libre-webui 0.19.5 → 0.20.0

package/backend/dist/services/workRuntimeService.js

@@ -14,83 +14,26 @@
  * See the License for the specific language governing permissions and
  * limitations under the License.
  */
-import { spawn } from 'node:child_process';
-import { createHash } from 'node:crypto';
 import path from 'node:path';
 import { getDatabase } from '../db.js';
 import { createLogger } from '../utils/logger.js';
 import { buildWorkGitCommand, parseWorkGitBranches, parseWorkGitLog, parseWorkGitStatus, validateWorkGitBranchName, validateWorkGitRepositoryPaths, } from '../utils/workGit.js';
+import { userHasWorkAccess } from './workAccessService.js';
+import workPolicyService from './workPolicyService.js';
 import workPreviewProxyService from './workPreviewProxyService.js';
+import workTaskService from './workTaskService.js';
+import { KubernetesWorkRuntimeDriver } from './workKubernetesDriver.js';
+import { DockerWorkRuntimeDriver, } from './workRuntimeDriver.js';
+import { WorkRuntimeError, workRuntimeConfig as config, } from './workRuntimeShared.js';
+// The public surface of the Work runtime is unchanged by the driver split:
+// consumers and tests keep importing everything from this module.
+export { WORK_RUNTIME_ADMISSION_DEFAULTS, WORK_RUNTIME_DEFAULTS, WorkRuntimeError, parseDnsServers, } from './workRuntimeShared.js';
+export { DockerWorkRuntimeDriver, buildWorkContainerRunArgs, describeDockerUnavailable, formatPreviewHost, parseManagedContainerList, parsePublishedPort, } from './workRuntimeDriver.js';
 const logger = createLogger('services:work-runtime');
-const activeDockerProcesses = new Set();
-export const WORK_RUNTIME_DEFAULTS = {
-    image: 'node:22.22-bookworm@sha256:2d178f2785b96dfbf62a416ca2e40f50e30150b4ff3320d706f0d96e90600eb3',
-    dockerCommand: 'docker',
-    commandTimeoutMs: 120000,
-    maxOutputChars: 50000,
-    maxAgentRounds: 48,
-    memoryLimit: '2g',
-    cpuLimit: '2',
-    pidsLimit: 256,
-    previewPort: 4173,
-    previewBind: '127.0.0.1',
-    networkName: 'libre-webui-work',
-};
-// Two runtimes per administrator so a second task does not have to wait for
-// the first, three per instance to bound the worst case at three containers'
-// resource caps. Both remain tunable through WORK_MAX_ACTIVE_RUNTIMES_*.
-export const WORK_RUNTIME_ADMISSION_DEFAULTS = {
-    maxActiveRuntimesGlobal: 3,
-    maxActiveRuntimesPerUser: 2,
-};
-const config = {
-    image: process.env.WORK_RUNTIME_IMAGE || WORK_RUNTIME_DEFAULTS.image,
-    dockerCommand: process.env.WORK_DOCKER_COMMAND || WORK_RUNTIME_DEFAULTS.dockerCommand,
-    commandTimeoutMs: positiveInteger(process.env.WORK_COMMAND_TIMEOUT_MS, WORK_RUNTIME_DEFAULTS.commandTimeoutMs),
-    maxOutputChars: positiveInteger(process.env.WORK_MAX_OUTPUT_CHARS, WORK_RUNTIME_DEFAULTS.maxOutputChars),
-    maxAgentRounds: positiveInteger(process.env.WORK_MAX_AGENT_ROUNDS, WORK_RUNTIME_DEFAULTS.maxAgentRounds),
-    memoryLimit: process.env.WORK_MEMORY_LIMIT || WORK_RUNTIME_DEFAULTS.memoryLimit,
-    cpuLimit: process.env.WORK_CPU_LIMIT || WORK_RUNTIME_DEFAULTS.cpuLimit,
-    pidsLimit: positiveInteger(process.env.WORK_PIDS_LIMIT, WORK_RUNTIME_DEFAULTS.pidsLimit),
-    previewPort: positiveInteger(process.env.WORK_PREVIEW_PORT, WORK_RUNTIME_DEFAULTS.previewPort),
-    // Interface the daemon publishes a task preview on. Loopback keeps a preview
-    // private to the Docker host, which is correct when the browser runs there.
-    previewBind: process.env.WORK_PREVIEW_BIND || WORK_RUNTIME_DEFAULTS.previewBind,
-    maxActiveRuntimesGlobal: positiveInteger(process.env.WORK_MAX_ACTIVE_RUNTIMES_GLOBAL, WORK_RUNTIME_ADMISSION_DEFAULTS.maxActiveRuntimesGlobal),
-    maxActiveRuntimesPerUser: positiveInteger(process.env.WORK_MAX_ACTIVE_RUNTIMES_PER_USER, WORK_RUNTIME_ADMISSION_DEFAULTS.maxActiveRuntimesPerUser),
-    // Dedicated bridge network for networked Work tasks. It is created with
-    // inter-container communication disabled, so a sandbox cannot reach other
-    // Work sandboxes or the deployment's own containers on the default bridge.
-    networkName: process.env.WORK_NETWORK_NAME || WORK_RUNTIME_DEFAULTS.networkName,
-    // Optional resolvers forced onto every networked sandbox. Pointing this at
-    // a filtering resolver is the supported egress-policy hook.
-    dnsServers: parseDnsServers(process.env.WORK_RUNTIME_DNS),
-};
 const PREVIEW_READY_TIMEOUT_MS = 15000;
 const PREVIEW_POLL_INTERVAL_MS = 250;
-const runtimePolicyFingerprint = createHash('sha256')
-    .update(JSON.stringify({
-    version: 2,
-    memoryLimit: config.memoryLimit,
-    cpuLimit: config.cpuLimit,
-    pidsLimit: config.pidsLimit,
-    previewPort: config.previewPort,
-    previewBind: config.previewBind,
-    networkName: config.networkName,
-    dnsServers: config.dnsServers,
-    memorySwapPinned: true,
-}))
-    .digest('hex');
-export class WorkRuntimeError extends Error {
-    constructor(message, status = 503, code = 'WORK_RUNTIME_UNAVAILABLE') {
-        super(message);
-        this.name = 'WorkRuntimeError';
-        this.status = status;
-        this.code = code;
-    }
-}
 export class WorkRuntimeService {
-    constructor() {
+    constructor(driver = new DockerWorkRuntimeDriver()) {
         this.image = config.image;
         this.previewPort = config.previewPort;
         this.limits = {
@@ -100,6 +43,7 @@ export class WorkRuntimeService {
             maxActiveRuntimesGlobal: config.maxActiveRuntimesGlobal,
             maxActiveRuntimesPerUser: config.maxActiveRuntimesPerUser,
         };
+        this.imagePreparations = new Map();
         this.lifecycleTails = new Map();
         this.preparations = new Map();
         this.retiringTasks = new Set();
@@ -110,13 +54,33 @@ export class WorkRuntimeService {
         this.previewLeaseReleases = new Map();
         this.terminalHolds = new Map();
         this.recoveryTasks = new Map();
+        this.recoveryOrphans = new Map();
+        // Sweeps left for the empty-inventory case before giving up on a daemon
+        // that never appears (30 × 10s: covers a socket proxy starting late
+        // without probing a Docker-less deployment forever).
