@forgezero/agent 0.1.73 → 0.1.75

package/dist/software-helper.js

@@ -4,22 +4,30 @@ import {
   accessSync,
   chmodSync,
   copyFileSync,
+  createReadStream,
   existsSync,
   mkdtempSync,
   mkdirSync,
   readFileSync,
   renameSync,
   rmSync,
+  statSync,
   symlinkSync,
   unlinkSync,
   writeFileSync
 } from "node:fs";
 import { tmpdir } from "node:os";
-import { join } from "node:path";
+import { dirname, join } from "node:path";
 var PINNED_BUN_VERSION = "1.3.14";
 var BUN_RELEASE_SHA256 = "951ee2aee855f08595aeec6225226a298d3fea83a3dcd6465c09cbccdf7e848f";
 var ARANGO_SHA256 = "b5a9197b4343f2ed554e1ebc1ef8e6529c7c39cde0035cdc311a4747a3355066";
 var CLOUDFLARED_SHA256 = "9d71c677db00134c1bd4144b7783486b654ad281b1ea62b4972098d19f770f17";
+var NERDCTL_VERSION = "2.3.5";
+var BUILDKIT_VERSION = "0.32.2";
+var KATA_CONTAINERS_VERSION = "4.0.0";
+var NERDCTL_SHA256 = "de3206aeb7cbd5f20f5fb1f55c1e3bf2db1be567812a8a3f5e65eba2488347ee";
+var BUILDKIT_SHA256 = "2975d0f651ad96ba8b80b9992ae1f9a964f4408569af5b6dc36544165c3926af";
+var KATA_SHA256 = "2c3b9dfeba355582b40aee462b12916c9740654d0230f696adf719d67b063a8c";
 var OS_CATALOG = [
   {
     id: "ubuntu",
@@ -49,6 +57,8 @@ var OS_CATALOG = [
 var SOFTWARE_CATALOG = [
   { id: "bun", version: "1.3.14", status: "active", os: "ubuntu", osVersion: "26.04", architecture: "x64", evidence: "reviewed-strategy-and-tests" },
   { id: "docker", version: "ubuntu-26.04", status: "active", os: "ubuntu", osVersion: "26.04", architecture: "x64", evidence: "reviewed-strategy-and-tests" },
+  { id: "containerd", version: "ubuntu-26.04", status: "active", os: "ubuntu", osVersion: "26.04", architecture: "x64", evidence: "reviewed-strategy-and-tests" },
+  { id: "kata-containers", version: "4.0.0", status: "active", os: "ubuntu", osVersion: "26.04", architecture: "x64", evidence: "reviewed-strategy-and-tests" },
   { id: "nginx", version: "ubuntu-26.04", status: "active", os: "ubuntu", osVersion: "26.04", architecture: "x64", evidence: "reviewed-strategy-and-tests" },
   { id: "arangodb", version: "3.11.14", status: "active", os: "ubuntu", osVersion: "26.04", architecture: "x64", evidence: "reviewed-strategy-and-tests" },
   { id: "cloudflared", version: "2026.7.3", status: "active", os: "ubuntu", osVersion: "26.04", architecture: "x64", evidence: "reviewed-strategy-and-tests" },
@@ -57,6 +67,7 @@ var SOFTWARE_CATALOG = [
   { id: "openssh-client", version: "ubuntu-26.04", status: "active", os: "ubuntu", osVersion: "26.04", architecture: "x64", evidence: "reviewed-strategy-and-tests" },
   { id: "git", version: "ubuntu-26.04", status: "active", os: "ubuntu", osVersion: "26.04", architecture: "x64", evidence: "reviewed-strategy-and-tests" },
   { id: "docker", version: "ubuntu-24.04", status: "active", os: "ubuntu", osVersion: "24.04", architecture: "x64", evidence: "reviewed-strategy-and-tests" },
+  { id: "containerd", version: "ubuntu-24.04", status: "active", os: "ubuntu", osVersion: "24.04", architecture: "x64", evidence: "reviewed-strategy-and-tests" },
   { id: "nginx", version: "ubuntu-24.04", status: "active", os: "ubuntu", osVersion: "24.04", architecture: "x64", evidence: "reviewed-strategy-and-tests" },
   { id: "ufw", version: "ubuntu-24.04", status: "active", os: "ubuntu", osVersion: "24.04", architecture: "x64", evidence: "reviewed-strategy-and-tests" },
   { id: "openssh-client", version: "ubuntu-24.04", status: "active", os: "ubuntu", osVersion: "24.04", architecture: "x64", evidence: "reviewed-strategy-and-tests" },
@@ -65,6 +76,8 @@ var SOFTWARE_CATALOG = [
 var UBUNTU_2604_X64 = [
   { requirement: { id: "bun", version: "1.3.14" } },
   { requirement: { id: "docker", version: "ubuntu-26.04" } },
+  { requirement: { id: "containerd", version: "ubuntu-26.04" } },
+  { requirement: { id: "kata-containers", version: "4.0.0" } },
   { requirement: { id: "nginx", version: "ubuntu-26.04" } },
   { requirement: { id: "arangodb", version: "3.11.14" } },
   { requirement: { id: "cloudflared", version: "2026.7.3" } },
@@ -76,6 +89,7 @@ var UBUNTU_2604_X64 = [
 var UBUNTU_2404_X64 = [
   { requirement: { id: "bun", version: "1.3.14" } },
   { requirement: { id: "docker", version: "ubuntu-24.04" } },
+  { requirement: { id: "containerd", version: "ubuntu-24.04" } },
   { requirement: { id: "nginx", version: "ubuntu-24.04" } },
   { requirement: { id: "ufw", version: "ubuntu-24.04" } },
   { requirement: { id: "openssh-client", version: "ubuntu-24.04" } },
@@ -92,6 +106,46 @@ var DOCKER_DAEMON_CONFIG = `${JSON.stringify({
   "log-opts": { "max-size": "10m", "max-file": "3" }
 }, null, 2)}
 `;
+var CONTAINERD_CONFIG_PATH = "/etc/containerd/config.toml";
+var KATA_SNP_CONFIG_PATH = "/opt/kata/share/defaults/kata-containers/configuration-qemu-snp.toml";
+var KATA_ACTIVE_CONFIG_PATH = "/etc/kata-containers/configuration.toml";
+var CONTAINERD_CONFIG = (kata) => `version = 2
+root = "/var/lib/forgezero/containerd"
+state = "/run/forgezero/containerd"
+
+[grpc]
+  address = "/run/containerd/containerd.sock"
+
+[plugins."io.containerd.grpc.v1.cri".containerd]
+  snapshotter = "overlayfs"
+  default_runtime_name = "runc"
+
+[plugins."io.containerd.grpc.v1.cri".containerd.runtimes.runc]
+  runtime_type = "io.containerd.runc.v2"
+${kata ? `
+[plugins."io.containerd.grpc.v1.cri".containerd.runtimes.kata-qemu-snp]
+  runtime_type = "io.containerd.kata.v2"
+  [plugins."io.containerd.grpc.v1.cri".containerd.runtimes.kata-qemu-snp.options]
+    ConfigPath = "${KATA_ACTIVE_CONFIG_PATH}"
+` : ""}`;
+var BUILDKIT_UNIT = `[Unit]
+Description=ForgeZero BuildKit daemon
+After=network-online.target containerd.service
+Wants=network-online.target
+Requires=containerd.service
+
+[Service]
+Type=notify
+ExecStart=/usr/local/bin/buildkitd --addr unix:///run/buildkit/buildkitd.sock --root /var/lib/forgezero/buildkit
+Restart=on-failure
+RestartSec=2
+NoNewPrivileges=yes
+ProtectSystem=strict
+ReadWritePaths=/var/lib/forgezero/buildkit /run/buildkit
+
+[Install]
+WantedBy=multi-user.target
+`;
 var softwareSpawnFailure = (cause, argv) => cause.code === "ENOENT" ? { exitCode: 127, output: `executable is absent: ${argv[0]}` } : undefined;
 var runSoftwareCommand = async (argv, env = {}) => {
   let child;
@@ -111,14 +165,28 @@ var runSoftwareCommand = async (argv, env = {}) => {
   return { exitCode, output: `${stdout}${stderr}` };
 };
 var run = runSoftwareCommand;
