feat(podman): isolate workloads behind a separate supervisor - #3230

Merged

drew merged 19 commits into

codex/1737-rfc12-supervisor-primitivesfrom

codex/podman-host-supervisor

Sep 14, 2026

Commits on Sep 14, 2026

feat(podman): adopt isolated sandbox and supervisor containers
drew
committed
1a8ff15
fix(podman): stage bootstrap archives at named volume destinations
drew
committed
64a9fa3
feat(podman): rotate launch-scoped authentication
drew
committed
b2bffa7
refactor(podman): use sandbox backend protocol
drew
committed
d91df87
refactor(podman): use host networking for supervisor
drew
committed
294bb50
feat(podman): split sandbox and supervisor images
drew
committed
25ea6d6
fix(podman): repair rebase integration
drew
committed
5693eec
refactor(podman): name the sandbox runtime directly
drew
committed
bd652ee
fix(podman): provision supervisor CA runtime storage
drew
committed
c51d382
fix(podman): address isolation review findings
drew
committed
68da95d
fix(podman): inspect Debian supervisor provenance
drew
committed
a2850d8
fix(podman): use libpod-compatible tmpfs options
drew
committed
2dea15a
fix(podman): bind verified sandbox runtime binary
drew
committed
78924df
fix(podman): provide external driver data directory
drew
committed
c683aa4
fix(podman): start sandbox before joining user namespace
drew
committed
4ee9751
fix(podman): separate supervisor user namespace
drew
committed
bf3d8cb
fix(podman): make sandbox starts generation-aware
drew
committed
52a03bc
fix(podman): rotate restored sandbox sessions
drew
committed
1d32119
fix(podman): bind sandbox session lineage
drew
committed
238196f