+        this.emptyInventorySweepsLeft = 30;
         this.shuttingDown = false;
+        // Last observed activity per task, feeding the idle sweep: a finished
+        // command, a terminal session ending, or a preview fetch. In-memory only —
+        // after a restart the clock restarts from the first sighting.
+        this.taskActivity = new Map();
+        this.driver = driver;
+        // Authorized preview traffic keeps its task's idle clock fresh.
+        workPreviewProxyService.onPreviewActivity(taskId => this.noteTaskActivity(taskId));
+        this.scheduleIdleSweep();
+    }
+    noteTaskActivity(taskId) {
+        this.taskActivity.set(taskId, Date.now());
     }
     get recoveryPending() {
-        return this.recoveryTasks.size > 0;
+        return this.recoveryPendingCount > 0;
     }
     get recoveryPendingCount() {
-        return this.recoveryTasks.size;
+        // Before reconciliation has run, every inventoried task counts as
+        // pending: nothing has been proven about its container yet.
+        return ((this.recoveryInventory?.length ?? 0) +
+            this.recoveryTasks.size +
+            this.recoveryOrphans.size);
     }
     assertAcceptingWork() {
         if (this.shuttingDown) {
@@ -128,14 +92,13 @@ export class WorkRuntimeService {
     }
     async isDockerAvailable() {
         try {
-            await this.docker(['info', '--format', '{{.ServerVersion}}'], {
-                timeoutMs: 5000,
-            });
+            await this.driver.probe();
             this.lastDockerUnavailableReason = null;
             return true;
         }
         catch (error) {
-            this.lastDockerUnavailableReason = describeDockerUnavailable(error, config.dockerCommand);
+            this.lastDockerUnavailableReason =
+                error instanceof Error ? error.message : String(error);
             return false;
         }
     }
@@ -162,9 +125,7 @@ export class WorkRuntimeService {
         return { global: this.runtimeLeases.size, user };
     }
     async beginRecovery(tasks) {
-        for (const task of tasks) {
-            this.recoveryTasks.set(task.id, task);
-        }
+        this.recoveryInventory = tasks;
         const result = await this.sweepRecoveryTasks();
         this.scheduleRecoverySweep();
         return result;
@@ -233,7 +194,7 @@ export class WorkRuntimeService {
         }
         let tracked;
         tracked = (async () => {
-            await waitForAbortSignal(this.ensureImage(), signal);
+            await waitForAbortSignal(this.ensureImage(task), signal);
             this.assertTaskIsActive(task);
             await this.withLifecycleLock(task.id, async () => {
                 this.assertTaskIsActive(task);
@@ -272,6 +233,7 @@ export class WorkRuntimeService {
             if (released)
                 return;
             released = true;
+            this.noteTaskActivity(task.id);
             const remaining = (this.terminalHolds.get(task.id) ?? 1) - 1;
             if (remaining <= 0) {
                 this.terminalHolds.delete(task.id);
@@ -301,9 +263,11 @@ export class WorkRuntimeService {
             clearTimeout(this.recoveryTimer);
             this.recoveryTimer = undefined;
         }
-        for (const child of activeDockerProcesses) {
-            child.kill('SIGKILL');
+        if (this.idleTimer) {
+            clearTimeout(this.idleTimer);
+            this.idleTimer = undefined;
         }
+        this.driver.shutdown();
     }
     beginTaskSuspension(taskId) {
         if (this.retiringTasks.has(taskId)) {
@@ -315,16 +279,63 @@ export class WorkRuntimeService {
         this.retiringTasks.delete(taskId);
     }
     async sweepRecoveryTasks() {
-        if (this.recoveryTasks.size === 0) {
+        if (this.recoveryInventory === undefined &&
+            this.recoveryTasks.size === 0 &&
+            this.recoveryOrphans.size === 0) {
             return { stopped: 0, failed: 0 };
         }
         if (this.shuttingDown || !(await this.isDockerAvailable())) {
-            return { stopped: 0, failed: this.recoveryTasks.size };
+            if (this.recoveryInventory?.length === 0) {
+                // No tasks to supervise, so nothing fail-closes — but leftover
+                // containers may still exist (a restored database, a daemon or
+                // socket proxy that comes up after the backend). Keep retrying the
+                // reconciliation quietly for a bounded window, then give up so a
+                // deployment without Docker is not probed forever.
+                if (this.shuttingDown || this.emptyInventorySweepsLeft <= 0) {
+                    this.recoveryInventory = undefined;
+                    return { stopped: 0, failed: 0 };
+                }
+                this.emptyInventorySweepsLeft -= 1;
+                return { stopped: 0, failed: 0 };
+            }
+            return { stopped: 0, failed: this.recoveryPendingCount };
+        }
+        if (this.recoveryInventory !== undefined) {
+            // Reconcile against what actually exists instead of stopping every
+            // known task blind: one labeled listing decides which containers are
+            // running unsupervised, which are at rest, and which are orphans left
+            // by a task whose database row is gone.
