feat(podman): isolate workloads behind a separate supervisor - #3230

Open

drew wants to merge 18 commits into

codex/kubernetes-proxy-pod-isolationfrom

codex/podman-host-supervisor

Commits on Sep 14, 2026

feat(podman): adopt isolated sandbox and supervisor containers
drew
committed
f3c17c4
fix(podman): stage bootstrap archives at named volume destinations
drew
committed
dcc8da9
feat(podman): rotate launch-scoped authentication
drew
committed
99807e4
refactor(podman): use sandbox backend protocol
drew
committed
801664d
refactor(podman): use host networking for supervisor
drew
committed
c2364ca
feat(podman): split sandbox and supervisor images
drew
committed
b458cf5
fix(podman): repair rebase integration
drew
committed
a201b94
refactor(podman): name the sandbox runtime directly
drew
committed
230d1da
fix(podman): provision supervisor CA runtime storage
drew
committed
c29f6e2
fix(podman): address isolation review findings
drew
committed
6530041
fix(podman): inspect Debian supervisor provenance
drew
committed
ef0ee72
fix(podman): use libpod-compatible tmpfs options
drew
committed
b90d933
fix(podman): bind verified sandbox runtime binary
drew
committed
b335041
fix(podman): provide external driver data directory
drew
committed
7694ed6
fix(podman): start sandbox before joining user namespace
drew
committed
1d50081
fix(podman): separate supervisor user namespace
drew
committed
a37d287
fix(podman): make sandbox starts generation-aware
drew
committed
68eec76
fix(podman): rotate restored sandbox sessions
drew
committed
5bf6e66