-var download = async (url, destination, sha256) => {
-  const response = await fetch(url, { redirect: "follow", signal: AbortSignal.timeout(120000) });
+var download = async (url, destination, sha256, maximumBytes = 512 * 1024 * 1024) => {
+  const response = await fetch(url, { redirect: "follow", signal: AbortSignal.timeout(30 * 60000) });
   if (!response.ok)
     throw new Error(`download failed with HTTP ${response.status}`);
-  const bytes = new Uint8Array(await response.arrayBuffer());
-  if (createHash("sha256").update(bytes).digest("hex") !== sha256)
+  const declared = Number(response.headers.get("content-length") ?? 0);
+  if (declared > maximumBytes)
+    throw new Error("download exceeds reviewed size bound");
+  if (existsSync(destination))
+    throw new Error("download destination already exists");
+  await Bun.write(destination, response);
+  chmodSync(destination, 384);
+  if (statSync(destination).size > maximumBytes) {
+    rmSync(destination, { force: true });
+    throw new Error("download exceeds reviewed size bound");
+  }
+  const digest = createHash("sha256");
+  for await (const chunk of createReadStream(destination))
+    digest.update(chunk);
+  if (digest.digest("hex") !== sha256) {
+    rmSync(destination, { force: true });
     throw new Error("download checksum mismatch");
-  writeFileSync(destination, bytes, { mode: 384, flag: "wx" });
+  }
 };
 var successful = (result, pattern) => result.exitCode === 0 && (!pattern || pattern.test(result.output));
 var aptInstall = async (name) => {
@@ -126,6 +194,106 @@ var aptInstall = async (name) => {
   const update = await run(["/usr/bin/apt-get", "update", "-qq"], environment);
   return update.exitCode === 0 ? run(["/usr/bin/apt-get", "install", "-y", name], environment) : update;
 };
+var aptInstallMany = async (names) => {
+  const environment = { DEBIAN_FRONTEND: "noninteractive" };
+  const update = await run(["/usr/bin/apt-get", "update", "-qq"], environment);
+  return update.exitCode === 0 ? run(["/usr/bin/apt-get", "install", "-y", ...names], environment) : update;
+};
+var writeOwnedPolicy = (pathValue, content, mode = 420) => {
+  if (existsSync(pathValue)) {
+    if (readFileSync(pathValue, "utf8") !== content)
+      throw new Error(`refusing to overwrite non-ForgeZero policy at ${pathValue}`);
+    return;
+  }
+  mkdirSync(dirname(pathValue), { recursive: true, mode: 493 });
+  writeFileSync(pathValue, content, { mode, flag: "wx" });
+};
+var installContainerdRuntime = async (directory, osVersion) => {
+  const installed = await aptInstallMany(["containerd", "runc", "containernetworking-plugins"]);
+  if (installed.exitCode !== 0)
+    return installed;
+  const nerdctl = join(directory, "nerdctl.tar.gz");
+  await download(`https://github.com/containerd/nerdctl/releases/download/v${NERDCTL_VERSION}/nerdctl-${NERDCTL_VERSION}-linux-amd64.tar.gz`, nerdctl, NERDCTL_SHA256);
+  const nerdctlExtract = await run(["/usr/bin/tar", "-xzf", nerdctl, "-C", "/usr/local/bin", "nerdctl"]);
+  if (nerdctlExtract.exitCode !== 0)
+    return nerdctlExtract;
+  chmodSync("/usr/local/bin/nerdctl", 493);
+  const buildkit = join(directory, "buildkit.tar.gz");
+  await download(`https://github.com/moby/buildkit/releases/download/v${BUILDKIT_VERSION}/buildkit-v${BUILDKIT_VERSION}.linux-amd64.tar.gz`, buildkit, BUILDKIT_SHA256);
+  const unpacked = join(directory, "buildkit");
+  mkdirSync(unpacked, { mode: 448 });
+  const buildkitExtract = await run(["/usr/bin/tar", "-xzf", buildkit, "-C", unpacked]);
+  if (buildkitExtract.exitCode !== 0)
+    return buildkitExtract;
+  for (const binary of ["buildctl", "buildkitd"]) {
+    copyFileSync(join(unpacked, "bin", binary), `/usr/local/bin/${binary}`);
+    chmodSync(`/usr/local/bin/${binary}`, 493);
+  }
+  mkdirSync("/etc/containerd", { recursive: true, mode: 493 });
+  const expected = CONTAINERD_CONFIG(false);
+  const kataExpected = CONTAINERD_CONFIG(true);
+  if (existsSync(CONTAINERD_CONFIG_PATH) && ![expected, kataExpected].includes(readFileSync(CONTAINERD_CONFIG_PATH, "utf8"))) {
+    return { exitCode: 2, output: "refusing to overwrite an existing containerd configuration that differs from the reviewed ForgeZero policy" };
+  }
+  if (!existsSync(CONTAINERD_CONFIG_PATH))
+    writeFileSync(CONTAINERD_CONFIG_PATH, expected, { mode: 420, flag: "wx" });
+  writeOwnedPolicy("/etc/systemd/system/forgezero-buildkit.service", BUILDKIT_UNIT);
+  mkdirSync("/var/lib/forgezero/containerd", { recursive: true, mode: 448 });
+  mkdirSync("/var/lib/forgezero/buildkit", { recursive: true, mode: 448 });
+  const reload = await run(["/usr/bin/systemctl", "daemon-reload"]);
+  if (reload.exitCode !== 0)
+    return reload;
+  const enabled = await run(["/usr/bin/systemctl", "enable", "--now", "containerd.service", "forgezero-buildkit.service"]);
+  return enabled.exitCode === 0 ? { exitCode: 0, output: `containerd ${osVersion} with nerdctl ${NERDCTL_VERSION} and BuildKit ${BUILDKIT_VERSION}` } : enabled;
+};
+var installKataRuntime = async (directory) => {
+  for (const pathValue of ["/dev/kvm", "/dev/sev"])
+    if (!existsSync(pathValue))
+      return { exitCode: 2, output: `${pathValue} is required for Kata SEV-SNP` };
+  for (const parameter of ["/sys/module/kvm_amd/parameters/sev", "/sys/module/kvm_amd/parameters/sev_snp"]) {
+    if (!existsSync(parameter) || !/^(1|Y)$/i.test(readFileSync(parameter, "utf8").trim()))
+      return { exitCode: 2, output: `${parameter} does not enable SEV-SNP` };
+  }
+  const dependencies = await aptInstallMany(["zstd"]);
+  if (dependencies.exitCode !== 0)
+    return dependencies;
+  const archive = join(directory, "kata.tar.zst");
+  await download(`https://github.com/kata-containers/kata-containers/releases/download/${KATA_CONTAINERS_VERSION}/kata-static-${KATA_CONTAINERS_VERSION}-amd64.tar.zst`, archive, KATA_SHA256, 2200000000);
+  const tar = join(directory, "kata.tar");
+  const expanded = await run(["/usr/bin/unzstd", "--quiet", archive, "--output", tar]);
+  if (expanded.exitCode !== 0)
+    return expanded;
+  const extracted = await run(["/usr/bin/tar", "-xf", tar, "-C", "/"]);
+  if (extracted.exitCode !== 0)
+    return extracted;
+  if (!existsSync("/opt/kata/bin/containerd-shim-kata-v2") || !existsSync(KATA_SNP_CONFIG_PATH)) {
+    return { exitCode: 2, output: "Kata archive does not contain the reviewed QEMU SNP runtime and configuration" };