+            let discovered;
+            try {
+                discovered = await this.driver.listManaged();
+            }
+            catch (error) {
+                logger.warn('Could not list Work containers for startup reconciliation:', error);
+                return { stopped: 0, failed: this.recoveryPendingCount };
+            }
+            const plan = planStartupReconciliation(this.recoveryInventory, discovered);
+            for (const task of plan.stop) {
+                this.recoveryTasks.set(task.id, task);
+            }
+            for (const orphan of plan.removeOrphans) {
+                this.recoveryOrphans.set(orphan.name, orphan);
+            }
+            await this.reportOrphanWorkspaces(this.recoveryInventory);
+            this.recoveryInventory = undefined;
+            if (this.recoveryPendingCount > 0 || plan.atRest > 0) {
+                logger.info(`Work startup reconciliation: ${plan.stop.length} running container(s) to stop, ` +
+                    `${plan.removeOrphans.length} orphaned container(s) to remove, ` +
+                    `${plan.atRest} container(s) already at rest.`);
+            }
         }
         const tasks = [...this.recoveryTasks.values()];
-        const results = await Promise.allSettled(tasks.map(task => this.stopContainer(task)));
+        const orphans = [...this.recoveryOrphans.values()];
+        const [taskResults, orphanResults] = await Promise.all([
+            Promise.allSettled(tasks.map(task => this.stopContainer(task))),
+            Promise.allSettled(orphans.map(orphan => this.driver.removeOrphan(orphan.name))),
+        ]);
         let stopped = 0;
-        results.forEach((result, index) => {
+        taskResults.forEach((result, index) => {
             if (result.status === 'fulfilled') {
                 this.recoveryTasks.delete(tasks[index].id);
                 stopped += 1;
@@ -333,14 +344,135 @@ export class WorkRuntimeService {
                 logger.warn(`Could not stop Work container ${tasks[index].containerName} during recovery:`, result.reason);
             }
         });
-        if (this.recoveryTasks.size === 0) {
+        orphanResults.forEach((result, index) => {
+            if (result.status === 'fulfilled') {
+                this.recoveryOrphans.delete(orphans[index].name);
+                stopped += 1;
+            }
+            else {
+                logger.warn(`Could not remove orphaned Work container ${orphans[index].name} during recovery:`, result.reason);
+            }
+        });
+        if (this.recoveryPendingCount === 0 && (tasks.length || orphans.length)) {
             logger.info('Work startup container recovery completed.');
         }
-        return { stopped, failed: this.recoveryTasks.size };
+        return { stopped, failed: this.recoveryPendingCount };
+    }
+    /**
+     * Workspaces whose task record no longer exists are reported, never
+     * auto-deleted: a workspace is the durable half of a task, so removal is
+     * always an explicit operator decision.
+     */
+    async reportOrphanWorkspaces(inventory) {
+        if (!this.driver.listWorkspaces)
+            return;
+        try {
+            const known = new Set(inventory.map(task => task.id));
+            const orphaned = (await this.driver.listWorkspaces()).filter(workspace => !known.has(workspace.taskId));
+            if (orphaned.length > 0) {
+                logger.warn(`Work found ${orphaned.length} workspace(s) with no task record, left in place: ` +
+                    orphaned.map(workspace => workspace.name).join(', '));
+            }
+        }
+        catch (error) {
+            logger.warn('Could not list Work workspaces for orphan reporting:', error);
+        }
+    }
+    /**
+     * Stop sandboxes that have seen no activity — no command finished, no
+     * terminal attached, no preview fetch — for WORK_RUNTIME_IDLE_TIMEOUT_MS.
+     * Stopping is cheap and the workspace persists, so the sweep only spends
+     * an admission slot holder that nobody is using. Busy tasks (active
+     * command, terminal, or a non-preview operation lease) refresh their
+     * clock instead of being considered. A running sandbox seen for the
+     * first time starts its clock at the sighting rather than being stopped
+     * on a guess.
+     */
+    async sweepIdleRuntimes(now = Date.now()) {
+        if (this.shuttingDown || this.recoveryPending) {
+            return { stopped: 0 };
+        }
+        // Idle-stop can come from the global knob or from any named policy.
+        if (config.idleTimeoutMs <= 0 &&
+            !workPolicyService.anyIdleTimeoutConfigured()) {
+            return { stopped: 0 };
+        }
+        let discovered;
+        try {
+            discovered = await this.driver.listManaged();
+        }
+        catch {
+            // The runtime is unreachable; nothing can be stopped anyway.
+            return { stopped: 0 };
+        }
+        const records = new Map(workTaskService.listAllTaskRecords().map(task => [task.id, task]));
+        let stopped = 0;
+        for (const entry of discovered) {
+            if (!entry.running)
+                continue;
+            const task = records.get(entry.taskId);
+            // Containers without a task row are startup reconciliation's business.
+            if (!task)
+                continue;
+            const busy = this.activeCommands.has(task.id) ||
+                (this.terminalHolds.get(task.id) ?? 0) > 0 ||
+                (this.runtimeLeases.has(task.id) &&
+                    !this.previewLeaseReleases.has(task.id));
+            const lastActivity = this.taskActivity.get(task.id);
+            if (busy || lastActivity === undefined) {
+                this.noteTaskActivity(task.id);
+                continue;
+            }
+            const idleAfterMs = workPolicyService.resolve(task.policyId).idleTimeoutMs;
+            if (idleAfterMs <= 0 || now - lastActivity < idleAfterMs)
+                continue;
+            try {
+                if (this.previewLeaseReleases.has(task.id)) {
+                    await this.stopPreview(task, {
+                        onStopped: () => workTaskService.updatePreview(task.id, 'stopped'),
+                    });
+                }
+                else {
+                    await this.stopContainer(task);
+                }
+                this.taskActivity.delete(task.id);
+                stopped += 1;
+                logger.info(`Stopped idle Work sandbox ${task.containerName} after ${idleAfterMs}ms of inactivity.`);
+            }
+            catch (error) {
+                logger.warn(`Could not stop idle Work sandbox ${task.containerName}:`, error);
+            }
+        }
+        return { stopped };
+    }
+    scheduleIdleSweep() {
+        if (this.shuttingDown || this.idleTimer) {
+            return;
+        }
+        // Policies can enable idle-stop at runtime even when the global knob is
+        // off, so the timer always runs; the sweep itself exits in one cheap
+        // query when nothing configures a timeout. With a global timeout the
+        // interval sits well inside it, so an idle sandbox overshoots its
+        // deadline by a fraction, not a multiple.
