reeval 0.8.0 → 0.10.0

package/dist/{src-TdJuDYqB.js → src-B7treWa8.js}

@@ -1,11 +1,13 @@
-import { u as ownFileURL } from "./root-CvdRlRZX.js";
-import { existsSync, lstatSync, readFileSync, readdirSync, readlinkSync } from "node:fs";
-import { basename, dirname, join, posix, relative, win32 } from "node:path";
+import { u as ownFileURL } from "./root-DICDHCtp.js";
+import { n as shellQuote, t as run } from "./process-CSVO_jsc.js";
+import { existsSync, lstatSync, readFileSync, readdirSync, readlinkSync, renameSync, writeFileSync } from "node:fs";
+import { tmpdir } from "node:os";
+import { basename, dirname, join, posix, relative } from "node:path";
 import net, { BlockList, isIP } from "node:net";
-import { fileURLToPath } from "node:url";
 import { createHash, generateKeyPairSync, randomBytes, randomInt, sign } from "node:crypto";
+import { fileURLToPath } from "node:url";
+import { execFileSync, spawn } from "node:child_process";
 import { createHarnessSandboxTemplate } from "@ai-sdk/harness/agent";
-import { spawn } from "node:child_process";
 import { isUtf8 } from "node:buffer";
 import { Duplex, Readable, Transform } from "node:stream";
 import http from "node:http";
@@ -13,6 +15,1073 @@ import http2 from "node:http2";
 import https from "node:https";
 import tls from "node:tls";
 import { lookup } from "node:dns/promises";
+//#region ../sandbox-docker/src/seccomp-profile.ts
+const DOCKER_SECCOMP_PROFILE = {
+	defaultAction: "SCMP_ACT_ERRNO",
+	defaultErrnoRet: 1,
+	archMap: [
+		{
+			architecture: "SCMP_ARCH_X86_64",
+			subArchitectures: ["SCMP_ARCH_X86", "SCMP_ARCH_X32"]
+		},
+		{
+			architecture: "SCMP_ARCH_AARCH64",
+			subArchitectures: ["SCMP_ARCH_ARM"]
+		},
+		{
+			architecture: "SCMP_ARCH_MIPS64",
+			subArchitectures: ["SCMP_ARCH_MIPS", "SCMP_ARCH_MIPS64N32"]
+		},
+		{
+			architecture: "SCMP_ARCH_MIPS64N32",
+			subArchitectures: ["SCMP_ARCH_MIPS", "SCMP_ARCH_MIPS64"]
+		},
+		{
+			architecture: "SCMP_ARCH_MIPSEL64",
+			subArchitectures: ["SCMP_ARCH_MIPSEL", "SCMP_ARCH_MIPSEL64N32"]
+		},
+		{
+			architecture: "SCMP_ARCH_MIPSEL64N32",
+			subArchitectures: ["SCMP_ARCH_MIPSEL", "SCMP_ARCH_MIPSEL64"]
+		},
+		{
+			architecture: "SCMP_ARCH_S390X",
+			subArchitectures: ["SCMP_ARCH_S390"]
+		},
+		{
+			architecture: "SCMP_ARCH_RISCV64",
+			subArchitectures: null
+		},
+		{
+			architecture: "SCMP_ARCH_LOONGARCH64",
+			subArchitectures: null
+		}
+	],
+	syscalls: [
+		{
+			names: [
+				"accept",
+				"accept4",
+				"access",
+				"adjtimex",
+				"alarm",
+				"bind",
+				"brk",
+				"cachestat",
+				"capget",
+				"capset",
+				"chdir",
+				"chmod",
+				"chown",
+				"chown32",
+				"clock_adjtime",
+				"clock_adjtime64",
+				"clock_getres",
+				"clock_getres_time64",
+				"clock_gettime",
+				"clock_gettime64",
+				"clock_nanosleep",
+				"clock_nanosleep_time64",
+				"close",
+				"close_range",
+				"connect",
+				"copy_file_range",
+				"creat",
+				"dup",
+				"dup2",
+				"dup3",
+				"epoll_create",
+				"epoll_create1",
+				"epoll_ctl",
+				"epoll_ctl_old",
+				"epoll_pwait",
+				"epoll_pwait2",
+				"epoll_wait",
+				"epoll_wait_old",
+				"eventfd",
+				"eventfd2",
+				"execve",
+				"execveat",
+				"exit",
+				"exit_group",
+				"faccessat",
+				"faccessat2",
+				"fadvise64",
+				"fadvise64_64",
+				"fallocate",
+				"fanotify_mark",
+				"fchdir",
+				"fchmod",
+				"fchmodat",
+				"fchmodat2",
+				"fchown",
+				"fchown32",
+				"fchownat",
+				"fcntl",
+				"fcntl64",
+				"fdatasync",
+				"fgetxattr",
+				"flistxattr",
+				"flock",
+				"fork",
+				"fremovexattr",
+				"fsetxattr",
+				"fstat",
+				"fstat64",
+				"fstatat64",
+				"fstatfs",
+				"fstatfs64",
+				"fsync",
+				"ftruncate",
+				"ftruncate64",
+				"futex",
+				"futex_requeue",
+				"futex_time64",
+				"futex_wait",
+				"futex_waitv",
+				"futex_wake",
+				"futimesat",
+				"getcpu",
+				"getcwd",
+				"getdents",
+				"getdents64",
+				"getegid",
+				"getegid32",
+				"geteuid",
+				"geteuid32",
+				"getgid",
+				"getgid32",
+				"getgroups",
+				"getgroups32",
+				"getitimer",
+				"getpeername",
+				"getpgid",
+				"getpgrp",
+				"getpid",
+				"getppid",
+				"getpriority",
+				"getrandom",
+				"getresgid",
+				"getresgid32",
+				"getresuid",
+				"getresuid32",
+				"getrlimit",
+				"get_robust_list",
+				"getrusage",
+				"getsid",
+				"getsockname",
+				"getsockopt",
+				"get_thread_area",
+				"gettid",
+				"gettimeofday",
+				"getuid",
+				"getuid32",
+				"getxattr",
+				"getxattrat",
+				"inotify_add_watch",
+				"inotify_init",
+				"inotify_init1",
+				"inotify_rm_watch",
+				"io_cancel",
+				"ioctl",
+				"io_destroy",
+				"io_getevents",
+				"io_pgetevents",
+				"io_pgetevents_time64",
+				"ioprio_get",
+				"ioprio_set",
+				"io_setup",
+				"io_submit",
+				"ipc",
+				"kill",
+				"landlock_add_rule",
+				"landlock_create_ruleset",
+				"landlock_restrict_self",
+				"lchown",
+				"lchown32",
+				"lgetxattr",
+				"link",
+				"linkat",
+				"listen",
+				"listmount",
+				"listxattr",
+				"listxattrat",
+				"llistxattr",
+				"_llseek",
+				"lremovexattr",
+				"lseek",
+				"lsetxattr",
+				"lstat",
+				"lstat64",
+				"madvise",
+				"map_shadow_stack",
+				"membarrier",
+				"memfd_create",
+				"memfd_secret",
+				"mincore",
+				"mkdir",
+				"mkdirat",
+				"mknod",
+				"mknodat",
+				"mlock",
+				"mlock2",
+				"mlockall",
+				"mmap",
+				"mmap2",
+				"mprotect",
+				"mq_getsetattr",
+				"mq_notify",
+				"mq_open",
+				"mq_timedreceive",
+				"mq_timedreceive_time64",
+				"mq_timedsend",
+				"mq_timedsend_time64",
+				"mq_unlink",
+				"mremap",
+				"mseal",
+				"msgctl",
+				"msgget",
+				"msgrcv",
+				"msgsnd",
+				"msync",
+				"munlock",
+				"munlockall",
+				"munmap",
+				"name_to_handle_at",
+				"nanosleep",
+				"newfstatat",
+				"_newselect",
+				"open",
+				"openat",
+				"openat2",
+				"pause",
+				"pidfd_open",
+				"pidfd_send_signal",
+				"pipe",
+				"pipe2",
+				"pkey_alloc",
+				"pkey_free",
+				"pkey_mprotect",
+				"poll",
+				"ppoll",
+				"ppoll_time64",
+				"prctl",
+				"pread64",
+				"preadv",
+				"preadv2",
+				"prlimit64",
+				"process_mrelease",
+				"pselect6",
+				"pselect6_time64",
+				"pwrite64",
+				"pwritev",
+				"pwritev2",
+				"read",
+				"readahead",
+				"readlink",
+				"readlinkat",
+				"readv",
+				"recv",
+				"recvfrom",
+				"recvmmsg",
+				"recvmmsg_time64",
+				"recvmsg",
+				"remap_file_pages",
+				"removexattr",
+				"removexattrat",
+				"rename",
+				"renameat",
+				"renameat2",
+				"restart_syscall",
+				"riscv_hwprobe",
+				"rmdir",
+				"rseq",
+				"rt_sigaction",
+				"rt_sigpending",
+				"rt_sigprocmask",
+				"rt_sigqueueinfo",
+				"rt_sigreturn",
+				"rt_sigsuspend",
+				"rt_sigtimedwait",
+				"rt_sigtimedwait_time64",
+				"rt_tgsigqueueinfo",
+				"sched_getaffinity",
+				"sched_getattr",
+				"sched_getparam",
+				"sched_get_priority_max",
+				"sched_get_priority_min",
+				"sched_getscheduler",
+				"sched_rr_get_interval",
+				"sched_rr_get_interval_time64",
+				"sched_setaffinity",
+				"sched_setattr",
+				"sched_setparam",
+				"sched_setscheduler",
+				"sched_yield",
+				"seccomp",
+				"select",
+				"semctl",
+				"semget",
+				"semop",
+				"semtimedop",
+				"semtimedop_time64",
+				"send",
+				"sendfile",
+				"sendfile64",
+				"sendmmsg",
+				"sendmsg",
+				"sendto",
+				"setfsgid",
+				"setfsgid32",
+				"setfsuid",
+				"setfsuid32",
+				"setgid",
+				"setgid32",
+				"setgroups",
+				"setgroups32",
+				"setitimer",
+				"setpgid",
+				"setpriority",
+				"setregid",
+				"setregid32",
+				"setresgid",
+				"setresgid32",
+				"setresuid",
+				"setresuid32",
+				"setreuid",
+				"setreuid32",
+				"setrlimit",
+				"set_robust_list",
+				"setsid",
+				"setsockopt",
+				"set_thread_area",
+				"set_tid_address",
+				"setuid",
+				"setuid32",
+				"setxattr",
+				"setxattrat",
+				"shmat",
+				"shmctl",
+				"shmdt",
+				"shmget",
+				"shutdown",
+				"sigaltstack",
+				"signalfd",
+				"signalfd4",
+				"sigprocmask",
+				"sigreturn",
+				"socketcall",
+				"socketpair",
+				"splice",
+				"stat",
+				"stat64",
+				"statfs",
+				"statfs64",
+				"statmount",
+				"statx",
+				"symlink",
+				"symlinkat",
+				"sync",
+				"sync_file_range",
+				"syncfs",
+				"sysinfo",
+				"tee",
+				"tgkill",
+				"time",
+				"timer_create",
+				"timer_delete",
+				"timer_getoverrun",
+				"timer_gettime",
+				"timer_gettime64",
+				"timer_settime",
+				"timer_settime64",
+				"timerfd_create",
+				"timerfd_gettime",
+				"timerfd_gettime64",
+				"timerfd_settime",
+				"timerfd_settime64",
+				"times",
+				"tkill",
+				"truncate",
+				"truncate64",
+				"ugetrlimit",
+				"umask",
+				"uname",
+				"unlink",
+				"unlinkat",
+				"uretprobe",
+				"utime",
+				"utimensat",
+				"utimensat_time64",
+				"utimes",
+				"vfork",
+				"vmsplice",
+				"wait4",
+				"waitid",
+				"waitpid",
+				"write",
+				"writev"
+			],
+			action: "SCMP_ACT_ALLOW"
+		},
+		{
+			names: [
