feat(security): provide shared runsc provisioning for Bluefin-family hosts

[joshyorko]

Outcome

Provide one shared, trusted Bluefin-family host provisioning path for gVisor's
runsc OCI runtime so Review and other isolated workloads can select
--runtime=runsc without each image repository maintaining its own installer.

Ownership

Common's system_files/shared/ is distributed to the Bluefin family and owns
reusable host infrastructure. The initial implementation was developed in
projectbluefin/bluefin#1142; this issue re-homes that work rather than creating
a second implementation.

Required behavior

Preserve the #1142 contract: a pinned upstream release; exact x86_64 and
aarch64 identities; unsupported-architecture rejection before download;
HTTPS-only acquisition; digest verification before archive inspection or
extraction; expected-member allowlisting; the required gvisor-bin payload;
safe install/update/remove ownership and symlink protection; atomic
publication; idempotency; /usr/local/bin/runsc discovery; unchanged Podman
default runtime; no Review packaging; no ignore-cgroups=true; and no
host-network workaround.

Consumers and acceptance

• Originating requirement: feat(security): provide trusted runsc provisioning for Review bluefin#1139
• Superseded implementation location: feat: provision pinned gVisor runsc bluefin#1142
• Consumer security contract: feat(security): require gVisor isolation for Review agent containers contribute#348 and merged add dynamic wallpaper timer #349
• Future Review execution engine: feat(engine): add the local execution engine for Review workloads contribute#362

Common provisioning alone does not prove native acceptance. After a Bluefin
Testing image consumes this change, prove ujust runsc install, version
reporting, rootless podman --runtime=runsc, OCIRuntime=runsc, ordinary
networking, lifecycle behavior, no cgroup or host-network workaround, the
Review fail-closed path, and separate arm64 acceptance.

[castrojo]

Let's get this in dakota asap.

Additionally let's start testing enabling it by default in podman. Just have everything in podman using this thing. This is going to end up being a killer feature that separates us from the pack.

gvisor is going for CNCF Sandbox so let's give them a hand. Josh send a PR here on our behalf please, this is gonna be awesome! https://github.com/google/gvisor/blob/master/ADOPTERS.md

[repires]

The runtime ujust helper approach from #1142 was previously implemented in PR #1039 but closed following maintainer feedback rejecting host-level runtime downloading as duct tape in favor of image-layer provisioning ("let's just add it at the image layer"), prioritizing delivery via Dakota ("Let's get this in dakota asap"), and testing enabling it by default in Podman.

Because this pivot alters the architecture and triggers the repository's Design, Security, and Breakage human decision gates (modifying image composition, changing default container runtime behavior across all downstream variants), no shippable work can proceed in projectbluefin/common until maintainers provide an architectural decision and specification on:

1. Whether runsc should be packaged at the image layer in common or in downstream OS builds (e.g. Dakota).
2. The concrete design for image-layer acquisition and packaging within Containerfile.
3. Policy regarding Podman default runtime configuration.

Closing investigation as blocked on an unanswered maintainer decision.

AI attribution

Assisted-by: Gemini 3.8 Flash via GitHub Copilot
Co-authored-by: Copilot 223556219+Copilot@users.noreply.github.com

— hive: backend=agy

🐝 Hive Agent: contributor | SHA: e92dd96

[hivecommons-hive]

What to reply

• /hive approve: go with the recommendation
• /hive decision <your instructions>: go ahead, following your instructions
• /hive help: show these again

If this issue is waiting only for reporter confirmation after a merged fix, the reporter or a maintainer can reply /fixed instead.

Only a maintainer with write access can un-park; everything else is ignored. Full command reference: https://github.com/hivecommons/hive/blob/v5/src/docs/maintainer-commands.md.

[castrojo]

This was generated by AI during triage.

Substantive triage

Outcome: External implementation or infrastructure owner

Established: Provisioning runsc (gVisor OCI runtime) for sandboxed container execution. Maintainer @castrojo explicitly rejected host-level ujust runtime provisioning and decided to deliver runsc directly at the image layer, prioritized for Dakota.

Evidence:

• Maintainer architectural decision in PR feat(security): provide shared runsc provisioning for Bluefin-family hosts #1039 review: feat(security): provide shared runsc provisioning for Bluefin-family hosts #1039 (comment) ("Ok better idea, it's 2026 we need this thing let's just add it at the image layer, this is just duct tape") and issue comment feat(security): provide shared runsc provisioning for Bluefin-family hosts #1038 (comment) ("Let's get this in dakota asap. Additionally let's start testing enabling it by default in podman").
  • Technical proof of why runtime provisioning cannot live in common: /usr/local on bootc hosts is read-only (composefs / overlay ro, verity=require), so runtime installers writing to /usr/local/libexec/ or /usr/local/bin fail with EROFS.
  • Ownership: Work belongs in projectbluefin/dakota (BuildStream element packaging runsc into the base image rootfs) and downstream image layers (e.g. projectbluefin/bluefin Containerfile), not projectbluefin/common.

Next actor: Dakota build team / maintainer (@castrojo) in projectbluefin/dakota

Next action / exact decision: Follow the already chosen image-layer direction in Dakota: package the runtime and validate Podman integration there rather than reopening the rejected host-downloader design. Link the canonical downstream implementation task before retiring common coordination; do not close as relocated without a tracked destination.

Completion criteria:

• BuildStream element packaging runsc binary into /usr/bin/runsc or /usr/libexec/ landed in projectbluefin/dakota.
  • Dakota image ships runsc pre-baked at the image layer, available to podman --runtime=runsc.

Verification limits: common does not build OS binaries or package BuildStream elements; cannot bake binaries into the rootfs image layer from this repo.

Preserved controls: Existing ownership and human holds/preferences remain authoritative. This assessment does not grant implementation acceptance, infer image delivery, or clear Hive admission controls.

[github-actions]

Status: Waiting on Maintainer

Maintainer

• Maintainer/dependency owner: resolve the recorded blocker or hold, then have its owner remove blocked or hold using the Labels picker before new implementation dispatch. Preserve existing assignments and PRs.
• Review, use GitHub's Labels picker to add triage/accepted if you approve implementation.
• Do not remove needs-triage or needs-human to signal approval: the bot restores them until acceptance is recorded.
• Acceptance does not assign a contributor.
• If a specific question prevents acceptance, ask it and select triage/needs-information; if declining or marking a duplicate, close with the reason. /hive approve is not a Common lifecycle acceptance action.

Reporter

Reporter action: No action needed unless information is requested.