Release notes from Containarium
Articles about Release notes from Containarium
Containarium v0.103.3
What changed Internal cut v0.103.3 — mcp-server works with Claude Code and lists its tools for a box token (#2533) Other [#2529] fix(mcp): never reply to a notification; list tools for a box token (#2531) Full diff: v0.103.2...v0.103.3 Containarium v0.103.3 The open-source, self-hostable, agent-native sandbox.
Containarium v0.103.2
What changed Fixed correct platform constraints for hostcheck and agent-box (#2507) Internal cut v0.103.2 — a dispatched run can call its tracker tools (#2511) Other [#2508] fix(agent): the seeded platform MCP carries the plaintext opt-in for the bridge URL (
Containarium v0.103.1
What changed Fixed apply privileged Podman policy to local create (#2495) Internal cut v0.103.1 — agents:run can provision a skill's box; local create honours the privileged-Podman policy (#2506) Other [#2504] fix(server): agents:run provisions the skill's box without containers:write (
Release v0.103.0 · FootprintAI/Containarium
What changed Fixed open SubjectDigest files O_NONBLOCK (#2487) Internal cut v0.103.0 — coding-agent boxes ship the SDLC skills, keyless boxes reachable, cleartext tunnel path removed (#2494) Ot
Containarium v0.102.0
What changed Fixed fail back to the preferred primary after it recovers (#2476) (#2477) Internal cut v0.102.0 — sentinel: failback to the preferred primary, TLS-only tunnel sessions by default, per-backend certificate scoping, loopback-bound tunnel API ports (#2478) Other sentinel: require TLS for tunnel sessions by default (
Containarium v0.101.4
What changed Fixed tunnel client reconnect backoff starts over after a stable session; cut v0.101.4 (#2473) (#2474) Full diff: v0.101.3...v0.101.4 Containarium v0.101.4 The open-source, self-hostable, agent-native sandbox. Binaries Four binaries ship in this release: Binary Where it runs What it does containariumd The host The platform daemon plus host-side admin commands. containarium Your laptop / CI (linux, macOS, windows) The client CLI: create, list, expose-port, ssh-config,
Containarium v0.101.3
What changed Fixed never dial the sentinel's own HTTPS listener as the passthrough fallback; cut v0.101.3 (#2470) (#2471) Full diff: v0.101.2...v0.101.3 Containarium v0.101.3 The open-source, self-hostable, agent-native sandbox. Binaries Four binaries ship in this release: Binary Where it runs What it does containariumd The host The platform daemon plus host-side admin commands. containarium Your laptop / CI (linux, macOS, windows) The client CLI: create, list, expose-port, ssh-config
Containarium v0.101.2
What changed Added report whether a run’s model traffic is scanned (#2367) (#2465) wire the inbound response scan into the daemon’s model gateway (#2367) (#2464) cache the inbound policy read; exp
Containarium v0.101.1
What changed Fixed pass upstream non-2xx errors through the inbound scan (#2453) (#2461) Internal cut v0.101.1 — sidecar images pass the Trivy gate (#2463) Full diff: v0.101.0...v0.101.1 Containarium v0.101.1 The open-source, self-hostable, agent-native sandbox. Binaries Four binaries ship in this relea
Containarium v0.101.0
What changed Added allow-list-only egress preset and a plan of what to allow (#2440) (#2445) detect a non-distro SSH listener in a box (#2439) (#2444) box sshd key-only drop-in + posture reconcile
Containarium v0.101.0-rc.1
What changed Added restore/verify --managed, --latest, restore --target (#2403) (#2418) hook dumps with a declared pg_custom format (#2405) (#2409) key-wrap seam and managed key mode (#2402) (#241
Containarium v0.99.3
What changed Fixed bound and cache the host resources read so a hung hardware scan cannot block creates (#2325) (#2326) Documentation PRD for approving an agent's permission request from a phone (#2182) Internal cut v0.99.3 — a hung Incus hardware scan no longer blocks creates, GetSystemInfo or ListBackends (
Containarium v0.99.2
What changed Added per-tenant backup-health dead-man alert series (#2294) Fixed attribute write audit rows to run claims (#2043) (#2168) bound ListBackends probes and run peers in parallel (#231
Containarium v0.99.1
What changed Fixed apt-get upgrade the runtime stage of the four images that failed the v0.99.0 Trivy gate (#2308) Internal cut v0.99.1 — supersedes v0.99.0, whose images failed the release Trivy gate (#2309) Full diff: v0.99.0...v0.99.1 Containarium v0.99.1 The open-source, self-hostable, agent-native sandbox. Binaries Four binaries ship in this release: Binary Where it runs What it does containariumd The host The platform daemon plus host-side admin commands. containarium Your laptop / CI (linux, macOS, windo
Containarium v0.99.0
What changed Added bound how many runs one dispatch tick starts (#2270) (#2306) decrypt-verification for backup verify (#2295) (#2302) sweep stale lineage reservations on run-lease end, surface th
Containarium v0.98.0
What changed Added daemon StartBoxRun RPC + code run --session (#2260) enforce a named-engine skill’s pinned model (#2229) (#2258) per-invocation --engine override on run/crew run (#2228) (#2257)
Containarium v0.97.1
What changed Internal cut v0.97.1 — supersedes the dead v0.97.0 tag (#2255) Full diff: v0.97.0...v0.97.1 Containarium v0.97.1 The open-source, self-hostable, agent-native sandbox. Binaries Four binaries ship in this release: Binary Where it runs What it does containariumd The host The platform daemon plus host-side admin commands. containarium Your laptop / CI (linux, macOS, windows) The client CLI: create, list, expose-port, ssh-config, etc. against a server (--server).