+  }
+  const snpConfig = readFileSync(KATA_SNP_CONFIG_PATH, "utf8");
+  if (!/^\s*confidential_guest\s*=\s*true\s*$/m.test(snpConfig) || !/^\s*sev_snp_guest\s*=\s*true\s*$/m.test(snpConfig)) {
+    return { exitCode: 2, output: "Kata QEMU configuration does not enable confidential SEV-SNP guests" };
+  }
+  mkdirSync("/etc/kata-containers", { recursive: true, mode: 493 });
+  if (existsSync(KATA_ACTIVE_CONFIG_PATH) && readFileSync(KATA_ACTIVE_CONFIG_PATH, "utf8") !== snpConfig) {
+    return { exitCode: 2, output: "refusing to overwrite a non-ForgeZero Kata runtime configuration" };
+  }
+  if (!existsSync(KATA_ACTIVE_CONFIG_PATH))
+    copyFileSync(KATA_SNP_CONFIG_PATH, KATA_ACTIVE_CONFIG_PATH);
+  chmodSync(KATA_ACTIVE_CONFIG_PATH, 420);
+  try {
+    unlinkSync("/usr/local/bin/containerd-shim-kata-v2");
+  } catch {}
+  symlinkSync("/opt/kata/bin/containerd-shim-kata-v2", "/usr/local/bin/containerd-shim-kata-v2");
+  const base = CONTAINERD_CONFIG(false);
+  const kata = CONTAINERD_CONFIG(true);
+  if (!existsSync(CONTAINERD_CONFIG_PATH) || ![base, kata].includes(readFileSync(CONTAINERD_CONFIG_PATH, "utf8"))) {
+    return { exitCode: 2, output: "containerd must use the reviewed ForgeZero policy before Kata is installed" };
+  }
+  if (readFileSync(CONTAINERD_CONFIG_PATH, "utf8") !== kata)
+    writeFileSync(CONTAINERD_CONFIG_PATH, kata, { mode: 420 });
+  const restarted = await run(["/usr/bin/systemctl", "restart", "containerd.service"]);
+  return restarted.exitCode === 0 ? { exitCode: 0, output: `Kata Containers ${KATA_CONTAINERS_VERSION} QEMU SNP` } : restarted;
+};
 async function executeSoftwareOperation(operation) {
   const { software, version } = operation;
   if (![...UBUNTU_2604_X64, ...UBUNTU_2404_X64].some(({ requirement }) => requirement.id === software && requirement.version === version)) {
@@ -143,6 +311,26 @@ async function executeSoftwareOperation(operation) {
       const active = await run(["/usr/bin/systemctl", "is-active", "--quiet", "docker.service"]);
       return active.exitCode === 0 ? { exitCode: 0, output: binary.output } : active;
     }
+    if (software === "containerd") {
+      const [containerd, nerdctl, buildkit, active, builder] = await Promise.all([
+        run(["/usr/bin/containerd", "--version"]),
+        run(["/usr/local/bin/nerdctl", "--version"]),
+        run(["/usr/local/bin/buildkitd", "--version"]),
+        run(["/usr/bin/systemctl", "is-active", "--quiet", "containerd.service"]),
+        run(["/usr/bin/systemctl", "is-active", "--quiet", "forgezero-buildkit.service"])
+      ]);
+      const policy = existsSync(CONTAINERD_CONFIG_PATH) ? readFileSync(CONTAINERD_CONFIG_PATH, "utf8") : "";
+      const validPolicy = policy === CONTAINERD_CONFIG(false) || policy === CONTAINERD_CONFIG(true);
+      return successful(containerd, /containerd/) && successful(nerdctl, new RegExp(NERDCTL_VERSION.replaceAll(".", "\\."))) && successful(buildkit, new RegExp(BUILDKIT_VERSION.replaceAll(".", "\\."))) && active.exitCode === 0 && builder.exitCode === 0 && validPolicy ? { exitCode: 0, output: `${containerd.output}${nerdctl.output}${buildkit.output}` } : { exitCode: 1, output: "containerd, nerdctl, BuildKit, or ForgeZero storage/runtime policy is unavailable" };
+    }
+    if (software === "kata-containers") {
+      const shim = await run(["/opt/kata/bin/containerd-shim-kata-v2", "--version"]);
+      const policy = existsSync(CONTAINERD_CONFIG_PATH) ? readFileSync(CONTAINERD_CONFIG_PATH, "utf8") : "";
+      const activeConfig = existsSync(KATA_ACTIVE_CONFIG_PATH) ? readFileSync(KATA_ACTIVE_CONFIG_PATH, "utf8") : "";
+      const host = ["/dev/kvm", "/dev/sev", KATA_SNP_CONFIG_PATH, KATA_ACTIVE_CONFIG_PATH].every(existsSync) && ["/sys/module/kvm_amd/parameters/sev", "/sys/module/kvm_amd/parameters/sev_snp"].every((parameter) => existsSync(parameter) && /^(1|Y)$/i.test(readFileSync(parameter, "utf8").trim()));
+      const active = await run(["/usr/bin/systemctl", "is-active", "--quiet", "containerd.service"]);
+      return successful(shim, /kata.*4\.0\.0/i) && policy === CONTAINERD_CONFIG(true) && activeConfig === (existsSync(KATA_SNP_CONFIG_PATH) ? readFileSync(KATA_SNP_CONFIG_PATH, "utf8") : "") && host && active.exitCode === 0 ? { exitCode: 0, output: shim.output } : { exitCode: 1, output: "Kata QEMU SNP runtime, host capability, or containerd policy is unavailable" };
+    }
     if (software === "nginx") {
       const binary = await run(["/usr/sbin/nginx", "-v"]);
       return binary.exitCode === 0 ? run(["/usr/bin/systemctl", "is-active", "--quiet", "nginx.service"]) : binary;
@@ -194,6 +382,17 @@ async function executeSoftwareOperation(operation) {
   }
   const directory = mkdtempSync(join(tmpdir(), "forgezero-software-"));
   try {
+    if (software === "containerd")
+      return installContainerdRuntime(directory, version === "ubuntu-24.04" ? "24.04" : "26.04");
+    if (software === "kata-containers") {
+      const containerd = await executeSoftwareOperation({ kind: "check", software: "containerd", version: "ubuntu-26.04" });
+      if (containerd.exitCode !== 0) {
+        const installed2 = await installContainerdRuntime(directory, "26.04");
+        if (installed2.exitCode !== 0)
+          return installed2;
+      }
+      return installKataRuntime(directory);
+    }
     if (software === "cloudflare-warp") {
       const key = join(directory, "cloudflare-warp-key.gpg");
       await download("https://pkg.cloudflareclient.com/pubkey.gpg", key, "0f37fc298c98e88ee3c0ee68c95b69f1dba9eb477abe3167e13982105911264d");
@@ -275,7 +474,7 @@ function validateSoftwareRequirements(value, _options = {}) {
     if (Object.keys(row).some((key) => key !== "id" && key !== "version")) {
       throw new Error("software requirement contains an unknown field");
     }
-    if (!["bun", "docker", "nginx", "arangodb", "cloudflared", "cloudflare-warp", "ufw", "openssh-client", "git"].includes(String(row.id)) || typeof row.version !== "string" || !/^[A-Za-z0-9][A-Za-z0-9.-]{0,31}$/.test(row.version)) {
+    if (!["bun", "docker", "containerd", "kata-containers", "nginx", "arangodb", "cloudflared", "cloudflare-warp", "ufw", "openssh-client", "git"].includes(String(row.id)) || typeof row.version !== "string" || !/^[A-Za-z0-9][A-Za-z0-9.-]{0,31}$/.test(row.version)) {
       throw new Error("software requirement coordinate is invalid");