+				"process_vm_readv",
+				"process_vm_writev",
+				"ptrace"
+			],
+			action: "SCMP_ACT_ALLOW",
+			includes: { minKernel: "4.8" }
+		},
+		{
+			names: ["socket"],
+			action: "SCMP_ACT_ALLOW",
+			args: [{
+				index: 0,
+				value: 3,
+				op: "SCMP_CMP_LT"
+			}]
+		},
+		{
+			names: ["socket"],
+			action: "SCMP_ACT_ALLOW",
+			args: [{
+				index: 0,
+				value: 7,
+				op: "SCMP_CMP_EQ"
+			}]
+		},
+		{
+			names: ["socket"],
+			action: "SCMP_ACT_ALLOW",
+			args: [{
+				index: 0,
+				value: 8,
+				op: "SCMP_CMP_EQ"
+			}]
+		},
+		{
+			names: ["socket"],
+			action: "SCMP_ACT_ALLOW",
+			args: [{
+				index: 0,
+				value: 9,
+				op: "SCMP_CMP_EQ"
+			}]
+		},
+		{
+			names: ["socket"],
+			action: "SCMP_ACT_ALLOW",
+			args: [{
+				index: 0,
+				value: 10,
+				op: "SCMP_CMP_EQ"
+			}]
+		},
+		{
+			names: ["socket"],
+			action: "SCMP_ACT_ALLOW",
+			args: [{
+				index: 0,
+				value: 13,
+				op: "SCMP_CMP_EQ"
+			}]
+		},
+		{
+			names: ["socket"],
+			action: "SCMP_ACT_ALLOW",
+			args: [{
+				index: 0,
+				value: 14,
+				op: "SCMP_CMP_EQ"
+			}]
+		},
+		{
+			names: ["socket"],
+			action: "SCMP_ACT_ALLOW",
+			args: [{
+				index: 0,
+				value: 15,
+				op: "SCMP_CMP_EQ"
+			}]
+		},
+		{
+			names: ["socket"],
+			action: "SCMP_ACT_ALLOW",
+			args: [{
+				index: 0,
+				value: 16,
+				op: "SCMP_CMP_EQ"
+			}]
+		},
+		{
+			names: ["socket"],
+			action: "SCMP_ACT_ALLOW",
+			args: [{
+				index: 0,
+				value: 17,
+				op: "SCMP_CMP_EQ"
+			}]
+		},
+		{
+			names: ["socket"],
+			action: "SCMP_ACT_ALLOW",
+			args: [{
+				index: 0,
+				value: 18,
+				op: "SCMP_CMP_EQ"
+			}]
+		},
+		{
+			names: ["socket"],
+			action: "SCMP_ACT_ALLOW",
+			args: [{
+				index: 0,
+				value: 21,
+				op: "SCMP_CMP_EQ"
+			}]
+		},
+		{
+			names: ["socket"],
+			action: "SCMP_ACT_ALLOW",
+			args: [{
+				index: 0,
+				value: 22,
+				op: "SCMP_CMP_EQ"
+			}]
+		},
+		{
+			names: ["socket"],
+			action: "SCMP_ACT_ALLOW",
+			args: [{
+				index: 0,
+				value: 24,
+				op: "SCMP_CMP_EQ"
+			}]
+		},
+		{
+			names: ["socket"],
+			action: "SCMP_ACT_ALLOW",
+			args: [{
+				index: 0,
+				value: 26,
+				op: "SCMP_CMP_EQ"
+			}]
+		},
+		{
+			names: ["socket"],
+			action: "SCMP_ACT_ALLOW",
+			args: [{
+				index: 0,
+				value: 27,
+				op: "SCMP_CMP_EQ"
+			}]
+		},
+		{
+			names: ["socket"],
+			action: "SCMP_ACT_ALLOW",
+			args: [{
+				index: 0,
+				value: 28,
+				op: "SCMP_CMP_EQ"
+			}]
+		},
+		{
+			names: ["socket"],
+			action: "SCMP_ACT_ALLOW",
+			args: [{
+				index: 0,
+				value: 29,
+				op: "SCMP_CMP_EQ"
+			}]
+		},
+		{
+			names: ["socket"],
+			action: "SCMP_ACT_ALLOW",
+			args: [{
+				index: 0,
+				value: 30,
+				op: "SCMP_CMP_EQ"
+			}]
+		},
+		{
+			names: ["socket"],
+			action: "SCMP_ACT_ALLOW",
+			args: [{
+				index: 0,
+				value: 31,
+				op: "SCMP_CMP_EQ"
+			}]
+		},
+		{
+			names: ["socket"],
+			action: "SCMP_ACT_ALLOW",
+			args: [{
+				index: 0,
+				value: 32,
+				op: "SCMP_CMP_EQ"
+			}]
+		},
+		{
+			names: ["socket"],
+			action: "SCMP_ACT_ALLOW",
+			args: [{
+				index: 0,
+				value: 33,
+				op: "SCMP_CMP_EQ"
+			}]
+		},
+		{
+			names: ["socket"],
+			action: "SCMP_ACT_ALLOW",
+			args: [{
+				index: 0,
+				value: 35,
+				op: "SCMP_CMP_EQ"
+			}]
+		},
+		{
+			names: ["socket"],
+			action: "SCMP_ACT_ALLOW",
+			args: [{
+				index: 0,
+				value: 36,
+				op: "SCMP_CMP_EQ"
+			}]
+		},
+		{
+			names: ["socket"],
+			action: "SCMP_ACT_ALLOW",
+			args: [{
+				index: 0,
+				value: 39,
+				op: "SCMP_CMP_EQ"
+			}]
+		},
+		{
+			names: ["socket"],
+			action: "SCMP_ACT_ALLOW",
+			args: [{
+				index: 0,
+				value: 41,
+				op: "SCMP_CMP_EQ"
+			}]
+		},
+		{
+			names: ["socket"],
+			action: "SCMP_ACT_ALLOW",
+			args: [{
+				index: 0,
+				value: 42,
+				op: "SCMP_CMP_EQ"
+			}]
+		},
+		{
+			names: ["socket"],
+			action: "SCMP_ACT_ALLOW",
+			args: [{
+				index: 0,
+				value: 43,
+				op: "SCMP_CMP_EQ"
+			}]
+		},
+		{
+			names: ["socket"],
+			action: "SCMP_ACT_ALLOW",
+			args: [{
+				index: 0,
+				value: 44,
+				op: "SCMP_CMP_EQ"
+			}]
+		},
+		{
+			names: ["socket"],
+			action: "SCMP_ACT_ALLOW",
+			args: [{
+				index: 0,
+				value: 45,
+				op: "SCMP_CMP_EQ"
+			}]
+		},
+		{
+			names: ["personality"],
+			action: "SCMP_ACT_ALLOW",
+			args: [{
+				index: 0,
+				value: 0,
+				op: "SCMP_CMP_EQ"
+			}]
+		},
+		{
+			names: ["personality"],
+			action: "SCMP_ACT_ALLOW",
+			args: [{
+				index: 0,
+				value: 8,
+				op: "SCMP_CMP_EQ"
+			}]
+		},
+		{
+			names: ["personality"],
+			action: "SCMP_ACT_ALLOW",
+			args: [{
+				index: 0,
+				value: 131072,
+				op: "SCMP_CMP_EQ"
+			}]
+		},
+		{
+			names: ["personality"],
+			action: "SCMP_ACT_ALLOW",
+			args: [{
+				index: 0,
+				value: 131080,
+				op: "SCMP_CMP_EQ"
+			}]
+		},
+		{
+			names: ["personality"],
+			action: "SCMP_ACT_ALLOW",
+			args: [{
+				index: 0,
+				value: 4294967295,
+				op: "SCMP_CMP_EQ"
+			}]
+		},
+		{
+			names: ["sync_file_range2", "swapcontext"],
+			action: "SCMP_ACT_ALLOW",
+			includes: { arches: ["ppc64le"] }
+		},
+		{
+			names: [
+				"arm_fadvise64_64",
+				"arm_sync_file_range",
+				"sync_file_range2",
+				"breakpoint",
+				"cacheflush",
+				"set_tls"
+			],
+			action: "SCMP_ACT_ALLOW",
+			includes: { arches: ["arm", "arm64"] }
+		},
+		{
+			names: ["arch_prctl"],
+			action: "SCMP_ACT_ALLOW",
+			includes: { arches: ["amd64", "x32"] }
+		},
+		{
+			names: ["modify_ldt"],
+			action: "SCMP_ACT_ALLOW",
+			includes: { arches: [
+				"amd64",
+				"x32",
+				"x86"
+			] }
+		},
+		{
+			names: [
+				"s390_pci_mmio_read",
+				"s390_pci_mmio_write",
+				"s390_runtime_instr"
+			],
+			action: "SCMP_ACT_ALLOW",
+			includes: { arches: ["s390", "s390x"] }
+		},
+		{
+			names: ["riscv_flush_icache"],
+			action: "SCMP_ACT_ALLOW",
+			includes: { arches: ["riscv64"] }
+		},
+		{
+			names: ["open_by_handle_at"],
+			action: "SCMP_ACT_ALLOW",
+			includes: { caps: ["CAP_DAC_READ_SEARCH"] }
+		},
+		{
+			names: [
+				"bpf",
+				"clone",
+				"clone3",
+				"fanotify_init",
+				"fsconfig",
+				"fsmount",
+				"fsopen",
+				"fspick",
+				"lookup_dcookie",
+				"lsm_get_self_attr",
+				"lsm_list_modules",
+				"lsm_set_self_attr",
+				"mount",
+				"mount_setattr",
+				"move_mount",
+				"open_tree",
+				"perf_event_open",
+				"quotactl",
+				"quotactl_fd",
+				"setdomainname",
+				"sethostname",
+				"setns",
+				"syslog",
+				"umount",
+				"umount2",
+				"unshare"
+			],
+			action: "SCMP_ACT_ALLOW",
+			includes: { caps: ["CAP_SYS_ADMIN"] }
+		},
+		{
+			names: ["clone"],
+			action: "SCMP_ACT_ALLOW",
+			args: [{
+				index: 0,
+				value: 2114060288,
+				op: "SCMP_CMP_MASKED_EQ"
+			}],
+			excludes: {
+				caps: ["CAP_SYS_ADMIN"],
+				arches: ["s390", "s390x"]
+			}
+		},
+		{
+			names: ["clone"],
+			action: "SCMP_ACT_ALLOW",
+			args: [{
+				index: 1,
+				value: 2114060288,
+				op: "SCMP_CMP_MASKED_EQ"
+			}],
+			comment: "s390 parameter ordering for clone is different",
+			includes: { arches: ["s390", "s390x"] },
+			excludes: { caps: ["CAP_SYS_ADMIN"] }
+		},
+		{
+			names: ["clone3"],
+			action: "SCMP_ACT_ERRNO",
+			errnoRet: 38,
+			excludes: { caps: ["CAP_SYS_ADMIN"] }
+		},
+		{
+			names: ["reboot"],
+			action: "SCMP_ACT_ALLOW",
+			includes: { caps: ["CAP_SYS_BOOT"] }
+		},
+		{
+			names: ["chroot"],
+			action: "SCMP_ACT_ALLOW",
+			includes: { caps: ["CAP_SYS_CHROOT"] }
+		},
+		{
+			names: [
+				"delete_module",
+				"init_module",
+				"finit_module"
+			],
+			action: "SCMP_ACT_ALLOW",
+			includes: { caps: ["CAP_SYS_MODULE"] }
+		},
+		{
+			names: ["acct"],
+			action: "SCMP_ACT_ALLOW",
+			includes: { caps: ["CAP_SYS_PACCT"] }
+		},
+		{
+			names: [
+				"kcmp",
+				"pidfd_getfd",
+				"process_madvise",
+				"process_vm_readv",
+				"process_vm_writev",
+				"ptrace"
+			],
+			action: "SCMP_ACT_ALLOW",
+			includes: { caps: ["CAP_SYS_PTRACE"] }
+		},
+		{
+			names: ["iopl", "ioperm"],
+			action: "SCMP_ACT_ALLOW",
+			includes: { caps: ["CAP_SYS_RAWIO"] }
+		},
+		{
+			names: [
+				"settimeofday",
+				"stime",
+				"clock_settime",
+				"clock_settime64"
+			],
+			action: "SCMP_ACT_ALLOW",
+			includes: { caps: ["CAP_SYS_TIME"] }
+		},
+		{
+			names: ["vhangup"],
+			action: "SCMP_ACT_ALLOW",
+			includes: { caps: ["CAP_SYS_TTY_CONFIG"] }
+		},
+		{
+			names: [
+				"get_mempolicy",
+				"mbind",
+				"set_mempolicy",
+				"set_mempolicy_home_node"
+			],
+			action: "SCMP_ACT_ALLOW",
+			includes: { caps: ["CAP_SYS_NICE"] }
+		},
+		{
+			names: ["syslog"],
+			action: "SCMP_ACT_ALLOW",
+			includes: { caps: ["CAP_SYSLOG"] }
+		},
+		{
+			names: ["bpf"],
+			action: "SCMP_ACT_ALLOW",
+			includes: { caps: ["CAP_BPF"] }
+		},
+		{
+			names: ["perf_event_open"],
+			action: "SCMP_ACT_ALLOW",
+			includes: { caps: ["CAP_PERFMON"] }
+		}
+	]
+};
+//#endregion
+//#region ../sandbox-docker/src/engine.ts
+let seccompFile;
+/**
+* Docker's default seccomp profile as a file Podman can read, written once per content under the
+* temp directory (a compiled reeval has no real file of its own to point at).
