Containerise - run spikes on outer and inner containers#4

Merged

neuromaxer merged 16 commits into

mainfrom

containerise-p1

Jun 12, 2026

Commits on Jun 11, 2026

add containerisation plan
neuromaxer
committed
add podman spike files
neuromaxer
committed
spike: record host facts (Ubuntu 26.04, kernel 7.0, apparmor userns restriction active)
stage0 spike agent
committed
update spike brief
neuromaxer
committed
≈Merge branch 'containerise-p1' into stage0-spike
stage0 spike agent
committed
spike: fix newuidmap via file-caps (setuid-root failed CAP_SYS_ADMIN check)
stage0 spike agent
committed
spike: full nested chain green (12/12 smoke pass)
stage0 spike agent
committed
spike: clear crun runtime state on boot so 'podman start --all' recovers inner containers after docker restart (Stage 4 recovery mechanism)
stage0 spike agent
committed
spike: T4 pin native rootless overlay, drop --device /dev/fuse
stage0 spike agent
committed
spike: T2 minimise flags — tailored seccomp profile replaces unconfined
stage0 spike agent
committed
spike: T2 outer-runtime sub-question + complete SPIKE-FINDINGS.md
stage0 spike agent
committed
spike: update run-outer.sh header (candidate -> final proven set, T2 complete)
stage0 spike agent
committed