@homeflare/alchemy 0.31.1 → 0.32.0

package/dist/linux/index.js

@@ -419,11 +419,14 @@ var HostDirectoryProvider = () => Provider.effect(HostDirectory, Effect6.gen(fun
 // src/linux/providers.ts
 import * as Layer2 from "effect/Layer";
 
-// src/linux/remote-file.ts
+// src/linux/container.ts
 import { Resource as Resource2 } from "alchemy";
+import * as Provider2 from "alchemy/Provider";
+import * as Effect8 from "effect/Effect";
+
+// src/linux/container-handlers.ts
 import { Unowned as Unowned3 } from "alchemy/AdoptPolicy";
 import { isResolved as isResolved2 } from "alchemy/Diff";
-import * as Provider2 from "alchemy/Provider";
 import * as Effect7 from "effect/Effect";
 
 // src/launchd/job-form.ts
@@ -594,27 +597,556 @@ var jobPlistDict = (props) => {
   if (calendar !== undefined) {
     dict["StartCalendarInterval"] = Array.isArray(calendar) ? calendar.map(calendarDict) : calendarDict(calendar);
   }
-  if (props.throttleInterval !== undefined)
-    dict["ThrottleInterval"] = props.throttleInterval;
-  if (props.standardOutPath !== undefined)
-    dict["StandardOutPath"] = props.standardOutPath;
-  if (props.standardErrorPath !== undefined)
-    dict["StandardErrorPath"] = props.standardErrorPath;
-  if (props.workingDirectory !== undefined)
-    dict["WorkingDirectory"] = props.workingDirectory;
-  if (props.userName !== undefined)
-    dict["UserName"] = props.userName;
-  if (props.groupName !== undefined)
-    dict["GroupName"] = props.groupName;
-  return dict;
+  if (props.throttleInterval !== undefined)
+    dict["ThrottleInterval"] = props.throttleInterval;
+  if (props.standardOutPath !== undefined)
+    dict["StandardOutPath"] = props.standardOutPath;
+  if (props.standardErrorPath !== undefined)
+    dict["StandardErrorPath"] = props.standardErrorPath;
+  if (props.workingDirectory !== undefined)
+    dict["WorkingDirectory"] = props.workingDirectory;
+  if (props.userName !== undefined)
+    dict["UserName"] = props.userName;
+  if (props.groupName !== undefined)
+    dict["GroupName"] = props.groupName;
+  return dict;
+};
+var sha256Hex = (bytes) => createHash("sha256").update(bytes).digest("hex");
+var renderJob = (props) => {
+  const text = renderPlist(jobPlistDict(props));
+  const bytes = new TextEncoder().encode(text);
+  return { bytes, sha256: sha256Hex(bytes), text };
+};
+
+// src/linux/unit-form.ts
+var DEFAULT_UNIT_DIRECTORY = "/etc/systemd/system";
+var UNIT_SEARCH_DIRECTORIES = [
+  "/etc/systemd/system",
+  "/run/systemd/system",
+  "/usr/local/lib/systemd/system",
+  "/usr/lib/systemd/system",
+  "/lib/systemd/system"
+];
+var UNIT_WRITE = { gid: 0, mode: 420, uid: 0 };
+var digestOf = (text) => sha256Hex(new TextEncoder().encode(text));
+var configDigest = (restartOn) => digestOf((restartOn ?? []).join(`
+`));
+var isUnitRunning = (activeState, subState, started) => {
+  if (activeState === "active")
+    return true;
+  if (activeState !== "activating")
+    return false;
+  if (subState === "auto-restart" || subState === "auto-restart-queued")
+    return true;
+  return started;
+};
+var renderUnit = (sections) => `${sections.map((section) => [`[${section.name}]`, ...section.lines.map(([key, value]) => `${key}=${value}`)].join(`
+`)).join(`
+
+`)}
+`;
+var unitText = (props) => props.content ?? renderUnit(props.sections ?? []);
+var unitPathFor = (props) => `${props.directory ?? DEFAULT_UNIT_DIRECTORY}/${props.name}`;
+var NAME = /^[A-Za-z0-9][A-Za-z0-9_.@:-]*\.([a-z]+)$/;
+var TYPES = new Set([
+  "automount",
+  "device",
+  "mount",
+  "path",
+  "scope",
+  "service",
+  "slice",
+  "socket",
+  "swap",
+  "target",
+  "timer"
+]);
+var INSTALL_KEYS = new Set(["WantedBy", "RequiredBy", "UpsertedBy", "Also", "Alias"]);
+var unitProblems = (props, expect) => {
+  const found = [];
+  const type = NAME.exec(props.name)?.[1];
+  if (type === undefined || !TYPES.has(type)) {
+    found.push(`name must be <unit>.<type> with a systemd unit type, got ${JSON.stringify(props.name)}`);
+  } else if (expect !== undefined && type !== expect) {
+    found.push(`this resource declares a .${expect} unit; ${props.name} is a .${type}`);
+  }
+  if (props.content === undefined === (props.sections === undefined)) {
+    found.push("declare exactly one of content or sections");
+  }
+  const directory = props.directory ?? DEFAULT_UNIT_DIRECTORY;
+  if (!directory.startsWith("/") || directory.endsWith("/") || directory.includes("/..")) {
+    found.push("directory must be an absolute, normalised path with no trailing slash");
+  }
+  found.push(...textProblems(unitText(props)));
+  if (props.enabled !== false && !UNIT_SEARCH_DIRECTORIES.includes(directory)) {
+    found.push(`an enabled unit must live where systemd looks for it by name (${UNIT_SEARCH_DIRECTORIES.join(", ")}); ` + `${directory} is not one of them. Move it, or declare enabled: false.`);
+  }
+  if (props.enabled !== false && !hasInstall(props)) {
+    found.push("enabled units need an [Install] section with WantedBy/RequiredBy/Also/Alias; without one " + 'systemd calls the unit "static" and `systemctl enable` has nothing to link. Add one, or ' + "declare enabled: false and let something else pull it in.");
+  }
+  if (type === "timer" && !unitText(props).includes("[Timer]")) {
+    found.push("a .timer needs a [Timer] section");
+  }
+  return found;
+};
+var hasInstall = (props) => {
+  const text = unitText(props);
+  if (!text.includes("[Install]"))
+    return false;
+  const after = text.slice(text.indexOf("[Install]"));
+  return [...INSTALL_KEYS].some((key) => new RegExp(`^${key}=`, "m").test(after));
+};
+var textProblems = (text) => {
+  const found = [];
+  if (text.trim() === "")
+    found.push("the unit file is empty");
+  if (text.includes("\x00"))
+    found.push("the unit file contains NUL");
+  if (!/^\s*\[[A-Za-z]+]/.test(text))
+    found.push("a unit file must begin with a [Section]");
+  return found;
+};
+
+// src/linux/systemctl.ts
+var SYSTEMCTL = "systemctl";
+var SHOW_PROPERTIES = [
+  "Id",
+  "LoadState",
+  "ActiveState",
+  "SubState",
+  "UnitFileState",
+  "FragmentPath",
+  "SourcePath",
+  "NeedDaemonReload"
+];
+
+class SystemctlError extends Error {
+  constructor(command, exitCode, stderr) {
+    super(`systemctl ${command} -> ${String(exitCode)}: ${stderr.trim().slice(0, 300)}`);
+    this.name = "SystemctlError";
+  }
+}
+var parseShow = (stdout) => {
+  const fields = new Map;
+  for (const line of stdout.split(`
+`)) {
+    const at = line.indexOf("=");
+    if (at <= 0)
+      continue;
+    const key = line.slice(0, at);
+    if (!fields.has(key))
+      fields.set(key, line.slice(at + 1));
+  }
+  return fields;
+};
+var statusOf = (stdout) => {
+  const fields = parseShow(stdout);
+  const loadState = fields.get("LoadState") ?? "not-found";
+  const unitFileState = fields.get("UnitFileState") ?? "";
+  const fragmentPath = fields.get("FragmentPath") ?? "";
+  const sourcePath = fields.get("SourcePath") ?? "";
+  const subState = fields.get("SubState") ?? "";
+  return {
+    activeState: fields.get("ActiveState") ?? "inactive",
+    known: loadState !== "not-found" || unitFileState !== "",
+    loadState,
+    needDaemonReload: fields.get("NeedDaemonReload") === "yes",
+    ...subState === "" ? {} : { subState },
+    ...unitFileState === "" ? {} : { unitFileState },
+    ...fragmentPath === "" ? {} : { fragmentPath },
+    ...sourcePath === "" ? {} : { sourcePath }
+  };
+};
+var showUnit = async (runner, name) => {
+  const result = await runner.exec([
+    SYSTEMCTL,
+    "show",
+    "--no-pager",
+    "-p",
+    SHOW_PROPERTIES.join(","),
+    "--",
+    name
+  ]);
+  if (result.exitCode !== 0)
+    throw new SystemctlError(`show ${name}`, result.exitCode, result.stderr);
+  return statusOf(result.stdout);
+};
+var run = async (runner, args) => {
+  const result = await runner.exec([SYSTEMCTL, ...args]);
+  if (result.exitCode !== 0) {
+    throw new SystemctlError(args.join(" "), result.exitCode, result.stderr);
+  }
+};
+var daemonReload = (runner) => run(runner, ["daemon-reload"]);
+var enableUnit = (runner, name) => run(runner, ["enable", "--", name]);
+var disableUnit = (runner, name) => run(runner, ["disable", "--", name]);
+var startUnit = (runner, name) => run(runner, ["start", "--", name]);
+var stopUnit = (runner, name) => run(runner, ["stop", "--", name]);
+var restartUnit = (runner, name) => run(runner, ["restart", "--", name]);
+
+// src/linux/container-generator.ts
+class QuadletGeneratorError extends Error {
+  constructor(name, detail) {
+    super(`Podman.Container ${name}: ${detail}`);
+    this.name = "QuadletGeneratorError";
+  }
+}
+var generatedMatches = (containerPath, status) => status.known && status.loadState === "loaded" && (status.sourcePath === undefined || status.sourcePath === containerPath);
+var needsVerificationReload = (containerPath, status) => !generatedMatches(containerPath, status);
+var verifyGenerated = (name, containerPath, serviceName, status) => {
+  if (!status.known || status.loadState !== "loaded") {
+    throw new QuadletGeneratorError(name, `${serviceName} does not exist after daemon-reload (LoadState=${status.loadState}). The ` + ".container file was written and reloaded, so Quadlet’s generator refused it — a bad " + "key, a bad value, or an interaction this validation does not check. Debug on the host " + "with '/usr/lib/systemd/system-generators/podman-system-generator --dryrun' or " + `'systemd-analyze --generators=true verify ${serviceName}' (podman-systemd.unit(5), Podman 5.4).`);
+  }
+  if (status.sourcePath !== undefined && status.sourcePath !== containerPath) {
+    throw new QuadletGeneratorError(name, `${serviceName}'s SourcePath is ${status.sourcePath}, not ${containerPath} — a same-named ` + ".container file earlier in Quadlet’s search path is generating this unit instead of ours " + "(podman-systemd.unit(5) “Podman Unit Search Path”, Podman 5.4).");
+  }
+};
+
+// src/linux/container-secrets.ts
+var SECRET_KEY_NAME = /(SECRET|TOKEN|PASSWORD|PASSWD|PRIVATE_KEY|API_?KEY|CREDENTIAL|ACCESS_KEY|CLIENT_SECRET|AUTH_?KEY|DSN)/i;
+var SECRET_VALUE_PREFIX = /^(Bearer\s|Basic\s|sk-|ghp_|gho_|glpat-|xox[baprs]-|AKIA|eyJ)/;
+var SECRET_VALUE_ANYWHERE = new RegExp(SECRET_VALUE_PREFIX.source.replace(/^\^/, ""));
+var EMBEDDED_SECRET_ASSIGNMENT = new RegExp(`[A-Za-z0-9_]*(?:${SECRET_KEY_NAME.source})[A-Za-z0-9_]*\\s*=\\s*\\S+`, "i");
+var ENV_FLAG = /^(?:-e|--env)(?:=|$|[A-Za-z_])/;
+var secretLikeEnvironment = (environment) => {
+  const found = [];
+  for (const [key, value] of Object.entries(environment)) {
+    if (SECRET_KEY_NAME.test(key)) {
+      found.push(`environment key ${JSON.stringify(key)} looks like a secret by its name. Environment= is ` + "rendered into a world-readable file and stored in Alchemy state; use environmentFile " + "instead, pointing at a host path a secret renderer maintains.");
+    } else if (SECRET_VALUE_PREFIX.test(value)) {
+      found.push(`environment key ${JSON.stringify(key)}'s value looks like a credential. Environment= is ` + "rendered into a world-readable file and stored in Alchemy state; use environmentFile " + "instead, pointing at a host path a secret renderer maintains.");
+    }
+  }
+  return found;
+};
+var secretLikeLines = (lines) => {
+  const found = [];
+  for (const [key, value] of lines) {
+    if (SECRET_VALUE_ANYWHERE.test(value)) {
+      found.push(`${key}=${JSON.stringify(value)} looks like it carries a credential by its value. This ` + "line is rendered into a world-readable file and stored in Alchemy state; use " + "container.environmentFile instead, pointing at a host path a secret renderer maintains.");
+    } else if (EMBEDDED_SECRET_ASSIGNMENT.test(value)) {
+      found.push(`${key}=${JSON.stringify(value)} embeds a KEY=VALUE pair whose key looks like a secret ` + "name. This line is rendered into a world-readable file and stored in Alchemy state; use " + "container.environment (checked for secrets) or container.environmentFile instead.");
+    }
+  }
+  return found;
+};
+var podmanArgsProblems = (args) => args.filter((arg) => ENV_FLAG.test(arg)).map((arg) => `podmanArgs entry ${JSON.stringify(arg)} sets a container environment variable outside ` + "the typed props, which this family never checks for a secret. Use container.environment " + "(checked) or container.environmentFile (for anything secret) instead.");
+
+// src/linux/container-form.ts
+var QUADLET_SEARCH_DIRECTORIES = [
+  "/run/containers/systemd",
+  "/etc/containers/systemd",
