0.4.1

What's Changed

• Sec Audit by @isbm in #14
• Add net proxy by @isbm in #16
• Termwrap proto by @isbm in #17
• Fix vsock collision bug by @isbm in #18
• Add Goose image by @isbm in #20
• Netstack patch by @isbm in #21

Full Changelog: 0.4.0...0.4.1

0.4.0

What's Changed

• Migrate configuration by @isbm in #8
• Add security env modes by @isbm in #9
• Configuration wizard by @isbm in #10
• Fix vscomm binary by @isbm in #12
• Add bubblewrap sandbox by @isbm in #13

Full Changelog: 0.3.0...0.4.0

0.3.0

Bunkerbox 0.3.0

The "pinhole" release.

Passthrough — host tooling from inside the VM

The headliner. The VM runs Alpine. Your project needs cargo, make, go,
npm. These aren't in the VM, and baking them into the image ties you to one
distro's toolchain forever.

Passthrough solves this with a tiny static binary (bunkerbox-vscomm) inside
the container and a tokio daemon on the host, connected over virtio-vsock. You
whitelist commands in .bunkerbox/env.conf:

passthrough:
  - "cargo *"
  - "make *"
  - "go *"

When the AI agent calls cargo build, the call tunnels through the vsock
channel to the host daemon. The daemon checks the whitelist, spawns the real
command inside the overlay workspace, and streams stdout, stderr, and the exit
code back to the AI. The agent sees real build output. The command runs with
your host's real HOME and caches — .cargo/registry, .cache/go-build,
.npm are shared, not re-downloaded.

The VM always wins: if a command already exists in the container, no symlink is
created. Passthrough only fills gaps. Only whitelisted commands get through.
Everything else stays locked inside the bunker.

Auto-detection — zero-config first run

When .bunkerbox/env.conf is created (or passthrough is empty), Bunkerbox
scans your repository root for build system files and pre-fills the whitelist
automatically. Nine detectors ship out of the box:

Detects	Whitelists
Cargo.toml	cargo *
Makefile / makefile / GNUmakefile	make *
package.json	npm *, npx *
pyproject.toml / setup.py / setup.cfg	python *, pip *
go.mod	go *
CMakeLists.txt	cmake *, make *
build.gradle* / settings.gradle* / gradlew	gradle *, ./gradlew *
pom.xml	mvn *
meson.build	meson *, ninja *

If your project has a Cargo.toml and a Makefile, both show up. Edit the
list anytime. Add one command, detection stops helping — you're in charge.

Auto-sync — changes land in your repo when the container exits

Overlay workspace changes are now automatically synced back to your real
repository on container exit. No bunkerbox sync step needed. The AI works,
the container stops, your files are updated. Review the diff, commit, move on.

Bind mounts are gone

Excluded directories (target/, node_modules/, etc.) used to be bind-mounted
to host storage to save quota space. This broke cargo clean and rm -rf —
Linux refuses to delete a bind mount point. They're now normal overlay
directories. Everything lives in the loopback image. If you need more headroom,
bump quota in env.conf. The default auto-quota floor was raised from 1 GB
to 5 GB to match.

Documentation

A full tutorial walks you from git clone to reviewing the AI's Git diff,
explaining why at each step — not just what to type. A dedicated Passthrough
guide covers the vsock architecture, security model, and configuration syntax.
The config schema is updated. All public-facing text now says "Bunkerbox"
instead of the underlying VM runtime name.

Under the hood

What	Where
Host-side vsock daemon (tokio)	src/daemon.rs
Guest-side proxy binary (musl static)	src/bin/bunkerbox-vscomm.rs
Shared protocol + frame codec	src/vscomm/mod.rs
Build system auto-detectors	src/vscomm/buildsys/ (9 files)
Passthrough doc	docs/guides/passthrough.md
Tutorial	docs/guides/tutorial.md

New Rust dependencies: tokio, tokio-vsock, libc.

Config change: minion: passthrough: in env.conf is now just passthrough:.
The word "minion" does not appear anywhere in the project.

0.2.1

Bunkerbox 0.2.1

Startup is noticeably faster in this release.

Container startup, CNI network setup, and container image imports are now run in parallel asyncronous.

Session storage is now persistent.

Your home directory inside a Bunkerbox session is backed by a mounted buffer filesystem, meaning your files survive across restarts without any extra steps. The session recovery subsystem has been simplified to safely handle leftover session images from crashes, so an interrupted session won't cause problems the next time you start Bunkerbox.

Security gets a boost with credentials encryption.

Files in your home directory can now be protected with AES-256-GCM encryption behind a passphrase, so anything sensitive you store inside a Bunkerbox session stays private.

Bunkerbox now warns you on shutdown.

If you have unsynced changes in your workspace, helping you avoid accidentally closing a session before saving your work, you will get a warning. A related sync bug has been fixed — the overlay is properly flushed after syncing, preventing garbage timestamps from polluting your Git data and keeping your repository history clean.

The environment configuration file

Conf file has been reworked to use proper serde YAML serialization instead of a hand-crafted template, making .bunkerbox/env.conf more predictable and less fragile. Existing configurations remain fully compatible.

Kata container 2.2.5

Users should note that containerd version 2.2.5 or later is now required, with a guard in place to verify the version before attempting to launch a container.

For contributors, the test suite is now wired up with make test running unit tests through cargo-nextest. The initial batch covers environment config loading, quota computation, exclude merging, and file walking. Function docstrings have been added throughout the codebase, several functions have been streamlined, and the Rust toolchain has been updated to 1.97.1.

0.2.0

bunkerbox 0.2.0

• Faster workspace setup: workspace images are now sized to match your actual project, not the entire repo. Build directories and large test data are skipped automatically.
• Smarter disk usage: exclude slow-changing directories (like ML models or assets) from the sandbox. They stay on your fast host disk while code remains protected.
• Session cleanup:bunkerbox sync removes leftover workspace sessions from crashed or forgotten runs.
• Choose your workspace style: cow (isolated snapshot), isolated (clean copy), or direct (work in-place). Set it once in your config or override with --workspace.
• Tool-specific defaults: the opencode, crush, kilocode, and netdebug demos now ship with optimized workspace settings out of the box.

0.0.2

What's Changed

• Add "crush" image by @isbm in #2

Full Changelog: 0.0.1...0.0.2

0.0.1

PoC release. Pray it works at all. :-)

What's Changed

• Add docs by @isbm in #1

New Contributors

• @isbm made their first contribution in #1

Full Changelog: https://github.com/tinythings/bunkerbox/commits/0.0.1