     }
     const requirement = { id: row.id, version: row.version };
@@ -747,34 +946,180 @@ function phasePipeline(definition, phase, profile, executeRelease = false) {
   };
 }
 
+// src/deployment-connectivity.ts
+import { createHash as createHash2 } from "node:crypto";
+import { mkdirSync as mkdirSync2, renameSync as renameSync2, writeFileSync as writeFileSync2 } from "node:fs";
+import { dirname as dirname2 } from "node:path";
+var TOKEN = /^[A-Za-z0-9._-]{40,16384}$/;
+var UUID = /^[a-f0-9]{8}-[a-f0-9]{4}-[1-5][a-f0-9]{3}-[89ab][a-f0-9]{3}-[a-f0-9]{12}$/i;
+var HOSTNAME = /^(?=.{1,253}$)(?:[a-z0-9](?:[a-z0-9-]{0,61}[a-z0-9])?\.)+[a-z0-9](?:[a-z0-9-]{0,61}[a-z0-9])?$/;
+var NAME2 = /^[a-z][a-z0-9._-]{0,99}$/;
+var idFor = (key) => createHash2("sha256").update(key).digest("hex").slice(0, 20);
+var checked = async (host, argv2, label) => {
+  const result = await host.exec(argv2);
+  if (result.exitCode !== 0)
+    throw new Error(`${label} failed: ${result.output.slice(0, 512)}`);
+  return result.output.trim();
+};
+async function sealWithSystemd(name, path2, value) {
+  mkdirSync2(dirname2(path2), { recursive: true, mode: 448 });
+  const next = `${path2}.next`;
+  const child = Bun.spawn(["/usr/bin/systemd-creds", "encrypt", `--name=${name}`, "-", next], {
+    stdin: "pipe",
+    stdout: "pipe",
+    stderr: "pipe",
+    env: { PATH: "/usr/sbin:/usr/bin:/sbin:/bin", LANG: "C", LC_ALL: "C" }
+  });
+  child.stdin.write(value);
+  child.stdin.end();
+  const [stdout, stderr, exitCode] = await Promise.all([
+    new Response(child.stdout).text(),
+    new Response(child.stderr).text(),
+    child.exited
+  ]);
+  if (exitCode !== 0)
+    throw new Error(`systemd credential sealing failed: ${`${stdout}${stderr}`.replaceAll(value, "[REDACTED]").slice(0, 512)}`);
+  renameSync2(next, path2);
+}
+var defaultHost = {
+  seal: sealWithSystemd,
+  write(path2, content, mode) {
+    mkdirSync2(dirname2(path2), { recursive: true, mode: 493 });
+    const next = `${path2}.next`;
+    writeFileSync2(next, content, { mode });
+    renameSync2(next, path2);
+  },
+  async exec(argv2) {
+    const child = Bun.spawn([...argv2], { stdout: "pipe", stderr: "pipe", env: { PATH: "/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin", LANG: "C", LC_ALL: "C" } });
+    const [stdout, stderr, exitCode] = await Promise.all([new Response(child.stdout).text(), new Response(child.stderr).text(), child.exited]);
+    return { exitCode, output: `${stdout}${stderr}` };
+  },
+  sleep: (ms) => Bun.sleep(ms)
+};
+function validate(request) {
+  if (!request.key || request.key.length > 256)
+    throw new Error("deployment connectivity key is invalid");
+  const publicIntent = request.intent.public;
+  const privateIntent = request.intent.private;
+  if (publicIntent?.mode === "cloudflare-tunnel") {
+    if (!NAME2.test(publicIntent.credential) || !HOSTNAME.test(publicIntent.hostname) || !NAME2.test(publicIntent.tunnelKey) || publicIntent.service.protocol !== "http" || !Number.isInteger(publicIntent.service.port) || publicIntent.service.port < 1 || publicIntent.service.port > 65535 || !request.capabilities.public || !UUID.test(request.capabilities.public.tunnelId) || !TOKEN.test(request.capabilities.public.connectorToken)) {
+      throw new Error("public deployment connectivity is malformed");
+    }
+  } else if (request.capabilities.public)
+    throw new Error("unexpected public deployment capability");
+  if (privateIntent?.mode === "cloudflare-warp") {
+    if (!NAME2.test(privateIntent.credential) || privateIntent.network.length < 1 || privateIntent.network.length > 128 || !request.capabilities.private || !UUID.test(request.capabilities.private.connectorId) || !TOKEN.test(request.capabilities.private.connectorToken)) {
+      throw new Error("private deployment connectivity is malformed");
+    }
+  } else if (request.capabilities.private)
+    throw new Error("unexpected private deployment capability");
+}
+async function applyDeploymentConnectivity(request, host = defaultHost) {
+  validate(request);
+  const id = idFor(request.key);
+  const evidence = { key: request.key };
+  if (request.intent.public?.mode === "cloudflare-tunnel") {
+    const capability = request.capabilities.public;
+    const credentialName = `FZ_TUNNEL_${id.toUpperCase()}`;
+    const credentialPath = `/etc/forgezero/creds/deployment-tunnel-${id}.cred`;
+    const unit = `forgezero-cloudflared-${id}.service`;
+    const unitPath = `/etc/systemd/system/${unit}`;
+    const metricsPort = 20000 + Number.parseInt(id.slice(0, 4), 16) % 20000;
+    await host.seal(credentialName, credentialPath, capability.connectorToken);
+    host.write(unitPath, `[Unit]
+Description=ForgeZero deployment Tunnel ${id}
+After=network-online.target
+Wants=network-online.target
+
+[Service]
+Type=simple
+DynamicUser=yes
+LoadCredentialEncrypted=${credentialName}:${credentialPath}
+ExecStart=/usr/local/bin/cloudflared tunnel --no-autoupdate --metrics 127.0.0.1:${metricsPort} run --token-file %d/${credentialName}
+Restart=always
+RestartSec=5
+NoNewPrivileges=true
+PrivateTmp=true
+ProtectSystem=strict
+ProtectHome=true
+
+[Install]
+WantedBy=multi-user.target
+`, 420);
+    await checked(host, ["/usr/bin/systemctl", "daemon-reload"], "cloudflared daemon reload");
+    await checked(host, ["/usr/bin/systemctl", "enable", "--now", unit], "cloudflared start");
+    await checked(host, ["/usr/bin/systemctl", "is-active", "--quiet", unit], "cloudflared readiness");
+    evidence.public = { hostname: request.intent.public.hostname, tunnelId: capability.tunnelId, unit, active: true };
+  }
+  if (request.intent.private?.mode === "cloudflare-warp") {
+    const capability = request.capabilities.private;
+    const credentialPath = "/etc/forgezero/creds/CF_WARP_CONNECTOR_TOKEN.cred";
+    const unit = "forgezero-deployment-mesh.service";
+    await host.seal("CF_WARP_CONNECTOR_TOKEN", credentialPath, capability.connectorToken);
+    host.write(`/etc/systemd/system/${unit}`, `[Unit]
+Description=ForgeZero deployment Mesh/WARP connector
+Requires=warp-svc.service
+After=network-online.target warp-svc.service
+Wants=network-online.target
+
+[Service]
+Type=oneshot
+RemainAfterExit=yes
+LoadCredentialEncrypted=CF_WARP_CONNECTOR_TOKEN:${credentialPath}
+ExecStart=/usr/local/bin/fz-agent mesh-config
+NoNewPrivileges=true
