Reference

Sandbox

Sandboxes are ephemeral containers built from setup recipes and driven by a local container runtime. The registry below is embedded in the overplane binary and validated at startup.

Container Runtimes

The sandbox.runtime field of overplane.yaml must name a supported engine. Planned engines are modeled for future asymmetric build/run pairs but are not implemented yet.

Runtime	Status	Capabilities
`docker`	supported	build, run
`podman`	supported	build, run
`nerdctl`	planned	build
`k3s`	planned	run

Runtime reference

Container engines Overplane knows about, with their capabilities and support status. Images are built and run by the engines below; asymmetric build/run combinations are modeled internally and listed here for reference.

Required

Docker Engine, driven through the docker CLI. Builds run through Buildx/BuildKit (BuildKit 0.13 or newer is required for reproducible rewrite-timestamp output) and containers run with docker run. This is the default runtime.

capabilities: build, run

Podman, driven through the podman CLI. Daemonless and rootless-friendly; builds use Buildah under the hood and must support the --source-date-epoch and --rewrite-timestamp reproducibility flags (Podman 5.x / Buildah 1.32 or newer).

capabilities: build, run

Optional

containerd's nerdctl CLI as a build-only engine for environments that build images with containerd and run them elsewhere. Planned: the engine is modeled in the runtime matrix but not yet implemented.

capabilities: build

Lightweight Kubernetes (k3s) as a run-only engine for executing agent containers built by docker, podman, or nerdctl. Planned: the engine is modeled in the runtime matrix but not yet implemented.

capabilities: run

Allowed build/run pairs

# build engine -> run engine
- {build: docker, run: docker}
- {build: podman, run: podman}
- {build: nerdctl, run: docker}
- {build: nerdctl, run: podman}
- {build: docker, run: k3s}
- {build: podman, run: k3s}