Release v0.97.0 · FootprintAI/Containarium
chore(release): cut v0.97.0 — agent-router readiness RPC, web UI, two
Containarium v0.96.0
v0.96.0 — 2026-10-02 Added Agent engine on the skill manifest: a skill can name its agent engine (engine: claude | codex | gemini), honoured per run, so skills or crew members on one daemon can run on different engines. An unknown engine fails at catalog load; a skill naming an engine with no resolvable key is refused before anything is provisioned. The engine a run used is recorded on its lease and audit event and shown by containarium agent get (#2237, #2222).
Containarium v0.95.0
What changed Added opt-in expiry reminder — containarium remind-me, webhook delivery at T-30m, once (#2206) (#2233) expiry warner — wall at T-10m and T-1m, once each, restart-safe (#2202) (#2227)
Containarium v0.94.0
v0.94.0 — 2026-10-01 Added ssh new. anonymous VM boxes: EnsureAnonymousBox resolves or creates an Incus VM per SSH-key fingerprint (fixed 2 vCPU / 4 GB / 20 GB, 4 h TTL, DNS/HTTP/HTTPS-only egress), the sshpiperd anon-door plugin and sshpiper-anon unit behind ssh new., and ClaimAnonymousBox / containarium claim / containarium anon claim to bind a box to a tenant (TTL cleared, egress lifted, keys added). (#2196, #2197,
Release v0.93.1 · FootprintAI/Containarium
What changed Fixed present the issued SSH certificate in connect exec/session (#2179) (#2180) bump pinned otelcol-contrib 0.110.0 -> 0.162.0 (decision O1) (#2178) Internal cut v0.93.1 — MCP conn
Containarium v0.93.0
v0.93.0 — 2026-09-29 Added sentinel: opt-in --watch-spot-vm name:zone[:project] flag (repeatable) so a sentinel can watch an additional, independent GCP spot/preemptible VM for preemption and auto-restart it, without adding it to the primary/failover HTTP proxy pool. Each watch target gets its own recovery/backoff timeline, independent of the primary backend's. (#2175) Full diff: v0.92.0...v0.93.0 What changed Added watch additional GCP spot VMs for preemption-recovery (#2175) Internal cut v0.93.0 — sentinel watch-spot-vm (
Containarium v0.92.0
v0.92.0 — 2026-09-29 A backend upgrade can now say which version it will install. A default upgrade pulls whatever binary the sentinel serves and checks it by checksum only, so until now nothing could name the target. It can also be behind the latest GitHub release until an operator runs containarium sentinel fetch-release.
Containarium v0.91.1
v0.91.1 — 2026-09-29 Supersedes v0.91.0, which shipped no CLI/MCP/agent-box release assets — release.yml's "Build agent-runtime bundle" step failed on a pre-existing bug in verify-agent-runtime-bundle.sh (fixed below). v0.91.0's other content (daemon image, PyPI package, sshpiper/agent-box sidecar images, the sentinel SSH-CA trust auto-sync fix, etc. — see the v0.91.0 notes) is unaffected and carries forward into this release.
Containarium v0.91.0
v0.91.0 — 2026-09-29 Added Sentinel: auto-sync SSH CA trust bundle from cloud, fixing a class of silent trust-anchor loss on redeploy (fixes cloud#1928) (#2152) netpolicy: deny a box its peers' A2A port in the compiled allowed_peers policy (#2154) code: ListBoxRuns + TailBoxRunLog daemon reads for code-run records, code runs/logs CLI, MCP wrappers (#2123) (
Containarium v0.90.1
v0.90.1 — 2026-09-26 Fixed /authorized-keys's orphan filter batched into one Incus call per request instead of one live call per tenant — was serializing into multi-second responses on a fleet-sized backend, which the sentinel's event-driven key-resync push could intermittently time out against. (#2071) A run token can no longer add or remove a scope:* label on an issue outside its own lineage. (#2060, #2067) Full diff: v0.90.0...v0.90.1
Containarium v0.90.0
v0.90.0 — 2026-09-26 Added Tracker dispatch failure visibility, tracker issue create, tracker dispatch, dispatched-run result reporting, code install credential/agent-box improvements, coding-agent recipe, and engineer-crew (issue-to-PR-content catalog crew). (#2021-#2026, #2030,
Containarium v0.89.0
v0.89.0 — 2026-09-24 Added containarium sentinel ssh-sessions list / follow: read the sentinel's SSH session lifecycle records (newest-first table or --json; tail with follow; filter by --session-id / --login). (#2004, #2009) Fixed Sentinel key resync no longer 404s (unknown backend) for a direct backend whose daemon ID differs from the sentinel's name for it; an unknown ID now falls back to the request's source IP, so the event-driven push actually shortens the ~2 min SSH-key propagation window on those backends. (
Containarium v0.88.0
v0.88.0 — 2026-09-24 Added Sentinel SSH session lifecycle records: a chained sshpiperd plugin appends one JSONL record per SSH session open and close (#1980, #2005) Changed gRPC transport-level authentication hardened. External gRPC connections are now accepted only over mTLS (--mtls); without it the daemon no longer opens an external gRPC listener, so containarium gRPC clients using --insecure must switch to mTLS. REST behaviour is unchanged. Operators should upgrade promptly. (
Release v0.87.1 · FootprintAI/Containarium
v0.87.1 — 2026-09-23 Fixed diff-drafter / diff-reviewer prompts hardened against non-compliant output. A live run showed the model could emit a hallucinated tool-call snippet instead of the {"files": [...], ...} JSON artifact the skill's contract requires. Both prompts now explicitly require using real file-editing tools, reading each changed file back from disk before reporting it, and — as the final, repeated instruction — that the response must be ONLY the JSON object. Root cause tracked separately as a real feature (cloud#1752): agent-card.
Release v0.87.0 · FootprintAI/Containarium
v0.87.0 — 2026-09-23 Changed diff-drafter / diff-reviewer emit whole-file content, not a unified diff. The platform's only PR-opening mechanism (internal/githubpr) applies full file bodies via GitHub's Contents API and has never applied a real diff — matching that shape means the cloud actuator can turn a completed diff-crew run into a real PR by composing existing machinery. diff-reviewer echoes the drafter's summary back (drafter_summary) so a PR can credit both agents. (#1997, cloud#1738) Full diff: v0.86.0...v0.87.0
Containarium v0.86.0
Added diff-drafter / diff-reviewer skills + diff-crew, the reference pair for a crew that jointly edits a repo. diff-drafter reads a checked-out repo plus a task and emits a small, well-scoped unified diff; diff-reviewer receives that diff as its own task input (the existing pipeline hand-off), applies it to its own checkout of the same commit, reviews and edits it, and emits the final diff as the crew's own artifact. Both reuse the existing generic agent-runtime recipe — no new platform machinery, image, or recipe changes.
Containarium v0.85.1
v0.85.1 — 2026-09-22 Fixed startServeMode kills a prior agent-runtime before launching a fresh one. A crew member box is reused across runs, and RunCrew re-mints a fresh gateway token and reseeds it to disk on every call — but nothing stopped an earlier agent-runtime instance first. The A2A server binds a fixed port, so every relaunch after a box's first-ever boot crashed on EADDRINUSE, silently.
