reeval 0.9.0 → 0.11.0

package/dist/{src-8rRXy4u9.js → src-ftu5wPSt.js}

@@ -1,12 +1,12 @@
-import { u as ownFileURL } from "./root-CvdRlRZX.js";
-import { n as shellQuote, t as run } from "./process-CSVO_jsc.js";
-import { existsSync, lstatSync, readFileSync, readdirSync, readlinkSync } from "node:fs";
-import { basename, dirname, join, posix, relative } from "node:path";
+import { u as ownFileURL } from "./root-DICDHCtp.js";
+import { existsSync, lstatSync, readFileSync, readdirSync, readlinkSync, renameSync, writeFileSync } from "node:fs";
+import { tmpdir } from "node:os";
+import { basename, dirname, join, posix, relative, win32 } from "node:path";
 import net, { BlockList, isIP } from "node:net";
-import { fileURLToPath } from "node:url";
 import { createHash, generateKeyPairSync, randomBytes, randomInt, sign } from "node:crypto";
+import { fileURLToPath } from "node:url";
+import { execFileSync, spawn } from "node:child_process";
 import { createHarnessSandboxTemplate } from "@ai-sdk/harness/agent";
-import { spawn } from "node:child_process";
 import { isUtf8 } from "node:buffer";
 import { Duplex, Readable, Transform } from "node:stream";
 import http from "node:http";
@@ -14,6 +14,1073 @@ import http2 from "node:http2";
 import https from "node:https";
 import tls from "node:tls";
 import { lookup } from "node:dns/promises";
+//#region ../sandbox-docker/src/seccomp-profile.ts
+const DOCKER_SECCOMP_PROFILE = {
+	defaultAction: "SCMP_ACT_ERRNO",
+	defaultErrnoRet: 1,
+	archMap: [
+		{
+			architecture: "SCMP_ARCH_X86_64",
+			subArchitectures: ["SCMP_ARCH_X86", "SCMP_ARCH_X32"]
+		},
+		{
+			architecture: "SCMP_ARCH_AARCH64",
+			subArchitectures: ["SCMP_ARCH_ARM"]
+		},
+		{
+			architecture: "SCMP_ARCH_MIPS64",
+			subArchitectures: ["SCMP_ARCH_MIPS", "SCMP_ARCH_MIPS64N32"]
+		},
+		{
+			architecture: "SCMP_ARCH_MIPS64N32",
+			subArchitectures: ["SCMP_ARCH_MIPS", "SCMP_ARCH_MIPS64"]
+		},
+		{
+			architecture: "SCMP_ARCH_MIPSEL64",
+			subArchitectures: ["SCMP_ARCH_MIPSEL", "SCMP_ARCH_MIPSEL64N32"]
+		},
+		{
+			architecture: "SCMP_ARCH_MIPSEL64N32",
+			subArchitectures: ["SCMP_ARCH_MIPSEL", "SCMP_ARCH_MIPSEL64"]
+		},
+		{
+			architecture: "SCMP_ARCH_S390X",
+			subArchitectures: ["SCMP_ARCH_S390"]
+		},
+		{
+			architecture: "SCMP_ARCH_RISCV64",
+			subArchitectures: null
+		},
+		{
+			architecture: "SCMP_ARCH_LOONGARCH64",
+			subArchitectures: null
+		}
+	],
+	syscalls: [
+		{
+			names: [
+				"accept",
+				"accept4",
+				"access",
+				"adjtimex",
+				"alarm",
+				"bind",
+				"brk",
+				"cachestat",
+				"capget",
+				"capset",
+				"chdir",
+				"chmod",
+				"chown",
+				"chown32",
+				"clock_adjtime",
+				"clock_adjtime64",
+				"clock_getres",
+				"clock_getres_time64",
+				"clock_gettime",
+				"clock_gettime64",
+				"clock_nanosleep",
+				"clock_nanosleep_time64",
+				"close",
+				"close_range",
+				"connect",
+				"copy_file_range",
+				"creat",
+				"dup",
+				"dup2",
+				"dup3",
+				"epoll_create",
+				"epoll_create1",
+				"epoll_ctl",
+				"epoll_ctl_old",
+				"epoll_pwait",
+				"epoll_pwait2",
+				"epoll_wait",
+				"epoll_wait_old",
+				"eventfd",
+				"eventfd2",
