feat(runtimes): ship opt-in rootless Podman and Docker sysexts

[castrojo]

Summary

First independent replacement for #463, following @jeefy's requested split. Based on current main (eafc6f9), including its sed/gzip build dependencies.

• Ship version-locked Podman/Docker sysexts, private host binaries, separate rootless state and owner-only API sockets. No engine, client, rootful socket, Homebrew bridge, sudo rule or installer policy enters the base OS.
• Keep both sysupdate features and user units disabled by default. Include assets in the signed release, SBOM, validation and reproducibility assembly.
• Preserve Kubernetes' independent containerd and writable CNI paths. Document explicit nonroot activation and subordinate-ID/linger prerequisites.
• Remove brittle fixed-file/source-string assertions; retain behavior and signed-release/transfer contracts.

Verification

• just validate: passed on this standalone branch.
• Signed-release, lockstep, sysupdate-transfer and reproducibility contracts: 160 passed. pre-commit run --all-files: passed.
• Current-head GitHub unit, Go, docs, validate, actionlint, zizmor and Prow checks passed.
• Actual x86_64 runtime elements built in the integrated signed release; exported-image ELF/program closure passed for both runtime sysexts. The final stacked build's runtime payloads match the boot-tested payloads byte-for-byte, and the final signed release verifier passed.
• Integrated QEMU/Fedora-OVMF Secure Boot installed-system acceptance passed rootless host Podman workloads via Brew Docker/Podman clients, Compose and same-path mounts on both boots. This run does not claim to boot the optional Docker daemon backend.

Review decision

Docker retains the digest-pinned upstream static payload from #463 plus FSDK rootless support. The maintainer's upstream-static-binary policy question remains explicit; this PR does not approve or bypass it. No dependency on fsdk-containers#436 or Homebrew/installer changes.

Homebrew integration (#485) and opt-in installer profile (#486) are separate stacked PRs. Minimal remains the default. Independent review is requested from @jeefy.

[hivecommons-hive]

155a9e9

ℹ️ Sentinel notice — informational; author is trusted (owner), merge is not blocked

Hive flagged this PR (author @castrojo, head 155a9e943283) because it matches behaviors that can override security controls, escalate privileges or damage the codebase. This is a heuristic, not an accusation — a maintainer should confirm the change is intended before it merges.

• sensitive_path — changes 2 sensitive path(s) (Touches a sensitive path (OWNERS, workflows, policies, hive config, security docs, …))
  • .github/workflows/reproducibility.yml
  • Justfile

Hive did not add the sentinel-alert label because this author is trusted. The finding remains recorded for audit and the dashboard Security tab; set sentinel.trusted_authors_block: true to require the blocking label for trusted authors too.

[github-actions]

[APPROVALNOTIFIER] This PR is APPROVED

This pull-request has been approved by: castrojo

The full list of commands accepted by this bot can be found here.

Needs approval from an approver in each of these files:

• OWNERS [castrojo]

Approvers can indicate their approval by writing /approve in a comment
Approvers can cancel approval by writing /approve cancel in a comment

[hivecommons-hive]

649cc42

ℹ️ Sentinel notice — informational; author is trusted (owner), merge is not blocked

Hive flagged this PR (author @castrojo, head 649cc42e75b0) because it matches behaviors that can override security controls, escalate privileges or damage the codebase. This is a heuristic, not an accusation — a maintainer should confirm the change is intended before it merges.

• sensitive_path — changes 5 sensitive path(s) (Touches a sensitive path (OWNERS, workflows, policies, hive config, security docs, …))
  • .github/workflows/build.yml
  • .github/workflows/reproducibility.yml
  • .github/workflows/track-junctions.yml
  • .github/workflows/unit-tests.yml
  • Justfile

Hive did not add the sentinel-alert label because this author is trusted. The finding remains recorded for audit and the dashboard Security tab; set sentinel.trusted_authors_block: true to require the blocking label for trusted authors too.

[hivecommons-hive]

Reviewed at head 649cc42 (the queue dispatched 155a9e9; the branch has since gained one CI-comment commit).

correctness

• Podman's /etc/containers seed is shipped but never applied, so a fresh node has no policy.json or registries.conf and podman pull fails. elements/runtimes/podman-runtime.bst:56 installs tmpfiles.conf to /usr/lib/bluefin/podman/tmpfiles.conf, a path systemd-tmpfiles never reads; elements/runtimes/podman-sysext.bst:38-44 copies that tree and the user units and nothing else, and no unit runs systemd-tmpfiles --create on it (contrast elements/oci/kubeadm-sysext.bst:68 + files/kubeadm/sysext/containerd.service:15). The base image has no /etc/containers, sysexts cannot merge /etc, and containers/image resolves policy only from ~/.config/containers/policy.json or /etc/containers/policy.json with no /usr/share fallback (signature/policy_config.go defaultPolicyPathWithHomeDir: "no policy.json file found at any of the following"). Nothing in files/runtimes/podman/containers.conf or the wrapper files/runtimes/podman/podman:11 points Podman at the private copy under /usr/lib/bluefin/podman/etc/containers. Either install the rule into %{indep-libdir}/tmpfiles.d/ with a root-side activation path, or set the policy/registries paths explicitly (e.g. CONTAINERS_REGISTRIES_CONF and a signature_policy-equivalent in the wrapper). The docs at docs/skills/systemd-sysext-extensions.md:116-128 do not tell the operator to create these files either.
• Lock-step contract test deleted instead of adapted. tests/unit/test_signed_lockstep.py:170 (head) is where test_extension_release_name_carries_the_image_version used to assert sysext-release/sysext-image carry %{image-version} for every feature. It only failed because the new elements live under elements/runtimes/ rather than elements/oci/; dropping it removes that guard for zfs, kubeadm, homelab, mcp, etc. too. Resolve the element path per feature (glob elements/*/{name}-sysext.bst) rather than delete.

style

• New sysexts live in elements/runtimes/ while every other sysext is elements/oci/*-sysext.bst, which include/sysext.yml:1 documents as the convention. This is also what broke the test above. Low.
• include/runtimes.yml:6-12 carries # renovate: annotations, but renovate.json:9-13 only matches elements/**/*.bst and requires a following ref: line, so none of these versions (nor the sha256 ref:s in elements/runtimes/docker-bin.bst:21-45) will ever be bumped automatically. Either wire a manager or drop the comments so they do not imply tracking that does not exist. Low.

docs-currency

• docs/skills/ddi-installer.md:41 lists every image-locked sysext asset (zfs_… through nvidia-open-595_…) and was not extended with podman_<ver>.raw.zst / docker_<ver>.raw.zst, while scripts/publish-release.sh:290 and elements/oci/bluefin-server-image.bst:37-38 were. Low.

No findings from: security, intent-alignment.

Confidence: 2/5 (needs attention) — 1 high finding; 1 medium finding

— hive: agent=reviewer backend=copilot model=claude-fable-5.1 copilot=1.0.88