+  "/usr/share/containers/systemd"
+];
+var QUADLET_DEFAULT_DIRECTORY = "/etc/containers/systemd";
+var NAME2 = /^[A-Za-z0-9][A-Za-z0-9_.-]*$/;
+var containerPathFor = (props) => `${props.directory ?? QUADLET_DEFAULT_DIRECTORY}/${props.name}.container`;
+var serviceNameFor = (props) => `${props.name}.service`;
+var unitLines = (props) => [
+  ...props.unit?.description === undefined ? [] : [["Description", props.unit.description]],
+  ...props.unit?.documentation === undefined ? [] : [["Documentation", props.unit.documentation]],
+  ...props.unit?.lines ?? []
+];
+var containerLines = (c) => [
+  ["Image", c.image],
+  ...c.containerName === undefined ? [] : [["ContainerName", c.containerName]],
+  ...c.network === undefined ? [] : [["Network", c.network]],
+  ...c.user === undefined ? [] : [["User", c.user]],
+  ...c.exec === undefined ? [] : [["Exec", c.exec]],
+  ...c.autoUpdate === undefined ? [] : [["AutoUpdate", c.autoUpdate]],
+  ...(c.environmentFile ?? []).map((file) => ["EnvironmentFile", file]),
+  ...Object.keys(c.environment ?? {}).sort().map((key) => [
+    "Environment",
+    `${key}=${c.environment[key]}`
+  ]),
+  ...(c.volume ?? []).map((volume) => ["Volume", volume]),
+  ...(c.publishPort ?? []).map((port) => ["PublishPort", port]),
+  ...(c.podmanArgs ?? []).map((arg) => ["PodmanArgs", arg])
+];
+var serviceLines = (props) => [
+  ...props.service?.restart === undefined ? [] : [["Restart", props.service.restart]],
+  ...props.service?.restartSec === undefined ? [] : [["RestartSec", props.service.restartSec]],
+  ...props.service?.lines ?? []
+];
+var installLines = (props) => [
+  ...(props.install?.wantedBy ?? []).map((target) => ["WantedBy", target]),
+  ...(props.install?.requiredBy ?? []).map((target) => ["RequiredBy", target]),
+  ...(props.install?.alias ?? []).map((name) => ["Alias", name])
+];
+var renderContainerFile = (props) => {
+  const sections = [
+    { name: "Unit", lines: unitLines(props) },
+    { name: "Container", lines: containerLines(props.container) },
+    { name: "Service", lines: serviceLines(props) },
+    { name: "Install", lines: installLines(props) }
+  ];
+  return renderUnit(sections.filter((section) => section.lines.length > 0));
+};
+var refuseContainer = (name, message) => new Error(`Podman.Container ${name}: ${message}`);
+var containerProblems = (props) => {
+  const found = [];
+  if (!NAME2.test(props.name)) {
+    found.push(`name must match ${String(NAME2)}, with no '.container' suffix; got ${JSON.stringify(props.name)}`);
+  }
+  const directory = props.directory ?? QUADLET_DEFAULT_DIRECTORY;
+  if (!directory.startsWith("/") || directory.endsWith("/") || directory.includes("/..")) {
+    found.push("directory must be an absolute, normalised path with no trailing slash");
+  } else if (!QUADLET_SEARCH_DIRECTORIES.includes(directory)) {
+    found.push(`directory must be one of Quadlet's own rootful search path (${QUADLET_SEARCH_DIRECTORIES.join(", ")}); ` + `${directory} is never read by the generator (podman-systemd.unit(5), Podman 5.4).`);
+  }
+  if (props.container.image.trim() === "")
+    found.push("container.image is required");
+  if (props.container.network === "host" && (props.container.publishPort?.length ?? 0) > 0) {
+    found.push("container.publishPort has no effect with container.network 'host': the container already " + "binds the host’s ports directly. Drop publishPort, or use a different network.");
+  }
+  found.push(...secretLikeEnvironment(props.container.environment ?? {}).map((problem) => `container.${problem}`));
+  found.push(...podmanArgsProblems(props.container.podmanArgs ?? []).map((problem) => `container.${problem}`));
+  found.push(...secretLikeLines([
+    ...unitLines(props),
+    ...containerLines(props.container).filter(([key]) => key !== "Environment"),
+    ...serviceLines(props),
+    ...installLines(props)
+  ]));
+  if (renderContainerFile(props).includes("\x00"))
+    found.push("the rendered .container file contains NUL");
+  return found;
+};
+
+// src/linux/container-preflight.ts
+var decoder = new TextDecoder;
+var assertValid = (props) => {
+  const found = containerProblems(props);
+  if (found.length > 0)
+    throw refuseContainer(props.name, found.join("; "));
+};
+var assertMayWrite = (runner, name) => {
+  if (canActAsRoot(runner))
+    return;
+  throw refuseContainer(name, "a Quadlet .container file is root-owned and daemon-reload/systemctl need root. Point the " + "runner at a destination whose ssh user is root, or provide a privileged HostRunner. This " + "provider never calls sudo.");
+};
+var assertUsable = (props, status) => {
+  if (status.loadState === "masked" || status.unitFileState === "masked") {
+    throw refuseContainer(props.name, `${serviceNameFor(props)} is masked. If that is stale, \`systemctl unmask\` it deliberately, ` + "then redeploy. Nothing was written.");
+  }
+};
+var assertUnclaimed = async (runner, props) => {
+  const path = containerPathFor(props);
+  const bytes = await runner.readFile(path);
+  const live = bytes === undefined ? undefined : digestOf(decoder.decode(bytes));
+  if (live !== undefined && live !== digestOf(renderContainerFile(props))) {
+    throw refuseContainer(props.name, `${path} is already on this host and is not this resource. Remove it, or declare it as a ` + "new resource and deploy with --adopt.");
+  }
+};
+var assertRenameTarget = async (runner, old, name) => {
+  assertMayWrite(runner, old.name);
+  assertMayWrite(runner, name);
+  assertUsable({ name }, await showUnit(runner, serviceNameFor({ name })));
+};
+var assertReplaceable = async (runner, next, old) => {
+  assertValid(next);
+  await assertRenameTarget(runner, old, next.name);
+  await assertUnclaimed(runner, next);
+  await runner.checkWrite?.(containerPathFor(next), UNIT_WRITE);
+};
+
+// src/linux/container-settle.ts
+var attributesOf = (props, configSha256, containerSha256, containerPath, serviceName, status) => ({
+  active: status.activeState === "active" || status.activeState === "activating",
+  activeState: status.activeState,
+  configSha256,
+  containerPath,
+  containerSha256,
+  loadState: status.loadState,
+  name: props.name,
+  serviceName,
+  ...status.unitFileState === undefined ? {} : { unitFileState: status.unitFileState },
+  ...status.sourcePath === undefined ? {} : { sourcePath: status.sourcePath }
+});
+var settle = async (runner, props, configSha256, step) => {
+  const wantStarted = props.started !== false;
+  const running = isUnitRunning(step.status.activeState, step.status.subState, wantStarted);
+  const undo = async (detail) => {
+    if (step.before === undefined) {
+      await runner.removeFile(step.path).catch(() => {
+        return;
+      });
+      await daemonReload(runner).catch(() => {
+        return;
+      });
+    }
+    throw refuseContainer(props.name, `${detail} The container's unit is NOT running.`);
+  };
+  try {
+    if (!wantStarted) {
+      if (running)
+        await stopUnit(runner, step.serviceName);
+    } else if (!running)
+      await startUnit(runner, step.serviceName);
+    else if (step.changed || step.configChanged)
+      await restartUnit(runner, step.serviceName);
+  } catch (cause) {
+    return undo(cause instanceof Error ? cause.message : String(cause));
+  }
+  const after = await showUnit(runner, step.serviceName);
+  if (wantStarted && !isUnitRunning(after.activeState, after.subState, wantStarted)) {
+    return undo(`systemctl reported success but the unit is ${after.activeState}.`);
+  }
+  return attributesOf(props, configSha256, step.desired, step.path, step.serviceName, after);
+};
+
+// src/linux/container-lifecycle.ts
+var encoder = new TextEncoder;
+var decoder2 = new TextDecoder;
+var readContainer = async (runner, props) => {
+  const path = containerPathFor(props);
+  const bytes = await runner.readFile(path);
+  const status = await showUnit(runner, serviceNameFor(props));
+  if (bytes === undefined && !status.known)
+    return;
+  const sha = bytes === undefined ? "" : digestOf(decoder2.decode(bytes));
+  return attributesOf(props, configDigest(props.restartOn), sha, path, serviceNameFor(props), status);
+};
+var diffContainer = async (runner, news, output) => {
+  assertValid(news);
+  if (news.name !== output.name || containerPathFor(news) !== output.containerPath) {
+    await assertReplaceable(runner, news, output);
+    return { action: "replace", deleteFirst: true };
+  }
+  const desired2 = digestOf(renderContainerFile(news));
+  const update = async () => {
+    assertMayWrite(runner, news.name);
+    await runner.checkWrite?.(containerPathFor(news), UNIT_WRITE);
+    return { action: "update" };
+  };
+  if (desired2 !== output.containerSha256)
+    return update();
+  if (configDigest(news.restartOn) !== output.configSha256)
+    return update();
+  const live = await readContainer(runner, news);
+  if (live === undefined || live.containerSha256 !== desired2)
+    return update();
+  const status = await showUnit(runner, serviceNameFor(news));
+  const wantStarted = news.started !== false;
+  if (isUnitRunning(status.activeState, status.subState, wantStarted) !== wantStarted)
+    return update();
+  return status.needDaemonReload ? update() : { action: "noop" };
+};
+var reconcileContainer = async (runner, props, output, adopt = false) => {
+  assertValid(props);
+  assertMayWrite(runner, props.name);
+  const path = containerPathFor(props);
+  const serviceName = serviceNameFor(props);
+  const text = renderContainerFile(props);
+  const desired2 = digestOf(text);
+  const before = await runner.readFile(path);
+  const liveSha = before === undefined ? undefined : digestOf(decoder2.decode(before));
+  const moved = output !== undefined && (output.name !== props.name || output.containerPath !== path);
+  if (moved && output !== undefined)
+    await assertReplaceable(runner, props, output);
+  const prior = moved ? undefined : output;
+  if (prior === undefined && !(adopt && output === undefined) && liveSha !== undefined && liveSha !== desired2) {
+    throw refuseContainer(props.name, `${path} is already on this host and is not this resource. Remove it, or declare it as a ` + "new resource and deploy with --adopt.");
+  }
+  if (moved && output !== undefined)
+    await deleteContainer(runner, output);
+  const wrote = liveSha !== desired2;
+  const stale = prior !== undefined && prior.containerSha256 !== desired2;
+  const preStatus = await showUnit(runner, serviceName);
+  assertUsable(props, preStatus);
+  const needsReload = wrote || stale || preStatus.needDaemonReload || prior === undefined && needsVerificationReload(path, preStatus);
+  if (wrote)
+    await runner.writeFileAtomic(path, encoder.encode(text), UNIT_WRITE);
+  if (needsReload)
+    await daemonReload(runner);
+  const status = needsReload ? await showUnit(runner, serviceName) : preStatus;
+  try {
+    verifyGenerated(props.name, path, serviceName, status);
+  } catch (cause) {
+    if (wrote) {
+      if (before === undefined)
+        await runner.removeFile(path).catch(() => {
+          return;
+        });
+      else
+        await runner.writeFileAtomic(path, before, UNIT_WRITE).catch(() => {
+          return;
+        });
+      await daemonReload(runner).catch(() => {
+        return;
+      });
+    }
+    throw cause;
+  }
+  const configChanged = prior !== undefined && prior.configSha256 !== configDigest(props.restartOn);
+  const changed = wrote || stale || preStatus.needDaemonReload;
+  return settle(runner, props, configDigest(props.restartOn), {
+    before,
+    changed,
+    configChanged,
+    desired: desired2,
+    path,
+    serviceName,
+    status
+  });
 };
-var sha256Hex = (bytes) => createHash("sha256").update(bytes).digest("hex");
-var renderJob = (props) => {
-  const text = renderPlist(jobPlistDict(props));
-  const bytes = new TextEncoder().encode(text);
-  return { bytes, sha256: sha256Hex(bytes), text };
+var deleteContainer = async (runner, output) => {
+  assertMayWrite(runner, output.name);
+  const status = await showUnit(runner, output.serviceName);
+  if (status.activeState === "active" || status.activeState === "activating") {
+    await stopUnit(runner, output.serviceName);
+  }
+  const stat = await runner.stat(output.containerPath);
+  if (stat !== undefined) {
+    if (stat.kind !== "file")
+      throw refuseContainer(output.name, `${output.containerPath} is a ${stat.kind}`);
+    await runner.removeFile(output.containerPath);
+  }
+  await daemonReload(runner);
 };
 