+				"execve",
+				"execveat",
+				"exit",
+				"exit_group",
+				"faccessat",
+				"faccessat2",
+				"fadvise64",
+				"fadvise64_64",
+				"fallocate",
+				"fanotify_mark",
+				"fchdir",
+				"fchmod",
+				"fchmodat",
+				"fchmodat2",
+				"fchown",
+				"fchown32",
+				"fchownat",
+				"fcntl",
+				"fcntl64",
+				"fdatasync",
+				"fgetxattr",
+				"flistxattr",
+				"flock",
+				"fork",
+				"fremovexattr",
+				"fsetxattr",
+				"fstat",
+				"fstat64",
+				"fstatat64",
+				"fstatfs",
+				"fstatfs64",
+				"fsync",
+				"ftruncate",
+				"ftruncate64",
+				"futex",
+				"futex_requeue",
+				"futex_time64",
+				"futex_wait",
+				"futex_waitv",
+				"futex_wake",
+				"futimesat",
+				"getcpu",
+				"getcwd",
+				"getdents",
+				"getdents64",
+				"getegid",
+				"getegid32",
+				"geteuid",
+				"geteuid32",
+				"getgid",
+				"getgid32",
+				"getgroups",
+				"getgroups32",
+				"getitimer",
+				"getpeername",
+				"getpgid",
+				"getpgrp",
+				"getpid",
+				"getppid",
+				"getpriority",
+				"getrandom",
+				"getresgid",
+				"getresgid32",
+				"getresuid",
+				"getresuid32",
+				"getrlimit",
+				"get_robust_list",
+				"getrusage",
+				"getsid",
+				"getsockname",
+				"getsockopt",
+				"get_thread_area",
+				"gettid",
+				"gettimeofday",
+				"getuid",
+				"getuid32",
+				"getxattr",
+				"getxattrat",
+				"inotify_add_watch",
+				"inotify_init",
+				"inotify_init1",
+				"inotify_rm_watch",
+				"io_cancel",
+				"ioctl",
+				"io_destroy",
+				"io_getevents",
+				"io_pgetevents",
+				"io_pgetevents_time64",
+				"ioprio_get",
+				"ioprio_set",
+				"io_setup",
+				"io_submit",
+				"ipc",
+				"kill",
+				"landlock_add_rule",
+				"landlock_create_ruleset",
+				"landlock_restrict_self",
+				"lchown",
+				"lchown32",
+				"lgetxattr",
+				"link",
+				"linkat",
+				"listen",
+				"listmount",
+				"listxattr",
+				"listxattrat",
+				"llistxattr",
+				"_llseek",
+				"lremovexattr",
+				"lseek",
+				"lsetxattr",
+				"lstat",
+				"lstat64",
+				"madvise",
+				"map_shadow_stack",
+				"membarrier",
+				"memfd_create",
+				"memfd_secret",
+				"mincore",
+				"mkdir",
+				"mkdirat",
+				"mknod",
+				"mknodat",
+				"mlock",
+				"mlock2",
+				"mlockall",
+				"mmap",
+				"mmap2",
+				"mprotect",
+				"mq_getsetattr",
+				"mq_notify",
+				"mq_open",
+				"mq_timedreceive",
+				"mq_timedreceive_time64",
+				"mq_timedsend",
+				"mq_timedsend_time64",
+				"mq_unlink",
+				"mremap",
+				"mseal",
+				"msgctl",
+				"msgget",
+				"msgrcv",
+				"msgsnd",
+				"msync",
+				"munlock",
+				"munlockall",
+				"munmap",
+				"name_to_handle_at",
+				"nanosleep",
+				"newfstatat",
+				"_newselect",
+				"open",
+				"openat",
+				"openat2",
+				"pause",
+				"pidfd_open",
+				"pidfd_send_signal",
+				"pipe",
+				"pipe2",
+				"pkey_alloc",
+				"pkey_free",
+				"pkey_mprotect",
+				"poll",
+				"ppoll",
+				"ppoll_time64",
+				"prctl",
+				"pread64",
+				"preadv",
+				"preadv2",
+				"prlimit64",
+				"process_mrelease",
+				"pselect6",
+				"pselect6_time64",
+				"pwrite64",
+				"pwritev",
+				"pwritev2",
+				"read",
+				"readahead",
