On this page

Microsoft's open-source Conductor CLI defines multi-agent workflows in YAML and runs them against providers such as GitHub Copilot, OpenAI, and Anthropic Claude. Conductor 0.1.44, published on GitHub at 2026-11-01T16:50:01Z (2026-11-02 00:50 Asia/Shanghai), ships a concrete separation that many agent stacks still blur: which model provider answers versus where the agent loop, tools, and MCP calls actually run.

The release names that separation agent execution realms and profiles. Operators point a step or a workflow default at an execution.profile. That profile resolves to an isolated Docker runner or to an Azure Container Apps (ACA) dynamic session. The model provider stays a separate setting. We haven't run Conductor 0.1.44 end-to-end in production; the wording below follows the GitHub release notes, the project README, and the in-repo ACA provider documentation. For reference only.

Audience is narrow: teams already wiring Conductor workflows, or evaluating Conductor as a harness that must keep untrusted tool loops off the host. Readers who only chat in Copilot or Claude Code and never touch a Conductor YAML can skip this page. Related on-site context on runtimes and harnesses: AWS Opens Infinity, a Research Runtime for Extreme Agent Concurrency, Microsoft Copilot Harness Lands in Foundry Agent Service Preview, Same Model, Different Coding Harness: Pass Rate Barely Moves, the Bill Does, and Cursor Agent SDK Is Out: Folders, Eval, and Deploy.

What 0.1.44 adds

Per the Conductor 0.1.44 GitHub release notes:

  • Agents can run in isolated Docker containers or Azure Container Apps dynamic sessions through execution.profile.
  • Docker profiles accept a runner_image so the agent loop, stdio MCP tools, and staged workspace dependencies live together in a long-lived runner container.
  • Remote runners support /interrupt for targeted mid-turn pauses, multi-provider execution (Copilot, OpenAI, Claude), and per-call agent-scope secret delivery (env_overlay) into stdio MCP processes without dumping those secrets into the runner process environment.
  • Host-resolved credentials and endpoints stay authoritative inside the runner. Docker interrupt delivery remains monitored through transport shutdown; a racing completion keeps its result. Retained Docker workspaces record agent dispatch so resume refuses a missing staging marker instead of overwriting agent-written files.
  • ACA execution profiles configure the pool and session scope under an environment profile's aca block, independently of the agent's model provider. The legacy provider: aca form remains available with a deprecation notice.

The same release also fixes Fleet TUI gate text entry and removes the obsolete conductor.providers.aca_protocol module in favor of conductor.runner.protocol. Those fixes matter to day-to-day operators; the product story for this page is the profile split.

Why “model” and “execution environment” used to stick together

Earlier Conductor ACA usage entangled where an agent ran with which model stack it used. Choosing the old ACA provider form forced Copilot inside the sandbox and mixed pool credentials into workflow YAML. The in-repo ACA provider documentation states that migration goal plainly: execution profiles decouple what runs from where it runs. Workflows name the model provider; environment documents configure the ACA pool (or Docker backend). Switching between a laptop run and an Azure sandbox becomes a matter of which --environment file is passed, not a rewrite of every agent step.

That design matches other harness articles: the model card and the runtime that holds tools, files, and network policy are different levers. Conductor 0.1.44 makes the lever names explicit in YAML—runtime.provider on one side, execution.profile / environment profiles.*.backend on the other.

How execution.profile resolves

Workflows declare a profile name under workflow.defaults.execution.profile, with optional per-step execution.profile overrides. An execution environment document (for example under .conductor/environments/) maps each logical name to a concrete backend:

  • backend: docker — local or remote Docker runner; release notes highlight runner_image, workspace staging, interrupt, and env_overlay for MCP secrets.
  • backend: aca — Azure Container Apps dynamic-sessions sandbox; pool endpoint, API version, identifier scope, egress, lifecycle, and auth live under the profile's aca block.

Example shape from the project's own ACA profile sample: workflow runtime.provider: copilot plus defaults.execution.profile: aca_sandbox, while the environment file defines profiles.aca_sandbox.backend: aca and the pool settings. The docker-agent environment example in the repo shows both a docker_agent profile (with image / runner_image) and an aca_sandbox profile side by side—so the same workflow idea can target either backend by environment choice.

conductor validate … --environment … is the project's documented way to preview how profiles resolve before a live run. We haven't tested every validation table row against 0.1.44 binaries; the CLI output in the project's own environment is the live map.

ACA is still Experimental

The project README lists Azure Container Apps sandboxed execution under Experimental, with a section titled Using ACA (Experimental) and a provider comparison table that marks the ACA column Experimental. The ACA provider documentation likewise places ACA in the experimental tier and notes capability carve-outs.