+// src/linux/container-handlers.ts
+var readHandler = (runner, olds, output) => lift(async () => {
+  const found = await readContainer(runner, olds);
+  if (found === undefined)
+    return;
+  return output === undefined ? Unowned3(found) : found;
+});
+var diffHandler = (runner, instanceId, news, output) => {
+  if (output === undefined)
+    return noteUnfinished(instanceId);
+  if (isResolved2(news))
+    return lift(() => diffContainer(runner, news, output));
+  const name = resolvedString(news, "name");
+  if (name === undefined || name === output.name)
+    return Effect7.succeed(undefined);
+  return lift(async () => {
+    await assertRenameTarget(runner, output, name);
+    return { action: "replace", deleteFirst: true };
+  });
+};
+var reconcileHandler = (runner, args) => Effect7.flatMap(adoptsAtApply(args), (adopt) => lift(() => reconcileContainer(runner, args.news, args.output, adopt)));
+var deleteHandler = (runner, output) => lift(() => deleteContainer(runner, output));
+
+// src/linux/container.ts
+var PodmanContainer = Resource2("Podman.Container");
+var PodmanContainerProvider = () => Provider2.effect(PodmanContainer, Effect8.gen(function* () {
+  const runner = yield* HostRunnerService;
+  return PodmanContainer.Provider.of({
+    list: () => Effect8.succeed([]),
+    read: ({ olds, output }) => readHandler(runner, olds, output),
+    diff: ({ instanceId, news, output }) => diffHandler(runner, instanceId, news, output),
+    reconcile: (args) => reconcileHandler(runner, args),
+    delete: ({ output }) => deleteHandler(runner, output)
+  });
+}));
+
+// src/linux/remote-file.ts
+import { Resource as Resource3 } from "alchemy";
+import { Unowned as Unowned4 } from "alchemy/AdoptPolicy";
+import { isResolved as isResolved3 } from "alchemy/Diff";
+import * as Provider3 from "alchemy/Provider";
+import * as Effect9 from "effect/Effect";
+
 // src/linux/region.ts
 var DEFAULT_COMMENT = "#";
 var tokens = (spec) => {
@@ -726,8 +1258,8 @@ var fileProblems2 = (props) => {
 };
 
