feat(sandboxer): passing Mount info across sandboxer and runtime

[dungdm93]

Overview

Introduces a unified sandboxer.Mounter interface to decouple mount topology decisions from sandbox engines and container runtimes. Sandboxers dictate how their directories are exposed (coarse vs discrete subpaths, bind vs volume mounts, runtime symlink resolution), while overlay engines and action runtimes consume mounts without engine-specific coupling.

High-Level Design

• sandboxer.Mounter Interface:

  • OverlayMounts(target Layout, coarse bool) []*types.Mount: Generates mounts for overlay JobContainers. Supports coarse mounts (whole job directory) when source and target layouts align, or discrete subpath mounts (workspace, temp, actions, tools, runtimes).
  • RuntimeMounts(target Layout) []*types.Mount: Supplies mounts required by action containers (workspace, temp).
  • Exposing the mounter through LaunchResponse.Mounter.

• Sandboxer Implementations:

  • Incus: Mounts directories into JobContainers using recursive bind mounts (BindOptions: { Recursive: "enabled" }).
  • Host: Evaluates host symlinks under runtimes to canonical host paths with ReadOnly: true so container runtimes access valid directories.
  • Docker: Backed by a shared job volume (type mounter string), generating named volume mounts with subpaths.

• Overlay & Runtime Integration:

  • containerizedEngine: Consumes resp.Mounter.OverlayMounts when launching overlay JobContainers.
  • wire_runtime: Injects sandboxer.Mounter via Dig. When running sibling action containers alongside a JobContainer, translates requested mounts through the parent JobContainer's mount namespace (translateContainerMounts). Directly applies mounts for direct sandboxes.