+        const interval = config.idleTimeoutMs > 0
+            ? Math.max(15000, Math.min(60000, Math.floor(config.idleTimeoutMs / 4)))
+            : 60000;
+        this.idleTimer = setTimeout(() => {
+            this.idleTimer = undefined;
+            void this.sweepIdleRuntimes()
+                .catch(error => {
+                logger.warn('Work idle sweep failed:', error);
+            })
+                .finally(() => {
+                this.scheduleIdleSweep();
+            });
+        }, interval);
+        this.idleTimer.unref();
     }
     scheduleRecoverySweep() {
         if (this.shuttingDown ||
-            this.recoveryTasks.size === 0 ||
+            (this.recoveryPendingCount === 0 &&
+                this.recoveryInventory === undefined) ||
             this.recoveryTimer) {
             return;
         }
@@ -363,7 +495,7 @@ export class WorkRuntimeService {
     }
     completeRecoveryTask(taskId) {
         const removed = this.recoveryTasks.delete(taskId);
-        if (removed && this.recoveryTasks.size === 0) {
+        if (removed && this.recoveryPendingCount === 0) {
             logger.info('Pending Work container cleanup completed.');
         }
     }
@@ -383,72 +515,19 @@ export class WorkRuntimeService {
         this.assertRuntimeLease(task);
         this.assertCurrentNetworkPolicy(task);
         this.assertTaskIsActive(task);
-        await this.ensureVolume(task);
+        await this.driver.ensureWorkspace(task);
         this.assertTaskIsActive(task);
-        await this.ensureContainer(task);
+        this.assertRuntimeLease(task);
+        await this.driver.ensureRuntime(task);
         if (this.shuttingDown) {
             await this.stopContainerWithLock(task);
             this.assertTaskIsActive(task);
         }
     }
-    async ensureWorkNetwork(task) {
-        if (!task.networkEnabled)
-            return;
-        const inspect = await this.docker([
-            'network',
-            'inspect',
-            '--format',
-            '{{index .Labels "ai.libre-webui.managed"}} {{index .Options "com.docker.network.bridge.enable_icc"}}',
-            config.networkName,
-        ], { acceptFailure: true });
-        if (inspect.exitCode === 0) {
-            const [managed, icc] = inspect.stdout.trim().split(' ');
-            if (managed !== 'true' || icc !== 'false') {
-                throw new WorkRuntimeError(`Docker network "${config.networkName}" exists but is not the managed Work sandbox network (label ai.libre-webui.managed=true with inter-container communication disabled). Remove it or point WORK_NETWORK_NAME at an unused name.`, 503, 'WORK_NETWORK_CONFLICT');
-            }
-            return;
-        }
-        const created = await this.docker([
-            'network',
-            'create',
-            '--label',
-            'ai.libre-webui.managed=true',
-            '--opt',
-            'com.docker.network.bridge.enable_icc=false',
-            config.networkName,
-        ], { acceptFailure: true });
-        if (created.exitCode !== 0 && !/already exists/i.test(created.stderr)) {
-            throw new WorkRuntimeError(`Could not create the Work sandbox network "${config.networkName}": ${created.stderr.trim()}`, 503, 'WORK_NETWORK_UNAVAILABLE');
-        }
-    }
-    async ensureContainer(task) {
-        this.assertRuntimeLease(task);
-        await this.ensureWorkNetwork(task);
-        if (await this.containerExists(task.containerName)) {
-            await this.assertManagedContainer(task);
-            if (!(await this.containerMatchesTaskPolicy(task))) {
-                logger.warn(`Recreating Work container ${task.containerName} because its isolation policy is stale.`);
-                await this.docker(['rm', '-f', task.containerName]);
-                await this.docker(buildWorkContainerRunArgs(task, this.image));
-                return;
-            }
-            const state = await this.docker([
-                'inspect',
-                '--format',
-                '{{.State.Running}}',
-                task.containerName,
-            ]);
-            if (state.stdout.trim() !== 'true') {
-                await this.docker(['start', task.containerName]);
-            }
-            return;
-        }
-        await this.docker(buildWorkContainerRunArgs(task, this.image));
-    }
     async recreateContainer(task) {
         const releaseLease = this.acquireRuntimeLease(task);
         try {
-            await this.ensureImage();
+            await this.ensureImage(task);
             this.assertTaskIsActive(task);
             await this.withLifecycleLock(task.id, async () => {
                 this.assertTaskIsActive(task);
@@ -477,7 +556,7 @@ export class WorkRuntimeService {
         const releaseLease = this.acquireRuntimeLease(before);
         let previewStopped = false;
         try {
-            await this.ensureImage();
+            await this.ensureImage(before);
             this.assertTaskIsActive(before);
             return await this.withLifecycleLock(before.id, async () => {
                 this.assertTaskIsActive(before);
@@ -515,13 +594,10 @@ export class WorkRuntimeService {
     async recreateContainerWithLock(task) {
         this.assertRuntimeLease(task);
         this.assertTaskIsActive(task);
-        await this.ensureVolume(task);
+        await this.driver.ensureWorkspace(task);
         this.assertTaskIsActive(task);
-        if (await this.containerExists(task.containerName)) {
-            await this.assertManagedContainer(task);
-            await this.docker(['rm', '-f', task.containerName]);
-        }
-        await this.ensureContainer(task);
+        await this.driver.removeRuntime(task);
+        await this.driver.ensureRuntime(task);
         if (this.shuttingDown) {
             await this.stopContainerWithLock(task);
             this.assertTaskIsActive(task);
@@ -547,12 +623,7 @@ export class WorkRuntimeService {
     }
     async stopContainerWithLock(task) {
         try {
-            if (!(await this.containerExists(task.containerName)))
-                return;
-            await this.assertManagedContainer(task);
-            await this.docker(['stop', '--time', '1', task.containerName], {
-                timeoutMs: 10000,
-            });
+            await this.driver.stopRuntime(task);
         }
         catch (error) {
             this.queueFailedCleanup(task, error);
@@ -564,34 +635,11 @@ export class WorkRuntimeService {
             this.assertTaskStillOwned(task);
         }
         else {
-            this.assertTaskOwnerIsAdmin(task);
+            this.assertTaskOwnerHasWorkAccess(task);
         }
         this.retiringTasks.add(task.id);
         try {
-            await this.withLifecycleLock(task.id, async () => {
-                const [hasContainer, hasVolume] = await Promise.all([
-                    this.containerExists(task.containerName),
-                    this.volumeExists(task.volumeName),
-                ]);
-                // Validate every destructive target before removing either one, so a
-                // conflicting unmanaged Docker resource cannot cause partial cleanup.
