Containarium v0.119.0

What changed

Added

• refuse --github-tag older than the running version unless --allow-downgrade (#3059) (#3086)
• whole-box create path for backup create --box (#2801 PR B) (#3099)
• status reports KERNEL_UNSUPPORTED below the TCX kernel floor (#2972) (#3054)
• device approval on the same connection in the enforcing plugin (#3073)
• streamed instance export/import seam for whole-box backup (#2801 PR A) (#3072)

Fixed

• re-prompt once for the final JSON after a run that changed files (#2513) (#3098)
• default Node.js apps to Node 22, not EOL Node 20 (#3101)
• fail the air-gapped bundle on an empty apt/, and fill it (#3061) (#3076)
• enforce a token scope on TriggerUpgrade and GetUpgradeStatus (#3057) (#3067)

Documentation

• ssh-authz wording and evicted-decision audit records (#2845) (#3082)
• fix the blocking steps in the AUTH secret rotation runbook (#2890) (#3081)

Internal

• cut v0.119.0 — whole-box backup create, SSH device approval on the same connection, agent-run final-JSON re-prompt, air-gapped bundle fix (#3102)
• bump sigs.k8s.io/agent-sandbox from 1.0.6 to 1.0.8 (#3090)
• bump github/codeql-action/upload-sarif (#3093)
• bump actions/setup-python from 7.0.0 to 7.1.0 (#3096)
• bump actions/download-artifact from 8.0.1 to 8.0.2 (#3095)
• bump docker/login-action from 4.6.0 to 4.7.0 (#3094)
• bump aquasecurity/trivy-action (#3088)
• bump github.com/pires/go-proxyproto from 0.15.0 to 0.16.0 (#3092)
• bump google.golang.org/api from 0.304.0 to 0.308.0 (#3091)
• bump cloud.google.com/go/compute from 1.73.0 to 1.74.0 (#3089)
• device approval on the real sshpiperd chain with stock OpenSSH (#3075)
• raise sshpiperd login grace to 90s for device approval (#3074)

Other

• docs/ci: ssh-authz grace wording, stale Component 3, pin sshpiperd sha256 (#3087)

Full diff: v0.118.0...v0.119.0

---

Containarium v0.119.0

The open-source, self-hostable, agent-native sandbox.

Binaries

Four binaries ship in this release:

Binary	Where it runs	What it does
containariumd	The host	The platform daemon plus host-side admin commands.
containarium	Your laptop / CI (linux, macOS, windows)	The client CLI: create, list, expose-port, ssh-config, etc. against a server (--server).
mcp-server	Your laptop	The platform MCP — outside-the-box admin (create_container, list_containers, expose_port, list_backends). Wire it into Claude Code / Cursor.
agent-box	Inside each Containarium container	The in-the-box MCP — shell_exec, read_file, write_file, etc. Reached over stdio, typically via SSH.

Quick install (Linux host)

curl -fsSL https://raw.githubusercontent.com/footprintai/containarium/v0.119.0/hacks/install.sh | sudo bash

Manual install (any binary, any platform)

# containariumd daemon (Linux x86_64 host)
curl -L -o /usr/local/bin/containariumd \
  https://github.com/footprintai/containarium/releases/download/v0.119.0/containariumd-linux-amd64
chmod +x /usr/local/bin/containariumd
ln -sf /usr/local/bin/containariumd /usr/local/bin/containarium

# containarium client CLI (your laptop, e.g. macOS arm64)
curl -L -o /usr/local/bin/containarium \
  https://github.com/footprintai/containarium/releases/download/v0.119.0/containarium-darwin-arm64
chmod +x /usr/local/bin/containarium

# Windows: the same client CLI (create/list/ssh/… against a remote server)
# PowerShell:
#   curl.exe -L -o containarium.exe `
#     https://github.com/footprintai/containarium/releases/download/v0.119.0/containarium-windows-amd64.exe

# platform MCP (your laptop, e.g. macOS arm64)
curl -L -o /usr/local/bin/mcp-server \
  https://github.com/footprintai/containarium/releases/download/v0.119.0/mcp-server-darwin-arm64
chmod +x /usr/local/bin/mcp-server

# agent-box (drop into your container image, Linux x86_64)
curl -L -o /usr/local/bin/agent-box \
  https://github.com/footprintai/containarium/releases/download/v0.119.0/agent-box-linux-amd64
chmod +x /usr/local/bin/agent-box

Verify checksums via SHA256SUMS.txt.

SBOMs

Each Linux binary has an SPDX 2.3 SBOM next to it (<binary>-linux-amd64.spdx.json), generated from the shipped file and listed in SHA256SUMS.txt. The container images carry their own SBOM and provenance attestations.

Signatures

Every file on this page has a keyless cosign signature next to it, <file>.sigstore.json, made by this release workflow through GitHub OIDC. Verify with cosign verify-blob --bundle <file>.sigstore.json --certificate-identity https://github.com/FootprintAI/Containarium/.github/workflows/release.yml@refs/tags/v0.119.0 --certificate-oidc-issuer https://token.actions.githubusercontent.com <file>. See docs/security/VERIFYING-RELEASES.md.

Kubernetes (Helm)

Chart version 0.119.0 (installs the v0.119.0 daemon image):

helm install containarium oci://ghcr.io/footprintai/charts/containarium-k8s \
  --version 0.119.0 \
  --set daemon.jwtSecret="$(openssl rand -hex 24)" \
  --set gateway.upstreamKeySecret=sshpiper-upstream-key \
  --set-file gateway.upstreamPublicKey=./sshpiper_upstream.pub

MCP client setup

Wire the platform MCP into Claude Code (~/.claude.json):

{
  "mcpServers": {
    "containarium": {
      "command": "/usr/local/bin/mcp-server",
      "env": {
        "CONTAINARIUM_SERVER_URL": "http://your-host:8080",
        "CONTAINARIUM_JWT_TOKEN": "<your-token>"
      }
    }
  }
}

Wire agent-box for in-the-box file/shell ops:

{
  "mcpServers": {
    "containarium-box": {
      "command": "ssh",
      "args": ["user@your-box", "agent-box"]
    }
  }
}

See README.md for the full agent-native walkthrough.