fix(macos): shorten the podman runtime dir to fit sun_path

podman derives conmon's attach socket as
`$XDG_RUNTIME_DIR/libpod/tmp/socket/<64-hex-id>/attach`. With the
descriptive `/tmp/bot-bottle-podman-run` that path is 116 bytes, past
the 108-byte sun_path limit, so every attached `docker run` failed with
"unable to upgrade to tcp, received 500" — while image pulls and the
service itself worked, which is what made it look like a compat-API bug
rather than a path-length one.

Found on the macOS host: quay.io pulled fine and then no container
could be started. Test pins the budget so a more readable name cannot
silently reintroduce it.

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>

bot_bottle/backend/macos_container/nested-containers-init.sh

@@ -32,7 +32,9 @@ for device in /dev/fuse /dev/net/tun; do
     }
 done
 
-export XDG_RUNTIME_DIR="${XDG_RUNTIME_DIR:-/tmp/bot-bottle-podman-run}"
+# Short by necessity, not by accident: conmon's attach socket lives under
+# this directory and must fit in a 108-byte sun_path. See nested_containers.py.
+export XDG_RUNTIME_DIR="${XDG_RUNTIME_DIR:-/tmp/bbp}"
 config="$HOME/.config/containers"
 mkdir -p "$XDG_RUNTIME_DIR" "$config"
 chmod 700 "$XDG_RUNTIME_DIR"

bot_bottle/backend/macos_container/nested_containers.py

@@ -38,7 +38,14 @@ from typing import Callable
 from ...log import die, info
 
 _INIT = "/usr/local/libexec/bot-bottle/nested-containers-init"
-_RUNTIME_DIR = "/tmp/bot-bottle-podman-run"
+# Deliberately cryptic and short. podman derives conmon's attach socket as
+# `$XDG_RUNTIME_DIR/libpod/tmp/socket/<64-hex-id>/attach`, and a Unix socket
+# path may not exceed 108 bytes (`sun_path`). The descriptive
+# `/tmp/bot-bottle-podman-run` produced a 116-byte path, so every attached
+# `docker run` failed with "unable to upgrade to tcp, received 500" while
+# detached runs and image pulls worked fine. Do not lengthen this for
+# readability — it buys 8 bytes of headroom over the limit.
+_RUNTIME_DIR = "/tmp/bbp"
 _SOCKET = f"{_RUNTIME_DIR}/podman.sock"
 _LOG = "/tmp/bot-bottle-nested-containers.log"
 IMAGE_SUFFIX = "-nested-containers"

tests/unit/test_macos_nested_containers.py

@@ -142,11 +142,20 @@ class TestGuestEnvironment(unittest.TestCase):
 
     def test_enabled_bottle_uses_only_the_guest_local_socket(self) -> None:
         env = nested_containers.guest_env(True)
-        self.assertEqual(
-            "unix:///tmp/bot-bottle-podman-run/podman.sock", env["DOCKER_HOST"],
-        )
+        self.assertEqual("unix:///tmp/bbp/podman.sock", env["DOCKER_HOST"])
         self.assertNotIn("/var/run/docker.sock", " ".join(env.values()))
 
+    def test_runtime_dir_leaves_room_for_conmons_attach_socket(self) -> None:
+        """podman builds `$XDG_RUNTIME_DIR/libpod/tmp/socket/<64-hex>/attach`,
+        which must fit in sun_path (108 bytes). A descriptive runtime dir blew
+        past it and every attached `docker run` failed with "unable to upgrade
+        to tcp, received 500" while pulls and detached runs looked fine."""
+        attach = (
+            nested_containers.guest_env(True)["XDG_RUNTIME_DIR"]
+            + "/libpod/tmp/socket/" + "a" * 64 + "/attach"
+        )
+        self.assertLessEqual(len(attach), 107, attach)
+
     def test_macos_backend_declares_support(self) -> None:
         from bot_bottle.backend.macos_container.backend import (
             MacosContainerBottleBackend,