Marco Allegretti
cbf954bead
runtime: propagate offline mode
...
Add RuntimeSpec.offline and thread it through OCI/namespace backends.
Offline mode requires cached base images, forces sandbox network isolation,
and fails fast when system package resolution/installation would require
network access.
2026-02-23 18:28:10 +01:00
Marco Allegretti
8493831222
feat: karapace-runtime — namespace/OCI/mock backends, sandbox, host integration
...
- RuntimeBackend trait: resolve, build, enter, exec, destroy, status
- Namespace backend: unshare + fuse-overlayfs + chroot (unprivileged)
- OCI backend: crun/runc/youki support
- Mock backend: deterministic test backend with configurable resolution
- Image downloading from images.linuxcontainers.org with blake3 verification
- Sandbox script generation with POSIX shell-quote injection prevention
- Host integration: Wayland, X11, PipeWire, PulseAudio, D-Bus, GPU, audio, SSH agent
- Desktop app export as .desktop files on the host
- SecurityPolicy: mount whitelist, device policy, env var allow/deny, resource limits
- Prerequisite detection with distro-specific install instructions
- OSC 777 terminal markers for container-aware terminals
2026-02-22 18:36:46 +01:00
