[Epic] Support native Podman with buildless managed onboarding

[ericksoa]

Outcome

At completion, NemoClaw supports Docker and native Podman as pluggable runtime providers for buildless managed onboarding.

The supported path covers every shipped agent:

• OpenClaw
• Hermes
• LangChain Deep Agents Code

All three agents launch from complete immutable managed-image digests on linux/amd64 and linux/arm64. Native Podman support includes NVIDIA CDI GPU access and host-local Ollama, NVIDIA NIM, and vLLM through inference.local.

Runtime-specific behavior stays behind provider-neutral lifecycle and bootstrap contracts. The same contracts must admit a socket-free MXC-style provider without Podman branches in central orchestration.

NemoClaw uses existing OpenShell contracts. This epic does not require or authorize changes in NVIDIA/OpenShell.

Product decisions and invariants

• Docker remains supported.
• Stock managed onboarding becomes buildless. Explicit user-supplied --from Dockerfiles remain a separate opt-in path.
• --temp-managed-runtime remains hidden, default-off, and undocumented until the supported activation gate passes.
• The hidden gate permits qualification. It does not establish a supported surface.
• Buildless activation requires OpenClaw, Hermes, and LangChain Deep Agents Code to pass together.
• Native Podman activation requires all agents, both architectures, GPU access, local inference, lifecycle recovery, installer validation, and protected end-to-end evidence.
• Production Podman registration occurs only in B4-H.
• Central orchestration selects capabilities and opaque runtime providers. It does not branch on Podman.
• Each runtime registers one immutable provider bundle with complete, identity-consistent capabilities.
• Runtime provider state mutation is a mandatory supported-or-unsupported provider facet. The central contract does not accept callbacks or arbitrary privileged commands.
• Provider-owned inference authority is persisted before shared-state commit and re-proved after each lifecycle transition.
• Cleanup uses immutable provider-owned identifiers. Operations fail closed on missing, stale, incomplete, reused, or ambiguous authority.
• Earlier slices remain dormant or internally complete. They do not advertise partial buildless or Podman support.

Architecture

Managed images

• Resolve complete all-agent image cohorts by immutable per-platform digest.
• Keep custom Dockerfile onboarding separate from managed-image selection.
• Reject incomplete, mutable, or mixed-cohort image authority.

Runtime provider bundle

Each provider bundle owns its identity, capabilities, preflight, workload creation, lifecycle, runtime provider state mutation, managed bootstrap, snapshot, recovery, cleanup, and container-engine operations.

Registration fails closed when the bundle is incomplete or internally inconsistent. Docker, Podman, and the MXC-style fixture use the same central contract.

Transactional lifecycle

• Derive bounded, versioned, credential-free bootstrap plans from agent definitions.
• Keep privileged execution inside the selected provider.
• Persist provider-owned intent and receipts before shared state becomes visible.
• Resume, reconcile, or roll back incomplete work after process or controller failure.
• Re-prove provider, engine, endpoint, image, runtime, route, model, lifecycle generation, and NVIDIA CDI authority after every lifecycle transition.
• Prevent mutable-name lookup from deleting another runtime.

Work plan

GitHub native subissues are the progress source. Closed tasks represent completed delivery. Open tasks represent work that remains. Reference issues and source-only PRs are not subissues.

Completed work

Completed task	Merged PR	Delivered outcome
#9125	#7747	Driver-neutral compute selection groundwork.
#9126	#7756	Validated immutable managed OCI image publication.
#9127	#7772	Managed-image selection contracts.
#9128	#8045	Image-owned managed bootstrap runtime.
#9129	#8047	All-agent managed-image packaging and publication.
#9130	#8225	Managed bootstrap ownership and recovery hardening.
#9131	#8226	Inert protected multi-architecture lane bootstrap.
#9132	#8234	Protected buildless qualification batch.
#9133	#8261	Hidden, default-off buildless experiment gate.
#9134	#8276	B4-A dormant Podman CPU lifecycle.
#9135	#8052	B4-B dormant Podman managed-bootstrap transaction.
#9136	#8058	B4-C provider lifecycle and runtime provider state mutation contract.
#9137	#8658	B4-C2 durable Docker runtime provider state mutation.
#9138	#8061	B4-D dormant NVIDIA CDI GPU and host-local inference foundation.

Remaining delivery

Position	Work issue	Delivery PR	Exit condition
1/6 · B3-E	#9140	Not assigned	Activate supported buildless managed onboarding after the complete all-agent matrix passes.
2/6 · B4-E1	#9141	#9123	Preserve immutable host-local inference authority through every supported lifecycle transition.
3/6 · B4-E2	#9142	Not assigned	Add dormant protected inference qualification and candidate-only Podman execution, including real Podman runtime provider state mutation.
4/6 · B4-F	#9143	Not assigned	Land the trusted native qualification workflow and generic activation catalog.
5/6 · B4-G	#9144	Not assigned	Execute the trusted candidate, installer, multi-architecture, GPU, local-inference, lifecycle, recovery, and cleanup matrix.
6/6 · B4-H	#9145	Not assigned	Register supported native Podman and publish evidence-matched documentation.

Implementation source PRs

These PRs contain source material for delivered or remaining work. They are not subissues or accepted delivery ancestry unless a remaining work issue names them as source material.