+*/
+function dockerSeccompFile() {
+	if (seccompFile && existsSync(seccompFile)) return seccompFile;
+	const json = JSON.stringify(DOCKER_SECCOMP_PROFILE);
+	const hash = createHash("sha256").update(json).digest("hex").slice(0, 16);
+	const path = join(tmpdir(), `reeval-seccomp-${hash}.json`);
+	if (!existsSync(path)) {
+		const partial = `${path}.${process.pid}.tmp`;
+		writeFileSync(partial, json);
+		renameSync(partial, path);
+	}
+	seccompFile = path;
+	return path;
+}
+const ENGINES = {
+	docker: {
+		bin: "docker",
+		name: "Docker",
+		fn: "docker",
+		stateFormat: "{{.ServerVersion}} {{.OSType}}",
+		capacityFormat: "{{.NCPU}} {{.MemTotal}}",
+		imageId: ".Id",
+		rmForce: ["rm", "-f"],
+		runArgs: () => [],
+		createsWorkdir: true
+	},
+	podman: {
+		bin: "podman",
+		name: "Podman",
+		fn: "podman",
+		stateFormat: "{{.Version.Version}} {{.Host.OS}}",
+		capacityFormat: "{{.Host.CPUs}} {{.Host.MemTotal}}",
+		imageId: ".ID",
+		rmForce: [
+			"rm",
+			"-f",
+			"--time",
+			"0"
+		],
+		runArgs: () => [
+			"--network",
+			"bridge",
+			"--security-opt",
+			`seccomp=${dockerSeccompFile()}`
+		],
+		createsWorkdir: false
+	}
+};
+const engineSpec = (engine = "docker") => ENGINES[engine];
+/**
+* The `CONTAINER_HOST` that reaches a `podman machine` straight through its API socket (macOS) or
+* named pipe (Windows), from `podman machine inspect`'s JSON.
+*/
+function machineHost(inspect, platform) {
+	const machine = Array.isArray(inspect) ? inspect[0] : void 0;
+	const info = machine?.ConnectionInfo;
+	const name = machine?.Name ?? "podman-machine-default";
+	if (platform === "darwin" && info?.PodmanSocket?.Path) {
+		const path = info.PodmanSocket.Path;
+		return {
+			host: `unix://${path}`,
+			path,
+			name
+		};
+	}
+	if (platform === "win32" && info?.PodmanPipe?.Path) {
+		const path = info.PodmanPipe.Path;
+		return {
+			host: `npipe://${path.replaceAll("\\", "/")}`,
+			path,
+			name
+		};
+	}
+	return null;
+}
+/**
+* The environment every podman command gets. On macOS and Windows the client talks to the
+* machine's VM over SSH, a connection per command, and sshd's `MaxStartups` drops some of a burst
+* (exit 125, `ssh: handshake failed`), so commands go through the machine's API socket instead.
+* Not when the user picked a host (`CONTAINER_HOST`, `CONTAINER_CONNECTION`, or a default
+* connection that isn't the machine's), or the socket isn't there.
+*/
+function podmanHostEnv(inputs) {
+	const { platform, env } = inputs;
+	if (platform !== "darwin" && platform !== "win32") return {};
+	if (env.CONTAINER_HOST || env.CONTAINER_CONNECTION) return {};
+	const machine = machineHost(inputs.inspect(), platform);
+	if (!machine || !inputs.exists(machine.path)) return {};
+	const connections = inputs.connections();
+	const chosen = Array.isArray(connections) ? connections.find((c) => c.Default)?.Name : void 0;
+	if (chosen && chosen !== machine.name && chosen !== `${machine.name}-root`) return {};
+	return { CONTAINER_HOST: machine.host };
+}
+const readJson = (bin, args) => {
+	try {
+		const out = execFileSync(bin, args, {
+			encoding: "utf8",
+			stdio: [
+				"ignore",
+				"pipe",
+				"ignore"
+			],
+			timeout: 1e4,
+			windowsHide: true
+		});
+		return JSON.parse(out);
+	} catch {
+		return;
+	}
+};
+let podmanEnv;
+/** What every command on `engine` adds to its environment; read once per process. */
+function engineEnv(engine = "docker") {
+	if (engine !== "podman") return {};
+	podmanEnv ??= podmanHostEnv({
+		platform: process.platform,
+		env: process.env,
+		inspect: () => readJson("podman", ["machine", "inspect"]),
+		connections: () => readJson("podman", [
+			"system",
+			"connection",
+			"list",
+			"--format",
+			"json"
+		]),
+		exists: existsSync
+	});
+	return podmanEnv;
+}
+/** Docker's ids are `sha256:…`; Podman's are the bare hex. */
+const normalizeImageId = (id) => id.includes(":") ? id : `sha256:${id}`;
+//#endregion
 //#region ../sandbox-docker/src/build-failure.ts
 var ImageBuildError = class extends Error {
 	name = "ImageBuildError";
@@ -26,6 +1095,7 @@ const stripAnsi = (text) => text.replace(/\x1b\[[0-9;]*[A-Za-z]/g, "");
 /** The failing step and its output from `--progress plain` build output. */
 function parseBuildOutput(text) {
 	const lines = stripAnsi(text).split(/\r?\n/);
+	if (!lines.some((l) => /^(?:#\d+ )?ERROR: /.test(l)) && lines.some((l) => l.startsWith("Error: "))) return parseBuildahOutput(lines);
 	let step = null;
 	let error = null;
 	for (const line of lines) {
@@ -46,14 +1116,35 @@ function parseBuildOutput(text) {
 		exitCode: code ? Number(code) : null
 	};
 }
+/**
+* buildah's output (`podman build`): `STEP n/m: …` headers, each step's output as is, then
+* `Error: building at STEP "…": …`. Its own warnings are `time="…" level=…` lines.
+*/
+function parseBuildahOutput(lines) {
+	let error = null;
+	let output = [];
+	for (const line of lines) if (/^STEP \d+\/\d+: /.test(line)) output = [];
+	else if (line.startsWith("Error: ")) error = line.slice(7);
+	else if (!error && line.trim() && !/^time="[^"]*" level=|^--> /.test(line)) output.push(line);
+	error = (error ?? "").replace(/^building at STEP "(?:[^"\\]|\\.)*": /, "").replace(/ &imagebuilder\.Step\{.*$/, "").trim() || null;
+	const code = /exit status (\d+)$/.exec(error ?? "")?.[1];
+	return {
+		error,
+		output: output.slice(-8),
+		exitCode: code ? Number(code) : null
+	};
+}
 /** ENOSPC or a SIGKILL (137, usually the out-of-memory killer), from anything the build printed. */
 function failureCause(text, exitCode) {
 	if (/no space left on device|ENOSPC/i.test(text)) return "enospc";
-	if (exitCode === 137 || /exit(?:ed| code:?) 137\b|signal: killed|OOMKilled/i.test(text)) return "oom";
+	if (exitCode === 137 || /exit(?:ed| code:?| status) 137\b|signal: killed|OOMKilled/i.test(text)) return "oom";
 	return null;
 }
-const causeLine = (cause) => cause === "enospc" ? "out of disk space (ENOSPC): free space for Docker (docker system df, reeval clean --images) and rerun" : "killed (exit 137): usually out of memory; give Docker more memory or lower the concurrency";
-const DETERMINISTIC = /did not complete successfully|dockerfile parse error|unknown instruction|should not be blank|pull access denied|repository does not exist|manifest unknown|not found: manifest|: not found\b|unauthorized|denied:|reeval needs a Debian or Ubuntu based image/i;
+const causeLine = (cause, engine) => {
+	const { name, bin } = engineSpec(engine);
+	return cause === "enospc" ? `out of disk space (ENOSPC): free space for ${name} (${bin} system df, reeval clean --images) and rerun` : `killed (exit 137): usually out of memory; give ${name} more memory or lower the concurrency`;
+};
+const DETERMINISTIC = /did not complete successfully|while running runtime: exit status|did not resolve to an alias|requested access to the resource is denied|dockerfile parse error|unknown instruction|should not be blank|pull access denied|repository does not exist|manifest unknown|not found: manifest|: not found\b|unauthorized|denied:|reeval needs a Debian or Ubuntu based image/i;
 const TRANSIENT = /EAI_AGAIN|ECONNRESET|ETIMEDOUT|ECONNREFUSED|i\/o timeout|TLS handshake timeout|no such host|temporary failure in name resolution|connection reset by peer|dial tcp|net\/http: request canceled|unexpected EOF|\b(?:500|502|503|504) |429 Too Many Requests|toomanyrequests|Service Unavailable|Bad Gateway|Gateway Timeout|ENOTFOUND/i;
 /** A registry or network error: a pull, a metadata lookup, or a download in the harness bootstrap. */
 const isTransient = (text) => !DETERMINISTIC.test(text) && TRANSIENT.test(text);
@@ -76,7 +1167,7 @@ const RETRY_DELAYS = [2e3, 8e3];
 */
 function failureMessage(parts) {
 	const lines = [parts.headline];
-	if (parts.cause) lines.push(causeLine(parts.cause));
+	if (parts.cause) lines.push(causeLine(parts.cause, parts.engine));
 	if (parts.output.length) lines.push(...parts.output.map((l) => `  | ${l}`));
 	if (parts.log) lines.push(`(full log: ${parts.log})`);
 	return lines.join("\n");
@@ -86,119 +1177,6 @@ function outputTail(text, max = 8) {
 	return stripAnsi(text).split(/\r?\n/).map((l) => l.trimEnd()).filter((l) => l.trim()).slice(-max);
 }
 //#endregion
-//#region ../sandbox-docker/src/process.ts
-const CMD_META = /([()\][%!^"`<>&|;, *?])/g;
-const cmdEscape = (arg, twice) => {
-	const quoted = `"${arg.replace(/(\\*)"/g, "$1$1\\\"").replace(/(\\*)$/, "$1$1")}"`.replace(CMD_META, "^$1");
-	return twice ? quoted.replace(CMD_META, "^$1") : quoted;
-};
-/**
-* How to spawn `cmd` on Windows, where npm, npx and pnpm are `.cmd` scripts that only cmd.exe
-* runs: the program PATH and PATHEXT find, and for a script, cmd.exe with every argument escaped.
