Containarium v0.128.0

What changed

Added

• containarium code skill-sets re-applies a box's skill sets; code install documents the two paths (#3374 slice 3) (#3507)
• serve ApplyBoxSkillSets with a per-box skill-set manifest (#3374 slice 2) (#3506)
• ApplyBoxSkillSets contract: proto, typed refusals, client wiring (#3374 slice 1) (#3505)
• ListBoxRuns reads token usage from the structured result (slice 2 of #3467) (#3492)
• set tests_run from observed test executions (#3491) (#3497)
• opt-in Python toolchain and agent-python helper (#3491) (#3496)
• report token usage on skill, planner and graph crew runs (#3493)
• single-use zero-click login kept out of the URL query (#3486) (#3495)
• run token usage contract (RunUsage on BoxRun, skill and crew runs) (#3489)
• export per-target preemption metrics for --watch-spot-vm (#3485) (#3487)

Fixed

• complete birth idle-stop support for local CLI and MCP (#3490)
• agent-python probes the index pip will use; absolute venv override (#3491) (#3499)
• __Host- session cookie, any-valid check, and mint errors never become tokens (#3486) (#3498)
• quote the remaining backend-id log lines (#3484) (#3488)
• put a deadline on Incus operation waits (#3470) (#3478)
• cap bytes read from box exec output, file reads and HTTP responses (#3469) (#3477)
• initialize cold-start clock and wait for HTTP wake readiness (#3474)
• quote the tenant/peer strings the log sweep missed (#3476) (#3479)

Internal

• cut v0.128.0 — ApplyBoxSkillSets, per-target preemption metrics, run token usage contract, read caps and Incus deadlines (#3509)
• prove birth idle-stop validation rejects before any HTTP request (#3501)
• pin watch-target metrics locking with a concurrent -race test (#3485) (#3494)
• fail on %s/%v of tenant-controlled fields in logs and CLI tables (#3457) (#3481)

Full diff: v0.127.0...v0.128.0

---

Containarium v0.128.0

The open-source, self-hostable, agent-native sandbox.

Binaries

Four binaries ship in this release:

Binary	Where it runs	What it does
containariumd	The host	The platform daemon plus host-side admin commands.
containarium	Your laptop / CI (linux, macOS, windows)	The client CLI: create, list, expose-port, ssh-config, etc. against a server (--server).
mcp-server	Your laptop	The platform MCP — outside-the-box admin (create_container, list_containers, expose_port, list_backends). Wire it into Claude Code / Cursor.
agent-box	Inside each Containarium container	The in-the-box MCP — shell_exec, read_file, write_file, etc. Reached over stdio, typically via SSH.

Quick install (Linux host)

curl -fsSL https://raw.githubusercontent.com/footprintai/containarium/v0.128.0/hacks/install.sh | sudo bash

Manual install (any binary, any platform)

# containariumd daemon (Linux x86_64 host)
curl -L -o /usr/local/bin/containariumd \
  https://github.com/footprintai/containarium/releases/download/v0.128.0/containariumd-linux-amd64
chmod +x /usr/local/bin/containariumd
ln -sf /usr/local/bin/containariumd /usr/local/bin/containarium

# containarium client CLI (your laptop, e.g. macOS arm64)
curl -L -o /usr/local/bin/containarium \
  https://github.com/footprintai/containarium/releases/download/v0.128.0/containarium-darwin-arm64
chmod +x /usr/local/bin/containarium

# Windows: the same client CLI (create/list/ssh/… against a remote server)
# PowerShell:
#   curl.exe -L -o containarium.exe `
#     https://github.com/footprintai/containarium/releases/download/v0.128.0/containarium-windows-amd64.exe

# platform MCP (your laptop, e.g. macOS arm64)
curl -L -o /usr/local/bin/mcp-server \
  https://github.com/footprintai/containarium/releases/download/v0.128.0/mcp-server-darwin-arm64
chmod +x /usr/local/bin/mcp-server

# agent-box (drop into your container image, Linux x86_64)
curl -L -o /usr/local/bin/agent-box \
  https://github.com/footprintai/containarium/releases/download/v0.128.0/agent-box-linux-amd64
chmod +x /usr/local/bin/agent-box

Verify checksums via SHA256SUMS.txt.

SBOMs

Each Linux binary has an SPDX 2.3 SBOM next to it (<binary>-linux-amd64.spdx.json), generated from the shipped file and listed in SHA256SUMS.txt. The container images carry their own SBOM and provenance attestations.

Managed build tools

Each host installs one toolchains-linux-<arch>.tar.gz alongside its daemon release. The archive contains an installer, the pinned tool inventory, and the shared tools. Verify its signature and checksum before extracting, then run sudo bash install.sh from the extracted directory. See managed toolchains for installation and rollback. Each architecture has an SPDX SBOM; the release build scans both trees.

Signatures

Every file on this page has a keyless cosign signature next to it, <file>.sigstore.json, made by this release workflow through GitHub OIDC. Verify with cosign verify-blob --bundle <file>.sigstore.json --certificate-identity https://github.com/FootprintAI/Containarium/.github/workflows/release.yml@refs/tags/v0.128.0 --certificate-oidc-issuer https://token.actions.githubusercontent.com <file>. See docs/security/VERIFYING-RELEASES.md.

Kubernetes (Helm)

Chart version 0.128.0 (installs the v0.128.0 daemon image):

helm install containarium oci://ghcr.io/footprintai/charts/containarium-k8s \
  --version 0.128.0 \
  --set daemon.jwtSecret="$(openssl rand -hex 24)" \
  --set gateway.upstreamKeySecret=sshpiper-upstream-key \
  --set-file gateway.upstreamPublicKey=./sshpiper_upstream.pub

MCP client setup

Wire the platform MCP into Claude Code (~/.claude.json):

{
  "mcpServers": {
    "containarium": {
      "command": "/usr/local/bin/mcp-server",
      "env": {
        "CONTAINARIUM_SERVER_URL": "http://your-host:8080",
        "CONTAINARIUM_JWT_TOKEN": "<your-token>"
      }
    }
  }
}

Wire agent-box for in-the-box file/shell ops:

{
  "mcpServers": {
    "containarium-box": {
      "command": "ssh",
      "args": ["user@your-box", "agent-box"]
    }
  }
}

See README.md for the full agent-native walkthrough.