Containarium v0.106.0

What changed

Added

• TerminateUserSessions RPC, sessions terminate CLI, MCP tool, assignment handler (#2598)
• forward managed SSH authorization to cloud (#2541)
• audit live SSH authorization with bounded outage grace (#2518) (#2537)

Fixed

• unlabelled instances are informational, not DEGRADED (#2396) (#2604)
• set gcp.project_id on the OTLP resource (#2590) (#2591)
• never print env-derived secrets in flag usage (#2595) (#2596)
• fail loud on out-of-range --expiry; mint a short-lived token per backup run (#2592) (#2593)
• tell a dispatched run where its checkout is; say why an empty run failed (#2512, #2513) (#2588)
• record a failed clamdscan run as incomplete, never clean (#2496) (#2586)

Documentation

• v0.106.0 backup-token upgrade note — keep the static line until your rotation job is retired (#2607)

Internal

• pin block-metadata --persist and idempotent unit install (#2300) (#2605)
• cut v0.106.0 — GCP export fix, per-run backup tokens, SSH session termination, CLI secret-leak fix (#2601)
• pin the completion hook's detached contexts and RunStarted CAS guard (#2051) (#2594)
• waive legacy lint findings in buf.yaml, not in-source comments (#2549) (#2587)

Other

• test+docs(backup): scope contract and documented shape for the verifier's tenant-bound token (#2401) (#2597)

Full diff: v0.105.0...v0.106.0

---

Containarium v0.106.0

The open-source, self-hostable, agent-native sandbox.

Binaries

Four binaries ship in this release:

Binary	Where it runs	What it does
containariumd	The host	The platform daemon plus host-side admin commands.
containarium	Your laptop / CI (linux, macOS, windows)	The client CLI: create, list, expose-port, ssh-config, etc. against a server (--server).
mcp-server	Your laptop	The platform MCP — outside-the-box admin (create_container, list_containers, expose_port, list_backends). Wire it into Claude Code / Cursor.
agent-box	Inside each Containarium container	The in-the-box MCP — shell_exec, read_file, write_file, etc. Reached over stdio, typically via SSH.

Quick install (Linux host)

curl -fsSL https://raw.githubusercontent.com/footprintai/containarium/main/hacks/install.sh | sudo bash

Manual install (any binary, any platform)

# containariumd daemon (Linux x86_64 host)
curl -L -o /usr/local/bin/containariumd \
  https://github.com/footprintai/containarium/releases/download/v0.106.0/containariumd-linux-amd64
chmod +x /usr/local/bin/containariumd
ln -sf /usr/local/bin/containariumd /usr/local/bin/containarium

# containarium client CLI (your laptop, e.g. macOS arm64)
curl -L -o /usr/local/bin/containarium \
  https://github.com/footprintai/containarium/releases/download/v0.106.0/containarium-darwin-arm64
chmod +x /usr/local/bin/containarium

# Windows: the same client CLI (create/list/ssh/… against a remote server)
# PowerShell:
#   curl.exe -L -o containarium.exe `
#     https://github.com/footprintai/containarium/releases/download/v0.106.0/containarium-windows-amd64.exe

# platform MCP (your laptop, e.g. macOS arm64)
curl -L -o /usr/local/bin/mcp-server \
  https://github.com/footprintai/containarium/releases/download/v0.106.0/mcp-server-darwin-arm64
chmod +x /usr/local/bin/mcp-server

# agent-box (drop into your container image, Linux x86_64)
curl -L -o /usr/local/bin/agent-box \
  https://github.com/footprintai/containarium/releases/download/v0.106.0/agent-box-linux-amd64
chmod +x /usr/local/bin/agent-box

Verify checksums via SHA256SUMS.txt.

MCP client setup

Wire the platform MCP into Claude Code (~/.claude.json):

{
  "mcpServers": {
    "containarium": {
      "command": "/usr/local/bin/mcp-server",
      "env": {
        "CONTAINARIUM_SERVER_URL": "http://your-host:8080",
        "CONTAINARIUM_JWT_TOKEN": "<your-token>"
      }
    }
  }
}

Wire agent-box for in-the-box file/shell ops:

{
  "mcpServers": {
    "containarium-box": {
      "command": "ssh",
      "args": ["user@your-box", "agent-box"]
    }
  }
}

See README.md for the full agent-native walkthrough.