+				"readlink",
+				"readlinkat",
+				"readv",
+				"recv",
+				"recvfrom",
+				"recvmmsg",
+				"recvmmsg_time64",
+				"recvmsg",
+				"remap_file_pages",
+				"removexattr",
+				"removexattrat",
+				"rename",
+				"renameat",
+				"renameat2",
+				"restart_syscall",
+				"riscv_hwprobe",
+				"rmdir",
+				"rseq",
+				"rt_sigaction",
+				"rt_sigpending",
+				"rt_sigprocmask",
+				"rt_sigqueueinfo",
+				"rt_sigreturn",
+				"rt_sigsuspend",
+				"rt_sigtimedwait",
+				"rt_sigtimedwait_time64",
+				"rt_tgsigqueueinfo",
+				"sched_getaffinity",
+				"sched_getattr",
+				"sched_getparam",
+				"sched_get_priority_max",
+				"sched_get_priority_min",
+				"sched_getscheduler",
+				"sched_rr_get_interval",
+				"sched_rr_get_interval_time64",
+				"sched_setaffinity",
+				"sched_setattr",
+				"sched_setparam",
+				"sched_setscheduler",
+				"sched_yield",
+				"seccomp",
+				"select",
+				"semctl",
+				"semget",
+				"semop",
+				"semtimedop",
+				"semtimedop_time64",
+				"send",
+				"sendfile",
+				"sendfile64",
+				"sendmmsg",
+				"sendmsg",
+				"sendto",
+				"setfsgid",
+				"setfsgid32",
+				"setfsuid",
+				"setfsuid32",
+				"setgid",
+				"setgid32",
+				"setgroups",
+				"setgroups32",
+				"setitimer",
+				"setpgid",
+				"setpriority",
+				"setregid",
+				"setregid32",
+				"setresgid",
+				"setresgid32",
+				"setresuid",
+				"setresuid32",
+				"setreuid",
+				"setreuid32",
+				"setrlimit",
+				"set_robust_list",
+				"setsid",
+				"setsockopt",
+				"set_thread_area",
+				"set_tid_address",
+				"setuid",
+				"setuid32",
+				"setxattr",
+				"setxattrat",
+				"shmat",
+				"shmctl",
+				"shmdt",
+				"shmget",
+				"shutdown",
+				"sigaltstack",
+				"signalfd",
+				"signalfd4",
+				"sigprocmask",
+				"sigreturn",
+				"socketcall",
+				"socketpair",
+				"splice",
+				"stat",
+				"stat64",
+				"statfs",
+				"statfs64",
+				"statmount",
+				"statx",
+				"symlink",
+				"symlinkat",
+				"sync",
+				"sync_file_range",
+				"syncfs",
+				"sysinfo",
+				"tee",
+				"tgkill",
+				"time",
+				"timer_create",
+				"timer_delete",
+				"timer_getoverrun",
+				"timer_gettime",
+				"timer_gettime64",
+				"timer_settime",
+				"timer_settime64",
+				"timerfd_create",
+				"timerfd_gettime",
+				"timerfd_gettime64",
+				"timerfd_settime",
+				"timerfd_settime64",
+				"times",
+				"tkill",
+				"truncate",
+				"truncate64",
+				"ugetrlimit",
+				"umask",
+				"uname",
+				"unlink",
+				"unlinkat",
+				"uretprobe",
+				"utime",
+				"utimensat",
+				"utimensat_time64",
+				"utimes",
+				"vfork",
+				"vmsplice",
+				"wait4",
+				"waitid",
+				"waitpid",
+				"write",
+				"writev"
+			],
+			action: "SCMP_ACT_ALLOW"
+		},
+		{
+			names: [
+				"process_vm_readv",
+				"process_vm_writev",
+				"ptrace"
+			],
+			action: "SCMP_ACT_ALLOW",
+			includes: { minKernel: "4.8" }
+		},
+		{
+			names: ["socket"],
+			action: "SCMP_ACT_ALLOW",
+			args: [{
+				index: 0,
+				value: 3,
+				op: "SCMP_CMP_LT"
+			}]
+		},
+		{
+			names: ["socket"],
+			action: "SCMP_ACT_ALLOW",
+			args: [{
+				index: 0,
+				value: 7,
+				op: "SCMP_CMP_EQ"
+			}]
+		},
+		{
