Containarium v0.110.0

What changed

Added

• TaskGraph proto, validation and crew plan validate (#2803) (#2826)
• report the effective response policy via guardrail status (#2737) (#2852)
• miner-signature list/add/remove tools and kill_process on process-policy set (#2763) (#2841)
• ssh-authz enforce mode routes every offer itself (#2741) (#2815)
• rotate device keys with SSHSIG proof and login expiry checks (#2536)
• cap cached ALLOW TTL at grace; add unwired enforce-mode router (#2742)
• kernel hairpin for the 80/443 Caddy DNAT (#2263 slice A) (#2743)
• baseline log-only response scan when no admin policy exists (#2744)
• run_name, fresh-session discovery, and structured output for platform-started runs

Fixed

• persist and report a box's stack; document PodmanEnabled (#2163) (#2849)
• walkthroughs pass gateway.createNamespace=false so helm install works (#2776) (#2840)
• preserve SSH audit records during shutdown (#2830)
• stream backup dumps with bounded staging and transfer (#2838)
• prevent false credential-expiry alerts (#2790) (#2833)
• snapshot the finding MemFindingStore.Upsert returns (#2758)
• console-attach WebSocket uses the terminal route's Origin rule (#2721) (#2739)
• match the old Caddy DNAT's bridge subnet as a network (#2732) (#2757)
• sentry status is DEGRADED when the process responder is ALERT-only (#2719) (#2726)
• review fixes - whole-budget discovery, Go-decoded session id, derived-name guard

Documentation

• contributor rules for dependency, build and CI changes (#2796) (#2842)
• fix gateway key setup in EKS/GKE walkthrough (#2771)
• move seven post-cut entries from [0.109.0] to [Unreleased] (#2813)
• move seven post-tag entries out of 0.109.0 back to Unreleased (#2814)
• design note for live SSH authorization, device approval and key rotation (#2514)
• PRD + design — process guardrail, detect and contain cryptomining in tenant boxes (#2633)
• guide covers the process responder, standalone CPU sampler and new finding types (#2717) (#2723)
• remove stray diff3 marker and duplicate Fixed heading from 0.109.0 (#2764)
• trademark policy makes no response-time promise (#2561) (#2756)
• add NOTICE with the attribution notices Apache-2.0 requires (#2561) (#2753)
• add a trademark policy (#2561) (#2752)

Internal

• cut v0.110.0 — sentinel SSH enforce routing, SSH key rotation, process guardrail (miner signatures, exec telemetry), guardrail status, streamed backups (#2863)
• stabilize ConnMux routing test (#2760) (#2819)
• exempt intentional opt-in skips from the no-skip guard by exact name (#2847) (#2848)
• add pinned OpenSSF Scorecard measurement and baseline (#2791) (#2827)
• verify published chart installs and upgrades (#2818)
• verify published signatures and release asset completeness (#2561) (#2822)
• isolate PostgreSQL store tests per schema (#2749) (#2829)
• serialize Postgres tests sharing traffic schema (#2693) (#2695)
• list agent-runtime bundle and Helm chart in SHA256SUMS.txt (#2702) (#2722)
• bump cloud.google.com/go/compute from 1.72.0 to 1.73.0 (#2712)
• bump github.com/grpc-ecosystem/grpc-gateway/v2 (#2708)
• bump github.com/mark3labs/mcp-go from 1.2.1 to 1.3.0 (#2705)
• bump sigs.k8s.io/agent-sandbox from 1.0.5 to 1.0.6 (#2502)
• bump hashicorp/setup-terraform from 3 to 4 (#2713)
• drop the setsid shim so StopBoxRun sees a real process group
• gate and attribute the web UI and agent-runtime npm dependencies (#2754) (#2761)
• bump actions/upload-artifact from 6 to 7 (#2710)
• sign every release file with keyless cosign (#2561) (#2750)

Other

• [#2820] fix(threatdetect): deliver per-box responses on a shared finding and keep it open while any box is throttled (#2831)
• [#2711] docs(qa): W44 process guardrail verification pass 2 on d287d80 (#2821)
• [#2639] docs(security): PROCESS-GUARDRAIL operator guide (half A; exec telemetry and signature sections pending) (#2716)
• [#2769] test(helm): cover the sshpiper appVersion default via a packaged chart (#2817)
• [#2775] fix(threatdetect): deliver a miner kill through the finding webhook (#2789)
• [#2774] fix(netbpf): batch exec ring wakeups so telemetry stays under the CPU bar (#2812)
• [#2773] fix(gateway): let streaming responses flush through the audit and metrics middleware (#2788)
• [#2711] docs(qa): W44 process guardrail verification evidence on dbbf801 (#2777)
• [#2766] fix(server): check a queued response's release per container (#2772)
• [#2638] feat(threatdetect): miner-signature rule and optional kill-process (#2759)
• [#2637] feat(netbpf): execwatch eBPF object, build and loader for exec telemetry (part A) (#2724)
• [#2718] fix(threatdetect): deliver response transitions (applied/failed/released/expired) to the webhook (#2745)

Full diff: v0.109.0...v0.110.0

---

Containarium v0.110.0

The open-source, self-hostable, agent-native sandbox.

