---
title: "Week of July 5, 2026"
sidebarTitle: "Week of the 5th"
description: "Modify existing sandboxes, inspect resize headroom, trust private TLS upstreams, load images faster, and pick up CLI, network, and SDK fixes."
icon: "bolt"
---

<Tip>
  **Released this week:** [v0.6.1](https://github.com/superradcompany/microsandbox/releases/tag/v0.6.1) · [v0.6.2](https://github.com/superradcompany/microsandbox/releases/tag/v0.6.2) · [v0.6.3](https://github.com/superradcompany/microsandbox/releases/tag/v0.6.3) · [v0.6.4](https://github.com/superradcompany/microsandbox/releases/tag/v0.6.4)
</Tip>

## New features

**Modify existing sandboxes**

`msb modify` and the SDK modify APIs can update existing sandboxes without recreating them. Resize CPU and memory, update labels, set env vars or workdir for future execs, and preview the plan with `--dry-run`. Secret changes are available in the CLI and Rust SDK.

```bash
msb modify worker --cpus 2 --memory 1G --dry-run
msb modify worker --secret DB_URL@db.internal.example.com
```

See [Tuning](/sandboxes/tuning). Also new: `msb restart`, `msb touch`, and `msb ping`.

**Inspect allocation and metrics**

`msb ps` now shows CPU and memory as `effective / max`. `msb metrics` adds sandbox state, per-second I/O rates, sorting, live watch/follow modes, and live-resize-aware CPU and memory readings.

```bash
msb ps
msb metrics --watch --sort cpu
```

Crashed sandboxes now report as `exited` instead of `running`. The Rust SDK exposes the same report through `SandboxMetricsReport`.

**Host-scoped upstream TLS trust**

Trust self-signed or private HTTPS upstreams without disabling secret substitution globally. Pin a CA bundle to specific hosts, or turn verification off for a bounded set of hosts. Available in the CLI and all four SDKs.

```bash
msb create python --name agent \
  --tls-intercept \
  --tls-upstream-ca-cert-for 'api.internal.example.com=./certs/api-ca.pem' \
  --tls-no-verify-upstream-for '*.preview.internal'
```

See the [TLS networking guide](/networking/tls).

**Faster `msb load` and `msb pull`**

Loading an image that is already on disk now takes under a second instead of around 20 seconds for a 1.3 GB image. `msb load` also shows progress while streaming from Docker.

```bash
docker save app:latest | msb load
```

`msb-imago` 0.1.1 also fixes OCI image corruption for layers over 2 GiB.

**Other features**

- **`msb self downgrade`.** Move a local install back to version 0.6.0 or newer, with database backup and migration rollback.
- **`--no-tty`.** Force non-interactive captured execution in `msb run` and `msb exec`.

## Bug fixes

- `msb exec` now signals the full guest process group, so spawned background jobs do not survive as orphans.
- Large and fragmented UDP packets now round-trip through the relay; IPv6 DNS answers, IPv4-mapped addresses, and generated network config files are also handled more reliably.
- `msb stop` no longer reports `sandbox not found` when an ephemeral sandbox is cleaned up during the stop wait.
- `MSB_SHUTDOWN_FLUSH_TIMEOUT_MS` can shorten shutdown waits for Windows WHP tests and short-lived sandboxes.
- SSH `direct-tcpip`, image prune behavior, and Rust default-backend helpers are restored after backend-routing regressions.
- `msb doctor` now uses the same runtime path resolution as sandbox launches, and top-level `msb --help` no longer prints raw ANSI escapes on older Windows consoles.