Containarium v0.123.0

What changed

Added

• shared late-install helper for Postgres-backed store families (#3326) (#3336)
• StartBoxRun command mode runs a shell command as the run user, no engine (closes #3322) (#3323)
• --peers accepts id=host:port so a static peer can be a move target (#3324)
• a model_overrides argument on the run_crew tool (#3265) (#3316)
• carry model_overrides to the nodes of a graph run (#3264) (#3317)
• sweep stale per-run checkouts of platform runs, plus code sweep-checkouts (#3296) (#3303)
• SubmitTrackerChangeFiles appends to an existing head branch and reuses its open change (#3293)
• share pinned read-only build tools across boxes (#3285)

Fixed

• decode protobuf system info and show memory (#3292) (#3314)
• decode quoted int64 fields in SystemInfo over HTTP (#3252)
• support Debian 13 as a host OS (#3291)
• retain degraded health after failed Postgres startup (#3309)
• retry transient reads while waiting for the box to suspend for a volume change (#3298)
• keep backend outages from triggering watchdog restarts (#3227)
• require backups:verify after the migration window (#3219) (#3228)
• wait for volume-change suspension before resuming (#3282)
• stop exporting backup age for tenants with no container on the host (refs #3234) (#3240)

Documentation

• file #3322, #3324 and #3326 under 0.123.0 (#3337)
• record that a failed volume-change suspension has no automatic recovery (#3297) (#3320)
• document recovery after failed volume suspension (#3311)
• state that v0.120.1 through v0.122.0 accepted legacy verifier tokens (#3290)

Internal

• cut v0.123.0 — per-member model overrides on MCP and graph runs, shared build tools, Debian 13 hosts, sentinel outage watchdog fix (#3321)
• pin the graph node model wiring, document it (#3264) (#3318)
• pin managed-key detection over HTTP with gateway-shaped int64 bodies (#3312) (#3313)
• newTestPubKey must not return keys the placeholder check rejects (#3301)
• genKey must not return keys the placeholder check rejects (#3295)
• remove deprecated bridge-DNS flags (#2735) (#3273)
• pin fail-open residue after an unreadable master (#3283) (#3286)

Full diff: v0.122.0...v0.123.0

---

Containarium v0.123.0

The open-source, self-hostable, agent-native sandbox.

Binaries

Four binaries ship in this release:

Binary	Where it runs	What it does
containariumd	The host	The platform daemon plus host-side admin commands.
containarium	Your laptop / CI (linux, macOS, windows)	The client CLI: create, list, expose-port, ssh-config, etc. against a server (--server).
mcp-server	Your laptop	The platform MCP — outside-the-box admin (create_container, list_containers, expose_port, list_backends). Wire it into Claude Code / Cursor.
agent-box	Inside each Containarium container	The in-the-box MCP — shell_exec, read_file, write_file, etc. Reached over stdio, typically via SSH.

Quick install (Linux host)

curl -fsSL https://raw.githubusercontent.com/footprintai/containarium/v0.123.0/hacks/install.sh | sudo bash

Manual install (any binary, any platform)

# containariumd daemon (Linux x86_64 host)
curl -L -o /usr/local/bin/containariumd \
  https://github.com/footprintai/containarium/releases/download/v0.123.0/containariumd-linux-amd64
chmod +x /usr/local/bin/containariumd
ln -sf /usr/local/bin/containariumd /usr/local/bin/containarium

# containarium client CLI (your laptop, e.g. macOS arm64)
curl -L -o /usr/local/bin/containarium \
  https://github.com/footprintai/containarium/releases/download/v0.123.0/containarium-darwin-arm64
chmod +x /usr/local/bin/containarium

# Windows: the same client CLI (create/list/ssh/… against a remote server)
# PowerShell:
#   curl.exe -L -o containarium.exe `
#     https://github.com/footprintai/containarium/releases/download/v0.123.0/containarium-windows-amd64.exe

# platform MCP (your laptop, e.g. macOS arm64)
curl -L -o /usr/local/bin/mcp-server \
  https://github.com/footprintai/containarium/releases/download/v0.123.0/mcp-server-darwin-arm64
chmod +x /usr/local/bin/mcp-server

# agent-box (drop into your container image, Linux x86_64)
curl -L -o /usr/local/bin/agent-box \
  https://github.com/footprintai/containarium/releases/download/v0.123.0/agent-box-linux-amd64
chmod +x /usr/local/bin/agent-box

Verify checksums via SHA256SUMS.txt.

SBOMs

Each Linux binary has an SPDX 2.3 SBOM next to it (<binary>-linux-amd64.spdx.json), generated from the shipped file and listed in SHA256SUMS.txt. The container images carry their own SBOM and provenance attestations.

Managed build tools

Each host installs one toolchains-linux-<arch>.tar.gz alongside its daemon release. The archive contains an installer, the pinned tool inventory, and the shared tools. Verify its signature and checksum before extracting, then run sudo bash install.sh from the extracted directory. See managed toolchains for installation and rollback. Each architecture has an SPDX SBOM; the release build scans both trees.

Signatures

Every file on this page has a keyless cosign signature next to it, <file>.sigstore.json, made by this release workflow through GitHub OIDC. Verify with cosign verify-blob --bundle <file>.sigstore.json --certificate-identity https://github.com/FootprintAI/Containarium/.github/workflows/release.yml@refs/tags/v0.123.0 --certificate-oidc-issuer https://token.actions.githubusercontent.com <file>. See docs/security/VERIFYING-RELEASES.md.

Kubernetes (Helm)

Chart version 0.123.0 (installs the v0.123.0 daemon image):

helm install containarium oci://ghcr.io/footprintai/charts/containarium-k8s \
  --version 0.123.0 \
  --set daemon.jwtSecret="$(openssl rand -hex 24)" \
  --set gateway.upstreamKeySecret=sshpiper-upstream-key \
  --set-file gateway.upstreamPublicKey=./sshpiper_upstream.pub

MCP client setup

Wire the platform MCP into Claude Code (~/.claude.json):

{
  "mcpServers": {
    "containarium": {
      "command": "/usr/local/bin/mcp-server",
      "env": {
        "CONTAINARIUM_SERVER_URL": "http://your-host:8080",
        "CONTAINARIUM_JWT_TOKEN": "<your-token>"
      }
    }
  }
}

Wire agent-box for in-the-box file/shell ops:

{
  "mcpServers": {
    "containarium-box": {
      "command": "ssh",
      "args": ["user@your-box", "agent-box"]
    }
  }
}

See README.md for the full agent-native walkthrough.