Getting startedGuidesReferenceChangelog
Apoxy:// Docs / Changelog / v0.21.0

Apoxy v0.21.0

This release introduces compute Services with egress controls and a gVisor sandbox runtime, zero-config CLI deploys, a redesigned console UI, and tunnel improvements.

This release introduces compute Services with egress controls and a gVisor sandbox runtime, zero-config CLI deploys, a redesigned console UI, and tunnel improvements.

Features

  • Compute Service egress: full data and control plane with DNS resolution, SSRF filtering, and per-tenant isolation, backed by new EgressGateway and EgressRoute APIs (c169a5f, 18197e0, fb8efff)
  • New compute.apoxy.dev/v1alpha1 API group with Service, ServiceRevision, and Build resources, running on a gVisor-sandboxed workerd runtime with per-tenant isolation (ce96a13, 8ee02a2, 3a03377)
  • SecretStore API with secret bindings for compute Services (d0e55c6)
  • Zero-config deploys: apoxy deploy bootstraps service.yaml, resolves the project's hosted registry, and pins the built digest; apoxy build and apoxy bundle push are available for a manual build/push flow (a0aec0c, 2c43eec)
  • New apoxy service, apoxy egressgateway, and apoxy egressroute commands, plus apoxy service versions [name] to inspect a Service's revision history (3d81a1c, 5a9ecd1)
  • New vpc.apoxy.dev/v1alpha1 API group; VPCService now publishes spec.hostname as a <hostname>.<network>.vpc zone (9c4975f, 8581ee5)
  • Redesigned console UI with a YAML editor, command palette, keyboard navigation, and a miller-column resource browser (73538ac, b222846, c834781)

Bug Fixes

  • Fix a connection-slot deadlock on single-relay drain (97bd686)
  • Reap idle/half-open proxied connections to stop a tunnel memory leak (24c887a)
  • Fix a data race delivering nil/corrupt frames from a reused batch slice (2306617)
  • Resolve the latest release dynamically and fix amd64 arch mapping in the install script (614df7b)

Improvements

  • Graceful relay drain with GOAWAY + lame duck mode and agent make-before-break (b3792cd)
  • Multi-phase tunnel architecture overhaul: dual-stack relay datapath, ipalloc block-lease, and a relay registrar (257e3b6, 41eec1c)
  • Reject malformed OCI digests at admission (acf882c)
  • Auto-renew the apiz-cert via mTLS to cosmos with fsnotify hot-reload (f5bf67a, 2bbfac7)

Infrastructure

  • Relicense apoxy-cli to AGPL-3.0, keeping api/ and client/ as Apache-2.0 (0d57bd4)
  • Publish images to the apoxy-dev public GAR instead of Docker Hub (d47ab81)

Full Changelog: v0.20.0...v0.21.0