Containarium v0.85.0
What changed Added report Incus server version in BackendInfo (#1985) Internal cut v0.85.0 — Incus v7 client, Incus version in BackendInfo (#1986) Bump Incus Go client v6.23.0 -> v7.4.0 (and Go 1.26.7) (#1984) Full diff: v0.84.1...v0.85.0 Containarium v0.85.0 The open-source, self-hostable, agent-native sa
Containarium v0.84.1
v0.84.1 — 2026-09-21 Supersedes v0.84.0, whose release build failed the changelog gate (no CHANGELOG section) and published no artifacts. Same code; use v0.84.1. Added RunCrew accepts git_source / git_ref / git_credential, fetched into every member's own per-run workspace. CrewRun records git_source, git_ref and the resolved git_commit. containarium crew run gains --git-source, --git-ref, --git-credential-file. Additive proto fields. (#1981, cloud#1554) Fixed Dependency bumps: google.golang.org/api (#1978), cloud.google.com/go/compute (
Containarium v0.83.0
What changed Added surface host git preflight in tracker status (#1923 step 8/8 — final) (#1958) CLI + platform MCP for SubmitTrackerChange (#1923 step 7/8) (#1957) SubmitTrackerChange orchestrati
Containarium v0.82.0
What changed Added add run_id passthrough to RunCrewRequest (#1900) optional GitHub-direct daemon self-upgrade by tag (#1913) add ssh_public_keys to the Collaborator response (#1144) (#1911) add o
Containarium v0.81.2
What changed Fixed stop treating an unreachable backend as "container not found" (#1906) report unreachable backends instead of silently dropping their containers from the fleet list (#1904) report unreachable backends instead of silently dropping their fleet metrics (#1903) only wait for cloud-init when the image actually has it (
Containarium v0.81.1
v0.81.1 — 2026-09-17 Supersedes the broken v0.81.0 tag, which was cut without the required CHANGELOG.md section / pkg/version/version.go bump and failed the release CI's verify-release gate before publishing anything. This is the real 0.81 release — no artifacts were ever published from v0.81.0. Added app-hosting: warn when a DNS-01 subject's zone isn't in the credential's scope (#1891) Fixed network: require tenant ownership on egress-via-client start/stop (#1890) k8s: reject an invalid tenant name early, with a clear error (
Release v0.81.0 · FootprintAI/Containarium
This release is broken and superseded — do not use. It was tagged without the required CHANGELOG.md/pkg/version/version.go bump (docs/RELEASE-PROCESS.md), so its release build failed the verify-release gate before publishing anything. No artifacts exist for this tag. See v0.81.1 for the real release.
Containarium v0.80.1
What changed Internal cut v0.80.1 — reachability probe, KVM guest-agent wait, sandbox pool race, git-source agent runs, backup retention (#1874) Full diff: v0.80.0...v0.80.1 Containarium v0.80.1
V0.80.0 — DEAD, superseded by v0.80.1
⚠️ DEAD TAG — superseded by v0.80.1 This release was cut without following docs/RELEASE-PROCESS.md's checklist (pkg/version/version.go / CHANGELOG.md were not bumped first). release.yml's own gate caught the mismatch and refused to publish the GitHub Release binary assets — this release has none attached. Do not use this tag or its images. Use v0.80.1 instead (see #1874). Per the same precedent as v0.48.0, this dead tag is left in place rather than deleted or moved; a superseding release was cut on top of it instead.
Containarium v0.79.2
What changed Added --client-ip-header + --trusted-proxy-cidrs for CDN-fronted real client IP (#1829) (#1832) retention/pruning — keep newest N per database (#1840) Internal cut v0.79.2 — client-IP-behind-CDN + backup retention/pruning (
Containarium v0.79.1
What changed Added tenant self-registers its own age recipient via Secrets API (#1837) Internal cut v0.79.1 — tenant self-registered backup recipient (#1836) (#1838) Full diff: v0.79.0...v0.79.1 Containarium v0.79.1 The open-source, self-hostable, agent-native sandbox. Binaries Three binaries ship in this
Containarium v0.79.0
What changed Added credential-less in-tenant hook + user-held age encryption (#1833) Internal cut v0.79.0 — credential-less hook + user-held backup encryption (#1831) (#1834) Full diff: v0.78.1...v0.79.0 Containarium v0.79.0 The open-source, self-hostable, agent-native sandbox. Binaries Three binaries shi
Containarium v0.78.1
v0.78.0 — 2026-09-13 Execution-scoped authorization: a skill run's credentials now die with the run. Design: docs/architecture/execution-scoped-authorization.md in FootprintAI/Containarium-cloud. PRD: docs/product/execution-scoped-authorization.md. Added RunAgentSkill mints, holds, and ends a credential lease for every skill run: both the delegated platform JWT and the model-gateway token are revoked and wiped from the box on every exit path (success, agent error, or a cancelled caller), instead of living out their full 30-minute TTL
Release v0.78.0 · FootprintAI/Containarium
v0.78.0 — 2026-09-13 Execution-scoped authorization: a skill run's credentials now die with the run. Design: docs/architecture/execution-scoped-authorization.md in FootprintAI/Containarium-cloud. PRD: docs/product/execution-scoped-authorization.md. Added RunAgentSkill mints, holds, and ends a credential lease for every skill run: both the delegated platform JWT and the model-gateway token are revoked and wiped from the box on every exit path (success, agent error, or a cancelled caller), instead of living out their full 30-minute TTL
Containarium v0.77.0
What changed Added narrow FORWARD-chain block for the cloud metadata endpoint (#1103) (#1810) warn loudly on posture at enrollment, publish BYOC baseline (#1103) (#1808) Fixed remove --no-block-