-                if (hasContainer) {
-                    await this.assertManagedContainer(task);
-                }
-                if (hasVolume) {
-                    await this.assertManagedVolume(task);
-                }
-                if (hasContainer) {
-                    await this.docker(['rm', '-f', task.containerName], {
-                        timeoutMs: 15000,
-                    });
-                }
-                if (hasVolume) {
-                    await this.docker(['volume', 'rm', task.volumeName], {
-                        timeoutMs: 15000,
-                    });
-                }
-            });
+            await this.withLifecycleLock(task.id, () => this.driver.removeTaskResources(task));
         }
         catch (error) {
             this.retiringTasks.delete(task.id);
@@ -605,6 +653,8 @@ export class WorkRuntimeService {
         this.activeCommands.delete(taskId);
         this.releasePreviewLease(taskId);
         this.runtimeLeases.delete(taskId);
+        this.taskActivity.delete(taskId);
+        workPreviewProxyService.clearPreviewUpstream(taskId);
     }
     async listFiles(task, requestedPath = '.') {
         const workspacePath = validateWorkspacePath(requestedPath);
@@ -617,7 +667,7 @@ export class WorkRuntimeService {
     async withWorkspaceHelperContainer(task, operation) {
         const releaseLease = this.acquireRuntimeLease(task);
         try {
-            await this.ensureImage();
+            await this.ensureImage(task);
             this.assertTaskIsActive(task);
             return await this.withLifecycleLock(task.id, async () => {
                 this.assertTaskIsActive(task);
@@ -883,7 +933,7 @@ export class WorkRuntimeService {
         const releaseLease = this.acquireRuntimeLease(task);
         let commandRegistered = false;
         try {
-            await this.ensureImage();
+            await this.ensureImage(task);
             this.assertTaskIsActive(task);
             await this.withLifecycleLock(task.id, async () => {
                 this.assertTaskIsActive(task);
@@ -946,7 +996,7 @@ export class WorkRuntimeService {
         const releaseLease = this.acquireRuntimeLease(task);
         let leaseRetained = false;
         try {
-            await this.ensureImage();
+            await this.ensureImage(task);
             this.assertTaskIsActive(task);
             const url = await this.withLifecycleLock(task.id, async () => {
                 this.assertTaskIsActive(task);
@@ -993,19 +1043,7 @@ export class WorkRuntimeService {
     }
     async detectPreviewLaunch(task) {
         try {
-            const result = await this.docker([
-                'exec',
-                '--user',
-                '1000:1000',
-                '--workdir',
-                '/workspace',
-                task.containerName,
-                'node',
-                '-e',
-                PREVIEW_TARGET_SCRIPT,
-                '--',
-                '/workspace',
-            ], {
+            const result = await this.driver.exec(task, ['node', '-e', PREVIEW_TARGET_SCRIPT, '--', '/workspace'], {
                 acceptFailure: true,
                 timeoutMs: 5000,
                 maxOutputChars: 10000,
@@ -1056,13 +1094,7 @@ export class WorkRuntimeService {
     }
     async startPreviewPrepared(task, previewLaunch) {
         try {
-            const launch = await this.docker([
-                'exec',
-                '--user',
-                '1000:1000',
-                '--workdir',
-                previewLaunch.workdir,
-                task.containerName,
+            const launch = await this.driver.exec(task, [
                 '/bin/bash',
                 '-lc',
                 `if [ -s /tmp/libre-work-preview.pid ] &&
@@ -1085,17 +1117,17 @@ export class WorkRuntimeService {
                     ? STATIC_PREVIEW_SERVER_SCRIPT
                     : previewLaunch.command,
                 String(config.previewPort),
-            ], { acceptFailure: true, timeoutMs: 5000 });
+            ], {
+                workdir: previewLaunch.workdir,
+                acceptFailure: true,
+                timeoutMs: 5000,
+            });
             if (launch.exitCode !== 0 && launch.exitCode !== 17) {
                 throw await this.previewStartError(task, 'Preview process could not be launched.', launch.stderr);
             }
             const deadline = Date.now() + PREVIEW_READY_TIMEOUT_MS;
             while (true) {
-                const readiness = await this.docker([
-                    'exec',
-                    '--user',
-                    '1000:1000',
-                    task.containerName,
+                const readiness = await this.driver.exec(task, [
                     'node',
                     '-e',
                     PREVIEW_READY_SCRIPT,
@@ -1112,16 +1144,11 @@ export class WorkRuntimeService {
                 }
                 await new Promise(resolve => setTimeout(resolve, PREVIEW_POLL_INTERVAL_MS));
             }
-            const portResult = await this.docker([
-                'port',
-                task.containerName,
-                `${config.previewPort}/tcp`,
-            ]);
-            const publishedPort = parsePublishedPort(portResult.stdout, config.previewPort);
-            if (!publishedPort) {
-                throw new WorkRuntimeError('Docker did not publish the preview port.', 503, 'WORK_PREVIEW_PORT_UNAVAILABLE');
+            const endpoint = await this.driver.previewEndpoint(task);
+            if (!endpoint) {
+                throw new WorkRuntimeError('The runtime did not expose the preview port.', 503, 'WORK_PREVIEW_PORT_UNAVAILABLE');
             }
-            return workPreviewProxyService.createPreviewUrl(task.id, publishedPort);
+            return workPreviewProxyService.createPreviewUrl(task.id, endpoint.port, endpoint.host);
         }
         catch (error) {
             try {
@@ -1134,11 +1161,7 @@ export class WorkRuntimeService {
         }
     }
     async previewStartError(task, reason, detail = '') {
-        const log = await this.docker([
-            'exec',
-            '--user',
-            '1000:1000',
-            task.containerName,
+        const log = await this.driver.exec(task, [
             '/bin/bash',
             '-lc',
             'tail -c 4000 /tmp/libre-work-preview.log 2>/dev/null || true',
@@ -1189,22 +1212,9 @@ export class WorkRuntimeService {
         });
     }
     async previewProcessCheckWithLock(task) {
-        if (!(await this.containerExists(task.containerName)))
+        if ((await this.driver.runtimeState(task)) !== 'running')
             return 'absent';
-        await this.assertManagedContainer(task);
-        if (!(await this.containerIsRunning(task.containerName)))
-            return 'absent';
-        const readiness = await this.docker([
-            'exec',
-            '--user',
-            '1000:1000',
-            task.containerName,
-            'node',
-            '-e',
-            PREVIEW_READY_SCRIPT,
-            '--',
-            String(config.previewPort),
-        ], { acceptFailure: true, timeoutMs: 2000, maxOutputChars: 2000 });
+        const readiness = await this.driver.exec(task, ['node', '-e', PREVIEW_READY_SCRIPT, '--', String(config.previewPort)], { acceptFailure: true, timeoutMs: 2000, maxOutputChars: 2000 });
         if (readiness.exitCode === 0)
             return 'ready';
         if (readiness.exitCode === 3)
@@ -1214,208 +1224,37 @@ export class WorkRuntimeService {
         throw new WorkRuntimeError(readiness.stderr.trim() || 'Could not inspect the Work preview.', 503, 'WORK_PREVIEW_INSPECT_FAILED');
     }
     async stopPreviewPrepared(task) {
+        workPreviewProxyService.clearPreviewUpstream(task.id);
         // Stop the container, not only the recorded process group. A custom
         // preview command can intentionally double-fork or create a new session;
         // Docker's container boundary guarantees those descendants are gone.
         // The named /workspace volume remains persistent across the restart.
         await this.stopContainerWithLock(task);
     }
-    async ensureImage() {
-        if (!this.imagePreparation) {
-            this.imagePreparation = (async () => {
-                const inspected = await this.docker(['image', 'inspect', this.image], {
-                    timeoutMs: 10000,
-                    acceptFailure: true,
-                });
-                if (inspected.exitCode === 0)
-                    return;
-                logger.info(`Pulling Work runtime image ${this.image}`);
-                await this.docker(['pull', this.image], { timeoutMs: 900000 });
-            })().catch(error => {
-                this.imagePreparation = undefined;
+    async ensureImage(task) {
+        // Pulls are deduplicated per image, not globally: tasks under different
+        // policies may run different images.