 // src/linux/remote-file-plan.ts
-var decoder = new TextDecoder;
-var encoder = new TextEncoder;
+var decoder3 = new TextDecoder;
+var encoder2 = new TextEncoder;
 var refuse3 = (path, message) => new Error(`Remote.File ${path}: ${message}`);
 var numericId2 = (value) => typeof value === "number" ? value : /^\d+$/.test(value) ? Number(value) : undefined;
 var identity = async (runner, props) => {
@@ -748,7 +1280,7 @@ var identity = async (runner, props) => {
   }
   return { ...uid === undefined ? {} : { uid }, ...gid === undefined ? {} : { gid } };
 };
-var digestOf = (text) => sha256Hex(encoder.encode(text));
+var digestOf2 = (text) => sha256Hex(encoder2.encode(text));
 var relocation = (props, output) => {
   if (props.path !== output.path)
     return "path";
@@ -763,16 +1295,16 @@ var ownedDigest = (file, region) => {
   if (file === undefined)
     return;
   if (region === undefined)
-    return digestOf(file);
+    return digestOf2(file);
   const body = readRegion(file, region);
-  return body === undefined ? undefined : digestOf(body);
+  return body === undefined ? undefined : digestOf2(body);
 };
 var readFileAttributes = async (runner, path, region) => {
   const stat = await runner.stat(path);
   if (stat === undefined)
     return;
   const bytes = stat.kind === "file" ? await runner.readFile(path) : undefined;
-  const text = bytes === undefined ? undefined : decoder.decode(bytes);
+  const text = bytes === undefined ? undefined : decoder3.decode(bytes);
   return {
     contentSha256: ownedDigest(text, region) ?? "",
     gid: stat.gid,
@@ -791,13 +1323,13 @@ var planWrite = async (runner, props, want) => {
     throw refuse3(props.path, `is a ${stat.kind}; remove it from whatever owns it before declaring it here`);
   }
   const current = stat === undefined ? undefined : await runner.readFile(props.path);
-  const before = current === undefined ? undefined : decoder.decode(current);
+  const before = current === undefined ? undefined : decoder3.decode(current);
   const declaredMode = props.mode ?? DEFAULT_MODE2;
   if (props.region === undefined) {
     const write = { mode: declaredMode, ...want };
     return {
       before,
-      bytes: encoder.encode(props.content),
+      bytes: encoder2.encode(props.content),
       converged: before === props.content && matches(stat, write),
       write
     };
@@ -808,7 +1340,7 @@ var planWrite = async (runner, props, want) => {
     }
     return {
       before,
-      bytes: encoder.encode(spliceRegion("", props.region, props.content)),
+      bytes: encoder2.encode(spliceRegion("", props.region, props.content)),
       converged: false,
       write: { mode: declaredMode, ...want }
     };
@@ -816,7 +1348,7 @@ var planWrite = async (runner, props, want) => {
   const next = spliceRegion(before, props.region, props.content);
   return {
     before,
-    bytes: encoder.encode(next),
+    bytes: encoder2.encode(next),
     converged: next === before,
     write: { gid: stat?.gid ?? 0, mode: stat?.mode ?? declaredMode, uid: stat?.uid ?? 0 }
   };
@@ -830,7 +1362,7 @@ var diffFile = async (runner, news, output) => {
     return { action: "replace" };
   }
   const planned = await planWrite(runner, news, want);
-  if (planned.converged && output.contentSha256 === digestOf(news.content)) {
+  if (planned.converged && output.contentSha256 === digestOf2(news.content)) {
     return { action: "noop" };
   }
   await runner.checkWrite?.(news.path, planned.write);
@@ -845,7 +1377,7 @@ var reconcileFile = async (runner, props, output, adopt = false) => {
   const prior = move === "none" ? output : undefined;
   const planned = await planWrite(runner, props, want);
   const live = ownedDigest(planned.before, props.region);
-  const declared = digestOf(props.content);
+  const declared = digestOf2(props.content);
   if (prior === undefined && live !== undefined && live !== declared && !(adopt && output === undefined)) {
     throw refuse3(props.path, `${props.region === undefined ? "already exists" : "already carries that managed region"}` + " and is not this resource. Remove it, or declare it as a new resource and deploy --adopt.");
   }
@@ -884,11 +1416,11 @@ var deleteFile = async (runner, output) => {
   const bytes = await runner.readFile(output.path);
   if (bytes === undefined)
     return;
-  const before = decoder.decode(bytes);
+  const before = decoder3.decode(bytes);
   const next = removeRegion(before, output.region);
   if (next === before)
     return;
-  await runner.writeFileAtomic(output.path, encoder.encode(next), {
+  await runner.writeFileAtomic(output.path, encoder2.encode(next), {
     gid: stat.gid,
     mode: stat.mode,
     uid: stat.uid
@@ -896,208 +1428,45 @@ var deleteFile = async (runner, output) => {
 };
 