+PrivateTmp=true
+ProtectSystem=strict
+ProtectHome=true
+ReadWritePaths=/var/lib/cloudflare-warp
+
+[Install]
+WantedBy=multi-user.target
+`, 420);
+    await checked(host, ["/usr/bin/systemctl", "daemon-reload"], "WARP daemon reload");
+    await checked(host, ["/usr/bin/systemctl", "enable", "--now", "warp-svc.service", unit], "WARP connector start");
+    for (let attempt = 0;attempt < 10; attempt += 1) {
+      const status = await host.exec(["/usr/bin/warp-cli", "--accept-tos", "status"]);
+      if (status.exitCode === 0 && /\bconnected\b/i.test(status.output) && !/\bdisconnected\b/i.test(status.output)) {
+        evidence.private = { network: request.intent.private.network, connectorId: capability.connectorId, unit, active: true };
+        break;
+      }
+      await host.sleep(1000);
+    }
+    if (!evidence.private)
+      throw new Error("WARP connector readiness failed");
+  }
+  return evidence;
+}
+
 // src/software-helper.ts
-import { chmodSync as chmodSync2, existsSync as existsSync4, mkdirSync as mkdirSync4, unlinkSync as unlinkSync2 } from "node:fs";
+import { chmodSync as chmodSync2, existsSync as existsSync4, mkdirSync as mkdirSync5, unlinkSync as unlinkSync2 } from "node:fs";
 import { connect, createServer } from "node:net";
-import { dirname as dirname3 } from "node:path";
+import { dirname as dirname5 } from "node:path";
 
 // src/service-supervisor.ts
-import { createHash as createHash2 } from "node:crypto";
-import { existsSync as existsSync2, mkdirSync as mkdirSync2, readFileSync as readFileSync2, readdirSync, realpathSync, renameSync as renameSync2, rmSync as rmSync2, writeFileSync as writeFileSync2 } from "node:fs";
-import { dirname, join as join2, resolve, sep } from "node:path";
+import { createHash as createHash3 } from "node:crypto";
+import { existsSync as existsSync2, mkdirSync as mkdirSync3, readFileSync as readFileSync2, readdirSync, realpathSync, renameSync as renameSync3, rmSync as rmSync2, writeFileSync as writeFileSync3 } from "node:fs";
+import { dirname as dirname3, join as join2, resolve, sep } from "node:path";
 var SERVICE_STATE_DIRECTORY = "/var/lib/forgezero/services";
 var SERVICE_CONFIG_DIRECTORY = "/etc/forgezero/services";
 var SERVICE_UNIT_DIRECTORY = "/etc/systemd/system";
 var SERVICE_NGINX_DIRECTORY = "/etc/nginx/conf.d";
-var idFor = (key) => createHash2("sha256").update(key).digest("hex").slice(0, 24);
+var idFor2 = (key) => createHash3("sha256").update(key).digest("hex").slice(0, 24);
 var statePath = (id) => `${SERVICE_STATE_DIRECTORY}/${id}.json`;
 var within = (root, path2) => path2 === root || path2.startsWith(`${root}${sep}`);
-var defaultHost = {
+var defaultHost2 = {
   write(path2, content, mode) {
-    mkdirSync2(dirname(path2), { recursive: true, mode: 493 });
+    mkdirSync3(dirname3(path2), { recursive: true, mode: 493 });
     const next = `${path2}.next`;
-    writeFileSync2(next, content, { mode });
-    renameSync2(next, path2);
+    writeFileSync3(next, content, { mode });
+    renameSync3(next, path2);
   },
   read: (path2) => readFileSync2(path2, "utf8"),
   exists: existsSync2,
   list: (path2) => existsSync2(path2) ? readdirSync(path2) : [],
   realpath: realpathSync,
-  mkdir: (path2, mode) => mkdirSync2(path2, { recursive: true, mode }),
+  mkdir: (path2, mode) => mkdirSync3(path2, { recursive: true, mode }),
   remove: (path2) => rmSync2(path2, { force: true }),
   async exec(argv2) {
     const child = Bun.spawn([...argv2], { stdout: "pipe", stderr: "pipe", env: {
@@ -833,7 +1178,7 @@ function allocatedPorts(request, id, previous, states) {
   if (previous && previous.applicationPorts.length === required && previous.applicationPorts.every((port) => port >= allocation.from && port <= allocation.to && !occupied.has(port)))
     return [...previous.applicationPorts];
   const width = allocation.to - allocation.from + 1;
-  const start = Number.parseInt(createHash2("sha256").update(request.key).digest("hex").slice(0, 8), 16) % width;
+  const start = Number.parseInt(createHash3("sha256").update(request.key).digest("hex").slice(0, 8), 16) % width;
   for (let offset = 0;offset < width; offset += 1) {
     const first = allocation.from + (start + offset) % width;
     const candidate = Array.from({ length: required }, (_, index) => first + index);
@@ -891,12 +1236,12 @@ ${request.service.websocket ? `    proxy_set_header Upgrade $http_upgrade;
   }
 }
 `;
-async function checked(host, argv2, code) {
+async function checked2(host, argv2, code) {
   const result = await host.exec(argv2);
   if (result.exitCode !== 0)
     throw new Error(`${code}: ${result.output.slice(0, 512)}`);
 }
-async function activateSupervisedService(request, host = defaultHost) {
+async function activateSupervisedService(request, host = defaultHost2) {
   if (!/^[A-Za-z0-9][A-Za-z0-9_.:@/-]{0,255}$/.test(request.key) || !/^[a-f0-9]{40}$/.test(request.revision)) {
     throw new Error("SERVICE_IDENTITY_INVALID");
   }
@@ -905,7 +1250,7 @@ async function activateSupervisedService(request, host = defaultHost) {
   if (!within(root, release))
     throw new Error("SERVICE_RELEASE_OUTSIDE_ROOT");
   request = { ...request, root, release, service: validateDeploymentService(request.service) };
-  const id = idFor(request.key);
+  const id = idFor2(request.key);
   host.mkdir(SERVICE_STATE_DIRECTORY, 448);
   host.mkdir(SERVICE_CONFIG_DIRECTORY, 457);
   const previous = readState(host, statePath(id));
@@ -916,11 +1261,11 @@ async function activateSupervisedService(request, host = defaultHost) {
   const unitName = `forgezero-app-${id}-slot${nextSlot}.service`;
   host.write(configPath, appConfig({ ...request, release }, port), 292);
   host.write(`${SERVICE_UNIT_DIRECTORY}/${unitName}`, unit(id, nextSlot), 420);
-  await checked(host, ["/usr/bin/systemctl", "daemon-reload"], "SERVICE_UNIT_RELOAD_FAILED");
+  await checked2(host, ["/usr/bin/systemctl", "daemon-reload"], "SERVICE_UNIT_RELOAD_FAILED");
   if (request.service.strategy === "direct" && previous) {
     await host.exec(["/usr/bin/systemctl", "stop", `forgezero-app-${id}-slot${previous.activeSlot}.service`]);
   }
-  await checked(host, ["/usr/bin/systemctl", "restart", unitName], "SERVICE_START_FAILED");
+  await checked2(host, ["/usr/bin/systemctl", "restart", unitName], "SERVICE_START_FAILED");
   let healthy = false;
   for (let attempt = 0;attempt < 30; attempt += 1) {
     const active = await host.exec(["/usr/bin/systemctl", "is-active", "--quiet", unitName]);
@@ -938,8 +1283,8 @@ async function activateSupervisedService(request, host = defaultHost) {
   const oldNginx = host.exists(nginxPath) ? host.read(nginxPath) : null;
   try {
     host.write(nginxPath, nginx(request, id, port), 420);
-    await checked(host, ["/usr/sbin/nginx", "-t"], "SERVICE_NGINX_INVALID");
-    await checked(host, ["/usr/bin/systemctl", "reload", "nginx.service"], "SERVICE_NGINX_RELOAD_FAILED");
+    await checked2(host, ["/usr/sbin/nginx", "-t"], "SERVICE_NGINX_INVALID");
+    await checked2(host, ["/usr/bin/systemctl", "reload", "nginx.service"], "SERVICE_NGINX_RELOAD_FAILED");
   } catch (cause) {
     if (oldNginx === null)
       host.remove(nginxPath);
@@ -970,22 +1315,22 @@ async function activateSupervisedService(request, host = defaultHost) {
 }
 
 // src/container-supervisor.ts
-import { createHash as createHash3 } from "node:crypto";
-import { existsSync as existsSync3, mkdirSync as mkdirSync3, readFileSync as readFileSync3, readdirSync as readdirSync2, realpathSync as realpathSync2, renameSync as renameSync3, rmSync as rmSync3, writeFileSync as writeFileSync3 } from "node:fs";
-import { dirname as dirname2, resolve as resolve2, sep as sep2 } from "node:path";
-var defaultHost2 = {
+import { createHash as createHash4 } from "node:crypto";
+import { existsSync as existsSync3, mkdirSync as mkdirSync4, readFileSync as readFileSync3, readdirSync as readdirSync2, realpathSync as realpathSync2, renameSync as renameSync4, rmSync as rmSync3, writeFileSync as writeFileSync4 } from "node:fs";
+import { dirname as dirname4, resolve as resolve2, sep as sep2 } from "node:path";
+var defaultHost3 = {
   realpath: realpathSync2,
   exists: existsSync3,
   read: (path2) => readFileSync3(path2, "utf8"),
   write(path2, content, mode) {
-    mkdirSync3(dirname2(path2), { recursive: true, mode: 493 });
+    mkdirSync4(dirname4(path2), { recursive: true, mode: 493 });
     const next = `${path2}.next`;
-    writeFileSync3(next, content, { mode });
-    renameSync3(next, path2);
+    writeFileSync4(next, content, { mode });
+    renameSync4(next, path2);
   },
   remove: (path2) => rmSync3(path2, { force: true }),
   list: (path2) => existsSync3(path2) ? readdirSync2(path2) : [],
-  mkdir: (path2, mode) => mkdirSync3(path2, { recursive: true, mode }),
+  mkdir: (path2, mode) => mkdirSync4(path2, { recursive: true, mode }),
   async exec(argv2) {
     const child = Bun.spawn([...argv2], { stdout: "pipe", stderr: "pipe", env: { PATH: "/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin", LANG: "C", LC_ALL: "C" } });
     const [stdout, stderr, exitCode] = await Promise.all([new Response(child.stdout).text(), new Response(child.stderr).text(), child.exited]);
@@ -1003,9 +1348,41 @@ var defaultHost2 = {
   now: Date.now
 };
 var within2 = (root, path2) => path2 === root || path2.startsWith(`${root}${sep2}`);
-var idFor2 = (key) => createHash3("sha256").update(key).digest("hex").slice(0, 24);
+var idFor3 = (key) => createHash4("sha256").update(key).digest("hex").slice(0, 24);
 var statePath2 = (id) => `${SERVICE_STATE_DIRECTORY}/${id}.json`;
 var nameFor = (id, slot) => `forgezero-${id}-slot${slot}`;
+function backendFor(application) {
+  const runtime = application.runtime;
+  if (runtime.kind !== "container")
+    throw new Error("CONTAINER_RUNTIME_REQUIRED");
+  if (runtime.provider === "forgezero.docker") {
+    if (runtime.runtimeClass && runtime.runtimeClass !== "runc")
+      throw new Error("CONTAINER_RUNTIME_PROVIDER_MISMATCH");
+    return { engine: "docker", runtimeClass: "runc", prefix: ["/usr/bin/docker"] };
+  }
+  if (runtime.provider === "forgezero.containerd") {
+    if ((runtime.runtimeClass ?? "runc") !== "runc")
+      throw new Error("CONTAINER_RUNTIME_PROVIDER_MISMATCH");
+    return {
+      engine: "containerd",
+      runtimeClass: "runc",
+      prefix: ["/usr/local/bin/nerdctl", "--namespace", "forgezero"],
+      runtimeName: "io.containerd.runc.v2"
+    };
+  }
+  if (runtime.provider === "forgezero.kata") {
+    if (runtime.runtimeClass !== "kata-qemu-snp")
+      throw new Error("CONTAINER_RUNTIME_PROVIDER_MISMATCH");
+    return {
+      engine: "containerd",
+      runtimeClass: "kata-qemu-snp",
+      prefix: ["/usr/local/bin/nerdctl", "--namespace", "forgezero"],
+      runtimeName: "io.containerd.kata.v2"
+    };
+  }
+  throw new Error("CONTAINER_RUNTIME_PROVIDER_UNSUPPORTED");
+}
+var command = (backend, ...argv2) => [...backend.prefix, ...argv2];
 function validateRequest(request, host) {
   if (!/^[A-Za-z0-9][A-Za-z0-9_.:@/-]{0,255}$/.test(request.key) || !/^[a-f0-9]{40}$/.test(request.revision) || !/^[a-z][A-Za-z0-9-]{0,62}$/.test(request.component))
     throw new Error("CONTAINER_IDENTITY_INVALID");
@@ -1016,6 +1393,7 @@ function validateRequest(request, host) {
   const application = request.application;
   if (application.kind !== "application" || application.runtime.kind !== "container")
     throw new Error("CONTAINER_RUNTIME_REQUIRED");
+  backendFor(application);
   if (!application.resources.cpu || !application.resources.memory || !application.resources.pids)
     throw new Error("CONTAINER_LIMITS_REQUIRED");
   if (application.runtime.security.privileged !== false || application.runtime.security.noNewPrivileges !== true || !application.runtime.security.dropCapabilities.includes("ALL"))
@@ -1026,23 +1404,24 @@ function validateRequest(request, host) {
     throw new Error("CONTAINER_STABLE_PORT_REQUIRED");
   return { ...request, root, release };
 }
-async function checked2(host, argv2, code) {
+async function checked3(host, argv2, code) {
   const result = await host.exec(argv2);
   if (result.exitCode !== 0)
     throw new Error(`${code}: ${result.output.slice(0, 512)}`);
   return result.output.trim();
 }
-async function buildContainerImage(requestValue, host = defaultHost2) {
+async function buildContainerImage(requestValue, host = defaultHost3) {
   const request = validateRequest(requestValue, host);
   const runtime = request.application.runtime;
   if (runtime.kind !== "container")
     throw new Error("CONTAINER_RUNTIME_REQUIRED");
+  const backend = backendFor(request.application);
   const source = runtime.image.source;
   if (source.kind === "registry") {
     if (!source.reference.includes("@sha256:"))
