Containarium v0.101.0

What changed

Added

• allow-list-only egress preset and a plan of what to allow (#2440) (#2445)
• detect a non-distro SSH listener in a box (#2439) (#2444)
• box sshd key-only drop-in + posture reconciler (#2424) (#2428)
• ship SSH session records into the tamper-evident audit store + retention (#2415) (#2421)

Fixed

• meter responses blocked by the inbound scan (#2452) (#2460)
• move the inbound block audit write off the request path (#2451) (#2455)
• surface sshd marker failures, de-duplicate repeat config evidence (#2446) (#2447)
• box sshd posture follow-ups — escalate finding severity, mark boxes at create (#2424) (#2442)
• answer every request read before exiting on stdin EOF; poll listeners in sentinel tunnel tests (#2435)
• map zero ZFS quota restore to none (#2430)
• reject blank privileged Podman policy (#2407)

Documentation

• state in the FAQ that there is no opt-out from key-only box SSH (#2449)
• point the tunnel answer in the FAQ at the allow-list-only egress preset (#2448)
• add README tech-stack card (#2151) (#2335)
• design for #2415 audit-ingest token + IngestSSHSessionRecords RPC (#2417)

Internal

• cut v0.101.0 — OpenVAS opt-in scans, egress allow-list preset, inbound model-gateway guardrail, sentinel TLS tunnel, box sshd key-only enforcement (#2456)
• drop dead SecurityConfig.require_ssh_keys / min_password_length (#2424) (#2431)

Other

• sentinel: channel-bound token proof in tunnel handshake v2 (#2450)
• [B2 2/2] feat(modelgateway): enforce the inbound guardrail scan, fail closed, audit on block (#2367) (#2427)
• sentinel: accept TLS-wrapped tunnel sessions on the shared listener (#2443)
• [B2 1/2] feat(modelgateway): typed scan-unit decoders for inbound guardrail (#2367) (#2425)
• sentinel/cmd: tunnel client TLS transport with pinned sentinel identity (#2441)
• sentinel: parse ALPN alongside SNI from the peeked ClientHello (#2433)
• sentinel: tunnel identity keypair, SPKI pin format and verifier (#2434)
• [#2426] feat(pentest): persist the per-container OpenVAS scan opt-in (#2436)
• [#2426] feat(pentest): OpenVAS scanner module, opt-in per container (#2432)
• [C3] feat(guardrail): non-skippable guardrail gate on DeployRecipe (#2368) (#2408)

Full diff: v0.101.0-rc.1...v0.101.0

---

Containarium v0.101.0

The open-source, self-hostable, agent-native sandbox.

Binaries

Four binaries ship in this release:

Binary	Where it runs	What it does
containariumd	The host	The platform daemon plus host-side admin commands.
containarium	Your laptop / CI (linux, macOS, windows)	The client CLI: create, list, expose-port, ssh-config, etc. against a server (--server).
mcp-server	Your laptop	The platform MCP — outside-the-box admin (create_container, list_containers, expose_port, list_backends). Wire it into Claude Code / Cursor.
agent-box	Inside each Containarium container	The in-the-box MCP — shell_exec, read_file, write_file, etc. Reached over stdio, typically via SSH.

Quick install (Linux host)

curl -fsSL https://raw.githubusercontent.com/footprintai/containarium/main/hacks/install.sh | sudo bash

Manual install (any binary, any platform)

# containariumd daemon (Linux x86_64 host)
curl -L -o /usr/local/bin/containariumd \
  https://github.com/footprintai/containarium/releases/download/v0.101.0/containariumd-linux-amd64
chmod +x /usr/local/bin/containariumd
ln -sf /usr/local/bin/containariumd /usr/local/bin/containarium

# containarium client CLI (your laptop, e.g. macOS arm64)
curl -L -o /usr/local/bin/containarium \
  https://github.com/footprintai/containarium/releases/download/v0.101.0/containarium-darwin-arm64
chmod +x /usr/local/bin/containarium

# Windows: the same client CLI (create/list/ssh/… against a remote server)
# PowerShell:
#   curl.exe -L -o containarium.exe `
#     https://github.com/footprintai/containarium/releases/download/v0.101.0/containarium-windows-amd64.exe

# platform MCP (your laptop, e.g. macOS arm64)
curl -L -o /usr/local/bin/mcp-server \
  https://github.com/footprintai/containarium/releases/download/v0.101.0/mcp-server-darwin-arm64
chmod +x /usr/local/bin/mcp-server

# agent-box (drop into your container image, Linux x86_64)
curl -L -o /usr/local/bin/agent-box \
  https://github.com/footprintai/containarium/releases/download/v0.101.0/agent-box-linux-amd64
chmod +x /usr/local/bin/agent-box

Verify checksums via SHA256SUMS.txt.

MCP client setup

Wire the platform MCP into Claude Code (~/.claude.json):

{
  "mcpServers": {
    "containarium": {
      "command": "/usr/local/bin/mcp-server",
      "env": {
        "CONTAINARIUM_SERVER_URL": "http://your-host:8080",
        "CONTAINARIUM_JWT_TOKEN": "<your-token>"
      }
    }
  }
}

Wire agent-box for in-the-box file/shell ops:

{
  "mcpServers": {
    "containarium-box": {
      "command": "ssh",
      "args": ["user@your-box", "agent-box"]
    }
  }
}

See README.md for the full agent-native walkthrough.