Container-runtime seam for podman and nerdctl #639

New issue

Open

opened 2026-07-07 21:47:17 +00:00 by coilyco-ops · 0 comments

coilyco-ops commented

2026-07-07 21:47:17 +00:00

Member

Parent epic: #633. Depends on: none.

Context. ward resolves the container engine by literal name: lookPath("docker"), hostHasBinary("docker"), and Runner.Exec(ctx, "docker", ...) in cmd/ward/agent.go, with cmd/ward/docker_exec.go and cmd/ward/hook.go also hardcoding docker. Shops that run podman or nerdctl cannot use ward without editing Go, even though those engines are largely docker-CLI compatible.

Proposed change.

Introduce a WARD_CONTAINER_RUNTIME knob (default docker) that selects the binary name and, where needed, a small arg-shape adaptation.
Route the docker-named calls through a single resolved runtime value rather than string literals.
Keep the audited ward docker wrapper behavior intact for the docker case.

Acceptance criteria.

WARD_CONTAINER_RUNTIME=podman runs a full agent container lifecycle (create, exec, reap).
Default behavior with the knob unset is byte-for-byte the current docker path.
Tests cover runtime resolution and the arg-shape differences.

Milestone: foreign-stack compat. Filed from the read-only director surface (she/her), part of the release-readiness issue batch.

Parent epic: #633. **Depends on:** none. **Context.** ward resolves the container engine by literal name: `lookPath("docker")`, `hostHasBinary("docker")`, and `Runner.Exec(ctx, "docker", ...)` in `cmd/ward/agent.go`, with `cmd/ward/docker_exec.go` and `cmd/ward/hook.go` also hardcoding `docker`. Shops that run podman or nerdctl cannot use ward without editing Go, even though those engines are largely docker-CLI compatible. **Proposed change.** - Introduce a `WARD_CONTAINER_RUNTIME` knob (default `docker`) that selects the binary name and, where needed, a small arg-shape adaptation. - Route the `docker`-named calls through a single resolved runtime value rather than string literals. - Keep the audited `ward docker` wrapper behavior intact for the docker case. **Acceptance criteria.** - `WARD_CONTAINER_RUNTIME=podman` runs a full agent container lifecycle (create, exec, reap). - Default behavior with the knob unset is byte-for-byte the current docker path. - Tests cover runtime resolution and the arg-shape differences. --- Milestone: foreign-stack compat. Filed from the read-only director surface (she/her), part of the release-readiness issue batch.

coilyco-ops added this to the foreign-stack compat milestone

2026-07-07 21:47:17 +00:00

coilyco-ops added the

label

2026-07-07 21:47:17 +00:00

coilyco-ops referenced this issue

2026-07-07 21:47:17 +00:00

Add docs/compat-surface.md and make the compat surface first-class in CONTRIBUTING #640

coilyco-ops referenced this issue

2026-07-07 21:48:40 +00:00

[epic] Release readiness = running ward on foreign stacks (split-stack: git host + tracker) #633

coilyco-ops added the