 // src/linux/remote-file.ts
-var RemoteFile = Resource2("Remote.File");
-var RemoteFileProvider = () => Provider2.effect(RemoteFile, Effect7.gen(function* () {
+var RemoteFile = Resource3("Remote.File");
+var RemoteFileProvider = () => Provider3.effect(RemoteFile, Effect9.gen(function* () {
   const runner = yield* HostRunnerService;
   return RemoteFile.Provider.of({
-    list: () => Effect7.succeed([]),
+    list: () => Effect9.succeed([]),
     read: ({ olds, output }) => lift(async () => {
       const found = await readFileAttributes(runner, olds.path, olds.region);
       if (found === undefined)
         return;
       if (olds.region !== undefined && found.contentSha256 === "")
         return;
-      return output === undefined ? Unowned3(found) : found;
+      return output === undefined ? Unowned4(found) : found;
     }),
     diff: ({ instanceId, news, output }) => {
       if (output === undefined)
         return noteUnfinished(instanceId);
-      if (isResolved2(news))
+      if (isResolved3(news))
         return lift(() => diffFile(runner, news, output));
       const path = resolvedString(news, "path");
-      return Effect7.succeed(path !== undefined && path !== output.path ? { action: "replace" } : undefined);
+      return Effect9.succeed(path !== undefined && path !== output.path ? { action: "replace" } : undefined);
     },
-    reconcile: ({ fqn, instanceId, news, output }) => Effect7.flatMap(adoptsAtApply({ fqn, instanceId, output }), (adopt) => lift(() => reconcileFile(runner, news, output, adopt))),
+    reconcile: ({ fqn, instanceId, news, output }) => Effect9.flatMap(adoptsAtApply({ fqn, instanceId, output }), (adopt) => lift(() => reconcileFile(runner, news, output, adopt))),
     delete: ({ output }) => lift(() => deleteFile(runner, output))
   });
 }));
 
