feat(macos): spike rootless Docker inside bottles

Add an opt-in docker_access path that layers rootless Docker tooling onto the selected agent image, starts the daemon only after registration, and retains the existing outer network and capability boundary. Include fail-closed bootstrap checks plus a live-Mac Compose/security acceptance test.\n\nRefs #392.
2026-07-21 05:53:54 +00:00
parent 1f192d785a
commit 72e35a1343
14 changed files with 408 additions and 7 deletions
@@ -75,6 +75,14 @@ On compatible macOS hosts, the default backend requires Apple's `container` CLI

 Use `BOT_BOTTLE_BACKEND=docker ./cli.py start <agent>` on hosts where neither Apple Container nor KVM is available and Docker is the desired backend.

+> **Experimental Docker-in-bottle spike (#392):** a bottle may set
+> `docker_access: true`. On the macOS backend this starts a guest-local,
+> rootless Docker daemon after the bottle is registered. It does not mount
+> Docker Desktop's socket or add outer VM capabilities. The spike currently
+> requires live-macOS validation before it is considered supported; startup
+> fails closed when the Apple guest kernel cannot satisfy rootless Docker's
+> user-namespace requirements.
+
 ### Firecracker on Linux

 On Linux, a KVM-capable host defaults to the Firecracker backend. It needs: