Containarium v0.108.0

What changed

Added

• version, stamp and publish the Helm chart with each release (#2574) (#2686)
• only the box owner can start a ClamAV scan; admin no longer bypasses (#2655) (#2690)
• containarium security clamav install (#2659) (#2671)
• security_process_policy get|set|release tools (#2666) (#2672)
• tenant-run in-box ClamAV scan runner with a status enum (#2658) (#2669)
• journal how the Gemini turn ended (finish reason, block reason) (#2513) (#2653)
• gauges and built-in alerts for bridge DNS drift (#2194) (#2627)
• scope TERMINATE_USER_SESSIONS to an org's boxes on shared hosts (#2546) (#2626)

Fixed

• forward InstallClamav to the backend that owns the box (#2683) (#2684)
• process-policy get shows the effective mining-behavior thresholds (#2675) (#2682)
• auto-quarantine never releases on a ClamAV 'clean' verdict (#2654) (#2663)
• deliver a persistent finding once per interval, not on every upsert (#2643) (#2652)
• cloud backend answers kms_* tools client-side as unsupported (cloud#2679) (#2661)
• point the GCM dashboard at the Prometheus-namespace series (#2608) (#2628)

Documentation

• PRD — contributor supply-chain gates for public contributions (#2648)
• --idle-stop help states the real defaults (FootprintAI/Containarium-cloud#2759) (#2673)
• downgrade malware-scanning claims; correct the v0.107.0 note (#2656) (#2664)
• remove leftover merge-conflict markers and a duplicated entry (#2667)

Internal

• cut v0.108.0 (#2687)
• drain box runs before the temp dir is removed; skip the box-run tests off Linux (#2677) (#2678)
• remove system-initiated ClamAV scans and the tenant-rootfs mount path (#2657) (#2668)
• run the ssh-authz real-sshpiperd integration tests (#2646) (#2651)

Other

• [#2675] fix(threatdetect): process-policy set changes only the fields it carries (#2681)
• [#2674] fix(threatdetect): reject a mining window below the sample cadence's floor (#2680)
• [#2676] fix(threatdetect): THROTTLE applies a hard CFS quota, not Incus's soft share (#2679)
• [#2660] feat(threatdetect): raise the sentry-unavailable finding when the CPU sampler is unavailable (#2670)
• [#2636] feat(cli): containarium security process-policy get|set|release + degraded-store status line (#2665)
• [#2645] feat(threatdetect): standalone CPU sampler when the metrics collector is off (#2650)
• [#2636] feat(threatdetect): process policy alert|throttle|freeze, responder, release and TTL backstop (#2662)
• [#2634] feat(threatdetect): sentry-unavailable finding on an armed backend (#2642)
• [#2635] fix(threatdetect): bound mining CPU history and measure window coverage on in-window samples (#2647)
• [#2520] feat(sshauthz): --ssh-authz-enforce refuses denied keys at the sentinel (#2630)
• [#2635] feat(threatdetect): mining-behavior rule over CPU samples and stratum-port flows (#2644)

Full diff: v0.107.0...v0.108.0

---

Containarium v0.108.0

The open-source, self-hostable, agent-native sandbox.

Binaries

Four binaries ship in this release:

Binary	Where it runs	What it does
containariumd	The host	The platform daemon plus host-side admin commands.
containarium	Your laptop / CI (linux, macOS, windows)	The client CLI: create, list, expose-port, ssh-config, etc. against a server (--server).
mcp-server	Your laptop	The platform MCP — outside-the-box admin (create_container, list_containers, expose_port, list_backends). Wire it into Claude Code / Cursor.
agent-box	Inside each Containarium container	The in-the-box MCP — shell_exec, read_file, write_file, etc. Reached over stdio, typically via SSH.

Quick install (Linux host)

curl -fsSL https://raw.githubusercontent.com/footprintai/containarium/main/hacks/install.sh | sudo bash

Manual install (any binary, any platform)

# containariumd daemon (Linux x86_64 host)
curl -L -o /usr/local/bin/containariumd \
  https://github.com/footprintai/containarium/releases/download/v0.108.0/containariumd-linux-amd64
chmod +x /usr/local/bin/containariumd
ln -sf /usr/local/bin/containariumd /usr/local/bin/containarium

# containarium client CLI (your laptop, e.g. macOS arm64)
curl -L -o /usr/local/bin/containarium \
  https://github.com/footprintai/containarium/releases/download/v0.108.0/containarium-darwin-arm64
chmod +x /usr/local/bin/containarium

# Windows: the same client CLI (create/list/ssh/… against a remote server)
# PowerShell:
#   curl.exe -L -o containarium.exe `
#     https://github.com/footprintai/containarium/releases/download/v0.108.0/containarium-windows-amd64.exe

# platform MCP (your laptop, e.g. macOS arm64)
curl -L -o /usr/local/bin/mcp-server \
  https://github.com/footprintai/containarium/releases/download/v0.108.0/mcp-server-darwin-arm64
chmod +x /usr/local/bin/mcp-server

# agent-box (drop into your container image, Linux x86_64)
curl -L -o /usr/local/bin/agent-box \
  https://github.com/footprintai/containarium/releases/download/v0.108.0/agent-box-linux-amd64
chmod +x /usr/local/bin/agent-box

Verify checksums via SHA256SUMS.txt.

Kubernetes (Helm)

Chart version 0.108.0 (installs the v0.108.0 daemon image):

helm install containarium oci://ghcr.io/footprintai/charts/containarium-k8s \
  --version 0.108.0 \
  --set daemon.jwtSecret="$(openssl rand -hex 24)"

MCP client setup

Wire the platform MCP into Claude Code (~/.claude.json):

{
  "mcpServers": {
    "containarium": {
      "command": "/usr/local/bin/mcp-server",
      "env": {
        "CONTAINARIUM_SERVER_URL": "http://your-host:8080",
        "CONTAINARIUM_JWT_TOKEN": "<your-token>"
      }
    }
  }
}

Wire agent-box for in-the-box file/shell ops:

{
  "mcpServers": {
    "containarium-box": {
      "command": "ssh",
      "args": ["user@your-box", "agent-box"]
    }
  }
}

See README.md for the full agent-native walkthrough.