 // src/linux/unit.ts
-import { Resource as Resource3 } from "alchemy";
-import * as Provider3 from "alchemy/Provider";
-import * as Effect9 from "effect/Effect";
+import { Resource as Resource4 } from "alchemy";
+import * as Provider4 from "alchemy/Provider";
+import * as Effect11 from "effect/Effect";
 
 // src/linux/unit-handlers.ts
-import { Unowned as Unowned4 } from "alchemy/AdoptPolicy";
-import { isResolved as isResolved3 } from "alchemy/Diff";
-import * as Effect8 from "effect/Effect";
-
-// src/linux/systemctl.ts
-var SYSTEMCTL = "systemctl";
-var SHOW_PROPERTIES = [
-  "Id",
-  "LoadState",
-  "ActiveState",
-  "SubState",
-  "UnitFileState",
-  "FragmentPath",
-  "NeedDaemonReload"
-];
-
-class SystemctlError extends Error {
-  constructor(command, exitCode, stderr) {
-    super(`systemctl ${command} -> ${String(exitCode)}: ${stderr.trim().slice(0, 300)}`);
-    this.name = "SystemctlError";
-  }
-}
-var parseShow = (stdout) => {
-  const fields = new Map;
-  for (const line of stdout.split(`
-`)) {
-    const at = line.indexOf("=");
-    if (at <= 0)
-      continue;
-    const key = line.slice(0, at);
-    if (!fields.has(key))
-      fields.set(key, line.slice(at + 1));
-  }
-  return fields;
-};
-var statusOf = (stdout) => {
-  const fields = parseShow(stdout);
-  const loadState = fields.get("LoadState") ?? "not-found";
-  const unitFileState = fields.get("UnitFileState") ?? "";
-  const fragmentPath = fields.get("FragmentPath") ?? "";
-  const subState = fields.get("SubState") ?? "";
-  return {
-    activeState: fields.get("ActiveState") ?? "inactive",
-    known: loadState !== "not-found" || unitFileState !== "",
-    loadState,
-    needDaemonReload: fields.get("NeedDaemonReload") === "yes",
-    ...subState === "" ? {} : { subState },
-    ...unitFileState === "" ? {} : { unitFileState },
-    ...fragmentPath === "" ? {} : { fragmentPath }
-  };
-};
-var showUnit = async (runner, name) => {
-  const result = await runner.exec([
-    SYSTEMCTL,
-    "show",
-    "--no-pager",
-    "-p",
-    SHOW_PROPERTIES.join(","),
-    "--",
-    name
-  ]);
-  if (result.exitCode !== 0)
-    throw new SystemctlError(`show ${name}`, result.exitCode, result.stderr);
-  return statusOf(result.stdout);
-};
-var run = async (runner, args) => {
-  const result = await runner.exec([SYSTEMCTL, ...args]);
-  if (result.exitCode !== 0) {
-    throw new SystemctlError(args.join(" "), result.exitCode, result.stderr);
-  }
-};
-var daemonReload = (runner) => run(runner, ["daemon-reload"]);
-var enableUnit = (runner, name) => run(runner, ["enable", "--", name]);
-var disableUnit = (runner, name) => run(runner, ["disable", "--", name]);
-var startUnit = (runner, name) => run(runner, ["start", "--", name]);
-var stopUnit = (runner, name) => run(runner, ["stop", "--", name]);
-var restartUnit = (runner, name) => run(runner, ["restart", "--", name]);
-
-// src/linux/unit-form.ts
-var DEFAULT_UNIT_DIRECTORY = "/etc/systemd/system";
-var UNIT_SEARCH_DIRECTORIES = [
-  "/etc/systemd/system",
-  "/run/systemd/system",
-  "/usr/local/lib/systemd/system",
-  "/usr/lib/systemd/system",
-  "/lib/systemd/system"
-];
-var UNIT_WRITE = { gid: 0, mode: 420, uid: 0 };
-var digestOf2 = (text) => sha256Hex(new TextEncoder().encode(text));
-var configDigest = (restartOn) => digestOf2((restartOn ?? []).join(`
-`));
-var isUnitRunning = (activeState, subState, started) => {
-  if (activeState === "active")
-    return true;
-  if (activeState !== "activating")
-    return false;
-  if (subState === "auto-restart" || subState === "auto-restart-queued")
-    return true;
-  return started;
-};
-var renderUnit = (sections) => `${sections.map((section) => [`[${section.name}]`, ...section.lines.map(([key, value]) => `${key}=${value}`)].join(`
-`)).join(`
-
-`)}
-`;
-var unitText = (props) => props.content ?? renderUnit(props.sections ?? []);
-var unitPathFor = (props) => `${props.directory ?? DEFAULT_UNIT_DIRECTORY}/${props.name}`;
-var NAME = /^[A-Za-z0-9][A-Za-z0-9_.@:-]*\.([a-z]+)$/;
-var TYPES = new Set([
-  "automount",
-  "device",
-  "mount",
-  "path",
-  "scope",
-  "service",
-  "slice",
-  "socket",
-  "swap",
-  "target",
-  "timer"
-]);
-var INSTALL_KEYS = new Set(["WantedBy", "RequiredBy", "UpsertedBy", "Also", "Alias"]);
-var unitProblems = (props, expect) => {
-  const found = [];
-  const type = NAME.exec(props.name)?.[1];
-  if (type === undefined || !TYPES.has(type)) {
-    found.push(`name must be <unit>.<type> with a systemd unit type, got ${JSON.stringify(props.name)}`);
-  } else if (expect !== undefined && type !== expect) {
-    found.push(`this resource declares a .${expect} unit; ${props.name} is a .${type}`);
-  }
-  if (props.content === undefined === (props.sections === undefined)) {
-    found.push("declare exactly one of content or sections");
-  }
-  const directory = props.directory ?? DEFAULT_UNIT_DIRECTORY;
-  if (!directory.startsWith("/") || directory.endsWith("/") || directory.includes("/..")) {
-    found.push("directory must be an absolute, normalised path with no trailing slash");
-  }
-  found.push(...textProblems(unitText(props)));
-  if (props.enabled !== false && !UNIT_SEARCH_DIRECTORIES.includes(directory)) {
-    found.push(`an enabled unit must live where systemd looks for it by name (${UNIT_SEARCH_DIRECTORIES.join(", ")}); ` + `${directory} is not one of them. Move it, or declare enabled: false.`);
-  }
-  if (props.enabled !== false && !hasInstall(props)) {
-    found.push("enabled units need an [Install] section with WantedBy/RequiredBy/Also/Alias; without one " + 'systemd calls the unit "static" and `systemctl enable` has nothing to link. Add one, or ' + "declare enabled: false and let something else pull it in.");
-  }
-  if (type === "timer" && !unitText(props).includes("[Timer]")) {
-    found.push("a .timer needs a [Timer] section");
-  }
-  return found;
-};
-var hasInstall = (props) => {
-  const text = unitText(props);
-  if (!text.includes("[Install]"))
-    return false;
-  const after = text.slice(text.indexOf("[Install]"));
-  return [...INSTALL_KEYS].some((key) => new RegExp(`^${key}=`, "m").test(after));
-};
-var textProblems = (text) => {
-  const found = [];
-  if (text.trim() === "")
-    found.push("the unit file is empty");
-  if (text.includes("\x00"))
-    found.push("the unit file contains NUL");
-  if (!/^\s*\[[A-Za-z]+]/.test(text))
-    found.push("a unit file must begin with a [Section]");
-  return found;
-};
+import { Unowned as Unowned5 } from "alchemy/AdoptPolicy";
+import { isResolved as isResolved4 } from "alchemy/Diff";
+import * as Effect10 from "effect/Effect";
 
