Week of July 5, 2026 - Microsandbox

<Tip> **Released this week:** [v0.6.1](https://github.com/superradcompany/microsandbox/releases/tag/v0.6.1) · [v0.6.2](https://github.com/superradcompany/microsandbox/releases/tag/v0.6.2) · [v0.6.3](https://github.com/superradcompany/microsandbox/releases/tag/v0.6.3) · [v0.6.4](https://github.com/superradcompany/microsandbox/releases/tag/v0.6.4) </Tip>

New features

Modify existing sandboxes

msb modify and the SDK modify APIs can update existing sandboxes without recreating them. Resize CPU and memory, update labels, set env vars or workdir for future execs, and preview the plan with --dry-run. Secret changes are available in the CLI and Rust SDK.

bash

msb modify worker --cpus 2 --memory 1G --dry-run
msb modify worker --secret [email protected]

See Tuning. Also new: msb restart, msb touch, and msb ping.

Inspect allocation and metrics

msb ps now shows CPU and memory as effective / max. msb metrics adds sandbox state, per-second I/O rates, sorting, live watch/follow modes, and live-resize-aware CPU and memory readings.

bash

msb ps
msb metrics --watch --sort cpu

Crashed sandboxes now report as exited instead of running. The Rust SDK exposes the same report through SandboxMetricsReport.

Host-scoped upstream TLS trust

Trust self-signed or private HTTPS upstreams without disabling secret substitution globally. Pin a CA bundle to specific hosts, or turn verification off for a bounded set of hosts. Available in the CLI and all four SDKs.

bash

msb create python --name agent \
  --tls-intercept \
  --tls-upstream-ca-cert-for 'api.internal.example.com=./certs/api-ca.pem' \
  --tls-no-verify-upstream-for '*.preview.internal'

See the TLS networking guide.

Faster msb load and msb pull

Loading an image that is already on disk now takes under a second instead of around 20 seconds for a 1.3 GB image. msb load also shows progress while streaming from Docker.

bash

docker save app:latest | msb load

msb-imago 0.1.1 also fixes OCI image corruption for layers over 2 GiB.

Other features

msb self downgrade. Move a local install back to version 0.6.0 or newer, with database backup and migration rollback.
--no-tty. Force non-interactive captured execution in msb run and msb exec.

Bug fixes

msb exec now signals the full guest process group, so spawned background jobs do not survive as orphans.
Large and fragmented UDP packets now round-trip through the relay; IPv6 DNS answers, IPv4-mapped addresses, and generated network config files are also handled more reliably.
msb stop no longer reports sandbox not found when an ephemeral sandbox is cleaned up during the stop wait.
MSB_SHUTDOWN_FLUSH_TIMEOUT_MS can shorten shutdown waits for Windows WHP tests and short-lived sandboxes.
SSH direct-tcpip, image prune behavior, and Rust default-backend helpers are restored after backend-routing regressions.
msb doctor now uses the same runtime path resolution as sandbox launches, and top-level msb --help no longer prints raw ANSI escapes on older Windows consoles.