Ctrlk
For the complete documentation index, see llms.txt. This page is also available as Markdown.

BlueRock 26.23.0

Purpose of this Document

This is a living document and is updated with each release.

This document provides information about the features, enhancements, and known issues in BlueRock Release 26.23.0. It applies to both new deployments and upgrades from earlier versions.

This release focuses on simplifying BlueRock Runtime deployment and configuration, improving sandbox networking and container runtime capabilities, expanding observability for AI coding agents, and introducing secure remote development workflows through the Bluedev VSCode Extension and Cobalt application. These enhancements improve deployment, security, and developer productivity while providing greater visibility into AI-assisted development activities.

Revision History

Release Version
Release Date

V26.23.0

Supported Platforms / Distributions

BlueRock Release 26.23.0 supports deployment across major public cloud providers.

The following operating systems have been validated for this release.

AWS

Distribution
Kernel

Amazon Linux 2023

6.12.89

Amazon Linux 2023 (Kubernetes 1.34)

6.12.89

GCP

Distribution
Kernel

Ubuntu 24.04

6.12.89

Azure

Distribution
Kernel

Ubuntu 24.04

6.12.89

New Features and Enhancements

This release introduces significant improvements to BlueRock Runtime deployment, sandbox networking, AI coding agent observability, and remote development workflows. Enhancements include a simplified runtime configuration model, expanded container networking capabilities, new observability sensors for AI coding assistants, and improved authentication support for remote development environments.

Ease of BlueRock Runtime Deployment and Configuration

The BlueRock Runtime now runs as the bluerockd system daemon, simplifying deployment and lifecycle management.

Key enhancements include:

  • BlueRock Runtime is managed through the bluerockd system service.

  • Runtime configuration is centralized in /etc/bluerock/bluerockd.toml.

  • Configuration is organized into dedicated Runtime, Policy, and OTLP sections.

  • Policy configuration supports downloading signed policy blobs and signature verification using public keys.

  • OTLP event streaming is configurable, with events written to /var/log/bluerockd/otel-event.logs by default.

BlueRock Sandbox Improvements

BlueRock Sandbox has been enhanced to improve container execution and network isolation.

Key enhancements include:

  • Support for containerd-shim to execute Docker images using standard Docker commands.

  • Ability to bind sandbox containers to Docker networks.

  • Network policy enforcement for ingress and egress traffic.

  • Expanded Seccomp policy support, including:

    • System call filtering

    • Suspicious syscall detection

    • Executable memory protection

    • File access protection

    • Socket monitoring

    • Connection monitoring

    • File deletion monitoring

    • Sensitive file access protection

    • Process guard enforcement

If no network policy is configured, sandbox containers allow all outbound traffic while blocking all inbound traffic by default.

Enhanced Network Firewall Management

Network firewall configuration has been enhanced with the following behavior:

  • A single network firewall configuration can be associated with either standalone applications or container-based applications.

  • Updating network firewall policies requires restarting the bluerockd service.

  • Standalone sandbox applications automatically inherit configured firewall policies.

  • Docker network creation is recommended before launching standalone sandbox applications when shared networking is required.

Observability for AI Coding Agents

BlueRock introduces new runtime observability capabilities for AI coding assistants.

The AI coding agent sensor is enabled by default and provides runtime visibility into AI coding agent activities. When AI coding agents are executed within a BlueRock Sandbox, sandbox policies are enforced.

Supported AI coding agents include:

  • Claude

  • Cursor

  • Gemini

  • Codex

Bluedev VSCode Extension

The Bluedev VSCode Extension enables developers to securely launch remote development workspaces on BlueRock virtual machines directly from Visual Studio Code.

Key capabilities include:

  • Launch secure remote development containers from a catalog of available Docker images

  • Clone Git repositories into remote development containers

  • Manage remote containers with attach, rename, pause, and destroy operations

  • Support for running Claude and Cursor AI coding agents inside remote development containers

  • SSH connectivity to remote Bluedev containers using either SSO or SSH key-based authentication

  • Single Sign-On (SSO) using Google Auth and Microsoft Entra ID

  • Support for multiple remote development workspaces

Cobalt Application for Claude Desktop

The Cobalt application enables Claude Desktop users to create and manage secure remote development workspaces hosted on BlueRock virtual machines.

Once the remote development container is launched, Claude Desktop IDE users can run their Claude Code session securely inside the remote container.

Features include:

  • Remote Bluedev container management

  • Secure SSH connectivity to remote Bluedev containers using Single Sign-On (SSO) or SSH key-based authentication

  • File sharing between the local filesystem and the remote container filesystem

  • Supported on Windows and MacOS

Bluedev User Identity Management

BlueRock now supports enhanced user authentication for remote development environments. BlueRock VM includes the StepCA server package and a deployment script to configure the StepCA server with Google Auth and Microsoft Entra ID provisioners for Single Sign-On (SSO).

Supported authentication methods include:

  • Single Sign-On (SSO) using Google Auth and Microsoft Entra ID

  • SSH key-based authentication

Resolved Issues

No resolved issues in this release.

Known Issues

BC-3371 Restarting bluerockd disrupts existing sensor connections

Restarting the BlueRock Control Plane service disconnects existing BlueRock sensor connections, interrupting active AI agent and MCP applications.

Workaround

Restart all affected AI agent and MCP applications after restarting the bluerockd service.

BA-2927 SSH connection failure on macOS Monterey

SSH connections to BlueRock hosts using the Bluedev VSCode Extension or the Cobalt application may fail on macOS Monterey because of domain socket path length limitations.

Workaround

No workaround is currently available.

BC-3381 Source-address ingress firewall rules not enforced

Source-address-based ingress firewall rules are not correctly enforced for BlueRock Sandbox containers.

Workaround

No workaround is currently available.

PreviousBlueRock 26.08.0NextAppendix

Last updated