Containarium v0.125.0

What changed

Added

• alert and credential-watch stores install in-process after a degraded start (#3334) (#3405)
• passthrough store and sync job install in-process after a degraded start (#3333) (#3403)
• verify a whole-box backup by restoring it into a scratch box (#2802) (#3394)
• restore a whole-box backup into a new box, streamed and bounded (#3357) (#3380)
• proto contract for restoring a whole-box backup (#3356) (#3373)

Fixed

• restart a preempted --watch-spot-vm target; poll status as a safety net (#3377) (#3382)
• headless run refuses git fetch/clone options that run a program (#3397) (#3399)
• launch Windows browser via rundll32 and validate the login URL (#3349) (#3392)
• allow read-only -C/--git-dir/--work-tree git forms in headless runs (#3385) (#3393)
• a config-refused store family does not hold the self-restart (#3378) (#3388)
• gateway revocation checks and cleanup follow a late-installed revocation list (#3365) (#3379)
• warn before BUILD_TOOLS runs are refused on a host with no toolchain release (#3375)
• verify backend SSH host keys (#3362)
• find the core Caddy by role label, not a name substring (#3371) (#3372)

Documentation

• record gateway revocation recovery and fix stale changelog notes (#3383) (#3384)
• name the managed toolchain install in the v0.123.0 upgrade notes (#3361) (#3376)

Internal

• cut v0.125.0 — preempted watch-spot-vm restart, sentinel backend host-key pins (needs pin file), whole-box backup restore and verify, late-install recovery families (#3408)
• pin aquasecurity/trivy-action to the v0.36.0 release commit (#3402)
• verification harness for #3213 managed-key detection against published releases (#3307)

Full diff: v0.124.0...v0.125.0

---

Containarium v0.125.0

The open-source, self-hostable, agent-native sandbox.

Binaries

Four binaries ship in this release:

Binary	Where it runs	What it does
containariumd	The host	The platform daemon plus host-side admin commands.
containarium	Your laptop / CI (linux, macOS, windows)	The client CLI: create, list, expose-port, ssh-config, etc. against a server (--server).
mcp-server	Your laptop	The platform MCP — outside-the-box admin (create_container, list_containers, expose_port, list_backends). Wire it into Claude Code / Cursor.
agent-box	Inside each Containarium container	The in-the-box MCP — shell_exec, read_file, write_file, etc. Reached over stdio, typically via SSH.

Quick install (Linux host)

curl -fsSL https://raw.githubusercontent.com/footprintai/containarium/v0.125.0/hacks/install.sh | sudo bash

Manual install (any binary, any platform)

# containariumd daemon (Linux x86_64 host)
curl -L -o /usr/local/bin/containariumd \
  https://github.com/footprintai/containarium/releases/download/v0.125.0/containariumd-linux-amd64
chmod +x /usr/local/bin/containariumd
ln -sf /usr/local/bin/containariumd /usr/local/bin/containarium

# containarium client CLI (your laptop, e.g. macOS arm64)
curl -L -o /usr/local/bin/containarium \
  https://github.com/footprintai/containarium/releases/download/v0.125.0/containarium-darwin-arm64
chmod +x /usr/local/bin/containarium

# Windows: the same client CLI (create/list/ssh/… against a remote server)
# PowerShell:
#   curl.exe -L -o containarium.exe `
#     https://github.com/footprintai/containarium/releases/download/v0.125.0/containarium-windows-amd64.exe

# platform MCP (your laptop, e.g. macOS arm64)
curl -L -o /usr/local/bin/mcp-server \
  https://github.com/footprintai/containarium/releases/download/v0.125.0/mcp-server-darwin-arm64
chmod +x /usr/local/bin/mcp-server

# agent-box (drop into your container image, Linux x86_64)
curl -L -o /usr/local/bin/agent-box \
  https://github.com/footprintai/containarium/releases/download/v0.125.0/agent-box-linux-amd64
chmod +x /usr/local/bin/agent-box

Verify checksums via SHA256SUMS.txt.

SBOMs

Each Linux binary has an SPDX 2.3 SBOM next to it (<binary>-linux-amd64.spdx.json), generated from the shipped file and listed in SHA256SUMS.txt. The container images carry their own SBOM and provenance attestations.

Managed build tools

Each host installs one toolchains-linux-<arch>.tar.gz alongside its daemon release. The archive contains an installer, the pinned tool inventory, and the shared tools. Verify its signature and checksum before extracting, then run sudo bash install.sh from the extracted directory. See managed toolchains for installation and rollback. Each architecture has an SPDX SBOM; the release build scans both trees.

Signatures

Every file on this page has a keyless cosign signature next to it, <file>.sigstore.json, made by this release workflow through GitHub OIDC. Verify with cosign verify-blob --bundle <file>.sigstore.json --certificate-identity https://github.com/FootprintAI/Containarium/.github/workflows/release.yml@refs/tags/v0.125.0 --certificate-oidc-issuer https://token.actions.githubusercontent.com <file>. See docs/security/VERIFYING-RELEASES.md.

Kubernetes (Helm)

Chart version 0.125.0 (installs the v0.125.0 daemon image):

helm install containarium oci://ghcr.io/footprintai/charts/containarium-k8s \
  --version 0.125.0 \
  --set daemon.jwtSecret="$(openssl rand -hex 24)" \
  --set gateway.upstreamKeySecret=sshpiper-upstream-key \
  --set-file gateway.upstreamPublicKey=./sshpiper_upstream.pub

MCP client setup

Wire the platform MCP into Claude Code (~/.claude.json):

{
  "mcpServers": {
    "containarium": {
      "command": "/usr/local/bin/mcp-server",
      "env": {
        "CONTAINARIUM_SERVER_URL": "http://your-host:8080",
        "CONTAINARIUM_JWT_TOKEN": "<your-token>"
      }
    }
  }
}

Wire agent-box for in-the-box file/shell ops:

{
  "mcpServers": {
    "containarium-box": {
      "command": "ssh",
      "args": ["user@your-box", "agent-box"]
    }
  }
}

See README.md for the full agent-native walkthrough.