Skip to content

v0.10.0

Choose a tag to compare

View all tags
@benvinegar benvinegar released this 04 Nov 02:14
· 24 commits to master since this release
v0.10.0
dabb5c9

This release requires a person to approve new VM access, adds GitHub Actions runners on pool VMs, and lets you see and patch VMs whose software is out of date. It also fixes ssh to VMs on remote hosts, which was broken in 0.9.0. Read "Upgrading" first.

Highlights

  • New access needs a person. boxery grant, agent-forward on, new --grant, fork --grants, pi's /vm grant and vm_grant all show what would be granted and ask for approval. The CLI reads the answer only from /dev/tty, defaults to No, and refuses to run without a terminal, so piping yes doesn't approve anything. Listing, revoking and re-applying existing grants don't ask. For cron, CI or pool setup, add GRANT_CONFIRM=off to a profile's config (#138, details).
  • GitHub Actions runners on your own host. Each job runs in a fresh pool VM, which is reset to its clean image afterwards. The GitHub token stays on the host, and the VM only gets a single-use JIT config (#141, docs): 
    boxery new r1 --headless --layers github-runner && boxery pool add r1
boxery runners token < token.txt
  • boxery runners once registers one runner with your own gh login, from wherever you run it. The host never holds a GitHub credential (#145).
  • See which VMs are out of date, and patch them in place. boxery ls has a GUEST column: current, outdated (older layers, built more than 30 days ago, or waiting for a reboot) or unknown. boxery patch NAME (or --all) runs the layers again inside a running VM: apt-get full-upgrade, the kernel, playwright-core, the pi and opencode CLIs, and node. It restarts the VM if needed. For pool VMs, it captures NAME@boxery-clean again, so later leases start patched (#137).

Security

  • Security updates in every VM, and MPTCP turned off. Every VM, desktop or headless, now runs apt-get full-upgrade (kernel included) when it's built. Before, VMs kept whatever the cached Ubuntu image had. MPTCP is turned off (net.mptcp.enabled=0) because of CVE-2026-98432, which has no fixed Ubuntu 24.04 kernel yet (#136).
  • The LLM proxy drops guest OpenAI billing headers. A VM can no longer pick another org or project with openai-organization / openai-project. Set them on the host with OPENAI_ORG_ID / OPENAI_PROJECT_ID in proxy.env (#147).

Fixes

  • ssh to VMs on remote hosts. In 0.9.0, a controller set up with boxery setup user@host wrote a KnownHostsCommand that ssh couldn't run, so every VM failed host key verification. Local hosts were fine. Existing profiles are rewritten the next time you run a command (#149).
  • Locks that hold on uutils coreutils. Ubuntu 26.04's default mkdir isn't atomic under a race. As a result, concurrent grants or revokes could lose an entry, and concurrent news could get the same network slot or port. Both now use an O_EXCL lock (#129, #134).
  • macOS: init no longer fails intermittently with Bootstrap failed: 5: Input/output error while launchd is still removing the old job (#132).
  • init refuses a HOME that isn't the account's, so it can't install services launchd or systemd would never load. Shell tests can no longer replace the real proxy on macOS (#140).
  • tokens.json is parsed again only when it changes, not on every proxied request (#147).

Other changes

  • e2e.sh checks first that grants can be approved. Without a terminal, it needs GRANT_CONFIRM=off in the profile and otherwise exits before creating a VM (#151).
  • Agent behaviour evals for the MCP server, under evals/: which vm_* tools an agent uses, and whether it follows instructions (#148).
  • Docs: a new README, tagline, hero diagram and promo video, and a research section that starts with hunk's test suite on macOS vs boxery VMs vs Docker (#128, #130, #131, #133, #135, #139, #142).

Upgrading

  • Upgrade the host before the controllers (boxery upgrade-host).
  • Scripts that run boxery grant without a terminal now fail. Either have a person run them, or add GRANT_CONFIRM=off to that profile's config. That setting turns off CLI confirmation for the profile, so use it only where an agent adding grants unprompted is acceptable. MCP and pi clients need a confirm dialog or elicitation to grant anything; pi's print mode can't approve.
  • Rebuild the desktop base, and patch or recreate existing VMs, to get the security updates and MPTCP turned off. Upgrading the host doesn't change the software inside existing VMs. boxery ls --refresh shows which ones are outdated, and boxery patch --all patches those that are running. Patching doesn't change the base itself: boxery build-base does that, and it refuses while desktop VMs or snapshots still depend on the old base. Desktops built before 0.9.0 also have no VNC password until they're recreated from a new base.
  • Controllers on 0.9.0 with a remote host get working ssh once they're updated. Nothing else needs to be done.
Assets 2
Loading