fix(sandbox): support Podman escape hatches

[penso]

Summary

• Add explicit, mutually exclusive Podman sandbox escape hatches for validated Linux host-socket passthrough and privileged nested Podman.
• Recreate sandboxes when escape-hatch mode or socket identity changes, fail closed on unavailable sockets, and improve rootless Podman diagnostics.
• Preserve secure systemd defaults while providing documented rootless Podman and optional API-service overrides.

Validation

Completed

• cargo test -p moltis-tools sandbox::tests::core::test_podman
• cargo test -p moltis-config podman_escape_hatch
• just build-web-assets
• just release-preflight
• ./scripts/local-validate.sh 1106

Remaining

• Runtime validation on a Linux host with rootless Podman for allow_host_podman and allow_nested_podman.
• Full PR CI.

Manual QA

• Install deploy/moltis.service with deploy/moltis-podman.conf; verify rootless podman run --rm alpine echo hello under the service.
• For allow_host_podman, enable deploy/moltis-podman-api.service, verify socket passthrough, then restart the API service and confirm the sandbox is recreated.
• For allow_nested_podman, verify nested Podman runs only in a privileged sandbox and switching the flag off recreates a hardened sandbox.

Fixes #1095

[greptile-apps]

Greptile Summary

The PR adds two validated, mutually exclusive Podman sandbox escape hatches while preserving secure defaults.

• Adds host Podman socket passthrough with live-socket validation and sandbox recreation when socket identity changes.
• Adds privileged nested-Podman mode and corresponding configuration validation, tests, diagnostics, and documentation.
• Restores hardening in the default systemd service and moves rootless Podman accommodations into an explicit drop-in.

Confidence Score: 5/5

The PR appears safe to merge.

No blocking failure remains; the previously reported unconditional service-hardening regression and unmounted-socket environment injection have both been addressed.

Important Files Changed

Filename	Overview
crates/tools/src/sandbox/docker.rs	Couples host-socket mounting and environment setup, validates socket availability, labels Podman mode and socket identity, and recreates incompatible running sandboxes.
crates/config/src/validate/semantic.rs	Enforces Podman-only, mutually exclusive escape-hatch configuration and emits explicit security diagnostics.
deploy/moltis.service	Restores secure systemd defaults and directs rootless Podman deployments to the dedicated override.
deploy/moltis-podman.conf	Selectively permits rootless Podman re-exec and provides writable home and runtime locations.
deploy/moltis-podman-api.service	Adds an optional Podman API service using the same runtime socket location configured for Moltis.
crates/tools/src/sandbox/tests/core.rs	Covers privileged mode, socket validation, socket identity transitions, recreation behavior, and improved diagnostics.

Flowchart

%%{init: {'theme': 'neutral'}}%%
flowchart TD
  C[Sandbox configuration] --> V{Podman escape hatch}
  V -->|Neither| H[Hardened Podman sandbox]
  V -->|allow_host_podman| S[Validate live host socket]
  S --> I[Compute socket identity]
  I --> M{Running sandbox label matches?}
  M -->|Yes| R[Reuse sandbox]
  M -->|No| X[Recreate with socket mount and API environment]
  V -->|allow_nested_podman| P[Recreate privileged nested sandbox]

Loading

_{Reviews (3): Last reviewed commit: "test(config): cover host Podman platform..." | Re-trigger Greptile}

[codspeed-hq]

Merging this PR will improve performance by 22.62%

⚠️ Different runtime environments detected

Some benchmarks with significant performance changes were compared across different runtime environments,
which may affect the accuracy of the results.

Open the report in CodSpeed to investigate

⚡ 1 improved benchmark
✅ 38 untouched benchmarks
⏩ 9 skipped benchmarks¹

Performance Changes

	Benchmark	BASE	HEAD	Efficiency
⚡	session_history_path[user@host:session:42]	8.1 µs	6.6 µs	+22.62%

Tip

Curious why this is faster? Comment @codspeedbot explain why this is faster on this PR, or directly use the CodSpeed MCP with your agent.

---

_{Comparing simplistic-partner (5781f63) with main (f32b67a)}

Footnotes

1. 9 benchmarks were skipped, so the baseline results were used instead. If they were deleted from the codebase, click here and archive them to remove them from the performance reports. ↩

[codecov]

Codecov Report

✅ All modified and coverable lines are covered by tests.

📢 Thoughts on this report? Let us know!

[cloudflare-workers-and-pages]

Deploying with    Cloudflare Workers

The latest updates on your project. Learn more about integrating Git with Workers.

Status	Name	Latest Commit	Preview URL	Updated (UTC)
✅ Deployment successful! View logs	withered-breeze-e956	24aa9bf	Commit Preview URL Branch Preview URL	Aug 18 2026, 01:47 AM

[penso]

@greptile review

[penso]

@greptile review