+        const image = workPolicyService.resolve(task.policyId).image;
+        let preparation = this.imagePreparations.get(image);
+        if (!preparation) {
+            preparation = this.driver.ensureImage(image).catch(error => {
+                this.imagePreparations.delete(image);
                 throw error;
             });
+            this.imagePreparations.set(image, preparation);
         }
-        await this.imagePreparation;
-    }
-    async initializeVolume(task) {
-        await this.docker([
-            'run',
-            '--rm',
-            '--network',
-            'none',
-            '--read-only',
-            '--tmpfs',
-            '/tmp:rw,noexec,nosuid,size=64m',
-            '--cap-drop',
-            'ALL',
-            '--cap-add',
-            'CHOWN',
-            '--mount',
-            `type=volume,src=${task.volumeName},dst=/workspace`,
-            this.image,
-            'chown',
-            '-R',
-            '1000:1000',
-            '/workspace',
-        ]);
-    }
-    async ensureVolume(task) {
-        if (await this.volumeExists(task.volumeName)) {
-            await this.assertManagedVolume(task);
-            return;
-        }
-        await this.docker([
-            'volume',
-            'create',
-            '--label',
-            'ai.libre-webui.managed=true',
-            '--label',
-            `ai.libre-webui.task=${task.id}`,
-            task.volumeName,
-        ]);
-        // Docker returns an existing volume from `volume create` if another
-        // process wins the name race, so prove ownership before mounting it.
-        await this.assertManagedVolume(task);
-        try {
-            await this.initializeVolume(task);
-        }
-        catch (error) {
-            await this.docker(['volume', 'rm', task.volumeName], {
-                acceptFailure: true,
-            });
-            throw error;
-        }
-    }
-    async volumeExists(name) {
-        const result = await this.docker(['volume', 'inspect', name], {
-            timeoutMs: 5000,
-            acceptFailure: true,
-        });
-        if (result.exitCode === 0)
-            return true;
-        if (/no such volume/i.test(`${result.stderr}\n${result.stdout}`)) {
-            return false;
-        }
-        throw new WorkRuntimeError(`Could not inspect Work volume "${name}": ${result.stderr.trim() || result.stdout.trim() || `Docker exited with code ${result.exitCode}.`}`, 503, 'WORK_DOCKER_INSPECT_FAILED');
-    }
-    async containerExists(name) {
-        const result = await this.docker(['container', 'inspect', name], {
-            timeoutMs: 5000,
-            acceptFailure: true,
-        });
-        if (result.exitCode === 0)
-            return true;
-        if (/no such (?:container|object)/i.test(`${result.stderr}\n${result.stdout}`)) {
-            return false;
-        }
-        throw new WorkRuntimeError(`Could not inspect Work container "${name}": ${result.stderr.trim() || result.stdout.trim() || `Docker exited with code ${result.exitCode}.`}`, 503, 'WORK_DOCKER_INSPECT_FAILED');
-    }
-    async containerIsRunning(name) {
-        const result = await this.docker([
-            'inspect',
-            '--format',
-            '{{.State.Running}}',
-            name,
-        ]);
-        const state = result.stdout.trim();
-        if (state === 'true')
-            return true;
-        if (state === 'false')
-            return false;
-        throw new WorkRuntimeError(`Docker returned an invalid state for Work container "${name}".`, 503, 'WORK_DOCKER_INSPECT_FAILED');
-    }
-    async assertManagedContainer(task) {
-        const result = await this.docker([
-            'inspect',
-            '--format',
-            '{{ index .Config.Labels "ai.libre-webui.task" }}',
-            task.containerName,
-        ]);
-        if (result.stdout.trim() !== task.id) {
-            throw new WorkRuntimeError(`Refusing to operate unmanaged container "${task.containerName}".`, 409, 'WORK_CONTAINER_NAME_CONFLICT');
-        }
-    }
-    async containerMatchesTaskPolicy(task) {
-        const result = await this.docker([
-            'inspect',
-            '--format',
-            '{{json .}}',
-            task.containerName,
-        ]);
-        let inspected;
-        try {
-            inspected = JSON.parse(result.stdout);
-        }
-        catch {
-            return false;
-        }
-        const containerConfig = objectRecord(inspected.Config);
-        const hostConfig = objectRecord(inspected.HostConfig);
-        const labels = objectRecord(containerConfig.Labels);
-        const env = stringArray(containerConfig.Env);
-        const capDrop = stringArray(hostConfig.CapDrop);
-        const securityOpt = stringArray(hostConfig.SecurityOpt);
-        const command = stringArray(containerConfig.Cmd);
-        const mounts = Array.isArray(inspected.Mounts)
-            ? inspected.Mounts.map(objectRecord)
-            : [];
-        const workspaceMount = mounts.find(mount => mount.Destination === '/workspace');
-        const expectedNetwork = task.networkEnabled ? config.networkName : 'none';
-        const portBindings = objectRecord(hostConfig.PortBindings);
-        const previewBindings = Array.isArray(portBindings[`${config.previewPort}/tcp`])
-            ? portBindings[`${config.previewPort}/tcp`].map(objectRecord)
-            : [];
-        const portPolicyMatches = task.networkEnabled
-            ? Object.keys(portBindings).length === 1 &&
-                previewBindings.length === 1 &&
-                previewBindings[0]?.HostIp === config.previewBind
-            : Object.keys(portBindings).length === 0;
-        return (labels['ai.libre-webui.managed'] === 'true' &&
-            labels['ai.libre-webui.task'] === task.id &&
-            labels['ai.libre-webui.policy'] === runtimePolicyFingerprint &&
-            containerConfig.Image === this.image &&
-            containerConfig.User === '1000:1000' &&
-            containerConfig.WorkingDir === '/workspace' &&
-            command.join('\0') === ['tail', '-f', '/dev/null'].join('\0') &&
-            env.includes('HOME=/tmp') &&
-            env.includes('NPM_CONFIG_CACHE=/tmp/npm-cache') &&
-            hostConfig.ReadonlyRootfs === true &&
-            hostConfig.Privileged === false &&
-            capDrop.includes('ALL') &&
-            securityOpt.includes('no-new-privileges') &&
-            Number(hostConfig.PidsLimit) === config.pidsLimit &&
-            Number(hostConfig.Memory) > 0 &&
-            Number(hostConfig.MemorySwap) === Number(hostConfig.Memory) &&
-            Number(hostConfig.NanoCpus) > 0 &&
-            hostConfig.NetworkMode === expectedNetwork &&
-            portPolicyMatches &&
-            workspaceMount?.Type === 'volume' &&
-            workspaceMount.Name === task.volumeName &&
-            workspaceMount.RW === true);
-    }
-    async assertManagedVolume(task) {
-        const result = await this.docker([
-            'volume',
-            'inspect',
-            '--format',
-            '{{ index .Labels "ai.libre-webui.task" }}',
-            task.volumeName,
-        ]);
-        if (result.stdout.trim() !== task.id) {
-            throw new WorkRuntimeError(`Refusing to operate unmanaged volume "${task.volumeName}".`, 409, 'WORK_VOLUME_NAME_CONFLICT');