       throw new Error("CONTAINER_IMAGE_DIGEST_REQUIRED");
-    await checked2(host, ["/usr/bin/docker", "pull", "--quiet", source.reference], "CONTAINER_PULL_FAILED");
-    const digest2 = await checked2(host, ["/usr/bin/docker", "image", "inspect", "--format={{.Id}}", source.reference], "CONTAINER_INSPECT_FAILED");
+    await checked3(host, command(backend, "pull", "--quiet", source.reference), "CONTAINER_PULL_FAILED");
+    const digest2 = await checked3(host, command(backend, "image", "inspect", "--format={{.Id}}", source.reference), "CONTAINER_INSPECT_FAILED");
     if (!/^sha256:[a-f0-9]{64}$/.test(digest2))
       throw new Error("CONTAINER_DIGEST_INVALID");
     return { image: source.reference, digest: digest2 };
@@ -1051,23 +1430,9 @@ async function buildContainerImage(requestValue, host = defaultHost2) {
   const dockerfile = host.realpath(resolve2(request.release, source.dockerfile));
   if (!within2(request.release, context) || !within2(context, dockerfile))
     throw new Error("CONTAINER_BUILD_PATH_INVALID");
-  const tag = `forgezero/${idFor2(request.key)}:${request.revision}`;
-  await checked2(host, [
-    "/usr/bin/docker",
-    "build",
-    "--pull",
-    ...request.noCache ? ["--no-cache"] : [],
-    "--file",
-    dockerfile,
-    "--tag",
-    tag,
-    "--label",
-    `net.forgezero.revision=${request.revision}`,
-    "--label",
-    `net.forgezero.component=${request.component}`,
-    context
-  ], "CONTAINER_BUILD_FAILED");
-  const digest = await checked2(host, ["/usr/bin/docker", "image", "inspect", "--format={{.Id}}", tag], "CONTAINER_INSPECT_FAILED");
+  const tag = `forgezero/${idFor3(request.key)}:${request.revision}`;
+  await checked3(host, command(backend, "build", "--pull", ...request.noCache ? ["--no-cache"] : [], "--file", dockerfile, "--tag", tag, "--label", `net.forgezero.revision=${request.revision}`, "--label", `net.forgezero.component=${request.component}`, context), "CONTAINER_BUILD_FAILED");
+  const digest = await checked3(host, command(backend, "image", "inspect", "--format={{.Id}}", tag), "CONTAINER_INSPECT_FAILED");
   if (!/^sha256:[a-f0-9]{64}$/.test(digest))
     throw new Error("CONTAINER_DIGEST_INVALID");
   return { image: tag, digest };
@@ -1135,7 +1500,7 @@ ${service.websocket ? `    proxy_set_header Upgrade $http_upgrade;
 }
 `;
 }
-function runArgv(request, id, slot, port, networkName) {
+function runArgv(request, backend, id, slot, port, networkName) {
   const { application } = request;
   const resources = application.resources;
   const runtime = application.runtime;
@@ -1143,35 +1508,7 @@ function runArgv(request, id, slot, port, networkName) {
     throw new Error("CONTAINER_RUNTIME_REQUIRED");
   const memory = resources.memory;
   const network = application.network.container;
-  const argv2 = [
-    "/usr/bin/docker",
-    "run",
-    "--detach",
-    "--name",
-    nameFor(id, slot),
-    "--restart",
-    "unless-stopped",
-    "--label",
-    `net.forgezero.key=${request.key}`,
-    "--label",
-    `net.forgezero.revision=${request.revision}`,
-    "--cpus",
-    String(resources.cpu.limit),
-    "--cpu-shares",
-    String(resources.cpu.weight ?? 100),
-    "--memory",
-    `${memory.limitMiB}m`,
-    ...memory.reservationMiB ? ["--memory-reservation", `${memory.reservationMiB}m`] : [],
-    ...memory.swap === "disabled" ? ["--memory-swap", `${memory.limitMiB}m`] : [],
-    "--pids-limit",
-    String(resources.pids.limit),
-    "--security-opt",
-    "no-new-privileges=true",
-    "--cap-drop",
-    "ALL",
-    ...runtime.security.root === "read-only" ? ["--read-only"] : [],
-    ...network.mode === "host" ? ["--network", "host", "--env", `FZ_APP_PORT=${port}`] : ["--network", networkName, "--publish", `127.0.0.1:${port}:${application.service.port}`]
-  ];
+  const argv2 = command(backend, "run", "--detach", "--name", nameFor(id, slot), "--restart", "unless-stopped", "--label", `net.forgezero.key=${request.key}`, "--label", `net.forgezero.revision=${request.revision}`, ...backend.runtimeName ? ["--runtime", backend.runtimeName] : [], "--cpus", String(resources.cpu.limit), "--cpu-shares", String(resources.cpu.weight ?? 100), "--memory", `${memory.limitMiB}m`, ...memory.reservationMiB ? ["--memory-reservation", `${memory.reservationMiB}m`] : [], ...memory.swap === "disabled" ? ["--memory-swap", `${memory.limitMiB}m`] : [], "--pids-limit", String(resources.pids.limit), "--security-opt", "no-new-privileges=true", "--cap-drop", "ALL", ...runtime.security.root === "read-only" ? ["--read-only"] : [], ...network.mode === "host" ? ["--network", "host", "--env", `FZ_APP_PORT=${port}`] : ["--network", networkName, "--publish", `127.0.0.1:${port}:${application.service.port}`]);
   for (const mount of application.storage ?? []) {
     if (mount.class === "ephemeral")
       argv2.push("--tmpfs", `${mount.path}:rw,noexec,nosuid,size=${mount.sizeMiB}m`);
@@ -1181,11 +1518,12 @@ function runArgv(request, id, slot, port, networkName) {
   argv2.push(request.image, ...runtime.entrypoint ?? []);
   return argv2;
 }
-async function activateContainer(requestValue, host = defaultHost2) {
+async function activateContainer(requestValue, host = defaultHost3) {
   const request = validateRequest(requestValue, host);
   if (!/^sha256:[a-f0-9]{64}$/.test(request.image) && !/^forgezero\/[a-f0-9]{24}:[a-f0-9]{40}$/.test(request.image) && !request.image.includes("@sha256:"))
     throw new Error("CONTAINER_IMAGE_INVALID");
-  const id = idFor2(request.key);
+  const backend = backendFor(request.application);
+  const id = idFor3(request.key);
   host.mkdir(SERVICE_STATE_DIRECTORY, 448);
   host.mkdir(SERVICE_NGINX_DIRECTORY, 493);
   const previous = readState2(host, id);
@@ -1197,9 +1535,9 @@ async function activateContainer(requestValue, host = defaultHost2) {
   if (containerNetwork.mode === "bridge") {
     networkName = containerNetwork.network ? `forgezero-${id}-${containerNetwork.network}` : "bridge";
     if (networkName !== "bridge") {
-      const inspected = await host.exec(["/usr/bin/docker", "network", "inspect", '--format={{index .Labels "net.forgezero.owner"}}', networkName]);
+      const inspected = await host.exec(command(backend, "network", "inspect", '--format={{index .Labels "net.forgezero.owner"}}', networkName));
       if (inspected.exitCode !== 0) {