So “ACA execution profile” in 0.1.44 is not a claim that Microsoft has promoted ACA-backed Conductor runs to the same stability tier as Copilot or OpenAI providers in that README table. Experimental means gaps, sharper edges, and policy that can change remain in play; it also does not invent a GA date the README never published.

Legacy provider: aca and the migration path

Release notes keep the legacy provider: aca form with a deprecation notice. The ACA provider documentation spells the warning operators will see:

provider: aca is deprecated; use provider: copilot with an ACA execution profile

Migration, in documentation terms:

  1. Set the workflow (or step) model provider to a supported value such as copilot, openai, or claude.
  2. Point execution.profile at an environment profile whose backend is aca.
  3. Move pool fields (pool_endpoint, api_version, identifier_scope, egress, lifecycle, auth) into that environment profile's aca block—out of the workflow YAML.
  4. Drop inner_provider from the old structured ACA provider block; the inner model choice becomes the normal provider: field.

Existing workflows that still use provider: aca continue through a compatibility facade per that documentation; new work starts on the profile form so credentials stay in environment documents.

MIT license, model bills, and Azure bills

The microsoft/conductor repository is licensed under MIT. Open-sourcing the CLI does not make model inference free, and it does not make Azure Container Apps capacity free. Copilot subscription usage, OpenAI or Claude token billing, and ACA dedicated-node / warm-pool charges remain separate meters. The ACA provider documentation even notes that sandbox wall-clock rows in usage views are a visibility proxy, not an Azure invoice line—pool sizing still has to be checked against the real Azure bill.

When a page says Conductor is open source, read that as the harness code is MIT, not as a bundle that erases provider or cloud spend.

Isolation is a feature claim, not a security certification

Docker runners and ACA dynamic sessions are framed as places to park untrusted or isolation-sensitive agent loops—generated code, broad tool access, MCP processes that should not sit in the host shell. That framing is useful. It is also incomplete as a security guarantee.

We haven't tested whether Docker or ACA isolation in Conductor 0.1.44 is enough to treat as a security guarantee. Credential forwarding into sandboxes, egress settings, image provenance, pool multi-tenancy, and interrupt races are not covered as a certified security boundary here. Plain reading: we haven't tested Docker / ACA isolation hard enough to call it a security guarantee. Teams that need a security boundary run their own threat model, image pinning, and credential scoping; “isolated container” alone is not a compliance fill-in.

Operator checklist for 0.1.44

  1. Version. Conductor 0.1.44 (or a newer tag if one already exists) is the install/upgrade target; the matching GitHub release notes for that tag are the source of record.
  2. Two settings stay split. The workflow names the model provider. The execution profile names where the agent loop runs. Pool endpoints sit in an environment document when that document can hold them, not inside workflow files.
  3. Docker vs ACA is a deliberate choice. Docker profiles fit collocated runner images and local or self-hosted container hosts. ACA profiles fit Azure dynamic-sessions pools and carry the README's Experimental label.
  4. Off provider: aca. Legacy ACA provider blocks give way to provider + execution.profile as the ACA documentation describes.
  5. Secrets as overlays, not ambient env. The release's env_overlay pattern for MCP process secrets keeps runner process environments cleaner.
  6. Validate before trusting. conductor validate against the intended environment file surfaces the execution resolution table the project documents.
  7. Three meters. Conductor MIT source ≠ model API spend ≠ Azure pool spend.
  8. Security call stays in-house. Isolation strength is something we haven't tested hard enough; anything that handles production secrets or untrusted code still needs internal review.

Where this sits among other runtimes

Conductor is one of several 2026-era bets that agent quality depends as much on the harness and execution environment as on the model name. AWS Infinity (research runtime for extreme concurrency), Foundry's Copilot harness preview, Cursor's Agent SDK packaging, and on-site discussions of harness cost all orbit the same split: model card versus place-the-loop-runs. Conductor 0.1.44's contribution is a concrete YAML vocabulary—execution.profile—plus Docker and ACA backends, with ACA still marked Experimental in the project README.

Closing

Conductor 0.1.44 makes model provider and execution environment first-class, separate choices: execution.profile can target isolated Docker runners or Azure Container Apps dynamic sessions while Copilot, OpenAI, Claude, and other providers stay independently configured. The GitHub release clock for 0.1.44 is 2026-11-01T16:50:01Z (2026-11-02 00:50 Asia/Shanghai). ACA remains Experimental in the project README. The repo is MIT; open source does not erase model or Azure bills. We haven't tested Docker / ACA isolation as a security guarantee. When console behavior and this page disagree, the GitHub release notes and project README are the ones that count. For reference only.