llama.cpp b10328 adds Docker tool isolation for safer AI agents

llama.cpp, ggml-org's massively popular open-source LLM runtime with 123k GitHub stars and 21.5k forks, just dropped release b10328. The headline feature is "server: add initial tool isolation support (via docker)" (#26507), which lets users execute LLM-generated tool calls—like bash commands, file reads, or network requests—inside Docker containers rather than directly on the host. This is a significant security upgrade for AI agent workflows, where models can be tricked into running malicious or unintended actions. By sandboxing tools, llama.cpp limits the blast radius from a prompt-injection attack to a disposable container with no persistent host access.

The commit also renames the older "sandbox" concept to "isolate" and splits the configuration into tools_io_sandbox and tools_io_docker, making the two runtime modes explicit. The HTTP header has been updated from x-tool-docker to x-tool-runtime, giving clients a flexible way to choose the isolation backend. Documentation and the get_info endpoint were adapted accordingly. This marks only the initial implementation, so expect more hardening and runtime options later. Meanwhile, b10328 ships a vast matrix of prebuilt binaries: macOS Apple Silicon with optional KleidiAI, Linux x86/arm64 with Vulkan, ROCm 7.2, OpenVINO, and SYCL, Windows with CUDA 12/13, Vulkan, OpenCL Adreno, and HIP, plus Android and openEuler builds. The scale of platform support reinforces llama.cpp's role as the go-to local inference engine.