Containarium v0.100.0

What changed

Added

• push an alert when a skill box's coding-agent sign-in expires (#2377)
• NetworkPolicy.allow_from_tenants; per-container ACLs carry egress only (#2364)
• GetNetworkGuardStatus RPC, network-guard status, doctor check and MCP tool (#2357)
• tenant network guard — tenants cannot reach each other on the shared bridge; both NIC-ACL guards default-on (#2354)
• add --runner-group for organization runners (#1217) (#2340)
• scan, redact, gate and attest a dataset before it leaves your side (#2356)
• carry peer headroom and capability profile in ListBackends (#2135) (#2343)

Fixed

• create --labels reaches the daemon in remote mode (#2361)
• assign deterministic IPs to core services (#2365)
• apply asks the engine for exactly the policy's kinds; attestation records kinds_scanned (#2363)
• per-container ACL attaches to a profile-inherited NIC and keeps custom rules (#2352)
• ensure ZFS quota headroom for device updates (#2341)
• add ProxyJump for remote single-VM boxes (#2333)
• find user-installed agent-box over non-interactive SSH (#2330)
• self-profile pool members on daemon startup (#2331)
• core-guard-legit-flows log check no longer SIGPIPEs under pipefail (#2323) (#2324)
• refuse to start on an unrecognised privileged-podman policy instead of falling back to all (#2299) (#2329)

Documentation

• admin-approved egress allowlist for the coding CLI's own traffic (#2376)
• inbound guardrail scan at the model gateway and a server-side guardrail policy (#2375)
• tenant network guard design (#2347, #2348, #2349) (#2351)
• assess tenant ↔ tenant network isolation; add the e2e probe script (#2350)

Internal

• cut v0.100.0 — tenant network guard on by default, guardrail CLI, network-guard status (#2388)
• tenant-guard e2e lane (real daemon at defaults): tenants denied, legit flows survive (#2355)
• improve diagnostics for parent-exit flake (#2336)
• cover the three outcomes of the run's git fetch (#2161) (#2334)

Other

• docs+scripts: review follow-ups for the tenant isolation assessment (#2350) and design (#2351) (#2360)
• Feat/2298 hostcheck metadata block (#2332)
• Update BYOC hardening baseline checks (#2342)

Full diff: v0.99.3...v0.100.0

---

Containarium v0.100.0

The open-source, self-hostable, agent-native sandbox.

Binaries

Four binaries ship in this release:

Binary	Where it runs	What it does
containariumd	The host	The platform daemon plus host-side admin commands.
containarium	Your laptop / CI (linux, macOS, windows)	The client CLI: create, list, expose-port, ssh-config, etc. against a server (--server).
mcp-server	Your laptop	The platform MCP — outside-the-box admin (create_container, list_containers, expose_port, list_backends). Wire it into Claude Code / Cursor.
agent-box	Inside each Containarium container	The in-the-box MCP — shell_exec, read_file, write_file, etc. Reached over stdio, typically via SSH.

Quick install (Linux host)

curl -fsSL https://raw.githubusercontent.com/footprintai/containarium/main/hacks/install.sh | sudo bash

Manual install (any binary, any platform)

# containariumd daemon (Linux x86_64 host)
curl -L -o /usr/local/bin/containariumd \
  https://github.com/footprintai/containarium/releases/download/v0.100.0/containariumd-linux-amd64
chmod +x /usr/local/bin/containariumd
ln -sf /usr/local/bin/containariumd /usr/local/bin/containarium

# containarium client CLI (your laptop, e.g. macOS arm64)
curl -L -o /usr/local/bin/containarium \
  https://github.com/footprintai/containarium/releases/download/v0.100.0/containarium-darwin-arm64
chmod +x /usr/local/bin/containarium

# Windows: the same client CLI (create/list/ssh/… against a remote server)
# PowerShell:
#   curl.exe -L -o containarium.exe `
#     https://github.com/footprintai/containarium/releases/download/v0.100.0/containarium-windows-amd64.exe

# platform MCP (your laptop, e.g. macOS arm64)
curl -L -o /usr/local/bin/mcp-server \
  https://github.com/footprintai/containarium/releases/download/v0.100.0/mcp-server-darwin-arm64
chmod +x /usr/local/bin/mcp-server

# agent-box (drop into your container image, Linux x86_64)
curl -L -o /usr/local/bin/agent-box \
  https://github.com/footprintai/containarium/releases/download/v0.100.0/agent-box-linux-amd64
chmod +x /usr/local/bin/agent-box

Verify checksums via SHA256SUMS.txt.

MCP client setup

Wire the platform MCP into Claude Code (~/.claude.json):

{
  "mcpServers": {
    "containarium": {
      "command": "/usr/local/bin/mcp-server",
      "env": {
        "CONTAINARIUM_SERVER_URL": "http://your-host:8080",
        "CONTAINARIUM_JWT_TOKEN": "<your-token>"
      }
    }
  }
}

Wire agent-box for in-the-box file/shell ops:

{
  "mcpServers": {
    "containarium-box": {
      "command": "ssh",
      "args": ["user@your-box", "agent-box"]
    }
  }
}

See README.md for the full agent-native walkthrough.