v0.4.0

Breaking changes

• wrap: isolate new sandbox networks by default (39f4047) #369
• runtime: refuse a containerd shim that shares the host kernel (09ed158)
  BRIG_CONTAINERD_RUNTIME no longer accepts a shim that shares the host kernel. brig refuses a boot or a join while the variable names runc or crun, by name or by path, or a shim name that containerd resolves to the runc shim, such as io.containerd.runc.v2. Unset the variable to use the default urunc shim, io.containerd.urunc.v2. A sandbox already running under one of them is found by name, not by its shim, so once the variable is unset the next brig run can join it rather than boot a microVM, and the ISOLATION row then names urunc. Stop such a sandbox with brig stop <ref> before that run. The run after the stop boots it again on urunc.
• cli: Exit 7 when a runtime cannot enforce a planned property (7b5500e) #237
  an egress policy refused on hull's vz or qemu backend, on nerdctl or docker, on hvi when the gateway probe finds no --egress-default, or on a hull backend brig holds no answer for, now exits 7 where v0.3.0 exits 1. So does brig network publish on a sandbox whose policy its backend cannot enforce, and brigd reports the same 7 in a response's code. A failed hvi gateway probe also exits 7. On a failed probe, v0.3.0 started the gateway with the rules anyway. The run booted with the rules on the gateway, or exited 1 when the gateway did not come up.
• wrap: Pass brig sh's command words through as arguments (51043b1) #307
  brig sh <words...>, and brig run on a kind: shell profile, pass each word to the guest command as one argument and no shell parses them. A script typed as one quoted word, or an assignment such as FOO=bar in front of the command, no longer runs. Run a script with brig sh -c '<script>', and set a variable with brig sh env FOO=bar .
• profile: Refuse an unquoted mode in a files: binding (b65ef46) #453
  a profile whose files binding has an unquoted mode is refused. Quote it, for example "0644". An unquoted 644, which happened to give 0o644, is refused as well. A file that overrides a built-in profile is then ignored with a warning, and the built-in profile runs instead.

Features

• runtime: Answer egress enforcement through one capability contract (b05c01e) #237 #245
• verify: Refuse a boot asset whose digest differs from the bundle (38e5c5c) #234 #168
• verify: Check the runtime bundle's record (c3b3b10) #234
• runtime: Spin while hull pulls an image (5501940) #306
• wrap: print first-run notices as short blocks (29b274d)
• wrap: print verification alerts as blocks (988ce36)
• wrap: print run warnings as blocks (d0068ef)
• brig: print command notices as blocks (555c3e6)
• cli: Add brig plan to preview a run without decrypting secrets (141df7e) #240
• sh: Run a script with brig sh -c (1b46340) #307
• runtime: Enforce egress policies on nerdctl (784fd4e) #266
• telemetry: Send brig's own events (6dcb23c) #428
• profile: let a tmpfs volume mount at a fixed guest path (e5fb812)
• wrap: mount a tmpfs with at: off the home share (9d555b4)
• wrap: seed and migrate agent state inside the config dir (d22a8db)