-        }
+        await preparation;
     }
     assertTaskIsActive(task) {
         this.assertAcceptingWork();
         if (this.retiringTasks.has(task.id)) {
             throw new WorkRuntimeError('This Work task is being deleted.', 409, 'WORK_TASK_REMOVING');
         }
-        this.assertTaskOwnerIsAdmin(task);
+        this.assertTaskOwnerHasWorkAccess(task);
     }
-    assertTaskOwnerIsAdmin(task) {
+    assertTaskOwnerHasWorkAccess(task) {
         const access = getDatabase()
-            .prepare(`SELECT users.role
+            .prepare(`SELECT users.role AS role, users.account_status AS status
          FROM work_tasks
          JOIN users ON users.id = work_tasks.user_id
          WHERE work_tasks.id = ? AND work_tasks.user_id = ?`)
@@ -1423,8 +1262,8 @@ export class WorkRuntimeService {
         if (!access) {
             throw new WorkRuntimeError('This Work task no longer exists.', 409, 'WORK_TASK_REMOVING');
         }
-        if (access.role !== 'admin') {
-            throw new WorkRuntimeError('Administrator access to this Work task was revoked.', 403, 'WORK_ACCESS_REVOKED');
+        if (!userHasWorkAccess(access)) {
+            throw new WorkRuntimeError('Work access for this task was revoked.', 403, 'WORK_ACCESS_REVOKED');
         }
     }
     assertTaskStillOwned(task) {
@@ -1593,106 +1432,41 @@ export class WorkRuntimeService {
         return this.exec(task, buildWorkGitCommand(args), options);
     }
     async exec(task, command, options = {}) {
-        const args = [
-            'exec',
-            ...(options.input !== undefined ? ['--interactive'] : []),
-            '--user',
-            '1000:1000',
-            '--workdir',
-            '/workspace',
-            task.containerName,
-            ...command,
-        ];
-        return this.docker(args, options);
-    }
-    async docker(args, options = {}) {
         try {
-            return await runProcess(config.dockerCommand, args, options);
+            return await this.driver.exec(task, command, options);
         }
-        catch (error) {
-            if (error instanceof WorkRuntimeError)
-                throw error;
-            throw new WorkRuntimeError(error instanceof Error ? error.message : 'Docker command failed.');
+        finally {
+            this.noteTaskActivity(task.id);
         }
     }
 }
-/** Bracket a bare IPv6 literal so it can carry a port in a URL. */
-export function formatPreviewHost(host) {
-    return host.includes(':') && !host.startsWith('[') ? `[${host}]` : host;
-}
 /**
- * Turn a failed `docker info` into the change an operator has to make. These
- * are the three ways a containerized Libre WebUI fails to reach the daemon:
- * the image has no CLI, the bind-mounted socket is owned by a group the
- * backend user is not in, or no daemon is listening.
+ * Decide the minimal startup cleanup from the task inventory and the labeled
+ * containers Docker actually has. A task without a container needs nothing —
+ * which is the common case, and why recovery is no longer O(tasks) docker
+ * calls. Ownership is decided by the task label alone (stamped at creation
+ * together with the managed label): a managed container whose label matches
+ * no inventory row is unowned, and stopping it through a task record would
+ * be refused by the ownership assertion anyway.
  */
-export function describeDockerUnavailable(error, dockerCommand = config.dockerCommand) {
-    const message = error instanceof Error ? error.message : String(error);
-    if (/ENOENT/.test(message)) {
-        return `The "${dockerCommand}" CLI is not installed in the Libre WebUI runtime. Run an image that ships the Docker CLI and mount the host Docker socket, or point WORK_DOCKER_COMMAND at the CLI path.`;
-    }
-    if (/EACCES/.test(message) || /permission denied/i.test(message)) {
-        return 'The Docker socket is mounted but the Libre WebUI user cannot open it. Add the backend user to the group that owns /var/run/docker.sock (Compose: group_add with the socket GID).';
-    }
-    if (/cannot connect to the docker daemon/i.test(message) ||
-        /is the docker daemon running/i.test(message) ||
-        /no such file or directory/i.test(message)) {
-        return 'No Docker daemon is reachable. Start Docker, or mount the host socket into the Libre WebUI container with -v /var/run/docker.sock:/var/run/docker.sock.';
+export function planStartupReconciliation(tasks, containers) {
+    const byId = new Map(tasks.map(task => [task.id, task]));
+    const stop = new Map();
+    const removeOrphans = [];
+    let atRest = 0;
+    for (const container of containers) {
+        const task = byId.get(container.taskId);
+        if (!task) {
+            removeOrphans.push(container);
+        }
+        else if (container.running) {
+            stop.set(task.id, task);
+        }
+        else {
+            atRest += 1;
+        }
     }
-    return message;
-}
-export function buildWorkContainerRunArgs(task, image = config.image) {
-    const args = [
-        'run',
-        '--detach',
-        '--name',
-        task.containerName,
-        '--init',
-        '--label',
-        'ai.libre-webui.managed=true',
-        '--label',
-        `ai.libre-webui.task=${task.id}`,
-        '--label',
-        `ai.libre-webui.policy=${runtimePolicyFingerprint}`,
-        '--user',
-        '1000:1000',
-        '--workdir',
-        '/workspace',
-        '--read-only',
-        '--tmpfs',
-        '/tmp:rw,nosuid,size=512m',
-        '--env',
-        'HOME=/tmp',
-        '--env',
-        'NPM_CONFIG_CACHE=/tmp/npm-cache',
-        '--cap-drop',
-        'ALL',
-        '--security-opt',
-        'no-new-privileges',
-        '--pids-limit',
-        String(config.pidsLimit),
-        '--memory',
-        config.memoryLimit,
-        // Same value as --memory: the memory cap cannot be sidestepped via swap.
-        '--memory-swap',
-        config.memoryLimit,
-        '--cpus',
-        config.cpuLimit,
-        '--network',
-        task.networkEnabled ? config.networkName : 'none',
-    ];
-    if (task.networkEnabled) {
-        args.push('--publish', `${config.previewBind}::${config.previewPort}`);
-        for (const server of config.dnsServers) {
-            args.push('--dns', server);
-        }
-    }
-    args.push('--mount', task.hostPath
-        ? // Host-folder workspaces are opt-in per deployment and validated
-            // against an allowlist before ever reaching this point.
-            `type=bind,src=${task.hostPath},dst=/workspace`
-        : `type=volume,src=${task.volumeName},dst=/workspace,volume-nocopy`, image, 'tail', '-f', '/dev/null');
-    return args;
+    return { stop: [...stop.values()], removeOrphans, atRest };
 }
 export function validateWorkspacePath(input, allowRoot = true) {
     const value = String(input || '.').trim();
@@ -1730,22 +1504,6 @@ function validateGitIdentity(value, field) {
     }
     return value;
 }
-export function parsePublishedPort(output, _containerPort = config.previewPort, bindAddress = config.previewBind) {
-    // Only a binding on the interface this deployment asked for counts. The
-    // default stays loopback, so a stray wildcard binding is still rejected.