Binaries

Four binaries ship in this release:

Binary	Where it runs	What it does
containariumd	The host	The platform daemon plus host-side admin commands.
containarium	Your laptop / CI (linux, macOS, windows)	The client CLI: create, list, expose-port, ssh-config, etc. against a server (--server).
mcp-server	Your laptop	The platform MCP — outside-the-box admin (create_container, list_containers, expose_port, list_backends). Wire it into Claude Code / Cursor.
agent-box	Inside each Containarium container	The in-the-box MCP — shell_exec, read_file, write_file, etc. Reached over stdio, typically via SSH.

Quick install (Linux host)

curl -fsSL https://raw.githubusercontent.com/footprintai/containarium/main/hacks/install.sh | sudo bash

Manual install (any binary, any platform)

# containariumd daemon (Linux x86_64 host)
curl -L -o /usr/local/bin/containariumd \
  https://github.com/footprintai/containarium/releases/download/v0.110.0/containariumd-linux-amd64
chmod +x /usr/local/bin/containariumd
ln -sf /usr/local/bin/containariumd /usr/local/bin/containarium

# containarium client CLI (your laptop, e.g. macOS arm64)
curl -L -o /usr/local/bin/containarium \
  https://github.com/footprintai/containarium/releases/download/v0.110.0/containarium-darwin-arm64
chmod +x /usr/local/bin/containarium

# Windows: the same client CLI (create/list/ssh/… against a remote server)
# PowerShell:
#   curl.exe -L -o containarium.exe `
#     https://github.com/footprintai/containarium/releases/download/v0.110.0/containarium-windows-amd64.exe

# platform MCP (your laptop, e.g. macOS arm64)
curl -L -o /usr/local/bin/mcp-server \
  https://github.com/footprintai/containarium/releases/download/v0.110.0/mcp-server-darwin-arm64
chmod +x /usr/local/bin/mcp-server

# agent-box (drop into your container image, Linux x86_64)
curl -L -o /usr/local/bin/agent-box \
  https://github.com/footprintai/containarium/releases/download/v0.110.0/agent-box-linux-amd64
chmod +x /usr/local/bin/agent-box

Verify checksums via SHA256SUMS.txt.

SBOMs

Each Linux binary has an SPDX 2.3 SBOM next to it (<binary>-linux-amd64.spdx.json), generated from the shipped file and listed in SHA256SUMS.txt. The container images carry their own SBOM and provenance attestations.

Signatures

Every file on this page has a keyless cosign signature next to it, <file>.sigstore.json, made by this release workflow through GitHub OIDC. Verify with cosign verify-blob --bundle <file>.sigstore.json --certificate-identity https://github.com/FootprintAI/Containarium/.github/workflows/release.yml@refs/tags/v0.110.0 --certificate-oidc-issuer https://token.actions.githubusercontent.com <file>. See docs/security/VERIFYING-RELEASES.md.

Kubernetes (Helm)

Chart version 0.110.0 (installs the v0.110.0 daemon image):

helm install containarium oci://ghcr.io/footprintai/charts/containarium-k8s \
  --version 0.110.0 \
  --set daemon.jwtSecret="$(openssl rand -hex 24)" \
  --set gateway.upstreamKeySecret=sshpiper-upstream-key \
  --set-file gateway.upstreamPublicKey=./sshpiper_upstream.pub

MCP client setup

Wire the platform MCP into Claude Code (~/.claude.json):

{
  "mcpServers": {
    "containarium": {
      "command": "/usr/local/bin/mcp-server",
      "env": {
        "CONTAINARIUM_SERVER_URL": "http://your-host:8080",
        "CONTAINARIUM_JWT_TOKEN": "<your-token>"
      }
    }
  }
}

Wire agent-box for in-the-box file/shell ops:

{
  "mcpServers": {
    "containarium-box": {
      "command": "ssh",
      "args": ["user@your-box", "agent-box"]
    }
  }
}

See README.md for the full agent-native walkthrough.