# Podman Container Configuration for a Sorcery-Go Sanctum
# File: Referenced by pkg/runtime/podman.go
#
# This file documents the Podman-specific options used when creating
# a Sorcery-Go sanctum. The actual container creation is done via the
# pkg/runtime/podman.go adapter, but this file serves as documentation
# and can be used with `podman play kube` for declarative workflows.
#
# Security is enforced by eBPF (not AppArmor/SELinux).
# The Tomb Guard LSM hook intercepts writes at kernel level.

# --security-opt apparmor=unconfined   # eBPF handles MAC
# --security-opt seccomp=unconfined    # eBPF LSM replaces seccomp for Tomb
# --cap-drop ALL                       # Drop all capabilities
# --cap-add CAP_SYS_ADMIN              # Required for OverlayFS in build sandbox
# --cap-add CAP_SYS_CHROOT             # Required for chroot in baremetal exec
# --memory 512m                        # Default memory limit
# --network bridge:br0                 # Coven Ley-Line bridge
# --mount type=bind,src=/var/lib/sorcery-go/tomb,dst=/var/lib/sorcery-go/tomb,ro
# --security-opt label=disable         # Disable SELinux labeling (eBPF handles it)