Changelog #21
Here's what we have been up to the last few weeks. The biggest area is network visibility and control. We shipped a new Egress Traffic dashboard that shows outbound connections for workloads with Egress Filtering enabled. This dashboard gives you visibility into whether your egress policies are working as intended. We also added Ubuntu 26.04 runner images and a batch of platform and CLI improvements, all covered below.
Egress Traffic Visibility
Namespace now records every outbound connection made by a workload and surfaces it in a new Egress Traffic dashboard. Requests are grouped by domain and split into allowed and denied, so you can see what a workload actually reached and catch anything that was blocked unexpectedly.
The workspace-level view aggregates traffic across all instances. Each individual instance also has an Egress tab that shows the same breakdown scoped to that instance alone.
Egress filtering is now generally available. For GitHub Actions runners, configure the
allow-list in the runner profile editor. For Devboxes,
set network_policy.egress_domains in the spec file.
Ubuntu 26.04 Runner Images
Ubuntu 26.04 based images are now available for GitHub Actions jobs. Select the new image
in the profile editor or use the ubuntu-26.04 runner label
directly in your workflow file.
jobs:
build:
runs-on: nscloud-ubuntu-26.04More updates
Instances can now forward CPU, memory, disk, and filesystem metrics to an external Prometheus remote write endpoint. Store the credential in the Namespace vault, reference it by object ID in a config file, and pass it to nsc create --experimental_from. Basic auth and bearer token are both supported.
nsc instance report now includes repository, runner profile, branch, and job conclusion fields for GitHub Actions jobs. Filter by profile with --github_profile. Cache volume hit ratio is also available as a new data point.
The nscloud-cache-action now supports Tuist cache mode. Set cache-flavor: tuist to cache the Tuist build artifacts directory.
The shape of remote Docker builders can now be changed from the Builds tab using the button in the top right corner. No config file edit required.
devbox create and devbox acquire now accept --setup_github to authenticate the gh CLI and configure git credentials from your local token at creation time. This replaces the separate devbox setup-github step. Declare it in a spec file with integrations.github.share_auth: true. The gh CLI is also now pre-installed in every Devbox.
devbox session list lists active terminal sessions on a running Devbox, with -o json for structured output. devbox port-forward now accepts --activate. Pass --theme auto|dark|light or set DEVBOX_THEME to control the CLI color scheme.