feat(runtime): activate qualified native Podman

.github/actions/setup-native-podman-e2e/action.yaml

@@ -0,0 +1,306 @@
+# SPDX-FileCopyrightText: Copyright (c) 2026 NVIDIA CORPORATION & AFFILIATES. All rights reserved.
+# SPDX-License-Identifier: Apache-2.0
+
+name: setup-native-podman-e2e
+description: Install the reviewed Podman toolchain artifact and start its rootless API service for E2E.
+
+inputs:
+  enabled:
+    description: Prepare Podman when the E2E dispatch selected the native Podman gateway runtime.
+    required: false
+    default: "false"
+
+runs:
+  using: composite
+  steps:
+    - id: artifact
+      name: Resolve native Podman toolchain artifact
+      if: ${{ inputs.enabled == 'true' }}
+      shell: bash
+      env:
+        RUNNER_ARCH_KIND: ${{ runner.arch }}
+      run: |
+        set -euo pipefail
+        case "$RUNNER_ARCH_KIND" in
+          X64) architecture=amd64 ;;
+          ARM64) architecture=arm64 ;;
+          *)
+            echo "::error::Native Podman E2E requires a Linux amd64 or arm64 runner" >&2
+            exit 1
+            ;;
+        esac
+        printf 'architecture=%s\n' "$architecture" >>"$GITHUB_OUTPUT"
+        printf 'name=native-podman-e2e-toolchain-%s\n' "$architecture" >>"$GITHUB_OUTPUT"
+
+    - name: Download native Podman toolchain
+      if: ${{ inputs.enabled == 'true' }}
+      uses: actions/download-artifact@3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c # v8.0.1
+      with:
+        name: ${{ steps.artifact.outputs.name }}
+        path: ${{ runner.temp }}/native-podman-e2e-toolchain
+
+    - name: Start native Podman runtime
+      if: ${{ inputs.enabled == 'true' }}
+      shell: bash
+      env:
+        EXPECTED_ARCHITECTURE: ${{ steps.artifact.outputs.architecture }}
+        TOOLCHAIN_DIRECTORY: ${{ runner.temp }}/native-podman-e2e-toolchain
+      run: |
+        set -euo pipefail
+        [[ "$RUNNER_OS" == "Linux" ]]
+        [[ -d "$TOOLCHAIN_DIRECTORY" && ! -L "$TOOLCHAIN_DIRECTORY" ]]
+        [[ -z "$(find -P "$TOOLCHAIN_DIRECTORY" -type l -print -quit)" ]]
+        mapfile -t actual_files < <(
+          cd "$TOOLCHAIN_DIRECTORY"
+          find . -type f -print | LC_ALL=C sort
+        )
+        expected_files=(
+          ./SHA256SUMS
+          ./bin/pasta
+          ./bin/podman
+          ./libexec/podman/aardvark-dns
+          ./libexec/podman/netavark
+          ./libexec/podman/rootlessport
+          ./manifest.json
+          ./share/containers/containers.conf
+        )
+        [[ "${actual_files[*]}" == "${expected_files[*]}" ]]
+        (
+          cd "$TOOLCHAIN_DIRECTORY"
+          sha256sum --check --strict SHA256SUMS
+        )
+        jq -e --arg architecture "$EXPECTED_ARCHITECTURE" '
+          .schemaVersion == 1 and
+          .kind == "nemoclaw-native-podman-toolchain-v1" and
+          .architecture == $architecture and
+          .podmanVersion == "6.1.0" and
+          .podmanSourceSha == "cade97a52ebdf9dbf9e81de8009015776837a074" and
+          .netavarkVersion == "2.1.0" and
+          .netavarkSourceSha == "8e91ad1d947ed325327b638f0cb906bea1f7d0ab" and
+          .aardvarkDnsVersion == "2.1.0" and
+          .aardvarkDnsSourceSha == "cd7417681229219059939bdd9f0b3bd9ac9abb08" and
+          .pastaVersion == "2026_07_28.f8df3f1" and
+          .pastaSourceArchiveSha256 == "54fc6a3b39b0fcb13182078662886a629032852e186e47a371fd9d7fd20d3958" and
+          .pastaSourceSha == "f8df3f1b228fe19a74a269334fdfe6cc7d0605ce" and
+          .goVersion == "1.25.9" and
+          .rustVersion == "1.88.0"
+        ' "$TOOLCHAIN_DIRECTORY/manifest.json" >/dev/null
+
+        sudo env DEBIAN_FRONTEND=noninteractive /usr/bin/apt-get update
+        sudo env DEBIAN_FRONTEND=noninteractive /usr/bin/apt-get install \
