CodePatrol INIT 1

INIT-1: Run agent sessions on Apple Container instead of Docker

Replace Docker as the NanoClaw session runtime on this install with Apple Container (https://github.com/apple/container, the macOS container CLI). Do not retoggle CONTAINER_RUNTIME_BIN — that path was retired. Implement a real SessionDriver and make setup/build/uninstall/OneCLI follow it.

Current state:

• Session spawn lives in src/drivers/docker-driver.ts (create/start --attach/stop/rm/ps/inspect/events/exec). Selection is NANOCLAW_RUNTIME_DRIVER via src/drivers/index.ts; overlays register in src/drivers/installed.ts.
• Non-session Docker is still hardcoded: src/container-runtime.ts (always 'docker'), src/container-runner.ts buildAgentGroupImage, src/egress-lockdown.ts, container/build.sh, container/pull.sh, setup/container.ts (rejects non-docker), uninstall, OneCLI compose.
• Image is Linux OCI (container/Dockerfile, node:22-slim). Apple Container can run that; the guest stays Linux.
• Historical skill/apple-container is frozen archaeology. Do not merge it.

Must change:

1. Add an Apple Container SessionDriver that preserves SessionSpec semantics: labels, mounts (including file binds), --user, resource caps, cap-drop/no-new-privileges/init equivalents, auto-remove, attach/exit supervision. If container events is missing, poll list/inspect instead of silently dropping watch/adoption.
2. Cover the leftover Docker shells: image build/tag/inspect, setup smoke, uninstall scan/rmi, registry reconcile. Setup must detect/start container instead of Docker Desktop / docker.sock ACLs.
3. Solve host networking: host.docker.internal, host-gateway, OneCLI gateway reachability, egress lockdown (--internal network + alias). OneCLI itself is Docker Compose today — either run the gateway under Apple Container or give agents a working host mapping. This is the highest-risk gap.
4. Keep Linux/Docker viable unless this install is explicitly macOS-only. Default on Apple Silicon macOS should be Apple Container; do not break the driver seam.
5. Update README, setup docs, SECURITY, debug skill, and stale localized /convert-to-apple-container references.

Out of scope: rewriting the agent-runner, changing the two-DB IO model, or depending on Docker Desktop.

Acceptance: a new agent-group session starts, heartbeats, and delivers a reply with Docker not running; build.sh and setup work via container; OneCLI credentialed calls still succeed; existing Docker driver still registers and tests pass.

Status: active

Waves

• WAVE-1.1: SessionDriver realization (accepted)
  • WORK-1.1.1: Implement Apple Container SessionDriver (accepted)
  • WORK-1.1.2: Register and select apple-container (accepted)
• WAVE-1.2: Image, setup, and uninstall shells (planning)
  • WORK-1.2.1: Extract leftover Docker-only shells (pending)
• WAVE-1.3: Host reachability, egress, OneCLI (planning)
  • WORK-1.3.1: Realize shared-private network and host reachability (pending)
  • WORK-1.3.2: OneCLI gateway without Docker Compose (pending)
• WAVE-1.4: Operator docs and stale skill copy (planning)
  • WORK-1.4.1: Document Apple Container as the macOS default (pending)