• Initial broad implementations: feat(onboard): add managed image selection contracts #7772 was narrowed and merged; feat(runtime): add native Podman support for all agents #7872 is the closed, unmerged all-agent native Podman monolith.
• Superseded B4-E1 delivery: feat(runtime): add durable host-local inference lifecycle #8069 is closed. feat(runtime): complete host-local inference lifecycle #8076 remains source material. Current delivery is feat(runtime): preserve host-local inference lifecycle #9123 under [Epic #7744 2/6][B4-E1] Preserve host-local inference lifecycle authority #9141.
• Remaining staged source: test(e2e): define protected inference qualification #8079 for B4-E2; test(e2e): define native runtime activation qualification #8062 and feat(runtime): add provider activation catalog #8063 for B4-F; feat(runtime): define the native activation candidate contract #8064 and feat(runtime): add native installer qualification receipts #8067 for B4-G.
• Buildless source record: feat(onboard): add managed startup profile schema #7944 is closed and unmerged; its replacement work landed through the completed history above.

Current batch: B4-E1

Issue #9141 and PR #9123 own one outcome: preserve immutable provider-owned host-local inference authority through every supported lifecycle transition.

B4-E1 must:

• persist the inference receipt and route before shared-state commit;
• bind sandbox, agent, runtime provider, engine, endpoint, immutable image, runtime, model, route, lifecycle generation, and NVIDIA CDI authority;
• make registration and route ownership compare-and-swap safe across retries and reconciliation;
• rebind and re-prove authority after destroy, snapshot, clone, rebuild, backup, restore, and recovery;
• use exact immutable identifiers for cleanup;
• fail closed on missing evidence, authority drift, name reuse, ambiguous ownership, incomplete creation, incomplete rollback, or indeterminate cleanup;
• cover Ollama, NVIDIA NIM, and vLLM; and
• cover OpenClaw, Hermes, and LangChain Deep Agents Code together.

B4-E1 does not register or document Podman. It does not activate a supported workflow or change the hidden gate.

Test and evidence gates

Every batch

• Use the accepted predecessor and the latest target-branch state.
• Keep the PR issue-scoped and exclude unrelated changes.
• Require signed, DCO-compliant, GitHub-verified commits.
• Run affected behavior tests, type checks, repository checks, source-shape and test-size checks, and diff checks.
• Prove dormancy when the batch must not affect a production command, provider registry, or supported surface.
• Run protected end-to-end qualification when the batch changes a product flow or candidate execution path.
• Bind evidence to the latest PR commit and its target-branch base.
• Preserve Docker and Kubernetes behavior unless the batch explicitly owns that change.

Buildless activation

B3-E must prove:

• OpenClaw, Hermes, and LangChain Deep Agents Code;
• linux/amd64 and linux/arm64;
• immutable all-agent image digests;
• managed onboarding without a stock Dockerfile build;
• nonroot agent identity;
• restart, rebuild, snapshot and restore, clone, backup, recovery, and rollback;
• exact bootstrap receipts and shared-state commit; and
• Docker, macOS, WSL, gateway-isolation, messaging, and security regressions.

Native Podman activation

B4-G and B4-H must prove:

• native Podman with Docker unavailable;
• OpenClaw, Hermes, and LangChain Deep Agents Code;
• supported amd64 and arm64 hosts;
• rootful and rootless operation where supported;
• networking, volumes, SELinux labeling, and exact cleanup;
• NVIDIA CDI GPU attachment;
• host-local Ollama, NVIDIA NIM, and vLLM;
• real GPU-backed inference turns;
• restart, rebuild, snapshot and restore, clone, backup, crash recovery, rollback, and name-reuse failure handling;
• installer and preflight behavior; and
• evidence-matched support documentation.

A candidate-introduced trusted workflow lands inert first. A later PR may use that workflow only after it is present on trusted main.

Related context

These records explain demand, compatibility failures, or dependencies. They are not delivery subissues:

• Native Podman requests: Support podman #420 and Support Podman as a container runtime (needed for Fedora/RHEL deployments) #7883.
• Compatibility failures: Podman compatibility: OpenShell gateway fails with 'host-gateway' on macOS #116, onboard: Docker-driver gateway crashes on macOS with Podman — dual-bind on unreachable bridge IP #7320, and fix(portable): post-exit cleanup fails through the rootless Podman API #9054.
• System-readiness dependency: [Epic] Expose versioned system readiness for reliable agent setup and automation #7407.
• Compatibility PRs: feat(runtime): add Podman as supported container runtime for macOS and Linux #1359, fix(onboard): reject macOS Podman compat socket before gateway launch (#7320) #7353, and fix(preflight): trust Docker version identity #7560.

Scope boundaries

In scope:

• buildless managed onboarding for all shipped agents;
• complete immutable images and atomic all-agent publication;
• provider-neutral lifecycle and transactional bootstrap;
• Docker and native Podman providers;
• amd64 and arm64;
• snapshot, clone, rebuild, backup, restore, durable recovery, and exact cleanup;
• native Podman GPU access and host-local Ollama, NVIDIA NIM, and vLLM;
• a socket-free MXC-style contract fixture; and
• evidence-backed installer and documentation changes.

Out of scope:

• arbitrary privileged commands or credential rewrite through startup profiles;
• OpenClaw-only or Docker-compatibility-only Podman support;
• production MXC enablement;
• Kubernetes behavior changes beyond regression preservation;
• changes in NVIDIA/OpenShell without separate explicit approval; and
• support claims for an untested runtime, host, architecture, GPU, or inference combination.

Definition of done

The epic closes only when:

• the temporary experiment gate is removed or replaced by an evidence-backed supported surface;
• Docker and native Podman launch all shipped agents through the same provider-neutral contracts;
• real Docker and Podman runtime provider state mutation facets have named production consumers and interruption-recovery evidence;
• stock managed onboarding performs no Dockerfile build;
• native Podman passes the complete multi-architecture GPU and Ollama, NVIDIA NIM, and vLLM matrix;
• lifecycle and crash recovery preserve exact provider-owned authority;
• name-only deletion cannot remove a managed runtime;
• protected end-to-end qualification passes for the activation commit; and
• installer and support documentation match the shipped evidence.