Implement sandlock-oci: OCI-compliant runtime for namespace-less sandboxing

Cargo.toml

@@ -4,6 +4,7 @@ members = [
     "crates/sandlock-core",
     "crates/sandlock-cli",
     "crates/sandlock-ffi",
+    "crates/sandlock-oci",
 ]
 
 [workspace.package]

crates/sandlock-oci/Cargo.toml

@@ -0,0 +1,31 @@
+[package]
+name = "sandlock-oci"
+version.workspace = true
+edition.workspace = true
+license.workspace = true
+repository.workspace = true
+homepage.workspace = true
+description = "OCI runtime shim for sandlock — namespace-less, Landlock-based"
+readme = "../../README.md"
+
+[lib]
+name = "sandlock_oci"
+path = "src/lib.rs"
+
+[[bin]]
+name = "sandlock-oci"
+path = "src/main.rs"
+
+[dependencies]
+sandlock-core = { version = "0.7.0", path = "../sandlock-core" }
+anyhow      = "1"
+clap        = { version = "4", features = ["derive"] }
+tokio       = { version = "1", features = ["rt-multi-thread", "macros"] }
+serde       = { version = "1", features = ["derive"] }
+serde_json  = "1"
+libc        = "0.2"
+oci-spec    = { version = "0.7", features = ["runtime"] }
+
+[dev-dependencies]
+tempfile = "3"
+tokio    = { version = "1", features = ["rt-multi-thread", "macros"] }

crates/sandlock-oci/src/lib.rs

@@ -0,0 +1,19 @@
+//! Sandlock OCI runtime shim library.
+//!
+//! Provides OCI spec parsing, policy translation, and state management
+//! for use by the sandlock-oci binary and integration tests.
+//!
+//! ## Key types
+//!
+//! - [`OciPolicy`] — in-memory representation of the translated OCI config
+//! - [`ContainerState`] — on-disk lifecycle state for a container
+//! - [`SupervisorCmd`] / [`SupervisorReply`] — IPC messages for the supervisor
+
+pub mod policy;
+pub mod spec;
+pub mod state;
+pub mod supervisor;
+
+pub use policy::OciPolicy;
+pub use state::{ContainerState, ExitInfo, Status};
+pub use supervisor::{SupervisorCmd, SupervisorReply, SUPERVISOR_SOCKET};