+          --yes --no-install-recommends \
+          apparmor btrfs-progs conmon fuse-overlayfs \
+          golang-github-containers-common iptables nftables runc slirp4netns uidmap
+
+        toolchain_install_root=/usr/lib/nemoclaw-native-podman-e2e
+        sudo install -d --owner=root --group=root --mode=0755 \
+          "$toolchain_install_root" "$toolchain_install_root/bin"
+        podman_executable="$toolchain_install_root/bin/podman"
+        sudo install --owner=root --group=root --mode=0755 \
+          "$TOOLCHAIN_DIRECTORY/bin/podman" "$podman_executable"
+        sudo install --owner=root --group=root --mode=0755 \
+          "$TOOLCHAIN_DIRECTORY/bin/pasta" "$toolchain_install_root/bin/pasta"
+        export PATH="$toolchain_install_root/bin:$PATH"
+        printf '%s\n' "$toolchain_install_root/bin" >>"$GITHUB_PATH"
+        for helper in aardvark-dns netavark rootlessport; do
+          sudo install -D --owner=root --group=root --mode=0755 \
+            "$TOOLCHAIN_DIRECTORY/libexec/podman/$helper" \
+            "/usr/local/libexec/podman/$helper"
+        done
+        sudo install --owner=root --group=root --mode=0644 \
+          "$TOOLCHAIN_DIRECTORY/share/containers/containers.conf" \
+          /usr/share/containers/containers.conf
+        [[ "$("$podman_executable" --version)" == "podman version 6.1.0" ]]
+
+        execution_user="$(id -un)"
+        ensure_subordinate_range() {
+          local file="$1"
+          local option="$2"
+          local range_start=100000
+          local range_end
+          local conflict_end
+          if awk -F: -v account="$execution_user" '
+            $1 == account && $2 ~ /^[0-9]+$/ && $3 ~ /^[0-9]+$/ && $3 >= 65536 { found = 1 }
+            END { exit found ? 0 : 1 }
+          ' "$file"; then
+            return
+          fi
+          while :; do
+            ((range_start <= 4294901760))
+            range_end=$((range_start + 65535))
+            conflict_end="$(awk -F: -v start="$range_start" -v end="$range_end" '
+              $2 ~ /^[0-9]+$/ && $3 ~ /^[0-9]+$/ {
+                current_end = $2 + $3 - 1
+                if ($2 <= end && current_end >= start && current_end > maximum) maximum = current_end
+              }
+              END { if (maximum != "") print maximum }
+            ' "$file")"
+            [[ -n "$conflict_end" ]] || break
+            range_start=$((conflict_end + 1))
+          done
+          range_end=$((range_start + 65535))
+          sudo usermod "$option" "${range_start}-${range_end}" "$execution_user"
+        }
+        ensure_subordinate_range /etc/subuid --add-subuids
+        ensure_subordinate_range /etc/subgid --add-subgids
+
+        podman_command=("$podman_executable")
+        podman_service_exec="$podman_executable system service --time=0"
+        if [[ -r /sys/module/apparmor/parameters/enabled ]] && grep -q '^Y' /sys/module/apparmor/parameters/enabled; then
+          profile="$RUNNER_TEMP/nemoclaw-native-podman-e2e.apparmor"
+          pasta_profile="$RUNNER_TEMP/nemoclaw-native-pasta-e2e.apparmor"
+          printf '%s\n' \
+            'abi <abi/4.0>,' \
+            'include <tunables/global>' \
+            '' \
+            'profile nemoclaw-native-podman-e2e /usr/lib/nemoclaw-native-podman-e2e/bin/podman flags=(unconfined, attach_disconnected) {' \
+            '  userns,' \
+            '}' >"$profile"
+          sudo apparmor_parser -r "$profile"
+          command -v aa-exec >/dev/null
+          aa_exec_path="$(command -v aa-exec)"
+          podman_command=("$aa_exec_path" -p nemoclaw-native-podman-e2e -- "$podman_executable")
+          podman_service_exec="$aa_exec_path -p nemoclaw-native-podman-e2e -- $podman_executable system service --time=0"