-*/
-function windowsSpawn(cmd, args, env = process.env, exists = existsSync) {
-	const exts = (env.PATHEXT ?? ".COM;.EXE;.BAT;.CMD").split(";").filter(Boolean);
-	const file = (/[\\/]/.test(cmd) ? [""] : (env.PATH ?? env.Path ?? "").split(";").filter(Boolean)).flatMap((dir) => {
-		const base = dir ? win32.join(dir, cmd) : cmd;
-		return [...win32.extname(cmd) ? [base] : [], ...exts.map((ext) => base + ext.toLowerCase())];
-	}).find(exists) ?? cmd;
-	if (!/\.(cmd|bat)$/i.test(file)) return {
-		file,
-		args,
-		verbatim: false
-	};
-	const twice = /node_modules[\\/]\.bin[\\/][^\\/]+\.cmd$/i.test(file);
-	const line = [win32.normalize(file).replace(CMD_META, "^$1"), ...args.map((a) => cmdEscape(a, twice))].join(" ");
-	return {
-		file: env.ComSpec ?? "cmd.exe",
-		args: [
-			"/d",
-			"/s",
-			"/c",
-			`"${line}"`
-		],
-		verbatim: true
-	};
-}
-/**
-* Kills a process and everything it started: its process group on POSIX (a detached child leads
-* one), its process tree with `taskkill` on Windows, which has neither groups nor signals.
-*/
-function killTree(pid) {
-	if (process.platform === "win32") {
-		spawn("taskkill", [
-			"/pid",
-			String(pid),
-			"/t",
-			"/f"
-		], {
-			stdio: "ignore",
-			windowsHide: true
-		}).on("error", () => {});
-		return;
-	}
-	try {
-		process.kill(-pid, "SIGKILL");
-	} catch {
-		try {
-			process.kill(pid, "SIGKILL");
-		} catch {}
-	}
-}
-/** `s` as one single-quoted POSIX shell word. */
-const shellQuote = (s) => `'${s.replaceAll("'", `'\\''`)}'`;
-function run(cmd, args, options = {}) {
-	const { signal } = options;
-	return new Promise((resolve, reject) => {
-		if (signal?.aborted) return reject(signal.reason);
-		const detached = options.detached ?? true;
-		const target = process.platform === "win32" ? windowsSpawn(cmd, args, options.env ? {
-			...process.env,
-			...options.env
-		} : process.env) : {
-			file: cmd,
-			args,
-			verbatim: false
-		};
-		const child = spawn(target.file, target.args, {
-			cwd: options.cwd,
-			stdio: "pipe",
-			detached: detached && !target.verbatim,
-			windowsHide: true,
-			windowsVerbatimArguments: target.verbatim,
-			env: options.env ? {
-				...process.env,
-				...options.env
-			} : process.env
-		});
-		const out = [];
-		let stderr = "";
-		child.stdout.on("data", (d) => out.push(d));
-		child.stderr.on("data", (d) => {
-			stderr += d;
-		});
-		const onAbort = () => {
-			if ((detached || process.platform === "win32") && child.pid) killTree(child.pid);
-			else child.kill("SIGKILL");
-		};
-		signal?.addEventListener("abort", onAbort, { once: true });
-		child.on("error", reject);
-		child.on("close", (code) => {
-			signal?.removeEventListener("abort", onAbort);
-			if (signal?.aborted) return reject(signal.reason);
-			const stdout = Buffer.concat(out);
-			resolve({
-				exitCode: code ?? 1,
-				stdout: options.binary ? stdout : stdout.toString(),
-				stderr
-			});
-		});
-		if (child.pid) options.onSpawn?.(child.pid);
-		child.stdin.on("error", () => {});
-		child.stdin.end(options.input ?? "");
-	});
-}
-//#endregion
 //#region ../sandbox-docker/src/trace.ts
 /** Most of each stream a trace keeps; the rest is counted. */
 const MAX_STREAM = 4096;
@@ -216,9 +1194,10 @@ function streamPreview(data) {
 	if (data.includes(0) || !isUtf8(data)) return `<${data.length} bytes>`;
 	return clip(data.toString("utf8"), MAX_STREAM);
 }
-function traceDocker(args, startedAt, result) {
+function traceDocker(args, startedAt, result, bin = "docker") {
 	if (!listener) return;
 	const base = {
+		bin,
 		args: args.map((a) => clip(a, MAX_ARG)),
 		ms: Date.now() - startedAt
 	};
@@ -245,107 +1224,199 @@ function traceDocker(args, startedAt, result) {
 }
 //#endregion
 //#region ../sandbox-docker/src/docker-cli.ts
-/** Runs the docker CLI. `env` values are passed via the CLI's environment, never argv. */
+/** How long to wait before each retry of a command that never reached Podman. */
+const CONNECTION_RETRY_MS = [
+	100,
+	250,
+	500,
+	1e3,
+	2e3
+];
+/**
+* Whether a podman command failed before reaching the engine: the remote client's SSH handshake
+* or socket connection to `podman machine`, so running it again is safe.
+*/
+const isConnectionFailure = (r) => r.exitCode === 125 && /ssh: handshake failed|unable to connect to Podman socket/.test(r.stderr);
+const sleep = (ms, signal) => new Promise((resolve) => {
+	const timer = setTimeout(done, ms);
+	function done() {
+		clearTimeout(timer);
+		signal?.removeEventListener("abort", done);
+		resolve();
+	}
+	signal?.addEventListener("abort", done, { once: true });
+});
+/**
+* Runs `attempt` again, after each of `delays`, while its result is a connection failure (see
+* {@link isConnectionFailure}), and returns the last result.
+*/
+async function retryConnection(attempt, options = {}) {
+	const { delays = CONNECTION_RETRY_MS, signal, wait = sleep } = options;
+	let r = await attempt();
+	for (const ms of delays) {
+		if (!isConnectionFailure(r) || signal?.aborted) break;
+		await wait(ms, signal);
+		r = await attempt();
+	}
+	return r;
+}
+/** Runs the docker (or podman) CLI. `env` values are passed via the CLI's environment, never argv. */
 async function docker(args, options = {}) {
-	const startedAt = Date.now();
+	const { engine, ...rest } = options;
+	const { bin } = engineSpec(engine);
 	const stdin = options.input?.length ?? 0;
-	try {
-		const r = await run("docker", args, {
-			...options,
-			binary: true
-		});
-		traceDocker(args, startedAt, {
-			...r,
-			stdin
-		});
-		return r;
-	} catch (error) {
-		traceDocker(args, startedAt, { error });
-		throw error;
-	}
+	const env = {
+		...engineEnv(engine),
+		...rest.env
+	};
+	const once = async () => {
+		const startedAt = Date.now();
+		try {
+			const r = await run(bin, args, {
+				...rest,
+				env,
+				binary: true
+			});
+			traceDocker(args, startedAt, {
+				...r,
+				stdin
+			}, bin);
+			return r;
+		} catch (error) {
+			traceDocker(args, startedAt, { error }, bin);
+			throw error;
+		}
+	};
+	return engine === "podman" ? retryConnection(once, { signal: options.signal }) : once();
 }
 async function dockerOk(args, opts) {
 	const r = await docker(args, opts);
-	if (r.exitCode !== 0) throw new Error(`docker ${args[0]} failed: ${r.stderr.trim()}`);
+	if (r.exitCode !== 0) throw new Error(`${engineSpec(opts?.engine).bin} ${args[0]} failed: ${r.stderr.trim()}`);
 	return r.stdout.toString("utf8").trim();
 }
-/** Removes a container in its own process group, so removal survives this process being killed. */
-function removeContainerDetached(id) {
-	return new Promise((resolve) => {
+/** Whether `rm -f` left the container gone: it removed it, or it was already gone. */
+const removalDone = (r) => r.exitCode === 0 || /no such container/i.test(r.stderr);
+/** How long to wait before each retry of a removal that failed. */
+const REMOVAL_RETRY_MS = [
+	250,
+	500,
+	1e3,
+	2e3,
+	4e3
+];
+/**
+* Removes a container in its own process group, so removal survives this process being killed,
+* and tries again while it fails. Resolves either way.
+*/
+async function removeContainerDetached(id, engine, options = {}) {
+	const { bin, rmForce } = engineSpec(engine);
+	const { delays = REMOVAL_RETRY_MS, wait = sleep } = options;
+	const args = [...rmForce, id];
+	const env = {
+		...process.env,
+		...engineEnv(engine)
+	};
+	const once = () => new Promise((resolve) => {
 		const keepAlive = setInterval(() => {}, 1e3);
 		const startedAt = Date.now();
-		const args = [
-			"rm",
-			"-f",
-			id
-		];
+		let stderr = "";
+		let settled = false;
 		const done = (exitCode) => {
+			if (settled) return;
+			settled = true;
 			clearInterval(keepAlive);
-			traceDocker(args, startedAt, { exitCode });
-			resolve();
+			traceDocker(args, startedAt, {
+				exitCode,
+				stderr
+			}, bin);
+			resolve({
+				exitCode,
+				stderr
+			});
 		};
-		const child = spawn("docker", args, {
+		const child = spawn(bin, args, {
 			detached: true,
-			stdio: "ignore",
-			windowsHide: true
+			stdio: [
+				"ignore",
+				"ignore",
+				"pipe"
+			],
+			windowsHide: true,
+			env
+		});
+		child.stderr.on("data", (d) => {
+			stderr += d;
+		});
+		child.on("error", (error) => {
+			stderr += String(error);
+			done(null);
 		});
-		child.on("error", () => done(null));
 		child.on("close", done);
 	});
+	let r = await once();
+	for (const ms of delays) {
+		if (removalDone(r) || r.exitCode === null) return;
+		await wait(ms);
+		r = await once();
+	}
 }
 /**
 * Removes every container with `label` (`key=value`) for the next few seconds, in its own process
 * group so it outlives this process. For a `docker run` killed mid-way: the daemon may create the
 * container after the CLI dies, and its id never came back.
