Containarium v0.120.0

What changed

Added

• require a code:answer scope to answer permission requests (#3191) (#3204)
• signer rotate/revoke/bundle and verify --trust-bundle (#3206)
• guarded native network Tenant membership and scoped atomic Tenant access updates (#3165)
• signer revocation and expected_revision on the server policy (part of #2729) (#3152)
• add RWX shared volume backend (#3167) (#3174)
• RFC 3161 timestamp-authority anchor sink for verify-anchor (#3150)
• define CSI snapshot backup destination (#3168) (#3178)
• validate local task node resource requirements (#3177)
• report structured host security posture (#2328) (#3170)
• support multi-source skill locks (#3048) (#3171)
• SetSSHKeys replace-all RPC for a box user's authorized keys (#3137)
• select SDLC skill sets by id instead of the sdlc_skills boolean (#3139)
• bound REST actuation connection lifetime via transport swap (#3157)
• find which box connected to a destination across boxes (#2884) (#3140)
• status reports whether a tenant runs the host default or a stored policy (#2996) (#3151)
• refuse creates and snapshots past a pool headroom floor (#3145)
• VerifyProofPack RPC so a client can verify a sealed pack (#3138)
• GetTrackerStatus reports the credential kind as a typed enum (#2993) (#3111)

Fixed

• decode box-run responses with DiscardUnknown (#3197)
• sentinel health check polls the whole window (part of #3108) (#3198)
• code status reads the whole approval journal (#3182) (#3201)
• lanes wait for a ready daemon, not just a bound port (#3195)
• sweep stale whole-box spill files; strengthen spill tests and lane (#3126) (#3161)
• pre-flight ZAP install check before enqueuing scans (#3078) (#3147)
• serialize whole-box backups per box, reserve space across boxes (#3160)
• #2618 round-2 review items — unmarked frames fail closed, routed test that can fail, lease cross-check, reseed signal (#3184)
• preserve container timezones across daemon restarts (#3176)
• decode protobuf capability profile responses (#3173)
• replies to inbound connections + source validation (part of #2618) (#3163)
• bound APT_BATCH_SIZE to 1-500 and reject anything else (#3155) (#3158)
• code run reports the baseline scan when no guardrail policy is configured (#3134)
• re-prompt follow-ups from #3098 review (#3135)
• attest the exec-watch BPF object in the self-measurement (#3136)
• bind the HTTP port before the startup waits and report degraded (#3143)
• refuse operator mutations while on the in-memory fallback store (#3131) (#3144)
• redact pool from unsigned /sentinel/peers callers (#3119) (#3142)
• warn on stale sshpiperd unit without --login-grace-time (part of #3125) (#3133)
• verify the sshpiperd tarball sha256 in the startup scripts (#3117)
• keep a kept hard link's content when its target is excluded; deflake the Incus export lane (#2801) (#3115)
• recycle REST client connection after repeated 5xx (#3106)
• self-measurement digests the embedded BPF object (#3110)
• /status auth-health counts only; per-pool detail behind AUTH gate (#3109)
• report a failed restore honestly instead of claiming a rollback (#3060) (#3112)
• the control-plane sink carries egress_mode, so a log-only soak is not enforced (#2994) (#3053)

Documentation

• draft Containarium vs. sandbox-runtime comparison (#3208)
• design hosted subdomain claims (#2145) (#3175)
• state that the enforce-mode unit does not pass --sshpiper-config (#2843) (#3104)

Internal

• cut v0.120.0 — agent permission requests (pause, answer, phone push), guardrail signer rotation and trust bundles, RWX shared volumes, SetSSHKeys; bridge-DNS status surface removed (#3218)
• remove the bridge-DNS reconciler and record writer; flags become no-ops (#2734) (#3162)
• bump golang.org/x/net to v0.62.0 (GO-2026-6866, GO-2026-6860) (#3205) (#3207)
• fix flaky peer-pool discovery test under -race (#3192) (#3193)
• scope decision table covers every BackupService RPC (#2401) (#3148)
• restore deletion checks after bridge-DNS removal (#3172)
• remove the bridge-DNS status RPC, CLI, MCP tool and alert (#2733) (#3149)
• document verify-release as the rollout gate and pin it in a test (#3156) (#3159)
• prove the storage pool fill alert fires on a synthetic series and routes to the operator webhook (#3129) (#3141)
• bound build-bundle, batch apt downloads, sign the binary without waiting on the bundle (#3123)
• prove the tunnel gate fails against a sentinel with no identity (#2469) (#3124)
• close wire-level gaps in device approval (#3114)
• deploy-binary.sh keeps .old and checks health; Helm lane tests rollback (#3097)

Other

• [#2185] feat(notify): push a waiting permission request to the phone via ntfy (#3189)
• [#2184] feat(code): answer a run's permission requests (code pending, code answer) (#3188)
• [#2183] feat(code): pause a run on a permission request with --approvals ask (#3183)
• security(sshauthz): bound and cancel the device-approval poll; audit prompts never answered (#3084) (#3127)

Full diff: v0.119.0...v0.120.0

---

Containarium v0.120.0

The open-source, self-hostable, agent-native sandbox.

