feat(docker): prototype attach-driven isolation boundaries

[drew]

Summary

Add the Docker proof for RFC 0012's attach-driven isolation boundary. This is PR 4 of 4 in the review stack and is stacked on the host-supervised VM prototype in #2945.

The proof runs the logical supervisor on the host and launches the admitted agent image directly, without an OpenShell supervisor binary inside the workload container. The compute driver passes trusted prepared inputs in a TopologyDescriptor; IsolationBackend::attach creates or locates the stopped container and atomically binds it to the sandbox context. There is no separate backend create or destroy operation. The compute driver retains durable deletion and reconciliation ownership.

Stack: #2941 → #2942 → #2945 → this PR.

Related Issue

Part of #1737. Builds on RFC #2048 and the RFC 0012 implementation stack.

Changes

• Keep IsolationBackend attach-only and remove the parallel create/provision/destroy contract types and registry path.
• Allow TopologyDescriptor payloads to carry existing-resource coordinates or trusted prepared inputs used during attach.
• Add a Linux-only experimental DockerIsolationBackend whose attach implementation creates or locates the stopped container, disables direct networking, drops all capabilities, and binds the resource before returning Bound.
• Keep Docker resource deletion and reconciliation in the compute-driver lifecycle.
• Install an OCI seccomp-notify profile, receive runc's listener FDs over SCM_RIGHTS, validate listener metadata and container identity, and keep the listener active for later Docker exec processes.
• Mediate policy DNS and transparent TCP through the native host supervisor without a container-visible proxy port.
• Pass the Docker boundary spec through the standard --topology-* supervisor flags.
• Use portable ioctl request types for GNU and musl targets, a short private runtime path for host Unix sockets, and the gateway process identity for host-run Docker operations.
• Print native Docker host-supervisor logs when the Docker E2E fails.
• Update RFC 0012, architecture documentation, Docker documentation, and gateway debugging guidance for attach-time establishment.

Testing

• mise run pre-commit
• cargo check -p openshell-isolation -p openshell-driver-docker -p openshell-sandbox --all-targets
• cargo test -p openshell-isolation (21 passed)
• cargo test -p openshell-driver-docker --lib (71 passed, 1 daemon test ignored)
• cargo test -p openshell-sandbox --lib (102 passed)
• mise run e2e:docker on an ARM64 Docker daemon, including sandbox create, supervisor registration, and sandbox exec

Checklist

• Follows Conventional Commits
• Commits are signed off (DCO)
• RFC, architecture, crate documentation, and related diagnostic skill updated

[copy-pr-bot]

This pull request requires additional validation before any workflows can run on NVIDIA's runners.

Pull request vetters can view their responsibilities here.

Contributors can view more details about this message here.

[github-actions]

🌿 Preview your docs: https://nvidia-preview-pr-2965.docs.buildwithfern.com/openshell

[copy-pr-bot]

Auto-sync is disabled for draft pull requests in this repository. Workflows must be run manually.

Contributors can view more details about this message here.