 */
-function sweepLabelDetached(label, seconds = 15) {
+function sweepLabelDetached(label, seconds = 15, engine) {
+	const { bin, rmForce } = engineSpec(engine);
 	const child = spawn(process.execPath, [
 		"-e",
 		`const { execFileSync } = require('node:child_process')
-const [filter, seconds] = process.argv.slice(1)
+const [filter, seconds, bin, ...rm] = process.argv.slice(1)
 const o = { encoding: 'utf8', stdio: ['ignore', 'pipe', 'ignore'], windowsHide: true }
 for (let i = 0; i < Number(seconds); i++) {
   try {
-    const ids = execFileSync('docker', ['ps', '-aq', '--filter', filter], o).split(/\\s+/).filter(Boolean)
-    if (ids.length) execFileSync('docker', ['rm', '-f', ...ids], o)
+    const ids = execFileSync(bin, ['ps', '-aq', '--filter', filter], o).split(/\\s+/).filter(Boolean)
+    if (ids.length) execFileSync(bin, [...rm, ...ids], o)
   } catch {}
   Atomics.wait(new Int32Array(new SharedArrayBuffer(4)), 0, 0, 1000)
 }`,
 		`label=${label}`,
-		String(seconds)
+		String(seconds),
+		bin,
+		...rmForce
 	], {
 		detached: true,
 		stdio: "ignore",
 		windowsHide: true,
 		env: {
 			...process.env,
+			...engineEnv(engine),
 			BUN_BE_BUN: "1"
 		}
 	});
 	child.on("error", () => {});
 	child.unref();
 }
-async function dockerState() {
+async function dockerState(engine) {
 	const r = await docker([
 		"info",
 		"--format",
-		"{{.ServerVersion}} {{.OSType}}"
-	]).catch(() => null);
+		engineSpec(engine).stateFormat
+	], { engine }).catch(() => null);
 	const [version, os] = r?.exitCode === 0 ? r.stdout.toString("utf8").trim().split(/\s+/) : [];
 	if (!version) return "down";
 	return os === "windows" ? "windows-containers" : "running";
 }
-/** Whether Docker is running Linux containers, as every sandbox needs. */
-async function dockerAvailable() {
-	return await dockerState() === "running";
+/** Whether Docker (or Podman) is running Linux containers, as every sandbox needs. */
+async function dockerAvailable(engine) {
+	return await dockerState(engine) === "running";
 }
-/** CPUs and memory of the machine containers run on (the VM, under Docker Desktop). */
-async function dockerCapacity() {
+/** CPUs and memory of the machine containers run on (the VM, under Docker Desktop or `podman machine`). */
+async function dockerCapacity(engine) {
 	const r = await docker([
 		"info",
 		"--format",
-		"{{.NCPU}} {{.MemTotal}}"
-	]).catch(() => null);
+		engineSpec(engine).capacityFormat
+	], { engine }).catch(() => null);
 	if (r?.exitCode !== 0) return null;
 	const [cpus, memoryBytes] = r.stdout.toString("utf8").trim().split(/\s+/).map(Number);
 	return cpus && memoryBytes ? {
@@ -359,23 +1430,51 @@ async function dockerCapacity() {
 * their bare local name (`reeval-sandbox@sha256:…`). A bare name is Docker Hub's `library/`
 * namespace, which only official images can push to, so only a digest whose name has a registry
 * host or a namespace counts. Official images such as `busybox` count as local; no image with
-* the harness baked in is one.
+* the harness baked in is one. Podman names local images `localhost/…`, which no one pulls from.
+*/
+const isRegistryDigest = (digest) => {
+	const name = digest.split("@")[0] ?? "";
+	return name.includes("/") && !name.startsWith("localhost/");
+};
+/** `repository:tag` of every local image in `repository`; none when the CLI fails. */
+async function imageTags(repository, engine) {
+	const r = await docker([
+		"image",
+		"ls",
+		"--format",
+		"{{.Repository}}:{{.Tag}}",
+		repository
+	], { engine }).catch(() => null);
+	if (r?.exitCode !== 0) return [];
+	return r.stdout.toString("utf8").split(/\r?\n/).filter(Boolean).map((t) => t.replace(/^localhost\//, ""));
+}
+/** `image inspect`'s answer when the engine has no such image (Docker's wording, then Podman's). */
+const isNoSuchImage = (stderr) => /no such image|image not known/i.test(stderr);
+/**
+* The image, or null when the engine says it has no such image. A CLI that can't start or a daemon
+* that doesn't answer throws instead, naming the error: that's not knowing, not a missing image.
 */
-const isRegistryDigest = (digest) => (digest.split("@")[0] ?? "").includes("/");
-async function imageInfo(image) {
+async function imageInfo(image, engine) {
+	const { bin, imageId } = engineSpec(engine);
 	const r = await docker([
 		"image",
 		"inspect",
 		"--format",
-		"{\"config\":{{json .Config}},\"id\":{{json .Id}},\"repoDigests\":{{json .RepoDigests}}}",
+		`{"config":{{json .Config}},"id":{{json ${imageId}}},"repoDigests":{{json .RepoDigests}}}`,
 		image
-	]).catch(() => null);
-	if (r?.exitCode !== 0) return null;
+	], { engine }).catch((error) => {
+		throw new Error(`${bin} image inspect ${image} couldn't run: ${error.message}`);
+	});
+	if (r.exitCode !== 0) {
+		const stderr = r.stderr.trim();
+		if (isNoSuchImage(stderr)) return null;
+		throw new Error(`${bin} image inspect ${image} failed: ${stderr || `exit ${r.exitCode}`}`);
+	}
 	const info = JSON.parse(r.stdout.toString("utf8"));
 	const repoDigests = (info.repoDigests ?? []).filter(isRegistryDigest);
 	return {
 		labels: info.config?.Labels ?? {},
-		id: info.id,
+		id: normalizeImageId(info.id),
 		repoDigests
 	};
 }
@@ -390,32 +1489,40 @@ async function imageInfo(image) {
 const HARNESS_PACKAGES = {
 	cursor: {
 		name: "@reeval/harness-cursor-sdk",
-		version: "0.1.4"
+		version: "0.1.5"
 	},
 	"claude-code": {
 		name: "@ai-sdk/harness-claude-code",
-		version: "1.0.152",
-		patch: "8edc594f"
+		version: "1.0.158",
+		patch: "6c1cff12"
 	},
 	antigravity: {
 		name: "@reeval/harness-antigravity",
-		version: "0.1.6"
+		version: "0.1.8"
 	},
 	opencode: {
 		name: "@reeval/harness-opencode",
-		version: "0.2.7"
+		version: "0.2.8"
 	},
 	goose: {
 		name: "@reeval/harness-goose",
-		version: "0.1.2"
+		version: "0.1.3"
 	},
 	pi: {
 		name: "@reeval/harness-pi",
-		version: "0.2.6"
+		version: "0.2.7"
 	},
 	codex: {
 		name: "@reeval/harness-codex",
-		version: "0.1.6"
+		version: "0.1.7"
+	},
+	fx: {
+		name: "@reeval/harness-fx",
+		version: "0.1.0"
+	},
+	"grok-build": {
+		name: "@reeval/harness-grok-build",
+		version: "0.1.0"
 	}
 };
 /** Every harness with an image, in {@link HARNESS_PACKAGES} order. */
@@ -780,7 +1887,9 @@ const HARNESS_HOSTS = {
 	opencode: ["generativelanguage.googleapis.com", "mcp.exa.ai"],
 	goose: ["generativelanguage.googleapis.com"],
 	pi: ["generativelanguage.googleapis.com"],
-	codex: ["api.openai.com"]
+	codex: ["api.openai.com"],
+	fx: ["ai-gateway.vercel.sh"],
+	"grok-build": ["api.x.ai"]
 };
 /** The package registries and GitHub, for a restricted policy that still installs. */
 const PACKAGE_HOSTS = Object.freeze([
@@ -1894,14 +3003,14 @@ const PROXY_PORT = 43128;
 const CA_PATH = "/usr/local/share/ca-certificates/reeval-egress.crt";
 /** Debian's system bundle, which `update-ca-certificates` rebuilds with the gateway's CA in it. */
 const CA_BUNDLE = "/etc/ssl/certs/ca-certificates.crt";
-const BUNDLED = "es:ca-bundle";
+const BUNDLED = "reeval:ca-bundle";
 const READY_TIMEOUT_MS = 15e3;
 /**
 * The gateway's side of the container runs as root, whoever the sandbox runs as: the sandbox user
 * can't signal, trace or replace the forwarder, or change the CA it installed.
 */
 const AS_ROOT = ["--user", "0:0"];
-const installCa = (containerId, cert, signal) => docker([
+const installCa = (containerId, cert, signal, engine) => docker([
 	"exec",
 	"--interactive",
 	...AS_ROOT,
@@ -1911,15 +3020,16 @@ const installCa = (containerId, cert, signal) => docker([
 	`umask 022 && mkdir -p "$(dirname ${CA_PATH})" && cat > ${CA_PATH} && { command -v update-ca-certificates >/dev/null && update-ca-certificates >/dev/null 2>&1 && grep -q "$(sed -n 2p ${CA_PATH})" ${CA_BUNDLE} && echo ${BUNDLED}; true; }`
 ], {
 	input: cert,
-	signal
+	signal,
+	engine
 });
 /**
 * Starts the egress gateway for one container: a forwarder inside it, tunnelled over one
 * `docker exec -i`, and the proxy in this process, which holds the real credentials.
 */
-async function startGateway(containerId, options, signal) {
+async function startGateway(containerId, options, signal, engine) {
 	const ca = createCertificateAuthority();
-	const installed = await installCa(containerId, ca.cert, signal);
+	const installed = await installCa(containerId, ca.cert, signal, engine);
 	if (installed.exitCode !== 0) throw new Error(`couldn't install the gateway CA: ${installed.stderr.trim()}`);
 	const bundled = installed.stdout.toString("utf8").includes(BUNDLED);
 	const proxy = createEgressProxy({
@@ -1936,14 +3046,19 @@ async function startGateway(containerId, options, signal) {
 		forwarderScript(PROXY_PORT)
 	];
 	const startedAt = Date.now();
-	const child = spawn("docker", args, {
+	const { bin } = engineSpec(engine);
+	const child = spawn(bin, args, {
 		stdio: "pipe",
-		detached: true
+		detached: true,
+		env: {
+			...process.env,
+			...engineEnv(engine)
+		}
 	});
 	child.once("close", (code) => traceDocker(args, startedAt, {
 		exitCode: code,
 		stderr
-	}));
+	}, bin));
 	let stderr = "";
 	child.stderr.on("data", (d) => {
 		stderr += d;
@@ -2057,6 +3172,35 @@ const DEFAULT_LIMITS = {
 	cpus: 2,
 	pids: 1024
 };
+const UNITS = {
+	b: 1,
+	k: 1024,
+	m: 1024 ** 2,
+	g: 1024 ** 3
+};
+/** A Docker memory size in bytes, as Docker reads it (binary units). */
+function sizeBytes(size) {
+	if (typeof size === "number") return size;
+	const m = /^(\d+(?:\.\d+)?)([bkmg])?$/i.exec(size.trim());
+	if (!m) throw new Error(`not a Docker memory size: ${JSON.stringify(size)}`);
+	const unit = m[2]?.toLowerCase() ?? "b";
+	return Math.floor(Number(m[1]) * UNITS[unit]);
+}
+/** Bytes in the largest unit that divides them evenly: `8g`, `1536m`, or plain bytes. */
+function formatSize(bytes) {
+	for (const unit of [
+		"g",
+		"m",
+		"k"
+	]) if (bytes % UNITS[unit] === 0) return `${bytes / UNITS[unit]}${unit}`;
+	return String(bytes);
+}
+/** Docker's `--memory-swap`: the total of memory and swap. */
+function memorySwap(limits) {
+	const memory = sizeBytes(limits.memory);
+	const swap = limits.swap === void 0 ? memory : sizeBytes(limits.swap);
+	return swap === 0 ? String(limits.memory) : formatSize(memory + swap);
+}
 /** What `root` adds back: what `apt-get` (and its `_apt` sandbox) and `dpkg` need as root. */
 const ROOT_CAPABILITIES = [
 	"CHOWN",
@@ -2065,14 +3209,21 @@ const ROOT_CAPABILITIES = [
 	"SETUID",
 	"SETGID"
 ];
-let hostCpus;
+const hostCpus = /* @__PURE__ */ new Map();
 /** Docker refuses `--cpus` above the host's count, so cap it there. */
-async function cpuLimit(cpus) {
-	hostCpus ??= dockerCapacity().then((c) => c?.cpus, () => void 0);
-	const available = await hostCpus;
+async function cpuLimit(cpus, engine = "docker") {
+	let known = hostCpus.get(engine);
+	if (!known) {
+		known = dockerCapacity(engine).then((c) => c?.cpus, () => void 0);
+		hostCpus.set(engine, known);
+	}
+	const available = await known;
 	return String(available ? Math.min(cpus, available) : cpus);
 }
-/** The `docker run` flags that confine the container: its user, capabilities and limits. */
+/**
+* The `docker run` flags that confine the container: its user, capabilities and limits, and on
+* Podman the bridge network and Docker's seccomp profile.
