Containarium v0.104.0

What changed

Added

• add authoritative SSH source-IP ban control (#933)
• self-host SSH authorization decider and ssh_keys registry (#2517) (#2545)
• preserve SSH authorization decisions and denied sessions (#2547)

Fixed

• run gvm-cli as the gvm user and drop the scanner-EOL result (#2579)
• an unreadable key registry denies with UPSTREAM_UNAVAILABLE (#2550) (#2551)
• address SSH ban review documentation and CI paths
• configure and verify SSH ban policy on both listeners (#933)
• pass guardrail input through recipe deploy (#2553)
• reject unknown YAML fields in recipe catalogs (#2554)
• pin buf and add lint/breaking CI (#2548)

Documentation

• keep the doc map to statuses and sources
• README verified against 106a18b — host verbs, verb list, roadmap, doc map (#2567)
• CONTRIBUTING.md — how we choose between duplicate PRs (#2543)

Internal

• cut v0.104.0 — SSH authz decider, macOS 11 clients, OpenVAS fix (#2580)
• make TestSpawn_SurvivesParentExit's sidecar wait diagnosable (#2479) (#2568)
• publish best-effort macOS 11 client binaries with each release (#2555)
• acknowledge control client cleanup errors
• land SSH device approval spike on main (#2544)
• bump cloud.google.com/go/compute from 1.71.0 to 1.72.0 (#2500)
• bump the opentelemetry group across 1 directory with 10 updates (#2497)
• bump github.com/mark3labs/mcp-go from 1.1.1 to 1.2.1 (#2499)
• bump google.golang.org/api from 0.300.0 to 0.301.0 (#2498)
• bump golang.org/x/sys from 0.48.0 to 0.49.0 (#2501)
• bump golang.org/x/sync from 0.23.0 to 0.24.0 (#2503)

Other

• [#2527] feat(sshauthz): AuthorizedKeysCommand on the LXC jump host (#2552)
• [#2516] feat(proto): SSHAuthzService contract, actuation mirror, Assignment kind and audit fields (#2534)

Full diff: v0.103.3...v0.104.0

---

Containarium v0.104.0

The open-source, self-hostable, agent-native sandbox.

Binaries

Four binaries ship in this release:

Binary	Where it runs	What it does
containariumd	The host	The platform daemon plus host-side admin commands.
containarium	Your laptop / CI (linux, macOS, windows)	The client CLI: create, list, expose-port, ssh-config, etc. against a server (--server).
mcp-server	Your laptop	The platform MCP — outside-the-box admin (create_container, list_containers, expose_port, list_backends). Wire it into Claude Code / Cursor.
agent-box	Inside each Containarium container	The in-the-box MCP — shell_exec, read_file, write_file, etc. Reached over stdio, typically via SSH.

Quick install (Linux host)

curl -fsSL https://raw.githubusercontent.com/footprintai/containarium/main/hacks/install.sh | sudo bash

Manual install (any binary, any platform)

# containariumd daemon (Linux x86_64 host)
curl -L -o /usr/local/bin/containariumd \
  https://github.com/footprintai/containarium/releases/download/v0.104.0/containariumd-linux-amd64
chmod +x /usr/local/bin/containariumd
ln -sf /usr/local/bin/containariumd /usr/local/bin/containarium

# containarium client CLI (your laptop, e.g. macOS arm64)
curl -L -o /usr/local/bin/containarium \
  https://github.com/footprintai/containarium/releases/download/v0.104.0/containarium-darwin-arm64
chmod +x /usr/local/bin/containarium

# Windows: the same client CLI (create/list/ssh/… against a remote server)
# PowerShell:
#   curl.exe -L -o containarium.exe `
#     https://github.com/footprintai/containarium/releases/download/v0.104.0/containarium-windows-amd64.exe

# platform MCP (your laptop, e.g. macOS arm64)
curl -L -o /usr/local/bin/mcp-server \
  https://github.com/footprintai/containarium/releases/download/v0.104.0/mcp-server-darwin-arm64
chmod +x /usr/local/bin/mcp-server

# agent-box (drop into your container image, Linux x86_64)
curl -L -o /usr/local/bin/agent-box \
  https://github.com/footprintai/containarium/releases/download/v0.104.0/agent-box-linux-amd64
chmod +x /usr/local/bin/agent-box

Verify checksums via SHA256SUMS.txt.

MCP client setup

Wire the platform MCP into Claude Code (~/.claude.json):

{
  "mcpServers": {
    "containarium": {
      "command": "/usr/local/bin/mcp-server",
      "env": {
        "CONTAINARIUM_SERVER_URL": "http://your-host:8080",
        "CONTAINARIUM_JWT_TOKEN": "<your-token>"
      }
    }
  }
}

Wire agent-box for in-the-box file/shell ops:

{
  "mcpServers": {
    "containarium-box": {
      "command": "ssh",
      "args": ["user@your-box", "agent-box"]
    }
  }
}

See README.md for the full agent-native walkthrough.