+			names: ["socket"],
+			action: "SCMP_ACT_ALLOW",
+			args: [{
+				index: 0,
+				value: 8,
+				op: "SCMP_CMP_EQ"
+			}]
+		},
+		{
+			names: ["socket"],
+			action: "SCMP_ACT_ALLOW",
+			args: [{
+				index: 0,
+				value: 9,
+				op: "SCMP_CMP_EQ"
+			}]
+		},
+		{
+			names: ["socket"],
+			action: "SCMP_ACT_ALLOW",
+			args: [{
+				index: 0,
+				value: 10,
+				op: "SCMP_CMP_EQ"
+			}]
+		},
+		{
+			names: ["socket"],
+			action: "SCMP_ACT_ALLOW",
+			args: [{
+				index: 0,
+				value: 13,
+				op: "SCMP_CMP_EQ"
+			}]
+		},
+		{
+			names: ["socket"],
+			action: "SCMP_ACT_ALLOW",
+			args: [{
+				index: 0,
+				value: 14,
+				op: "SCMP_CMP_EQ"
+			}]
+		},
+		{
+			names: ["socket"],
+			action: "SCMP_ACT_ALLOW",
+			args: [{
+				index: 0,
+				value: 15,
+				op: "SCMP_CMP_EQ"
+			}]
+		},
+		{
+			names: ["socket"],
+			action: "SCMP_ACT_ALLOW",
+			args: [{
+				index: 0,
+				value: 16,
+				op: "SCMP_CMP_EQ"
+			}]
+		},
+		{
+			names: ["socket"],
+			action: "SCMP_ACT_ALLOW",
+			args: [{
+				index: 0,
+				value: 17,
+				op: "SCMP_CMP_EQ"
+			}]
+		},
+		{
+			names: ["socket"],
+			action: "SCMP_ACT_ALLOW",
+			args: [{
+				index: 0,
+				value: 18,
+				op: "SCMP_CMP_EQ"
+			}]
+		},
+		{
+			names: ["socket"],
+			action: "SCMP_ACT_ALLOW",
+			args: [{
+				index: 0,
+				value: 21,
+				op: "SCMP_CMP_EQ"
+			}]
+		},
+		{
+			names: ["socket"],
+			action: "SCMP_ACT_ALLOW",
+			args: [{
+				index: 0,
+				value: 22,
+				op: "SCMP_CMP_EQ"
+			}]
+		},
+		{
+			names: ["socket"],
+			action: "SCMP_ACT_ALLOW",
+			args: [{
+				index: 0,
+				value: 24,
+				op: "SCMP_CMP_EQ"
+			}]
+		},
+		{
+			names: ["socket"],
+			action: "SCMP_ACT_ALLOW",
+			args: [{
+				index: 0,
+				value: 26,
+				op: "SCMP_CMP_EQ"
+			}]
+		},
+		{
+			names: ["socket"],
+			action: "SCMP_ACT_ALLOW",
+			args: [{
+				index: 0,
+				value: 27,
+				op: "SCMP_CMP_EQ"
+			}]
+		},
+		{
+			names: ["socket"],
+			action: "SCMP_ACT_ALLOW",
+			args: [{
+				index: 0,
+				value: 28,
+				op: "SCMP_CMP_EQ"
+			}]
+		},
+		{
+			names: ["socket"],
+			action: "SCMP_ACT_ALLOW",
+			args: [{
+				index: 0,
+				value: 29,
+				op: "SCMP_CMP_EQ"
+			}]
+		},
+		{
+			names: ["socket"],
+			action: "SCMP_ACT_ALLOW",
+			args: [{
+				index: 0,
+				value: 30,
+				op: "SCMP_CMP_EQ"
+			}]
+		},
+		{
+			names: ["socket"],
+			action: "SCMP_ACT_ALLOW",
+			args: [{
+				index: 0,
+				value: 31,
+				op: "SCMP_CMP_EQ"
+			}]
+		},
+		{
+			names: ["socket"],
+			action: "SCMP_ACT_ALLOW",
+			args: [{
+				index: 0,
+				value: 32,
+				op: "SCMP_CMP_EQ"
+			}]
+		},
+		{
+			names: ["socket"],
+			action: "SCMP_ACT_ALLOW",
+			args: [{
+				index: 0,
+				value: 33,
+				op: "SCMP_CMP_EQ"
+			}]
+		},
+		{
+			names: ["socket"],
+			action: "SCMP_ACT_ALLOW",
+			args: [{
+				index: 0,
+				value: 35,
+				op: "SCMP_CMP_EQ"
+			}]
+		},
+		{
+			names: ["socket"],
+			action: "SCMP_ACT_ALLOW",
+			args: [{
+				index: 0,
+				value: 36,
+				op: "SCMP_CMP_EQ"
+			}]
+		},
+		{
+			names: ["socket"],
+			action: "SCMP_ACT_ALLOW",
+			args: [{
+				index: 0,
+				value: 39,
+				op: "SCMP_CMP_EQ"
+			}]
+		},
+		{
+			names: ["socket"],