+*/
 async function confinementArgs(options) {
 	const limits = {
 		...DEFAULT_LIMITS,
@@ -2090,27 +3241,63 @@ async function confinementArgs(options) {
 		"--memory",
 		String(limits.memory),
 		"--memory-swap",
-		String(limits.memory),
+		memorySwap(limits),
 		"--pids-limit",
 		String(limits.pids),
 		"--cpus",
-		await cpuLimit(limits.cpus)
+		await cpuLimit(limits.cpus, options.engine),
+		...engineSpec(options.engine).runArgs()
 	];
 }
 /** Runtime `npm i -g` goes to the sandbox user's own prefix, whose `bin` the images put on PATH. */
 const userEnv = (options) => options.root ? {} : { NPM_CONFIG_PREFIX: `${SANDBOX_HOME}/.local` };
 /** Set on every exec, so a kill can find the command's whole process tree in the container. */
 const EXEC_MARKER = "REEVAL_EXEC_ID";
+/**
+* The container's cgroup counts every process the kernel killed at its memory limit: cgroup v2's
+* `memory.events` and v1's `memory.oom_control` both have an `oom_kill` line. Without either,
+* Docker's `OOMKilled` says only whether there was one.
+*/
+async function oomKills(id, engine) {
+	const events = await docker([
+		"exec",
+		id,
+		"sh",
+		"-c",
+		"cat /sys/fs/cgroup/memory.events 2>/dev/null || cat /sys/fs/cgroup/memory/memory.oom_control"
+	], { engine }).catch(() => null);
+	const count = events?.stdout.toString("utf8").match(/^oom_kill (\d+)$/m)?.[1];
+	if (events?.exitCode === 0 && count !== void 0) return Number(count);
+	const inspected = await docker([
+		"inspect",
+		"--format",
+		"{{.State.OOMKilled}}",
+		id
+	], { engine }).catch(() => null);
+	if (inspected?.exitCode !== 0) return null;
+	const killed = inspected.stdout.toString("utf8").trim();
+	return killed === "true" ? 1 : killed === "false" ? 0 : null;
+}
 /** The Docker networks a container is attached to. */
-async function networksOf(id) {
+async function networksOf(id, engine) {
 	const out = await dockerOk([
 		"inspect",
 		"--format",
 		"{{json .NetworkSettings.Networks}}",
 		id
-	]);
+	], { engine });
 	return Object.keys(JSON.parse(out) ?? {});
 }
+/** How the container is networked when it's on no network: `host`, `slirp4netns`, `pasta`…  */
+async function networkMode(id, engine) {
+	const r = await docker([
+		"inspect",
+		"--format",
+		"{{.HostConfig.NetworkMode}}",
+		id
+	], { engine }).catch(() => null);
+	return r?.exitCode === 0 ? r.stdout.toString("utf8").trim() || "unknown" : "unknown";
+}
 /**
 * A harness sandbox session backed by one local Docker container. Commands and file I/O go
 * through `docker exec`. With the egress gateway, ports are reached through its tunnel whatever
@@ -2125,6 +3312,8 @@ async function createDockerSession(options) {
 	};
 	const lifetime = Math.ceil((options.lifetimeMs ?? 864e5) / 1e3);
 	const signal = options.abortSignal;
+	const { engine } = options;
+	const spec = engineSpec(engine);
 	const env = {
 		...userEnv(options),
 		...options.env
@@ -2139,20 +3328,21 @@ async function createDockerSession(options) {
 		...Object.keys(env).flatMap((k) => ["--env", k]),
 		"--publish",
 		`127.0.0.1::${BRIDGE_PORT}`,
-		"--workdir",
-		SANDBOX_ROOT,
+		...spec.createsWorkdir ? ["--workdir", SANDBOX_ROOT] : [],
 		"--entrypoint",
 		"sleep",
 		options.image,
 		String(lifetime)
 	], {
 		signal,
-		env
+		env,
+		engine
 	}).catch((error) => {
-		if (signal?.aborted) sweepLabelDetached(`${LABEL.session}=${nonce}`);
-		if (/unable to find user/i.test(error.message)) {
-			sweepLabelDetached(`${LABEL.session}=${nonce}`);
-			throw new Error(`${options.image} has no ${SANDBOX_USER} user to run the sandbox as. Images reeval builds have one: rebuild it (reeval image build), or start from reeval's image or docker({ from }). An eval that needs root at run time can opt in with docker({ root: true }).`);
+		const sweep = () => sweepLabelDetached(`${LABEL.session}=${nonce}`, void 0, engine);
+		if (signal?.aborted) sweep();
+		if (/unable to find user|no matching entries in passwd/i.test(error.message)) {
+			sweep();
+			throw new Error(`${options.image} has no ${SANDBOX_USER} user to run the sandbox as. Images reeval builds have one: rebuild it (reeval image build), or start from reeval's image or ${spec.fn}({ from }). An eval that needs root at run time can opt in with ${spec.fn}({ root: true }).`);
 		}
 		throw error;
 	});
@@ -2160,33 +3350,57 @@ async function createDockerSession(options) {
 	let removed;
 	const remove = () => {
 		gateway?.close();
-		removed ??= removeContainerDetached(id);
+		removed ??= removeContainerDetached(id, engine);
 		return removed;
 	};
 	if (signal?.aborted) {
 		await remove();
 		throw signal.reason;
 	}
+	if (!spec.createsWorkdir) {
+		const made = await docker([
+			"exec",
+			"--user",
+			"0:0",
+			id,
+			"mkdir",
+			"-p",
+			SANDBOX_ROOT
+		], {
+			engine,
+			signal
+		}).catch((error) => ({
+			exitCode: 1,
+			stderr: error.message
+		}));
+		if (made.exitCode !== 0) {
+			await remove();
+			if (signal?.aborted) throw signal.reason;
+			throw new Error(`Couldn't create ${SANDBOX_ROOT} in the container: ${made.stderr.trim()}`);
+		}
+	}
 	const egressOptions = options.egress === true ? {} : options.egress || void 0;
 	let egress;
 	let detached = [];
 	const attach = async (policy) => {
 		if (isRestricted(policy) && detached.length === 0) {
-			detached = await networksOf(id);
+			detached = await networksOf(id, engine);
+			const mode = detached.length === 0 ? await networkMode(id, engine) : "none";
+			if (detached.length === 0 && mode !== "none") throw new Error(`the container's network is ${mode}, which ${spec.name} can't detach it from, so a restricted policy would still have a route out`);
 			for (const n of detached) await dockerOk([
 				"network",
 				"disconnect",
 				"--force",
 				n,
 				id
-			]);
+			], { engine });
 		} else if (!isRestricted(policy) && detached.length > 0) {
 			for (const n of detached) await dockerOk([
 				"network",
 				"connect",
 				n,
 				id
-			]);
+			], { engine });
 			detached = [];
 		}
 	};
@@ -2197,7 +3411,7 @@ async function createDockerSession(options) {
 			gateway = await startGateway(id, {
 				...rest,
 				policy
-			}, signal);
+			}, signal, engine);
 			egress = { active: true };
 		} catch (error) {
 			if (signal?.aborted || isRestricted(policy)) {
@@ -2240,14 +3454,15 @@ async function createDockerSession(options) {
 		"sh",
 		"-c",
 		`for e in /proc/[0-9]*/environ; do grep -qsxzF ${shellQuote(`${EXEC_MARKER}=${marker}`)} "$e" && kill -9 "$(basename "$(dirname "$e")")" 2>/dev/null; done; true`
-	]).then(() => {}, () => {});
+	], { engine }).then(() => {}, () => {});
 	const run = async (o) => {
 		const env = envFor(o.env);
 		const marker = nextMarker();
 		try {
 			const r = await docker(execArgs(o.command, marker, o.workingDirectory, env), {
 				env,
-				signal: o.abortSignal
+				signal: o.abortSignal,
+				engine
 			});
 			return {
 				exitCode: r.exitCode,
@@ -2266,7 +3481,10 @@ async function createDockerSession(options) {
 			"cat",
 			"--",
 			posix.resolve(SANDBOX_ROOT, o.path)
-		], { signal: o.abortSignal });
+		], {
+			signal: o.abortSignal,
+			engine
+		});
 		return r.exitCode === 0 ? new Uint8Array(r.stdout) : null;
 	};
 	const writeBinaryFile = async (o) => {
@@ -2280,7 +3498,8 @@ async function createDockerSession(options) {
 			`mkdir -p ${shellQuote(posix.dirname(path))} && cat > ${shellQuote(path)}`
 		], {
 			input: Buffer.from(o.content),
-			signal: o.abortSignal
+			signal: o.abortSignal,
+			engine
 		});
 	};
 	const brokering = gateway ? {
@@ -2303,7 +3522,7 @@ async function createDockerSession(options) {
 	} : {};
 	const session = {
 		id,
-		description: `Docker container ${id.slice(0, 12)} (${options.image})`,
+		description: `${spec.name} container ${id.slice(0, 12)} (${options.image})`,
 		defaultWorkingDirectory: SANDBOX_ROOT,
 		ports: [BRIDGE_PORT],
 		get egress() {
@@ -2315,29 +3534,31 @@ async function createDockerSession(options) {
 		},
 		...brokering,
 		...substituting,
+		oomKills: () => oomKills(id, engine),
 		run,
 		async spawn(o) {
 			const env = envFor(o.env);
 			const marker = nextMarker();
 			const args = execArgs(o.command, marker, o.workingDirectory, env);
 			const startedAt = Date.now();
-			const child = spawn("docker", args, {
+			const child = spawn(spec.bin, args, {
 				stdio: [
 					"ignore",
 					"pipe",
 					"pipe"
 				],
 				detached: true,
-				env: env ? {
+				env: {
 					...process.env,
+					...engineEnv(engine),
 					...env
-				} : process.env
+				}
 			});
 			const exited = new Promise((resolve) => child.on("close", (code) => {
 				traceDocker(args, startedAt, {
 					exitCode: code,
 					stdout: "<streamed>"
-				});
+				}, spec.bin);
 				resolve({ exitCode: code ?? 1 });
 			}));
 			const kill = async () => {
@@ -2386,10 +3607,10 @@ async function createDockerSession(options) {
 				"port",
 				id,
 				`${port}/tcp`
-			]);
+			], { engine });
 			const hostPort = mapped.stdout.toString("utf8").split("\n")[0]?.split(":").at(-1);
 			if (mapped.exitCode !== 0 || !hostPort) {
-				const reason = mapped.stderr.trim() || "Docker reports no host port for it";
+				const reason = mapped.stderr.trim() || `${spec.name} reports no host port for it`;
 				throw new Error(`Port ${port} of ${id.slice(0, 12)} isn't reachable: ${reason}`);
 			}
 			return { url: `${scheme}://127.0.0.1:${hostPort}` };
@@ -2420,7 +3641,7 @@ async function createDockerSession(options) {
 /** The session as an AI SDK harness sandbox provider. */
 const dockerSandboxProvider = (options) => ({