-        await checked2(host, ["/usr/bin/docker", "network", "create", "--driver", "bridge", "--label", `net.forgezero.owner=${id}`, networkName], "CONTAINER_NETWORK_CREATE_FAILED");
+        await checked3(host, command(backend, "network", "create", "--driver", "bridge", "--label", `net.forgezero.owner=${id}`, networkName), "CONTAINER_NETWORK_CREATE_FAILED");
       } else if (inspected.output.trim() !== id)
         throw new Error("CONTAINER_NETWORK_OWNERSHIP_INVALID");
     }
@@ -1208,8 +1546,8 @@ async function activateContainer(requestValue, host = defaultHost2) {
   const nextSlot = slots === 2 && previous?.activeSlot === 0 ? 1 : 0;
   const port = ports[nextSlot];
   const name = nameFor(id, nextSlot);
-  await host.exec(["/usr/bin/docker", "rm", "--force", name]);
-  await checked2(host, runArgv(request, id, nextSlot, port, networkName), "CONTAINER_START_FAILED");
+  await host.exec(command(backend, "rm", "--force", name));
+  await checked3(host, runArgv(request, backend, id, nextSlot, port, networkName), "CONTAINER_START_FAILED");
   let healthy = false;
   const health = request.application.service.health;
   for (let attempt = 0;attempt < (health.attempts ?? 30); attempt += 1) {
@@ -1220,15 +1558,28 @@ async function activateContainer(requestValue, host = defaultHost2) {
     await host.sleep(health.intervalMs ?? 1000);
   }
   if (!healthy) {
-    await host.exec(["/usr/bin/docker", "rm", "--force", name]);
+    await host.exec(command(backend, "rm", "--force", name));
     throw new Error("CONTAINER_HEALTH_FAILED");
   }
+  let runtimeEvidence;
+  if (backend.engine === "containerd") {
+    const raw = await checked3(host, ["/usr/bin/ctr", "--namespace", "forgezero", "containers", "info", name], "CONTAINER_RUNTIME_EVIDENCE_FAILED");
+    let observed = "";
+    try {
+      observed = String(JSON.parse(raw).Runtime?.Name ?? "");
+    } catch {
+      throw new Error("CONTAINER_RUNTIME_EVIDENCE_INVALID");
+    }
+    if (observed !== backend.runtimeName)
+      throw new Error("CONTAINER_RUNTIME_DOWNGRADE");
+    runtimeEvidence = observed;
+  }
   const nginxPath = `${SERVICE_NGINX_DIRECTORY}/forgezero-${id}.conf`;
   const previousNginx = host.exists(nginxPath) ? host.read(nginxPath) : null;
   host.write(nginxPath, nginx2(request, id, port), 420);
   try {
-    await checked2(host, ["/usr/sbin/nginx", "-t"], "CONTAINER_NGINX_INVALID");
-    await checked2(host, ["/usr/bin/systemctl", "reload", "nginx.service"], "CONTAINER_NGINX_RELOAD_FAILED");
+    await checked3(host, ["/usr/sbin/nginx", "-t"], "CONTAINER_NGINX_INVALID");
+    await checked3(host, ["/usr/bin/systemctl", "reload", "nginx.service"], "CONTAINER_NGINX_RELOAD_FAILED");
   } catch (cause) {
     if (previousNginx === null)
       host.remove(nginxPath);
@@ -1236,7 +1587,7 @@ async function activateContainer(requestValue, host = defaultHost2) {
       host.write(nginxPath, previousNginx, 420);
     await host.exec(["/usr/sbin/nginx", "-t"]);
     await host.exec(["/usr/bin/systemctl", "reload", "nginx.service"]);
-    await host.exec(["/usr/bin/docker", "rm", "--force", name]);
+    await host.exec(command(backend, "rm", "--force", name));
     throw cause;
   }
   const state = {
@@ -1249,13 +1600,18 @@ async function activateContainer(requestValue, host = defaultHost2) {
     applicationPorts: ports,
     activeSlot: nextSlot,
     healthPath: health.path,
+    containerRuntime: {
+      engine: backend.engine,
+      runtimeClass: backend.runtimeClass,
+      ...backend.engine === "containerd" ? { namespace: "forgezero", evidence: runtimeEvidence } : {}
+    },
     updatedAtTs: host.now()
   };
   host.write(statePath2(id), `${JSON.stringify(state, null, 2)}
 `, 384);
   if (previous && previous.activeSlot !== nextSlot) {
     await host.sleep(request.application.rollout.drainMs ?? 30000);
-    await host.exec(["/usr/bin/docker", "rm", "--force", nameFor(id, previous.activeSlot)]);
+    await host.exec(command(backend, "rm", "--force", nameFor(id, previous.activeSlot)));
   }
   return state;
 }
@@ -1270,11 +1626,12 @@ function startSoftwareHelper(options = {}) {
   const socketPath = options.socketPath ?? DEFAULT_SOFTWARE_HELPER_SOCKET;
   if (existsSync4(socketPath))
     unlinkSync2(socketPath);
-  mkdirSync4(dirname3(socketPath), { recursive: true, mode: 488 });
+  mkdirSync5(dirname5(socketPath), { recursive: true, mode: 488 });
   const ensure = options.ensure ?? ensureSoftwareRequirements;
   const activate = options.activate ?? activateSupervisedService;
   const buildContainer = options.buildContainer ?? buildContainerImage;
   const activateTypedContainer = options.activateContainer ?? activateContainer;
+  const applyConnectivity = options.applyConnectivity ?? applyDeploymentConnectivity;
   let tail = Promise.resolve();
   let pending = 0;
   const server = createServer((socket) => {
@@ -1331,6 +1688,12 @@ function startSoftwareHelper(options = {}) {
             throw new Error("container deployment root is not owned by this helper");
           const state = await activateTypedContainer(containerRequest);
           socket.end(`${JSON.stringify({ ok: true, state })}
+`);
+          return;
+        }
+        if (request.op === "apply-connectivity" && request.request) {
+          const result = await applyConnectivity(request.request);
+          socket.end(`${JSON.stringify({ ok: true, result })}
 `);
           return;
         }
@@ -1388,6 +1751,9 @@ function requestContainerBuild(request, socketPath = DEFAULT_SOFTWARE_HELPER_SOC
 function requestContainerActivation(request, socketPath = DEFAULT_SOFTWARE_HELPER_SOCKET, timeoutMs = 15 * 60000) {
   return requestContainer("activate-container", request, socketPath, timeoutMs);
 }
+function requestDeploymentConnectivity(request, socketPath = DEFAULT_SOFTWARE_HELPER_SOCKET, timeoutMs = 15 * 60000) {
+  return requestContainer("apply-connectivity", request, socketPath, timeoutMs);
+}
 function requestServiceActivation(request, socketPath = DEFAULT_SOFTWARE_HELPER_SOCKET, timeoutMs = 10 * 60000) {
   return new Promise((resolve3, reject) => {
     const socket = connect(socketPath, () => socket.write(`${JSON.stringify({ op: "activate-service", request })}
@@ -1449,6 +1815,7 @@ export {
   startSoftwareHelper,
   requestSoftware,
   requestServiceActivation,
+  requestDeploymentConnectivity,
   requestContainerBuild,
   requestContainerActivation,
   SOFTWARE_HELPER_UNIT_PATH,