From 6a7a8933c6487f60d3778ce648a263ecfde96012 Mon Sep 17 00:00:00 2001 From: Kieran Klukas Date: Sat, 8 Aug 2026 19:06:40 -0400 Subject: [PATCH] prattle: register gVisor (runsc) as a docker runtime Userspace-kernel sandbox alternative to Kata for kloe's sandbox; robust with docker's resource/interactive flags where Kata's runtime-rs wedges. --- machines/prattle/default.nix | 5 +++++ 1 file changed, 5 insertions(+) diff --git a/machines/prattle/default.nix b/machines/prattle/default.nix index 6fbf9c4..c5594dc 100644 --- a/machines/prattle/default.nix +++ b/machines/prattle/default.nix @@ -320,6 +320,11 @@ # it is the upstream-blessed workaround (kata-containers#13080). virtualisation.docker.daemon.settings.features.time-namespaces = false; + # gVisor (runsc): a userspace-kernel sandbox — lighter than Kata's full VM and + # far more robust with docker's resource/interactive flags (Kata's runtime-rs + # wedges on them). A plain path-based OCI runtime, so `--runtime runsc`. + virtualisation.docker.daemon.settings.runtimes.runsc.path = "${pkgs.gvisor}/bin/runsc"; + # ── ARM (Automatic Ripping Machine) ─────────────────────────────── atelier.services.arm = { enable = true; -- 2.51.2