Containarium v0.115.0

What changed

Added

• a retention.sweep.result entry names the chain base a purge ended on; document that the base outlives its authorising entries (#2979) (#2988)
• report whether the kernel supports TCX egress enforcement (#2982)
• report the applied network-policy state per tenant (#2978)
• separate egress mode for the egress allow-list (#2974)
• purge the hash-chained audit_logs as a prefix with a stored chain base (#2878, #2420) (#2977)
• enforce mode that deletes expired records from the non-chained stores (#2877) (#2962)
• export ZFS pool fragmentation and zpool capacity per storage pool (#2853) (#2969)
• /status reports per-primary auth health (#2892) (#2916)
• the run wrapper records the toolchain available to a run, token-free (#2954) (#2955)
• verify-anchor checks the bucket's anchors (#2881) (#2959)
• record each proxied model call per run and return it with the run log (#2928) (#2965)
• dry-run sweeper and retention report for the non-chained stores (#2876) (#2960)
• apply the tool-access level to an unprivileged run as CLI flags (part of #2944, slice 2) (#2951)
• run platform-started runs as an unprivileged user once a level is recorded (part of #2944, slice 1b) (#2949)
• record a per-box tool-access level for platform-started runs (part of #2944, slice 1a) (#2948)

Fixed

• status reports partial coverage and a stalled reconciler (#2971) (#2984)
• a failed create removes the jump account it made; the guard skips a box removed mid-pass (part of #2850) (#2967)
• bound the gcloud call in the GCS anchor sink (#2912) (#2958)
• a member whose serve mode fails to start fails the run, naming it (#2936) (#2966)
• validate a peer-bound create against the peer's stack catalog (#2952) (#2964)
• --force validates against the daemon before it deletes (#2925) (#2961)
• pin --force ordering, copy podman_enabled in clients, review nits (#2858 #2859 #2860) (#2946)
• review fixes for InstallStack stack recording (#2859) (#2926)
• review fixes - forward peer creates, validate before --force in local mode, cap stack length, changelog, proto comment (#2860) (#2927)
• store PodmanEnabled at create and read it back (#2914)

Documentation

• name every surface the kernel TCX posture check reaches; pin parser edge cases (#2986)

Internal

• cut v0.115.0 — separate egress mode, applied-state report, kernel TCX posture, audit-log retention, unprivileged platform runs (#2991)
• planted bucket checkpoint below the chain base fails verify-anchor; purge bound is the lower anchor (#2980) (#2985)
• make the box-run test harness hermetic so a run does not wait on the host's tools (#2973) (#2975)
• cover the tool-access HTTP client (wire format, 404 degrade, GetContainer decode) (#2950)
• isolate the credential store and never print a token (#2922) (#2929)

Full diff: v0.114.3...v0.115.0

---

Containarium v0.115.0

The open-source, self-hostable, agent-native sandbox.

Binaries

Four binaries ship in this release:

Binary	Where it runs	What it does
containariumd	The host	The platform daemon plus host-side admin commands.
containarium	Your laptop / CI (linux, macOS, windows)	The client CLI: create, list, expose-port, ssh-config, etc. against a server (--server).
mcp-server	Your laptop	The platform MCP — outside-the-box admin (create_container, list_containers, expose_port, list_backends). Wire it into Claude Code / Cursor.
agent-box	Inside each Containarium container	The in-the-box MCP — shell_exec, read_file, write_file, etc. Reached over stdio, typically via SSH.

Quick install (Linux host)

curl -fsSL https://raw.githubusercontent.com/footprintai/containarium/main/hacks/install.sh | sudo bash

Manual install (any binary, any platform)

# containariumd daemon (Linux x86_64 host)
curl -L -o /usr/local/bin/containariumd \
  https://github.com/footprintai/containarium/releases/download/v0.115.0/containariumd-linux-amd64
chmod +x /usr/local/bin/containariumd
ln -sf /usr/local/bin/containariumd /usr/local/bin/containarium

# containarium client CLI (your laptop, e.g. macOS arm64)
curl -L -o /usr/local/bin/containarium \
  https://github.com/footprintai/containarium/releases/download/v0.115.0/containarium-darwin-arm64
chmod +x /usr/local/bin/containarium

# Windows: the same client CLI (create/list/ssh/… against a remote server)
# PowerShell:
#   curl.exe -L -o containarium.exe `
#     https://github.com/footprintai/containarium/releases/download/v0.115.0/containarium-windows-amd64.exe

# platform MCP (your laptop, e.g. macOS arm64)
curl -L -o /usr/local/bin/mcp-server \
  https://github.com/footprintai/containarium/releases/download/v0.115.0/mcp-server-darwin-arm64
chmod +x /usr/local/bin/mcp-server

# agent-box (drop into your container image, Linux x86_64)
curl -L -o /usr/local/bin/agent-box \
  https://github.com/footprintai/containarium/releases/download/v0.115.0/agent-box-linux-amd64
chmod +x /usr/local/bin/agent-box

Verify checksums via SHA256SUMS.txt.

SBOMs

Each Linux binary has an SPDX 2.3 SBOM next to it (<binary>-linux-amd64.spdx.json), generated from the shipped file and listed in SHA256SUMS.txt. The container images carry their own SBOM and provenance attestations.

Signatures

Every file on this page has a keyless cosign signature next to it, <file>.sigstore.json, made by this release workflow through GitHub OIDC. Verify with cosign verify-blob --bundle <file>.sigstore.json --certificate-identity https://github.com/FootprintAI/Containarium/.github/workflows/release.yml@refs/tags/v0.115.0 --certificate-oidc-issuer https://token.actions.githubusercontent.com <file>. See docs/security/VERIFYING-RELEASES.md.

Kubernetes (Helm)

Chart version 0.115.0 (installs the v0.115.0 daemon image):

helm install containarium oci://ghcr.io/footprintai/charts/containarium-k8s \
  --version 0.115.0 \
  --set daemon.jwtSecret="$(openssl rand -hex 24)" \
  --set gateway.upstreamKeySecret=sshpiper-upstream-key \
  --set-file gateway.upstreamPublicKey=./sshpiper_upstream.pub

MCP client setup

Wire the platform MCP into Claude Code (~/.claude.json):

{
  "mcpServers": {
    "containarium": {
      "command": "/usr/local/bin/mcp-server",
      "env": {
        "CONTAINARIUM_SERVER_URL": "http://your-host:8080",
        "CONTAINARIUM_JWT_TOKEN": "<your-token>"
      }
    }
  }
}

Wire agent-box for in-the-box file/shell ops:

{
  "mcpServers": {
    "containarium-box": {
      "command": "ssh",
      "args": ["user@your-box", "agent-box"]
    }
  }
}

See README.md for the full agent-native walkthrough.