Fixes

• runtime: Pass BRIG_BOOT_ASSETS_REF to hull assets pull (047d63e) #234
• runtime: Say when the nerdctl adapter falls back to docker (ff2a6ae) #30
• brigd: Return the docker fallback note with the warnings (7e969cb) #30
• runtime: Refuse a boot with a policy when the gateway probe fails (29df3b1) #171 #237
• runtime: Replace or stop a shared gateway no sandbox is on (fc9de73) #366
• wrap: Name the posture a running sandbox has (616bc36) #368
• wrap: Stop calling a kept policy a changed one on restart (d76be84) #368
• runtime: Stop an isolated gateway left up by a failed release (4628834) #368
• verify: Stop quoting cosign's deprecation warning as the reason (ac03cb5) #365
• verify: Say when cosign timed out and kill its helpers too (7e4c2c5) #365
• agent: Refuse to remove a profile its sandboxes still use (eb2c646) #367
• runtime: Stop pointing refused isolated runs at the shared network (8c49500) #364
• wrap: re-check hostmount sources before handing them to the runtime (20de0ce)
• brigd: refuse a symlinked or hard-linked socket lock (2e4de3f)
• verify: Fetch the boot bundle that verified (7b412f8) #234
• install: Pin the Linux runtime bundle at v0.1.0-rc13 (82977fe) #234
• notice: address review of the block layout (bde00d4)
• runtime: recover networks with urunc's helper TAP (6f48092) #369
• script: stop parsing a deprecation notice as profile JSON (96f897c)
• wrap: mark a profile-chosen network without matching its wording (759ce7d) #433
• rm: forget the session when rm finds the sandbox already gone (3f68a43) #432
• cli: correct the help text and a retired spelling in an error (5c58571)
• cli: answer --help and -h on the top-level verbs (309cf0b) #357
• cli: answer --help on brig plan (8e9d2ff) #357
• profile: keep claude-code's tmpfs off the shared guest home (ce4af86)
• wrap: refuse to relocate a tmpfs a running sandbox has in home (30294e7)
• wrap: migrate .claude.json only in a home brig prepared (b769d28)
• wrap: write a hostmounted trust file in place (e1df7bd)
• wrap: stop calling a credential in the workspace unused (dd3b6ba)
• profile: refuse a tmpfs nested in another when either sets at: (99e15dd)
• wrap: say when a .claude.json stays behind unmigrated (d2c9cf0)
• cli: Retire the old spellings in v0.5.0 (f685ee9)

Refactors

• runtime: Resolve boot assets before the verify summary (9fcbd4b) #234
• lay out every warning block in internal/notice (72a46cc)

Documentation

• runtime: Say which urunc reads the boot annotations (bcf4057) #325
• Add AGENTS.md for coding agents working in the repository (9218fcb)
• stability: State the compatibility policy and removal release (a39408d) #60
• security: Say ISOLATION prints under --verbose and in brig info (3664606) #30
• policies: Say info names the posture the sandbox runs with (d502731) #368
• troubleshooting: Add the case where cosign does not answer (03f0910) #365
• rm: Correct the exit code sandboxPresent's comment gives (1a5733c) #367
• security: Say shared sandboxes reach each other on hvi (f8fe3dc) #364
• show warnings in their block layout (8f21ff1)
• security: record the Linux microVM measurements (1731cf5) #369
• security: record the amd64 Linux reachability run (d872cb5) #434
• readme: show Claude Code running in a sandbox (7b4739d)
• readme: put prerequisites and expected output first (306e9ae)
• security: correct telemetry counts and tighten the prose (6f7af08)
• install: say what each method installs and fix stale facts (2b2df11)
• cli: correct the reference against the code (f11cca6)
• profiles: correct profile and secret pages against the specs (8993963)
• troubleshooting: match quoted messages to the code (d83b9ee)
• assets: add four diagrams for the docs pages (8897f0c)
• security: state each limit once and lead with what you control (a8a8319)
• cli: give each verb one shape and move cases into tables (6f6f8cb)
• policies: open with an example policy and tabulate the postures (7d51895)
• profiles: name each field heading after the field (dbb4491)
• secrets: split login tasks from the store, compare run paths (2b62828)
• troubleshooting: give every entry the same four parts (be0bb34)
• tighten the first pages a new reader meets (d2b2e76)
• contributing: tighten the contributor and maintainer pages (95fe9c8)
• readme: shorten the README and link to brig.sh (a82606a)
• document tmpfs at: and claude-code's move to /brig/claude (735f708)
• security: state where the claude-code credential can reach disk (ab150a1)
• bring comments and profiles.md in line with /brig/claude (fa81fd4)
• security: Say hull filters terminal output (c405276) #463

Contributors

• @Ashutosh-Panda2004
• @ananos
• @artemisln
• @drpaneas
• @pmoust
• @xqliu

New contributors

• @Ashutosh-Panda2004 made their first contribution in #450
• @artemisln made their first contribution in #351
• @drpaneas made their first contribution in #408
• @xqliu made their first contribution in #402

Full changelog: v0.3.0...v0.4.0