BlueRock 26.23.0
Purpose of this Document
This is a living document and is updated with each release.
This document provides information about the features, enhancements, and known issues in BlueRock Release 26.23.0. It applies to both new deployments and upgrades from earlier versions.
This release focuses on simplifying BlueRock Runtime deployment and configuration, improving sandbox networking and container runtime capabilities, expanding observability for AI coding agents, and introducing secure remote development workflows through the Bluedev VSCode Extension and Cobalt application. These enhancements improve deployment, security, and developer productivity while providing greater visibility into AI-assisted development activities.
Revision History
V26.23.0
Supported Platforms / Distributions
BlueRock Release 26.23.0 supports deployment across major public cloud providers.
The following operating systems have been validated for this release.
AWS
Amazon Linux 2023
6.12.89
Amazon Linux 2023 (Kubernetes 1.34)
6.12.89
GCP
Ubuntu 24.04
6.12.89
Azure
Ubuntu 24.04
6.12.89
New Features and Enhancements
This release introduces significant improvements to BlueRock Runtime deployment, sandbox networking, AI coding agent observability, and remote development workflows. Enhancements include a simplified runtime configuration model, expanded container networking capabilities, new observability sensors for AI coding assistants, and improved authentication support for remote development environments.
Ease of BlueRock Runtime Deployment and Configuration
The BlueRock Runtime now runs as the bluerockd system daemon, simplifying deployment and lifecycle management.
Key enhancements include:
BlueRock Runtime is managed through the bluerockd system service.
Runtime configuration is centralized in
/etc/bluerock/bluerockd.toml.Configuration is organized into dedicated Runtime, Policy, and OTLP sections.
Policy configuration supports downloading signed policy blobs and signature verification using public keys.
OTLP event streaming is configurable, with events written to
/var/log/bluerockd/otel-event.logsby default.
BlueRock Sandbox Improvements
BlueRock Sandbox has been enhanced to improve container execution and network isolation.
Key enhancements include:
Support for containerd-shim to execute Docker images using standard Docker commands.
Ability to bind sandbox containers to Docker networks.
Network policy enforcement for ingress and egress traffic.
Expanded Seccomp policy support, including:
System call filtering
Suspicious syscall detection
Executable memory protection
File access protection
Socket monitoring
Connection monitoring
File deletion monitoring
Sensitive file access protection
Process guard enforcement
If no network policy is configured, sandbox containers allow all outbound traffic while blocking all inbound traffic by default.
Enhanced Network Firewall Management
Network firewall configuration has been enhanced with the following behavior:
A single network firewall configuration can be associated with either standalone applications or container-based applications.
Updating network firewall policies requires restarting the
bluerockdservice.Standalone sandbox applications automatically inherit configured firewall policies.
Docker network creation is recommended before launching standalone sandbox applications when shared networking is required.
Observability for AI Coding Agents
BlueRock introduces new runtime observability capabilities for AI coding assistants.
The AI coding agent sensor is enabled by default and provides runtime visibility into AI coding agent activities. When AI coding agents are executed within a BlueRock Sandbox, sandbox policies are enforced.
Supported AI coding agents include:
Claude
Cursor
Gemini
Codex
Bluedev VSCode Extension
The Bluedev VSCode Extension enables developers to securely launch remote development workspaces on BlueRock virtual machines directly from Visual Studio Code.
Key capabilities include:
Launch secure remote development containers from a catalog of available Docker images
Clone Git repositories into remote development containers
Manage remote containers with attach, rename, pause, and destroy operations
Support for running Claude and Cursor AI coding agents inside remote development containers
SSH connectivity to remote Bluedev containers using either SSO or SSH key-based authentication
Single Sign-On (SSO) using Google Auth and Microsoft Entra ID
Support for multiple remote development workspaces
Cobalt Application for Claude Desktop
The Cobalt application enables Claude Desktop users to create and manage secure remote development workspaces hosted on BlueRock virtual machines.
Once the remote development container is launched, Claude Desktop IDE users can run their Claude Code session securely inside the remote container.
Features include:
Remote Bluedev container management
Secure SSH connectivity to remote Bluedev containers using Single Sign-On (SSO) or SSH key-based authentication
File sharing between the local filesystem and the remote container filesystem
Supported on Windows and MacOS
Bluedev User Identity Management
BlueRock now supports enhanced user authentication for remote development environments. BlueRock VM includes the StepCA server package and a deployment script to configure the StepCA server with Google Auth and Microsoft Entra ID provisioners for Single Sign-On (SSO).
Supported authentication methods include:
Single Sign-On (SSO) using Google Auth and Microsoft Entra ID
SSH key-based authentication
Resolved Issues
No resolved issues in this release.
Known Issues
BC-3371 Restarting bluerockd disrupts existing sensor connections
Restarting the BlueRock Control Plane service disconnects existing BlueRock sensor connections, interrupting active AI agent and MCP applications.
Workaround
Restart all affected AI agent and MCP applications after restarting the bluerockd service.
BA-2927 SSH connection failure on macOS Monterey
SSH connections to BlueRock hosts using the Bluedev VSCode Extension or the Cobalt application may fail on macOS Monterey because of domain socket path length limitations.
Workaround
No workaround is currently available.
BC-3381 Source-address ingress firewall rules not enforced
Source-address-based ingress firewall rules are not correctly enforced for BlueRock Sandbox containers.
Workaround
No workaround is currently available.
Last updated