 // src/linux/unit-settle.ts
 var refuse4 = (name, message) => new Error(`Systemd.Unit ${name}: ${message}`);
-var attributesOf = (props, unitSha256, status) => ({
+var attributesOf2 = (props, unitSha256, status) => ({
   active: status.activeState === "active" || status.activeState === "activating",
   activeState: status.activeState,
   configSha256: configDigest(props.restartOn),
@@ -1108,7 +1477,7 @@ var attributesOf = (props, unitSha256, status) => ({
   unitSha256,
   ...status.unitFileState === undefined ? {} : { unitFileState: status.unitFileState }
 });
-var settle = async (runner, props, step) => {
+var settle2 = async (runner, props, step) => {
   const wantEnabled = props.enabled !== false;
   const wantStarted = props.started !== false;
   const isEnabled = step.status.unitFileState === "enabled" || step.status.unitFileState === "enabled-runtime";
@@ -1143,7 +1512,7 @@ var settle = async (runner, props, step) => {
   if (wantStarted && !isUnitRunning(after.activeState, after.subState, wantStarted)) {
     return undo(`systemctl reported success but the unit is ${after.activeState}.`);
   }
-  const settled = attributesOf(props, step.desired, after);
+  const settled = attributesOf2(props, step.desired, after);
   if (wantEnabled && !settled.enabled) {
     return undo(`systemctl enable reported success but systemd calls the unit ` + `${JSON.stringify(after.unitFileState ?? "")}, not enabled.`);
   }
@@ -1151,61 +1520,61 @@ var settle = async (runner, props, step) => {
 };
 
 // src/linux/unit-preflight.ts
-var decoder2 = new TextDecoder;
-var assertValid = (props, expect) => {
+var decoder4 = new TextDecoder;
+var assertValid2 = (props, expect) => {
   const found = unitProblems(props, expect);
   if (found.length > 0)
     throw refuse4(props.name, found.join("; "));
 };
-var assertMayWrite = (runner, name) => {
+var assertMayWrite2 = (runner, name) => {
   if (canActAsRoot(runner))
     return;
   throw refuse4(name, "a systemd unit is root-owned and systemctl needs root. Point the runner at a destination " + "whose ssh user is root, or provide a privileged HostRunner. This provider never calls sudo.");
 };
-var assertUsable = (props, status) => {
+var assertUsable2 = (props, status) => {
   if (status.loadState === "masked" || status.unitFileState === "masked") {
     throw refuse4(props.name, "is masked. If that is stale, `systemctl unmask` it deliberately, then redeploy. Nothing " + "was written.");
   }
 };
-var assertUnclaimed = async (runner, props) => {
+var assertUnclaimed2 = async (runner, props) => {
   const path = unitPathFor(props);
   const bytes = await runner.readFile(path);
-  const live = bytes === undefined ? undefined : digestOf2(decoder2.decode(bytes));
-  if (live !== undefined && live !== digestOf2(unitText(props))) {
+  const live = bytes === undefined ? undefined : digestOf(decoder4.decode(bytes));
+  if (live !== undefined && live !== digestOf(unitText(props))) {
     throw refuse4(props.name, `${path} is already on this host and is not this resource. Remove it, or declare it as a ` + "new resource and deploy with --adopt.");
   }
 };
-var assertRenameTarget = async (runner, old, name) => {
-  assertMayWrite(runner, old.name);
-  assertMayWrite(runner, name);
-  assertUsable({ name }, await showUnit(runner, name));
+var assertRenameTarget2 = async (runner, old, name) => {
+  assertMayWrite2(runner, old.name);
+  assertMayWrite2(runner, name);
+  assertUsable2({ name }, await showUnit(runner, name));
 };
-var assertReplaceable = async (runner, next, old, expect) => {
-  assertValid(next, expect);
-  await assertRenameTarget(runner, old, next.name);
-  await assertUnclaimed(runner, next);
+var assertReplaceable2 = async (runner, next, old, expect) => {
+  assertValid2(next, expect);
+  await assertRenameTarget2(runner, old, next.name);
+  await assertUnclaimed2(runner, next);
   await runner.checkWrite?.(unitPathFor(next), UNIT_WRITE);
 };
 
 // src/linux/unit-lifecycle.ts
-var encoder2 = new TextEncoder;
-var decoder3 = new TextDecoder;
+var encoder3 = new TextEncoder;
+var decoder5 = new TextDecoder;
 var readUnit = async (runner, props) => {
   const bytes = await runner.readFile(unitPathFor(props));
   const status = await showUnit(runner, props.name);
   if (bytes === undefined && !status.known)
     return;
-  return attributesOf(props, bytes === undefined ? "" : digestOf2(decoder3.decode(bytes)), status);
+  return attributesOf2(props, bytes === undefined ? "" : digestOf(decoder5.decode(bytes)), status);
 };
 var diffUnit = async (runner, news, output, expect) => {
-  assertValid(news, expect);
+  assertValid2(news, expect);
   if (news.name !== output.name || unitPathFor(news) !== output.unitPath) {
-    await assertReplaceable(runner, news, output, expect);
+    await assertReplaceable2(runner, news, output, expect);
     return { action: "replace", deleteFirst: true };
   }
-  const desired2 = digestOf2(unitText(news));
+  const desired2 = digestOf(unitText(news));
   const update = async () => {
-    assertMayWrite(runner, news.name);
+    assertMayWrite2(runner, news.name);
     await runner.checkWrite?.(unitPathFor(news), UNIT_WRITE);
     return { action: "update" };
   };
@@ -1226,18 +1595,18 @@ var diffUnit = async (runner, news, output, expect) => {
   return status.needDaemonReload ? update() : { action: "noop" };
 };
 var reconcileUnit = async (runner, props, output, adopt = false, expect) => {
-  assertValid(props, expect);
-  assertMayWrite(runner, props.name);
+  assertValid2(props, expect);
+  assertMayWrite2(runner, props.name);
   const path = unitPathFor(props);
   const status = await showUnit(runner, props.name);
-  assertUsable(props, status);
+  assertUsable2(props, status);
   const text = unitText(props);
-  const desired2 = digestOf2(text);
+  const desired2 = digestOf(text);
   const before = await runner.readFile(path);
-  const liveSha = before === undefined ? undefined : digestOf2(decoder3.decode(before));
+  const liveSha = before === undefined ? undefined : digestOf(decoder5.decode(before));
   const moved = output !== undefined && (output.name !== props.name || output.unitPath !== path);
   if (moved && output !== undefined)
-    await assertReplaceable(runner, props, output, expect);
+    await assertReplaceable2(runner, props, output, expect);
   const prior = moved ? undefined : output;
   if (prior === undefined && !(adopt && output === undefined) && liveSha !== undefined && liveSha !== desired2) {
     throw refuse4(props.name, `${path} is already on this host and is not this resource. Remove it, or declare it as a ` + "new resource and deploy with --adopt.");
@@ -1248,14 +1617,14 @@ var reconcileUnit = async (runner, props, output, adopt = false, expect) => {
   const stale = prior !== undefined && prior.unitSha256 !== desired2;
   const configChanged = prior !== undefined && prior.configSha256 !== configDigest(props.restartOn);
   if (wrote)
-    await runner.writeFileAtomic(path, encoder2.encode(text), UNIT_WRITE);
+    await runner.writeFileAtomic(path, encoder3.encode(text), UNIT_WRITE);
   if (wrote || status.needDaemonReload)
     await daemonReload(runner);
   const changed = wrote || stale || status.needDaemonReload;
-  return settle(runner, props, { before, changed, configChanged, desired: desired2, path, status });
+  return settle2(runner, props, { before, changed, configChanged, desired: desired2, path, status });
 };
 var deleteUnit = async (runner, output) => {
-  assertMayWrite(runner, output.name);
+  assertMayWrite2(runner, output.name);
   const status = await showUnit(runner, output.name);
   if (status.activeState === "active" || status.activeState === "activating") {
     await stopUnit(runner, output.name);
@@ -1273,54 +1642,54 @@ var deleteUnit = async (runner, output) => {
 };
 