 	specificationVersion: "harness-sandbox-v1",
-	providerId: "reeval-docker",
+	providerId: options.engine === "podman" ? "reeval-podman" : "reeval-docker",
 	async createSession(o) {
 		const session = await createDockerSession({
 			...options,
@@ -2433,7 +3654,7 @@ const dockerSandboxProvider = (options) => ({
 //#endregion
 //#region ../sandbox-docker/src/build-image.ts
 const PNPM_VERSION = "10.33.3";
-/** npm before 11.6 (node:22 ships 10.9) can crash on circular peer sets (npm/cli#8261); the same as docker/Dockerfile's. */
+/** npm before 11.6 (node:22 ships 10.9) can crash on circular peer sets (npm/cli#8261). */
 const NPM_VERSION = "11.20.0";
 const sha256 = (text) => createHash("sha256").update(text).digest("hex");
 const slugify = (text, max) => text.toLowerCase().replace(/[^a-z0-9]+/g, "-").replace(/^-+|-+$/g, "").slice(0, max).replace(/-+$/, "");
@@ -2453,22 +3674,22 @@ const BOOTSTRAPS = {
 		name: "Cursor",
 		cli: "@cursor/sdk",
 		version: `node -p "'@cursor/sdk ' + require(process.env.HOME + '/.ai-sdk-harness/.harness-bootstrap/cursor-sdk/node_modules/@cursor/sdk/package.json').version"`,
-		adapter: async () => (await import("./src-BT5pwco0.js")).createCursorSdk()
+		adapter: async () => (await import("./src-DTbrY1hi.js")).createCursorSdk()
 	},
 	"claude-code": {
 		name: "Claude Code",
 		cli: "claude",
-		adapter: async () => (await import("./dist-CTzThfu_.js")).createClaudeCode()
+		adapter: async () => (await import("./dist-B8hJImYt.js")).createClaudeCode()
 	},
 	antigravity: {
 		name: "Antigravity",
 		cli: "agy",
-		adapter: async () => (await import("./src-DdRlaiRc.js")).createAntigravity()
+		adapter: async () => (await import("./src-DNnG4e4R.js")).createAntigravity()
 	},
 	opencode: {
 		name: "OpenCode",
 		cli: "opencode",
-		adapter: async () => (await import("./src-BHNiP-5A.js")).createOpenCode({
+		adapter: async () => (await import("./src-ofUaYbuY.js")).createOpenCode({
 			auth: { GOOGLE_GENERATIVE_AI_API_KEY: "unused" },
 			model: "google/unused"
 		})
@@ -2476,7 +3697,7 @@ const BOOTSTRAPS = {
 	goose: {
 		name: "Goose",
 		cli: "goose",
-		adapter: async () => (await import("./src-BrMbt1B2.js")).createGoose({
+		adapter: async () => (await import("./src-DdyJEh2v.js")).createGoose({
 			auth: { GOOGLE_API_KEY: "unused" },
 			model: "unused"
 		})
@@ -2484,12 +3705,28 @@ const BOOTSTRAPS = {
 	pi: {
 		name: "pi",
 		cli: "pi",
-		adapter: async () => (await import("./src-D13vpMh0.js")).createPi({ auth: { GEMINI_API_KEY: "unused" } })
+		adapter: async () => (await import("./src-jzagbuqH.js")).createPi({ auth: { GEMINI_API_KEY: "unused" } })
 	},
 	codex: {
 		name: "Codex",
 		cli: "codex",
-		adapter: async () => (await import("./src-xczuQbE6.js")).createCodex({ auth: { OPENAI_API_KEY: "unused" } })
+		adapter: async () => (await import("./src-Dj9PAroc.js")).createCodex({ auth: { OPENAI_API_KEY: "unused" } })
+	},
+	fx: {
+		name: "fx",
+		cli: "fx",
+		adapter: async () => (await import("./src-C_lPtowT.js")).createFx({
+			auth: { AI_GATEWAY_API_KEY: "unused" },
+			model: "unused/unused"
+		})
+	},
+	"grok-build": {
+		name: "Grok Build",
+		cli: "grok",
+		adapter: async () => (await import("./src-Du8H85Qq.js")).createGrokBuild({
+			auth: { XAI_API_KEY: "unused" },
+			model: "unused"
+		})
 	}
 };
 /** Keeps the image's `PATH` in login shells, which Debian's `/etc/profile` resets. */
@@ -2521,10 +3758,10 @@ WORKDIR ${SANDBOX_ROOT}/${WORKSPACE_DIR}
 `;
 const tail = (text) => text.trim().split("\n").slice(-15).join("\n");
 const clipLine = (text, max = 300) => text.length > max ? `${text.slice(0, max - 1)}…` : text;
-/** Why a `docker build` failed, in a line: the failing step's exit, or BuildKit's own error. */
-function buildReason(error) {
-	if (!error) return "docker build failed";
-	const exit = /^process ".*" did not complete successfully: exit code: (\d+)$/s.exec(error);
+/** Why a `docker build` failed, in a line: the failing step's exit, or BuildKit's (or buildah's) own error. */
+function buildReason(error, engine) {
+	if (!error) return `${engineSpec(engine).bin} build failed`;
+	const exit = /^process ".*" did not complete successfully: exit code: (\d+)$/s.exec(error) ?? /^while running runtime: exit status (\d+)$/.exec(error);
 	return exit ? `a RUN step exited ${exit[1]}` : clipLine(error.replace(/\s+/g, " "));
 }
 /**
@@ -2536,12 +3773,13 @@ function buildError(output, what, reason, keep = () => true) {
 	const text = [parsed.error ?? "", ...parsed.output].join("\n");
 	const cause = failureCause(text, parsed.exitCode);
 	parsed.output = parsed.output.filter(keep);
-	const why = reason?.(parsed) ?? buildReason(parsed.error);
+	const why = reason?.(parsed) ?? buildReason(parsed.error, what.engine);
 	return new ImageBuildError(failureMessage({
 		headline: `${what.headline} failed: ${why}`,
 		cause,
 		output: parsed.output,
-		log: what.log ?? null
+		log: what.log ?? null,
+		...what.engine ? { engine: what.engine } : {}
 	}), {
 		stage: what.stage,
 		ref: what.ref,
@@ -2556,12 +3794,12 @@ const BUILT_BY = ["--label", `${LABEL.managed}=image`];
 * Removes the images reeval built that nothing tags any more (a rebuild's old image) and the
 * intermediate `-base` tags of `from` builds. Returns how many it removed.
 */
-async function pruneImages() {
+async function pruneImages(engine) {
 	const list = async (args) => (await docker([
 		"image",
 		"ls",
 		...args
-	])).stdout.toString("utf8").split("\n").map((l) => l.trim()).filter(Boolean);
+	], { engine })).stdout.toString("utf8").split("\n").map((l) => l.trim()).filter(Boolean);
 	const dangling = [...await list([
 		"-q",
 		"--filter",
@@ -2585,46 +3823,93 @@ async function pruneImages() {
 		"image",
 		"rm",
 		ref
-	]).catch(() => null))?.exitCode === 0) removed++;
+	], { engine }).catch(() => null))?.exitCode === 0) removed++;
 	return removed;
 }
+/** Docker's names for Node's architectures, as image indexes list platforms. */
+const OCI_ARCH = {
+	x64: "amd64",
+	arm64: "arm64",
+	arm: "arm",
+	ppc64: "ppc64le"
+};
+/**
+* A registry digest for `from` without Docker's buildx: skopeo's, which is the same digest
+* buildx gives, or else this platform's manifest from `podman manifest inspect`.
+*/
+async function podmanRemoteDigest(from, signal) {
+	const skopeo = await run("skopeo", [
+		"inspect",
+		"--format",
+		"{{.Digest}}",
+		`docker://${from}`
+	], { ...signal ? { signal } : {} }).catch(() => null);
+	const digest = skopeo?.exitCode === 0 ? skopeo.stdout.trim() : "";
+	if (digest.startsWith("sha256:")) return { digest };
+	const r = await docker([
+		"manifest",
+		"inspect",
+		from
+	], {
+		signal,
+		engine: "podman"
+	}).catch(() => null);
+	if (r?.exitCode === 0) {
+		const manifest = JSON.parse(r.stdout.toString("utf8"));
+		const arch = OCI_ARCH[process.arch] ?? process.arch;
+		const own = manifest.manifests?.find((m) => m.platform?.os === "linux" && m.platform.architecture === arch)?.digest;
+		if (own?.startsWith("sha256:")) return { digest: own };
+	}
+	return { error: (r?.stderr.trim() || skopeo?.stderr.trim() || "").replace(/^(?:Error|time="[^"]*" level=fatal msg=): ?/, "").replace(/\s+/g, " ") || `${from} doesn't resolve` };
+}
 /**
 * What a `from` names now, without pulling: its registry digest, or for an image that's only
 * local, its id (`local`). `error` when neither resolves, e.g. a typo or no network.
 */
-async function resolveFrom(from, signal) {
+async function resolveFrom(from, signal, engine) {
 	const pinned = /@(sha256:[0-9a-f]{64})$/.exec(from)?.[1];
 	if (pinned) return {
 		digest: pinned,
 		local: false
 	};
-	const remote = await docker([
-		"buildx",
-		"imagetools",
-		"inspect",
-		"--format",
-		"{{json .Manifest.Digest}}",
-		from
-	], { signal }).catch(() => null);
-	const digest = remote?.exitCode === 0 ? JSON.parse(remote.stdout.toString("utf8").trim()) : null;
-	if (typeof digest === "string" && digest.startsWith("sha256:")) return {
-		digest,
-		local: false
-	};
-	const local = await imageInfo(from);
+	let error = null;
+	if (engine === "podman") {
+		const remote = await podmanRemoteDigest(from, signal);
+		if ("digest" in remote) return {
+			digest: remote.digest,
+			local: false
+		};
+		error = remote.error;
+	} else {
+		const remote = await docker([
+			"buildx",
+			"imagetools",
+			"inspect",
+			"--format",
+			"{{json .Manifest.Digest}}",
+			from
+		], { signal }).catch(() => null);
+		const digest = remote?.exitCode === 0 ? JSON.parse(remote.stdout.toString("utf8").trim()) : null;
+		if (typeof digest === "string" && digest.startsWith("sha256:")) return {
+			digest,
+			local: false
+		};
+		error = remote?.stderr.trim().replace(/^ERROR: /, "").replace(/\s+/g, " ") || null;
+	}
+	const local = await imageInfo(from, engine).catch(() => null);
 	if (local) return {
 		digest: local.id,
 		local: true
 	};
-	return { error: remote?.stderr.trim().replace(/^ERROR: /, "").replace(/\s+/g, " ") || `${from} doesn't resolve` };
+	return { error: error || `${from} doesn't resolve` };
 }
 /** Removes a tag or an image reeval replaced, unless something still uses it. */
-const removeQuietly = async (ref) => {
+const removeQuietly = async (ref, engine) => {
 	await docker([
 		"image",
 		"rm",
 		ref
-	]).catch(() => {});
+	], { engine }).catch(() => {});
 };
 /** The hash of reeval's base image build context, which its images carry as a label. */
 function contextHash() {
@@ -2644,14 +3929,14 @@ function contextHash() {
 * intermediate `-base` tag of a `from` build, are removed once the new one is committed.
