Skip to content

Containarium v0.71.0

Choose a tag to compare

View all tags
@hsinatfootprintai hsinatfootprintai released this 03 Sep 23:03
· 7 commits to main since this release
v0.71.0
34a727d
This commit was created on GitHub.com and signed with GitHub’s verified signature.
GPG key ID: B5690EEEBB952194
Verified
Learn about vigilant mode.

Added

  • containarium code — run a coding agent ON a box, not on your laptop.
    code install lands the toolchain on a box you already use, credential
    delivered via the secrets store so no interactive login happens in a headless
    box. code run then starts the agent detached and streams its output back.

    It streams like a pipe but deliberately is not one: the run lives on the box
    with its output captured to a log, and your terminal is a resumable reader
    over that log. Close the laptop, lose wifi, Ctrl-C — the run continues, and
    code attach resumes byte-exact. Verified live at 132,000 bytes across 25
    forced mid-run disconnects.

  • code_run / code_attach / code_status / code_stop MCP tools, so an
    agent can drive a coding run rather than only a human at a terminal. These
    return a bounded output window plus next_offset; carrying that offset
    forward is what makes an agent's reconnect lossless.

  • Durable run records in agent-box. A run's identity and outcome persist
    beside its log, so a different agent-box instance — after a reconnect — can
    still answer "is it alive?" and "how did it end?". Records carry a boot id, so
    a PID the kernel may have reassigned across a reboot is never mistaken for a
    live run.

  • Runs record who authorized them, not only who they ran as.

  • Threat-detection sentry: security findings as first-class platform events,
    a background detection loop, fence-probe (cross-tenant flow, deny-burst) and
    known-bad-destination rules, plus webhook delivery and a findings triage
    surface.

Fixed

  • A detached run's exit status is no longer lost when the connection drops.
    The status was written by a goroutine inside agent-box, which dies with its
    SSH connection — so every detached run reported unknown forever, precisely
    the case durable records exist for. The child now records its own outcome. A
    run killed outright still reports unknown: an OOM must stay distinguishable
    from a clean exit.

  • Framed capture no longer kills the run it is streaming.
    --output-format stream-json set cmd.Stdout to an io.Writer rather than an
    *os.File, so os/exec inserted a pipe that died with agent-box and took the
    child with it via SIGPIPE. Framing moved to the child's side of the fork.

  • ssh-config sync will not wipe a working config with a zero-host run. Both
    the CLI and the MCP tool overwrote ~/.containarium/ssh_config with an empty
    file — and reported success — when the control plane returned no containers.

  • Agent-skill tokens are bounded by the dispatcher's own grant.
    RunAgentSkill minted the skill manifest's allowed_scopes without
    intersecting them against the caller's, making agents:run a universal upgrade
    to any scope any installed skill declares.

What changed

Added

  • code_run/attach/status/stop — let agents drive a coding run (#1703)
  • record who authorized a run, not just who it ran as (#1700)
  • mount-watchdog — recover a mount-dependency-killed containarium.service (#1317) (#1694)
  • rows carry actor, token_id, org_id and run_id (#1678) (#1692)
  • opt-in strict mode rejecting unscoped tokens (#1691)
  • delegation claim so a derived agent token names the human (#1687)
  • containarium code run/attach/status/stop — resumable reader (#1690)
  • containarium code install — Claude Code onto an existing box (#1686)
  • durable run records survive a dropped connection (#1684)
  • webhook delivery + findings triage CLI/MCP surface (#1659)
  • known-bad destination rule (mining pools) (#1657)
  • fence-probe rules — cross-tenant flow + deny-burst (#1658)
  • background detection loop in the daemon (#1656)
  • SECURITY_FINDING as a first-class platform event (#1646)

Fixed

  • refuse to wipe a working config with a zero-host sync (#1695)
  • frame on the child's side so framed runs survive disconnect (#1702)
  • record a run's exit status from the child, not the reaper (#1696)
  • intersect agent-skill token scopes with the caller's own grant (#1683)
  • give the ACME issuer email a config surface (#1616) (#1670)
  • trust the incus bridge for PROXY protocol automatically (#1669)

Documentation

  • document containarium code — running the agent on the box (#1697)
  • PRDs for remote coding agent and agent governance, plus design note (#1681)
  • design for the eBPF CI loading lane (#1663) (#1665)
  • threat-detection sentry operator guide (#1662)

Internal

  • cut v0.71.0 — containarium code, threat-detection sentry, agent governance (#1704)
  • bump golang.org/x/crypto to v0.55.0 -> v0.56.0 (#1689)
  • Bump the opentelemetry group with 2 updates (#1635)
  • Bump cloud.google.com/go/compute from 1.66.0 to 1.67.0 (#1636)
  • real two-org e2e for the fence-probe rules (#1664) (#1667)
  • eBPF load path — build + real load/attach/traffic-evaluation lane (#1666)

Full diff: v0.70.0...v0.71.0

Containarium v0.71.0

The open-source, self-hostable, agent-native sandbox.

Binaries

Three binaries ship in this release:

Binary Where it runs What it does
containarium The host (and your laptop, for the CLI) The platform daemon + CLI. create, list, expose-port, ssh-config, etc.
mcp-server Your laptop The platform MCP — outside-the-box admin (create_container, list_containers, expose_port, list_backends). Wire it into Claude Code / Cursor.
agent-box Inside each Containarium container The in-the-box MCP — shell_exec, read_file, write_file, etc. Reached over stdio, typically via SSH.

Quick install (Linux host)

curl -fsSL https://raw.githubusercontent.com/footprintai/containarium/main/hacks/install.sh | sudo bash

Manual install (any binary, any platform)

# containarium CLI / daemon (Linux x86_64 example)
curl -L -o /usr/local/bin/containarium \
  https://github.com/footprintai/containarium/releases/download/v0.71.0/containarium-linux-amd64
chmod +x /usr/local/bin/containarium

# Windows: client-only CLI (create/list/ssh/… against a remote daemon;
# the daemon/sentinel/tunnel subcommands are Linux/macOS only)
# PowerShell:
#   curl.exe -L -o containarium.exe `
#     https://github.com/footprintai/containarium/releases/download/v0.71.0/containarium-windows-amd64.exe

# platform MCP (your laptop, e.g. macOS arm64)
curl -L -o /usr/local/bin/mcp-server \
  https://github.com/footprintai/containarium/releases/download/v0.71.0/mcp-server-darwin-arm64
chmod +x /usr/local/bin/mcp-server

# agent-box (drop into your container image, Linux x86_64)
curl -L -o /usr/local/bin/agent-box \
  https://github.com/footprintai/containarium/releases/download/v0.71.0/agent-box-linux-amd64
chmod +x /usr/local/bin/agent-box

Verify checksums via SHA256SUMS.txt.

MCP client setup

Wire the platform MCP into Claude Code (~/.claude.json):

{
  "mcpServers": {
    "containarium": {
      "command": "/usr/local/bin/mcp-server",
      "env": {
        "CONTAINARIUM_SERVER_URL": "http://your-host:8080",
        "CONTAINARIUM_JWT_TOKEN": "<your-token>"
      }
    }
  }
}

Wire agent-box for in-the-box file/shell ops:

{
  "mcpServers": {
    "containarium-box": {
      "command": "ssh",
      "args": ["user@your-box", "agent-box"]
    }
  }
}

See README.md for the full agent-native walkthrough.

Assets 16
Loading