-    const allowed = new Set(bindAddress === WORK_RUNTIME_DEFAULTS.previewBind
-        ? ['127.0.0.1', '[::1]']
-        : [bindAddress, formatPreviewHost(bindAddress)]);
-    for (const line of output.trim().split(/\r?\n/)) {
-        const match = line.match(/^(.*):(\d+)$/);
-        if (!match || !allowed.has(match[1]))
-            continue;
-        const port = Number(match[2]);
-        if (Number.isInteger(port) && port > 0 && port <= 65535)
-            return port;
-    }
-    return undefined;
-}
 async function waitForAbortSignal(promise, signal) {
     if (!signal)
         return promise;
@@ -1767,98 +1525,6 @@ async function waitForAbortSignal(promise, signal) {
         });
     });
 }
-async function runProcess(command, args, options) {
-    const timeoutMs = options.timeoutMs ?? config.commandTimeoutMs;
-    const maxOutputChars = options.maxOutputChars ?? config.maxOutputChars;
-    return new Promise((resolve, reject) => {
-        const child = spawn(command, args, {
-            stdio: ['pipe', 'pipe', 'pipe'],
-            env: process.env,
-        });
-        activeDockerProcesses.add(child);
-        let stdout = '';
-        let stderr = '';
-        let truncated = false;
-        let settled = false;
-        let stdinError;
-        let timer;
-        const claimSettlement = () => {
-            if (settled)
-                return false;
-            settled = true;
-            if (timer)
-                clearTimeout(timer);
-            return true;
-        };
-        const append = (current, chunk) => {
-            const next = current + chunk.toString('utf8');
-            if (next.length <= maxOutputChars)
-                return next;
-            truncated = true;
-            const half = Math.floor(maxOutputChars / 2);
-            return `${next.slice(0, half)}\n... output truncated ...\n${next.slice(-half)}`;
-        };
-        child.stdout.on('data', chunk => {
-            stdout = append(stdout, chunk);
-        });
-        child.stderr.on('data', chunk => {
-            stderr = append(stderr, chunk);
-        });
-        child.stdin.on('error', error => {
-            // A helper may reject the request and close stdin before a large input
-            // has finished writing. EPIPE is then expected; the process exit carries
-            // the useful error. Other stdin failures are reported when it closes.
-            if (error.code !== 'EPIPE') {
-                stdinError = error;
-            }
-        });
-        child.on('error', error => {
-            activeDockerProcesses.delete(child);
-            if (!claimSettlement())
-                return;
-            reject(new WorkRuntimeError(`Could not start ${command}: ${error.message}`, 503, 'WORK_DOCKER_UNAVAILABLE'));
-        });
-        child.on('close', (code, signal) => {
-            activeDockerProcesses.delete(child);
-            const result = {
-                exitCode: code ?? -1,
-                stdout,
-                stderr,
-                truncated,
-                signal: signal || undefined,
-            };
-            if (stdinError && !options.acceptFailure) {
-                if (!claimSettlement())
-                    return;
-                reject(new WorkRuntimeError(`Could not write command input: ${stdinError.message}`, 503, 'WORK_DOCKER_STDIN_FAILED'));
-                return;
-            }
-            if (result.exitCode !== 0 && !options.acceptFailure) {
-                if (!claimSettlement())
-                    return;
-                reject(new WorkRuntimeError(stderr.trim() ||
-                    stdout.trim() ||
-                    `${command} exited with code ${result.exitCode}.`, 503, 'WORK_DOCKER_COMMAND_FAILED'));
-                return;
-            }
-            if (claimSettlement())
-                resolve(result);
-        });
-        timer = setTimeout(() => {
-            child.kill('SIGKILL');
-            if (!claimSettlement())
-                return;
-            reject(new WorkRuntimeError(`Command timed out after ${timeoutMs}ms.`, 504, 'WORK_COMMAND_TIMEOUT'));
-        }, timeoutMs);
-        timer.unref();
-        if (options.input !== undefined) {
-            child.stdin.end(options.input);
-        }
-        else {
-            child.stdin.end();
-        }
-    });
-}
 function parseJsonOutput(output) {
     try {
         return JSON.parse(output.trim());
@@ -1867,35 +1533,6 @@ function parseJsonOutput(output) {
         throw new WorkRuntimeError('Workspace helper returned an invalid response.', 500, 'WORK_HELPER_INVALID_RESPONSE');
     }
 }
-function positiveInteger(value, fallback) {
-    const parsed = Number(value);
-    return Number.isInteger(parsed) && parsed > 0 ? parsed : fallback;
-}
-export function parseDnsServers(value) {
-    if (!value)
-        return [];
-    return value
-        .split(',')
-        .map(server => server.trim())
-        .filter(server => {
-        if (!server)
-            return false;
-        if (/^[0-9a-fA-F:.]+$/.test(server))
-            return true;
-        logger.warn(`Ignoring WORK_RUNTIME_DNS entry "${server}": not an IPv4/IPv6 address.`);
-        return false;
-    });
-}
-function objectRecord(value) {
-    return value && typeof value === 'object'
-        ? value
-        : {};
-}
-function stringArray(value) {
-    return Array.isArray(value)
-        ? value.filter((item) => typeof item === 'string')
-        : [];
-}
 function isSafePreviewWorkdir(value) {
     if (typeof value !== 'string' ||
         value.length > 4096 ||
@@ -2428,6 +2065,21 @@ const walk = directory => {
 walk(targetReal);
 process.stdout.write(results.join('\\n'));
 `;
-export const workRuntimeService = new WorkRuntimeService();
+/**
+ * Select the runtime backend for this deployment. Docker remains the
+ * default; WORK_RUNTIME_BACKEND=kubernetes runs sandboxes as Pods in a
+ * namespace instead (no Docker daemon or socket anywhere). An unknown value
+ * fails startup loudly rather than silently running the wrong backend.
+ */
+export function createWorkRuntimeDriver(backend = process.env.WORK_RUNTIME_BACKEND) {
+    const selected = backend?.trim() || 'docker';
+    if (selected === 'docker')
+        return new DockerWorkRuntimeDriver();
+    if (selected === 'kubernetes')
+        return new KubernetesWorkRuntimeDriver();
+    throw new WorkRuntimeError(`Unknown WORK_RUNTIME_BACKEND "${selected}". Use "docker" or "kubernetes".`, 503, 'WORK_RUNTIME_BACKEND_INVALID');
+}
+export { KubernetesWorkRuntimeDriver } from './workKubernetesDriver.js';
+export const workRuntimeService = new WorkRuntimeService(createWorkRuntimeDriver());
 export default workRuntimeService;
 //# sourceMappingURL=workRuntimeService.js.map