+          printf '%s\n' \
+            'abi <abi/4.0>,' \
+            'include <tunables/global>' \
+            '' \
+            'profile nemoclaw-native-pasta-e2e /usr/lib/nemoclaw-native-podman-e2e/bin/pasta flags=(unconfined) {' \
+            '  userns,' \
+            '}' >"$pasta_profile"
+          sudo apparmor_parser -r "$pasta_profile"
+        fi
+
+        uid="$(id -u)"
+        gid="$(id -g)"
+        runtime_directory="/run/user/$uid"
+        socket_path="$runtime_directory/podman/podman.sock"
+        sudo systemctl start "user-runtime-dir@${uid}.service" "user@${uid}.service"
+        systemctl is-active --quiet "user-runtime-dir@${uid}.service"
+        systemctl is-active --quiet "user@${uid}.service"
+        [[ -d "$runtime_directory" && ! -L "$runtime_directory" ]]
+        [[ "$(stat -c '%u:%g:%a' "$runtime_directory")" == "${uid}:${gid}:700" ]]
+        XDG_RUNTIME_DIR="$runtime_directory" /usr/bin/systemctl --user start dbus.socket
+        XDG_RUNTIME_DIR="$runtime_directory" /usr/bin/systemctl --user is-active --quiet dbus.socket
+        [[ -S "$runtime_directory/bus" && ! -L "$runtime_directory/bus" ]]
+        [[ "$(stat -c '%u' "$runtime_directory/bus")" == "$uid" ]]
+        install -d -m 0700 "$runtime_directory/podman"
+        storage_directory="$RUNNER_TEMP/native-podman-e2e-storage"
+        storage_config="$RUNNER_TEMP/native-podman-e2e-storage.conf"
+        install -d -m 0700 "$storage_directory/runroot" "$storage_directory/graphroot"
+        printf '%s\n' \
+          '[storage]' \
+          'driver = "overlay"' \
+          "runroot = \"$storage_directory/runroot\"" \
+          "graphroot = \"$storage_directory/graphroot\"" >"$storage_config"
+        containers_config="$RUNNER_TEMP/native-podman-e2e-containers.conf"
+        printf '%s\n' \
+          '[containers]' \
+          'log_driver = "k8s-file"' \
+          '' \
+          '[engine]' \
+          'runtime = "runc"' \
+          '' \
+          '[network]' \
+          'firewall_driver = "nftables"' >"$containers_config"
+        export CONTAINERS_CONF="$containers_config"
+        export CONTAINERS_STORAGE_CONF="$storage_config"
+        export DBUS_SESSION_BUS_ADDRESS="unix:path=$runtime_directory/bus"
+        export XDG_RUNTIME_DIR="$runtime_directory"
+        service_name=nemoclaw-native-podman-e2e
+        service_environment="$RUNNER_TEMP/native-podman-e2e-service.env"
+        service_unit_directory="$HOME/.config/systemd/user"
+        service_unit="$service_unit_directory/$service_name.service"
+        socket_unit="$service_unit_directory/$service_name.socket"
+        install -d -m 0700 "$service_unit_directory"
+        printf '%s\n' \
+          "CONTAINERS_CONF=$containers_config" \
+          "CONTAINERS_STORAGE_CONF=$storage_config" \
+          "DBUS_SESSION_BUS_ADDRESS=unix:path=$runtime_directory/bus" \
+          "PATH=$toolchain_install_root/bin:$PATH" \
+          "XDG_RUNTIME_DIR=$runtime_directory" >"$service_environment"
+        chmod 0600 "$service_environment"
+        printf '%s\n' \
+          '[Unit]' \
+          'Description=NemoClaw native Podman E2E API service' \
+          "Requires=$service_name.socket" \
+          "After=$service_name.socket dbus.socket" \
+          '' \
+          '[Service]' \
+          'Type=exec' \
+          'Delegate=true' \
+          'KillMode=process' \
+          'Environment=PODMAN_SYSTEMD_UNIT=%n' \
+          "EnvironmentFile=$service_environment" \
+          "ExecStart=$podman_service_exec" >"$service_unit"
+        printf '%s\n' \
+          '[Unit]' \
+          'Description=NemoClaw native Podman E2E API socket' \
+          '' \
+          '[Socket]' \
+          "ListenStream=$socket_path" \