 */
 async function buildImage(log, options) {
-	const { harness, from, signal } = options;
-	const resolved = from ? await resolveFrom(from, signal) : null;
+	const { harness, from, signal, engine } = options;
+	const resolved = from ? await resolveFrom(from, signal, engine) : null;
 	const digest = resolved && "digest" in resolved ? resolved.digest : null;
 	const pinned = from && digest && resolved && "local" in resolved && !resolved.local && !from.includes("@") ? `${from}@${digest}` : from;
 	const bootstrap = BOOTSTRAPS[harness];
 	const base = from ? `${harnessImageFor(harness, from)}-base` : BASE_IMAGE;
 	const target = from ? harnessImageFor(harness, from) : imageFor(harness);
-	const previous = [(await imageInfo(target))?.id, from ? null : (await imageInfo(base))?.id];
+	const previous = [(await imageInfo(target, engine))?.id, from ? null : (await imageInfo(base, engine))?.id];
 	log(`Building ${base}${from ? ` from ${from}` : ""}`);
 	const build = from ? await docker([
 		"build",
@@ -2664,29 +3949,39 @@ async function buildImage(log, options) {
 		"-"
 	], {
 		input: toolchainDockerfile(pinned ?? from),
-		signal
+		signal,
+		engine
 	}) : await docker([
 		"build",
 		"--progress",
 		"plain",
 		...BUILT_BY,
+		"--build-arg",
+		`NPM_VERSION=${NPM_VERSION}`,
+		"--build-arg",
+		`PNPM_VERSION=${PNPM_VERSION}`,
 		"--tag",
 		base,
 		DOCKER_CONTEXT
-	], { signal });
+	], {
+		signal,
+		engine
+	});
 	const output = `${build.stdout.toString("utf8")}${build.stderr}`;
 	options.output?.write(output);
 	if (build.exitCode !== 0) throw buildError(output, {
 		stage: from ? "from" : "harness",
 		ref: target,
 		headline: from ? `Building the toolchain layer FROM ${from}` : "Building reeval's base image",
-		log: options.output?.path ?? null
+		log: options.output?.path ?? null,
+		engine
 	}, (parsed) => parsed.output.find((l) => l.startsWith("reeval needs a Debian")) ?? null);
 	log(`Installing the ${bootstrap.name} harness bootstrap`);
 	const session = await createDockerSession({
 		image: base,
 		lifetimeMs: 18e5,
-		...signal ? { abortSignal: signal } : {}
+		...signal ? { abortSignal: signal } : {},
+		...engine ? { engine } : {}
 	});
 	let agentVersion;
 	try {
@@ -2706,7 +4001,7 @@ async function buildImage(log, options) {
 			"CMD [\"bash\"]",
 			session.id,
 			target
-		]);
+		], { engine });
 	} catch (error) {
 		if (signal?.aborted || error instanceof ImageBuildError) throw error;
 		const [first = "", ...rest] = error.message.split("\n");
@@ -2716,7 +4011,8 @@ async function buildImage(log, options) {
 			headline: `Baking the ${bootstrap.name} CLI onto ${from ?? "reeval-sandbox-base:latest"} failed: ${clipLine(first)}`,
 			cause,
 			output: outputTail(rest.join("\n")),
-			log: options.output?.path ?? null
+			log: options.output?.path ?? null,
+			...engine ? { engine } : {}
 		}), {
 			stage: "harness",
 			ref: target,
@@ -2727,9 +4023,9 @@ async function buildImage(log, options) {
 	} finally {
 		await session.destroy();
 	}
-	if (from) await removeQuietly(base);
-	const now = (await imageInfo(target))?.id;
-	for (const id of previous) if (id && id !== now) await removeQuietly(id);
+	if (from) await removeQuietly(base, engine);
+	const now = (await imageInfo(target, engine))?.id;
+	for (const id of previous) if (id && id !== now) await removeQuietly(id, engine);
 	return {
 		image: target,
 		agentVersion
@@ -2772,15 +4068,18 @@ function installScript(steps) {
 }
 /** Builds the install layer if it's missing. `output` gets the build's output, for a log file. */
 async function buildInstallLayer(parent, steps, options = {}) {
-	const { signal } = options;
+	const { signal, engine } = options;
 	const tag = installLayerTag(parent, steps);
 	if ((await docker([
 		"image",
 		"inspect",
 		"--format",
-		"{{.Id}}",
+		"{{.Created}}",
 		tag
-	], { signal })).exitCode === 0) return tag;
+	], {
+		signal,
+		engine
+	})).exitCode === 0) return tag;
 	const script = installScript(steps);
 	const encoded = Buffer.from(script).toString("base64");
 	const home = `$(getent passwd ${SANDBOX_USER} | cut -d: -f6)`;
@@ -2803,7 +4102,8 @@ async function buildInstallLayer(parent, steps, options = {}) {
 		"-"
 	], {
 		input: dockerfile,
-		signal
+		signal,
+		engine
 	});
 	const output = `${build.stdout.toString("utf8")}${build.stderr}`;
 	options.output?.write(`${script}\n${dockerfile}\n\n${output}`);
@@ -2813,7 +4113,8 @@ async function buildInstallLayer(parent, steps, options = {}) {
 			stage: "install",
 			ref: tag,
 			headline: `Building the install layer (${`${steps.length} command${steps.length === 1 ? "" : "s"}`})`,
-			log: options.output?.path ?? null
+			log: options.output?.path ?? null,
+			engine
 		}, () => failed ? `install ${failed[1]} exited ${failed[2]}: ${clipLine(failed[3] ?? "")}` : null, (line) => !line.startsWith("reeval: install "));
 	}
 	return tag;
@@ -2873,16 +4174,16 @@ function contextFiles(context, dockerfile) {
 	return files.sort();
 }
 /** Whether the Dockerfile starts from reeval's sandbox image, which then has to exist first. */
-const usesEsBase = (dockerfile) => new RegExp(`\\$\\{?${REEVAL_BASE_ARG}\\b`).test(readFileSync(dockerfile, "utf8"));
+const usesReevalBase = (dockerfile) => new RegExp(`\\$\\{?${REEVAL_BASE_ARG}\\b`).test(readFileSync(dockerfile, "utf8"));
 /**
 * The tag of a `docker({ dockerfile })` build for a harness: a hash of the Dockerfile, every file
 * of its build context (its directory, less `.dockerignore`) and, for a Dockerfile `FROM
 * ${REEVAL_BASE}`, the id of the harness's image it names, so an edit to any of them, or a rebuilt reeval
-* image, builds anew. `esBase` is that id (null when it isn't built).
+* image, builds anew. `reevalBase` is that id (null when it isn't built).
 */
-function dockerfileTag(dockerfile, harness, esBase = null) {
+function dockerfileTag(dockerfile, harness, reevalBase = null) {
 	const context = dirname(dockerfile);
-	const base = usesEsBase(dockerfile) ? `${imageFor(harness)}@${esBase ?? "unbuilt"}` : "";
+	const base = usesReevalBase(dockerfile) ? `${imageFor(harness)}@${reevalBase ?? "unbuilt"}` : "";
 	const hash = createHash("sha256").update(`${REEVAL_BASE_ARG}=${base}\0`);
 	for (const path of contextFiles(context, dockerfile)) {
 		const full = join(context, path);
@@ -2899,14 +4200,14 @@ function dockerfileTag(dockerfile, harness, esBase = null) {
 }
 /**
 * Builds the user's Dockerfile with plain `docker build` (so Docker's layer cache applies), from
-* its directory, with `REEVAL_BASE` set to the harness's sandbox image (whose id is `esBase`).
+* its directory, with `REEVAL_BASE` set to the harness's sandbox image (whose id is `reevalBase`).
 * Rebuilds even when the tag exists with `force`, as `reeval image build` does, and then removes the
 * image the tag pointed at before. `name` is the path failures name.
 */
 async function buildDockerfile(dockerfile, options) {
-	const { harness, signal } = options;
-	const { tag } = dockerfileTag(dockerfile, harness, options.esBase ?? null);
-	const previous = (await imageInfo(tag))?.id;
+	const { harness, signal, engine } = options;
+	const { tag } = dockerfileTag(dockerfile, harness, options.reevalBase ?? null);
+	const previous = (await imageInfo(tag, engine))?.id;
 	if (previous && !options.force) return tag;
 	const build = await docker([
 		"build",
@@ -2921,20 +4222,24 @@ async function buildDockerfile(dockerfile, options) {
 		"--tag",
 		tag,
 		dirname(dockerfile)
-	], { signal });
+	], {
+		signal,
+		engine
+	});
 	const output = `${build.stdout.toString("utf8")}${build.stderr}`;
 	options.output?.write(output);
 	if (build.exitCode !== 0) throw buildError(output, {
 		stage: "dockerfile",
 		ref: tag,
 		headline: `Building ${options.name ?? dockerfile}`,
-		log: options.output?.path ?? null
+		log: options.output?.path ?? null,
+		engine
 	});
-	const now = (await imageInfo(tag))?.id;
-	if (previous && previous !== now) await removeQuietly(previous);
+	const now = (await imageInfo(tag, engine))?.id;
+	if (previous && previous !== now) await removeQuietly(previous, engine);
 	return tag;
 }
 //#endregion
-export { onDockerCommand as $, hostAllowed as A, WORKSPACE_DIR as B, applyTransformations as C, HARNESS_HOSTS as D, DOCKER_EGRESS as E, HARNESS_PACKAGES as F, docker as G, harnessLabel as H, LABEL as I, dockerOk as J, dockerAvailable as K, SANDBOX_HOME as L, BASE_IMAGE as M, BRIDGE_PORT as N, PACKAGE_HOSTS as O, DEFAULT_IMAGE as P, removeContainerDetached as Q, SANDBOX_ROOT as R, placeholder as S, onEndpoint as T, imageFor as U, adapterVersion as V, isBakedHarness as W, imageInfo as X, dockerState as Y, isRegistryDigest as Z, ROOT_CAPABILITIES as _, buildInstallLayer as a, failureCause as at, CA_PATH as b, dockerfileTag as c, retryTransient as ct, installLayerTag as d, run as et, installScript as f, DEFAULT_LIMITS as g, usesEsBase as h, buildImage as i, causeLine as it, BAKED_HARNESSES as j, defaultAllowedHosts as k, dockerignoreMatcher as l, resolveFrom as m, REEVAL_BASE_ARG as n, ImageBuildError as nt, contextFiles as o, isTransient as ot, pruneImages as p, dockerCapacity as q, buildDockerfile as r, RETRY_DELAYS as rt, contextHash as s, parseBuildOutput as st, DOCKER_CONTEXT as t, shellQuote as tt, harnessImageFor as u, createDockerSession as v, matches as w, PROXY_PORT as x, dockerSandboxProvider as y, SANDBOX_USER as z };
+export { removeContainerDetached as $, hostAllowed as A, WORKSPACE_DIR as B, applyTransformations as C, HARNESS_HOSTS as D, DOCKER_EGRESS as E, HARNESS_PACKAGES as F, docker as G, harnessLabel as H, LABEL as I, dockerOk as J, dockerAvailable as K, SANDBOX_HOME as L, BASE_IMAGE as M, BRIDGE_PORT as N, PACKAGE_HOSTS as O, DEFAULT_IMAGE as P, isRegistryDigest as Q, SANDBOX_ROOT as R, placeholder as S, onEndpoint as T, imageFor as U, adapterVersion as V, isBakedHarness as W, imageInfo as X, dockerState as Y, imageTags as Z, ROOT_CAPABILITIES as _, buildInstallLayer as a, isTransient as at, CA_PATH as b, dockerfileTag as c, ENGINES as ct, installLayerTag as d, normalizeImageId as dt, onDockerCommand as et, installScript as f, DEFAULT_LIMITS as g, usesReevalBase as h, buildImage as i, failureCause as it, BAKED_HARNESSES as j, defaultAllowedHosts as k, dockerignoreMatcher as l, dockerSeccompFile as lt, resolveFrom as m, REEVAL_BASE_ARG as n, RETRY_DELAYS as nt, contextFiles as o, parseBuildOutput as ot, pruneImages as p, dockerCapacity as q, buildDockerfile as r, causeLine as rt, contextHash as s, retryTransient as st, DOCKER_CONTEXT as t, ImageBuildError as tt, harnessImageFor as u, engineSpec as ut, createDockerSession as v, matches as w, PROXY_PORT as x, dockerSandboxProvider as y, SANDBOX_USER as z };
 
-//# sourceMappingURL=src-TdJuDYqB.js.map
+//# sourceMappingURL=src-B7treWa8.js.map