Containarium v0.126.0

What changed

Added

• app-hosting and route stores install in-process after a degraded start (#3331) (#3406)
• slides-agent recipe with a prebaked open-slide image (#3437)
• collaborators and self-host SSH authorization recover in-process after a degraded start (#3330) (#3404)
• containarium backup restore --box and the restore_box_backup MCP tool (#3358) (#3381)

Fixed

• bump golang.org/x/crypto to fix GO-2026-5932 (#3465)
• quote control characters in list YAML output, keep values lossless (#3458)
• host status probe reports Incus storage pool capacity, not the root disk (#3462)
• escape tenant strings in remaining inline CLI tables (#3453) (#3459)
• fail closed when OTEL_REQUIRE_AUTH is set but no bearer is available (#3443) (#3446)
• replay remembered passthrough deletes before the RPCs go live and name failures (#3441) (#3447)
• escape tenant-supplied table cells (#3343, CLI half) (#3448)
• command mode skips code.json; reject blank command, order timeout checks (#3422, #3423) (#3428)
• refuse to render without a real daemon.jwtSecret (#3442) (#3444)
• remove a box's passthrough routes deleted before the store installs (#3407) (#3430)
• validate release version input and publish only on tag push (#3389)
• the tracker's wait on a config-refused secrets store does not hold the self-restart (#3387) (#3391)
• NewPeerPool builds from ParseStaticPeers; reject case-folded ids (#3426) (#3427)
• --command rejects stream-json, rounds timeout up, fails clearly without timeout (#3425) (#3429)
• authenticate the sentinel's checksum and version before trusting them (#3420)
• require a token scope on RPCs that checked only role or tenant (#3419)
• drop revoked keys when seeding accounts from the box (#3347) (#3390)

Documentation

• explain the merge queue (#3452)
• state command mode's weaker tool-access guarantee (#3424) (#3432)
• upgrade notes and fixes for the security release (#3435)

Internal

• cut v0.126.0 — signed auto-update, scope enforcement on privileged RPCs, tenant-scoped exports, Incus pool capacity in the status probe (#3463)
• changelog fragments (changelog.d/) so PRs stop conflicting on CHANGELOG.md (#3461)
• share one Go module cache across jobs; move ssh-ban onto setup-go-cached (#3460)
• move gosec, real-Caddy e2e and release-artifact gate to the merge queue (#3451)
• publish the recipe image on release tags and build it on every change (#3445)
• run required-check workflows on merge_group (prep for merge queue) (#3450)
• bump cloud.google.com/go/compute from 1.74.0 to 1.74.1 (#3412)
• bump github.com/lxc/incus/v7 from 7.5.1 to 7.6.0 (#3414)
• bump the kubernetes group across 1 directory with 3 updates (#3411)
• bump securego/gosec (#3413)
• bump google.golang.org/api from 0.308.0 to 0.310.0 (#3415)
• bump github.com/mark3labs/mcp-go from 1.3.0 to 1.4.0 (#3416)
• keep the Trivy binary at v0.76.1 with an explicit version input (#3409)

Other

• Merge commit from fork
• Merge commit from fork
• Merge commit from fork
• Merge commit from fork
• Merge commit from fork

Full diff: v0.125.0...v0.126.0

---

Containarium v0.126.0

The open-source, self-hostable, agent-native sandbox.

Binaries

Four binaries ship in this release:

Binary	Where it runs	What it does
containariumd	The host	The platform daemon plus host-side admin commands.
containarium	Your laptop / CI (linux, macOS, windows)	The client CLI: create, list, expose-port, ssh-config, etc. against a server (--server).
mcp-server	Your laptop	The platform MCP — outside-the-box admin (create_container, list_containers, expose_port, list_backends). Wire it into Claude Code / Cursor.
agent-box	Inside each Containarium container	The in-the-box MCP — shell_exec, read_file, write_file, etc. Reached over stdio, typically via SSH.

Quick install (Linux host)

curl -fsSL https://raw.githubusercontent.com/footprintai/containarium/v0.126.0/hacks/install.sh | sudo bash

Manual install (any binary, any platform)

# containariumd daemon (Linux x86_64 host)
curl -L -o /usr/local/bin/containariumd \
  https://github.com/footprintai/containarium/releases/download/v0.126.0/containariumd-linux-amd64
chmod +x /usr/local/bin/containariumd
ln -sf /usr/local/bin/containariumd /usr/local/bin/containarium

# containarium client CLI (your laptop, e.g. macOS arm64)
curl -L -o /usr/local/bin/containarium \
  https://github.com/footprintai/containarium/releases/download/v0.126.0/containarium-darwin-arm64
chmod +x /usr/local/bin/containarium

# Windows: the same client CLI (create/list/ssh/… against a remote server)
# PowerShell:
#   curl.exe -L -o containarium.exe `
#     https://github.com/footprintai/containarium/releases/download/v0.126.0/containarium-windows-amd64.exe

# platform MCP (your laptop, e.g. macOS arm64)
curl -L -o /usr/local/bin/mcp-server \
  https://github.com/footprintai/containarium/releases/download/v0.126.0/mcp-server-darwin-arm64
chmod +x /usr/local/bin/mcp-server

# agent-box (drop into your container image, Linux x86_64)
curl -L -o /usr/local/bin/agent-box \
  https://github.com/footprintai/containarium/releases/download/v0.126.0/agent-box-linux-amd64
chmod +x /usr/local/bin/agent-box

Verify checksums via SHA256SUMS.txt.

SBOMs

Each Linux binary has an SPDX 2.3 SBOM next to it (<binary>-linux-amd64.spdx.json), generated from the shipped file and listed in SHA256SUMS.txt. The container images carry their own SBOM and provenance attestations.

Managed build tools

Each host installs one toolchains-linux-<arch>.tar.gz alongside its daemon release. The archive contains an installer, the pinned tool inventory, and the shared tools. Verify its signature and checksum before extracting, then run sudo bash install.sh from the extracted directory. See managed toolchains for installation and rollback. Each architecture has an SPDX SBOM; the release build scans both trees.

Signatures

Every file on this page has a keyless cosign signature next to it, <file>.sigstore.json, made by this release workflow through GitHub OIDC. Verify with cosign verify-blob --bundle <file>.sigstore.json --certificate-identity https://github.com/FootprintAI/Containarium/.github/workflows/release.yml@refs/tags/v0.126.0 --certificate-oidc-issuer https://token.actions.githubusercontent.com <file>. See docs/security/VERIFYING-RELEASES.md.

Kubernetes (Helm)

Chart version 0.126.0 (installs the v0.126.0 daemon image):

helm install containarium oci://ghcr.io/footprintai/charts/containarium-k8s \
  --version 0.126.0 \
  --set daemon.jwtSecret="$(openssl rand -hex 24)" \
  --set gateway.upstreamKeySecret=sshpiper-upstream-key \
  --set-file gateway.upstreamPublicKey=./sshpiper_upstream.pub

MCP client setup

Wire the platform MCP into Claude Code (~/.claude.json):

{
  "mcpServers": {
    "containarium": {
      "command": "/usr/local/bin/mcp-server",
      "env": {
        "CONTAINARIUM_SERVER_URL": "http://your-host:8080",
        "CONTAINARIUM_JWT_TOKEN": "<your-token>"
      }
    }
  }
}

Wire agent-box for in-the-box file/shell ops:

{
  "mcpServers": {
    "containarium-box": {
      "command": "ssh",
      "args": ["user@your-box", "agent-box"]
    }
  }
}

See README.md for the full agent-native walkthrough.