·

  ·
  1

  2

• fix(sandbox): zero-initialize sigset_t before assume_init

  #5194·EmilienM opened Nov 3, 2026Contributor·7 tasks done·

  ·
  1

  3

• fix(isolation): enforce workload identity invariants on deserialize

  #5192·EmilienM opened Nov 3, 2026Contributor·4 of 6 tasks·

  ·
  1

  2

• feat(gateway-interceptors): intercept StartSandbox and StopSandbox

  #5173·ericcurtin opened Nov 2, 2026Contributor·5 of 6 tasks·

  ·
  1

  2