+          'SocketMode=0600' \
+          'DirectoryMode=0700' \
+          'RemoveOnStop=true' \
+          "Service=$service_name.service" >"$socket_unit"
+        chmod 0600 "$service_unit" "$socket_unit"
+        /usr/bin/systemctl --user daemon-reload
+        /usr/bin/systemctl --user start "$service_name.socket"
+        /usr/bin/systemctl --user is-active --quiet "$service_name.socket"
+        service_ready=false
+        for attempt in $(seq 1 30); do
+          if "${podman_command[@]}" --url "unix://$socket_path" info --format json \
+            >"$RUNNER_TEMP/native-podman-e2e-info.json" 2>/dev/null; then
+            service_ready=true
+            break
+          fi
+          if [[ "$attempt" -lt 30 ]]; then
+            sleep 1
+          fi
+        done
+        if [[ "$service_ready" != true ]]; then
+          echo "::error::Native Podman API service did not become ready" >&2
+          /usr/bin/systemctl --user status "$service_name.socket" "$service_name.service" \
+            --no-pager --full >&2 || true
+          /usr/bin/journalctl --user --unit "$service_name.service" --no-pager --lines=100 >&2 || true
+          sudo dmesg | grep -E 'apparmor=.*DENIED' | tail -n 20 >&2 || true
+          exit 1
+        fi
+        [[ -S "$socket_path" ]]
+        /usr/bin/systemctl --user is-active --quiet "$service_name.service"
+        service_pid="$(/usr/bin/systemctl --user show "$service_name.service" --property=MainPID --value)"
+        [[ "$service_pid" =~ ^[1-9][0-9]*$ ]]
+        [[ "$(curl --fail --silent --show-error --noproxy '*' --unix-socket "$socket_path" http://localhost/_ping)" == "OK" ]]
+        jq -e '
+          (.host.security.rootless // .Host.Security.Rootless) == true and
+          ((.host.cgroupVersion // .Host.CgroupVersion) | ascii_downcase) == "v2" and
+          ((.host.ociRuntime.name // .Host.OCIRuntime.Name) | ascii_downcase) == "runc"
+        ' "$RUNNER_TEMP/native-podman-e2e-info.json" >/dev/null
+
+        # A Podman matrix row is qualification evidence only when Docker cannot
+        # satisfy an accidental legacy probe or resource operation. Keep this
+        # enforcement at the reusable runtime-setup boundary, never in an E2E
+        # scenario, so every Podman row proves the same provider isolation.
+        sudo systemctl stop docker.service docker.socket 2>/dev/null || true
+        sudo systemctl mask --runtime docker.service docker.socket 2>/dev/null || true
+        sudo pkill -TERM -x dockerd 2>/dev/null || true
+        sudo rm -f /var/run/docker.sock /run/docker.sock
+        ! systemctl is-active --quiet docker.service
+        ! systemctl is-active --quiet docker.socket
+        ! pgrep -x dockerd >/dev/null
+        [[ ! -S /var/run/docker.sock && ! -S /run/docker.sock ]]
+        if command -v docker >/dev/null 2>&1 && docker info >/dev/null 2>&1; then
+          echo "::error::Podman E2E isolation failed because Docker remains reachable" >&2
+          exit 1
+        fi
+
+        sudo ip address replace 169.254.2.2/32 dev lo
+        {
+          printf 'CONTAINERS_CONF=%s\n' "$containers_config"
+          printf 'CONTAINERS_STORAGE_CONF=%s\n' "$storage_config"
+          printf 'DBUS_SESSION_BUS_ADDRESS=unix:path=%s/bus\n' "$runtime_directory"
+          printf 'NEMOCLAW_NATIVE_PODMAN_SERVICE_PID=%s\n' "$service_pid"
+          printf 'OPENSHELL_PODMAN_SOCKET=%s\n' "$socket_path"
+          printf 'PATH=%s:%s\n' "$toolchain_install_root/bin" "$PATH"
+          printf 'XDG_RUNTIME_DIR=%s\n' "$runtime_directory"
+        } >>"$GITHUB_ENV"

.github/actions/stage-native-podman-e2e-toolchains/action.yaml

@@ -0,0 +1,88 @@
+# SPDX-FileCopyrightText: Copyright (c) 2026 NVIDIA CORPORATION & AFFILIATES. All rights reserved.