Binaries

Four binaries ship in this release:

Binary	Where it runs	What it does
containariumd	The host	The platform daemon plus host-side admin commands.
containarium	Your laptop / CI (linux, macOS, windows)	The client CLI: create, list, expose-port, ssh-config, etc. against a server (--server).
mcp-server	Your laptop	The platform MCP — outside-the-box admin (create_container, list_containers, expose_port, list_backends). Wire it into Claude Code / Cursor.
agent-box	Inside each Containarium container	The in-the-box MCP — shell_exec, read_file, write_file, etc. Reached over stdio, typically via SSH.

Quick install (Linux host)

curl -fsSL https://raw.githubusercontent.com/footprintai/containarium/v0.120.0/hacks/install.sh | sudo bash

Manual install (any binary, any platform)

# containariumd daemon (Linux x86_64 host)
curl -L -o /usr/local/bin/containariumd \
  https://github.com/footprintai/containarium/releases/download/v0.120.0/containariumd-linux-amd64
chmod +x /usr/local/bin/containariumd
ln -sf /usr/local/bin/containariumd /usr/local/bin/containarium

# containarium client CLI (your laptop, e.g. macOS arm64)
curl -L -o /usr/local/bin/containarium \
  https://github.com/footprintai/containarium/releases/download/v0.120.0/containarium-darwin-arm64
chmod +x /usr/local/bin/containarium

# Windows: the same client CLI (create/list/ssh/… against a remote server)
# PowerShell:
#   curl.exe -L -o containarium.exe `
#     https://github.com/footprintai/containarium/releases/download/v0.120.0/containarium-windows-amd64.exe

# platform MCP (your laptop, e.g. macOS arm64)
curl -L -o /usr/local/bin/mcp-server \
  https://github.com/footprintai/containarium/releases/download/v0.120.0/mcp-server-darwin-arm64
chmod +x /usr/local/bin/mcp-server

# agent-box (drop into your container image, Linux x86_64)
curl -L -o /usr/local/bin/agent-box \
  https://github.com/footprintai/containarium/releases/download/v0.120.0/agent-box-linux-amd64
chmod +x /usr/local/bin/agent-box

Verify checksums via SHA256SUMS.txt.

SBOMs

Each Linux binary has an SPDX 2.3 SBOM next to it (<binary>-linux-amd64.spdx.json), generated from the shipped file and listed in SHA256SUMS.txt. The container images carry their own SBOM and provenance attestations.

Signatures

Every file on this page has a keyless cosign signature next to it, <file>.sigstore.json, made by this release workflow through GitHub OIDC. Verify with cosign verify-blob --bundle <file>.sigstore.json --certificate-identity https://github.com/FootprintAI/Containarium/.github/workflows/release.yml@refs/tags/v0.120.0 --certificate-oidc-issuer https://token.actions.githubusercontent.com <file>. See docs/security/VERIFYING-RELEASES.md.

Kubernetes (Helm)

Chart version 0.120.0 (installs the v0.120.0 daemon image):

helm install containarium oci://ghcr.io/footprintai/charts/containarium-k8s \
  --version 0.120.0 \
  --set daemon.jwtSecret="$(openssl rand -hex 24)" \
  --set gateway.upstreamKeySecret=sshpiper-upstream-key \
  --set-file gateway.upstreamPublicKey=./sshpiper_upstream.pub

MCP client setup

Wire the platform MCP into Claude Code (~/.claude.json):

{
  "mcpServers": {
    "containarium": {
      "command": "/usr/local/bin/mcp-server",
      "env": {
        "CONTAINARIUM_SERVER_URL": "http://your-host:8080",
        "CONTAINARIUM_JWT_TOKEN": "<your-token>"
      }
    }
  }
}

Wire agent-box for in-the-box file/shell ops:

{
  "mcpServers": {
    "containarium-box": {
      "command": "ssh",
      "args": ["user@your-box", "agent-box"]
    }
  }
}

See README.md for the full agent-native walkthrough.