 // src/linux/unit-handlers.ts
-var readHandler = (runner, olds, output) => lift(async () => {
+var readHandler2 = (runner, olds, output) => lift(async () => {
   const found = await readUnit(runner, olds);
   if (found === undefined)
     return;
-  return output === undefined ? Unowned4(found) : found;
+  return output === undefined ? Unowned5(found) : found;
 });
-var diffHandler = (runner, instanceId, news, output, expect) => {
+var diffHandler2 = (runner, instanceId, news, output, expect) => {
   if (output === undefined)
     return noteUnfinished(instanceId);
-  if (isResolved3(news))
+  if (isResolved4(news))
     return lift(() => diffUnit(runner, news, output, expect));
   const name = resolvedString(news, "name");
   if (name === undefined || name === output.name)
-    return Effect8.succeed(undefined);
+    return Effect10.succeed(undefined);
   return lift(async () => {
-    await assertRenameTarget(runner, output, name);
+    await assertRenameTarget2(runner, output, name);
     return { action: "replace", deleteFirst: true };
   });
 };
-var reconcileHandler = (runner, args, expect) => Effect8.flatMap(adoptsAtApply(args), (adopt) => lift(() => reconcileUnit(runner, args.news, args.output, adopt, expect)));
-var deleteHandler = (runner, output) => lift(() => deleteUnit(runner, output));
+var reconcileHandler2 = (runner, args, expect) => Effect10.flatMap(adoptsAtApply(args), (adopt) => lift(() => reconcileUnit(runner, args.news, args.output, adopt, expect)));
+var deleteHandler2 = (runner, output) => lift(() => deleteUnit(runner, output));
 
 // src/linux/unit.ts
-var SystemdUnit = Resource3("Systemd.Unit");
-var SystemdTimer = Resource3("Systemd.Timer");
-var SystemdUnitProvider = () => Provider3.effect(SystemdUnit, Effect9.gen(function* () {
+var SystemdUnit = Resource4("Systemd.Unit");
+var SystemdTimer = Resource4("Systemd.Timer");
+var SystemdUnitProvider = () => Provider4.effect(SystemdUnit, Effect11.gen(function* () {
   const runner = yield* HostRunnerService;
   return SystemdUnit.Provider.of({
-    list: () => Effect9.succeed([]),
-    read: ({ olds, output }) => readHandler(runner, olds, output),
-    diff: ({ instanceId, news, output }) => diffHandler(runner, instanceId, news, output),
-    reconcile: (args) => reconcileHandler(runner, args),
-    delete: ({ output }) => deleteHandler(runner, output)
+    list: () => Effect11.succeed([]),
+    read: ({ olds, output }) => readHandler2(runner, olds, output),
+    diff: ({ instanceId, news, output }) => diffHandler2(runner, instanceId, news, output),
+    reconcile: (args) => reconcileHandler2(runner, args),
+    delete: ({ output }) => deleteHandler2(runner, output)
   });
 }));
-var SystemdTimerProvider = () => Provider3.effect(SystemdTimer, Effect9.gen(function* () {
+var SystemdTimerProvider = () => Provider4.effect(SystemdTimer, Effect11.gen(function* () {
   const runner = yield* HostRunnerService;
   return SystemdTimer.Provider.of({
-    list: () => Effect9.succeed([]),
-    read: ({ olds, output }) => readHandler(runner, olds, output),
-    diff: ({ instanceId, news, output }) => diffHandler(runner, instanceId, news, output, "timer"),
-    reconcile: (args) => reconcileHandler(runner, args, "timer"),
-    delete: ({ output }) => deleteHandler(runner, output)
+    list: () => Effect11.succeed([]),
+    read: ({ olds, output }) => readHandler2(runner, olds, output),
+    diff: ({ instanceId, news, output }) => diffHandler2(runner, instanceId, news, output, "timer"),
+    reconcile: (args) => reconcileHandler2(runner, args, "timer"),
+    delete: ({ output }) => deleteHandler2(runner, output)
   });
 }));
 
 // src/linux/providers.ts
-var linuxProviders = (runner) => Layer2.mergeAll(HostDirectoryProvider(), RemoteFileProvider(), SystemdTimerProvider(), SystemdUnitProvider()).pipe(Layer2.provide(hostRunnerLayer(runner)));
+var linuxProviders = (runner) => Layer2.mergeAll(HostDirectoryProvider(), PodmanContainerProvider(), RemoteFileProvider(), SystemdTimerProvider(), SystemdUnitProvider()).pipe(Layer2.provide(hostRunnerLayer(runner)));
 // src/linux/ssh-runner.ts
 import { spawn } from "node:child_process";
 import { randomBytes } from "node:crypto";
@@ -2726,6 +3095,10 @@ export {
   HostDirectory,
   HostDirectoryProvider,
   HostRunnerService,
+  PodmanContainer,
+  PodmanContainerProvider,
+  QUADLET_DEFAULT_DIRECTORY,
+  QUADLET_SEARCH_DIRECTORIES,
   RemoteFile,
   RemoteFileProvider,
   SystemdTimer,
@@ -2740,5 +3113,5 @@ export {
   sshSudoRunner
 };
 
-//# debugId=19CF970890A2548664756E2164756E21
+//# debugId=1EC8A0E327D500A164756E2164756E21
 //# sourceMappingURL=index.js.map