+# SPDX-License-Identifier: Apache-2.0
+
+name: stage-native-podman-e2e-toolchains
+description: Copy the reviewed native Podman toolchains into the current E2E run.
+
+inputs:
+  enabled:
+    description: Stage the toolchains when native Podman E2E is selected.
+    required: false
+    default: "false"
+  github-token:
+    description: Read-only token for retrieving the immutable source-run artifacts.
+    required: true
+
+runs:
+  using: composite
+  steps:
+    - name: Verify immutable native Podman E2E toolchains
+      if: ${{ inputs.enabled == 'true' }}
+      shell: bash
+      env:
+        GH_TOKEN: ${{ inputs.github-token }}
+        SOURCE_RUN_ID: "32523050217"
+      run: |
+        set -euo pipefail
+        verify_artifact() {
+          local artifact_id="$1"
+          local artifact_name="$2"
+          local artifact_digest="$3"
+          gh api "repos/NVIDIA/NemoClaw/actions/artifacts/$artifact_id" \
+            --jq '[.id,.name,.expired,.digest,.workflow_run.id] | @tsv' \
+            | awk -F '\t' \
+                -v expected_id="$artifact_id" \
+                -v expected_name="$artifact_name" \
+                -v expected_digest="$artifact_digest" \
+                -v expected_run="$SOURCE_RUN_ID" \
+                '$1 == expected_id && $2 == expected_name && $3 == "false" && $4 == expected_digest && $5 == expected_run { found = 1 }
+                 END { exit found ? 0 : 1 }'
+        }
+        verify_artifact \
+          9461520882 \
+          native-runtime-podman-toolchain-amd64 \
+          sha256:e8f54bf0f2419c4f852d4a240b78176031758ebd24206859a370c6acce8e8b8e
+        verify_artifact \
+          9461493915 \
+          native-runtime-podman-toolchain-arm64 \
+          sha256:e0bd6f308a18fe7daf7f15b2c72dd852d12afd13bd70afdcf6555c91e3617da9
+
+    - name: Download immutable native Podman amd64 toolchain
+      if: ${{ inputs.enabled == 'true' }}
+      uses: actions/download-artifact@3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c # v8.0.1
+      with:
+        github-token: ${{ inputs.github-token }}
+        repository: NVIDIA/NemoClaw
+        run-id: "32523050217"
+        name: native-runtime-podman-toolchain-amd64
+        path: ${{ runner.temp }}/native-podman-e2e-toolchain-amd64
+
+    - name: Download immutable native Podman arm64 toolchain
+      if: ${{ inputs.enabled == 'true' }}
+      uses: actions/download-artifact@3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c # v8.0.1
+      with:
+        github-token: ${{ inputs.github-token }}
+        repository: NVIDIA/NemoClaw
+        run-id: "32523050217"
+        name: native-runtime-podman-toolchain-arm64
+        path: ${{ runner.temp }}/native-podman-e2e-toolchain-arm64
+
+    - name: Publish native Podman amd64 toolchain for this run
+      if: ${{ inputs.enabled == 'true' }}
+      uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1
+      with:
+        name: native-podman-e2e-toolchain-amd64
+        path: ${{ runner.temp }}/native-podman-e2e-toolchain-amd64/
+        if-no-files-found: error
+        retention-days: 3
+        compression-level: 0
+
+    - name: Publish native Podman arm64 toolchain for this run
+      if: ${{ inputs.enabled == 'true' }}
+      uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1
+      with:
+        name: native-podman-e2e-toolchain-arm64
+        path: ${{ runner.temp }}/native-podman-e2e-toolchain-arm64/
+        if-no-files-found: error
+        retention-days: 3
+        compression-level: 0