+			action: "SCMP_ACT_ALLOW",
+			args: [{
+				index: 0,
+				value: 41,
+				op: "SCMP_CMP_EQ"
+			}]
+		},
+		{
+			names: ["socket"],
+			action: "SCMP_ACT_ALLOW",
+			args: [{
+				index: 0,
+				value: 42,
+				op: "SCMP_CMP_EQ"
+			}]
+		},
+		{
+			names: ["socket"],
+			action: "SCMP_ACT_ALLOW",
+			args: [{
+				index: 0,
+				value: 43,
+				op: "SCMP_CMP_EQ"
+			}]
+		},
+		{
+			names: ["socket"],
+			action: "SCMP_ACT_ALLOW",
+			args: [{
+				index: 0,
+				value: 44,
+				op: "SCMP_CMP_EQ"
+			}]
+		},
+		{
+			names: ["socket"],
+			action: "SCMP_ACT_ALLOW",
+			args: [{
+				index: 0,
+				value: 45,
+				op: "SCMP_CMP_EQ"
+			}]
+		},
+		{
+			names: ["personality"],
+			action: "SCMP_ACT_ALLOW",
+			args: [{
+				index: 0,
+				value: 0,
+				op: "SCMP_CMP_EQ"
+			}]
+		},
+		{
+			names: ["personality"],
+			action: "SCMP_ACT_ALLOW",
+			args: [{
+				index: 0,
+				value: 8,
+				op: "SCMP_CMP_EQ"
+			}]
+		},
+		{
+			names: ["personality"],
+			action: "SCMP_ACT_ALLOW",
+			args: [{
+				index: 0,
+				value: 131072,
+				op: "SCMP_CMP_EQ"
+			}]
+		},
+		{
+			names: ["personality"],
+			action: "SCMP_ACT_ALLOW",
+			args: [{
+				index: 0,
+				value: 131080,
+				op: "SCMP_CMP_EQ"
+			}]
+		},
+		{
+			names: ["personality"],
+			action: "SCMP_ACT_ALLOW",
+			args: [{
+				index: 0,
+				value: 4294967295,
+				op: "SCMP_CMP_EQ"
+			}]
+		},
+		{
+			names: ["sync_file_range2", "swapcontext"],
+			action: "SCMP_ACT_ALLOW",
+			includes: { arches: ["ppc64le"] }
+		},
+		{
+			names: [
+				"arm_fadvise64_64",
+				"arm_sync_file_range",
+				"sync_file_range2",
+				"breakpoint",
+				"cacheflush",
+				"set_tls"
+			],
+			action: "SCMP_ACT_ALLOW",
+			includes: { arches: ["arm", "arm64"] }
+		},
+		{
+			names: ["arch_prctl"],
+			action: "SCMP_ACT_ALLOW",
+			includes: { arches: ["amd64", "x32"] }
+		},
+		{
+			names: ["modify_ldt"],
+			action: "SCMP_ACT_ALLOW",
+			includes: { arches: [
+				"amd64",
+				"x32",
+				"x86"
+			] }
+		},
+		{
+			names: [
+				"s390_pci_mmio_read",
+				"s390_pci_mmio_write",
+				"s390_runtime_instr"
+			],
+			action: "SCMP_ACT_ALLOW",
+			includes: { arches: ["s390", "s390x"] }
+		},
+		{
+			names: ["riscv_flush_icache"],
+			action: "SCMP_ACT_ALLOW",
+			includes: { arches: ["riscv64"] }
+		},
+		{
+			names: ["open_by_handle_at"],
+			action: "SCMP_ACT_ALLOW",
+			includes: { caps: ["CAP_DAC_READ_SEARCH"] }
+		},
+		{
+			names: [
+				"bpf",
+				"clone",
+				"clone3",
+				"fanotify_init",
+				"fsconfig",
+				"fsmount",
+				"fsopen",
+				"fspick",
+				"lookup_dcookie",
+				"lsm_get_self_attr",
+				"lsm_list_modules",
+				"lsm_set_self_attr",
+				"mount",
+				"mount_setattr",
+				"move_mount",
+				"open_tree",
+				"perf_event_open",
+				"quotactl",
+				"quotactl_fd",
+				"setdomainname",
+				"sethostname",
+				"setns",
+				"syslog",
+				"umount",
+				"umount2",
+				"unshare"
+			],
+			action: "SCMP_ACT_ALLOW",
+			includes: { caps: ["CAP_SYS_ADMIN"] }
+		},
+		{
+			names: ["clone"],
+			action: "SCMP_ACT_ALLOW",
+			args: [{
+				index: 0,
+				value: 2114060288,
+				op: "SCMP_CMP_MASKED_EQ"
+			}],
+			excludes: {
+				caps: ["CAP_SYS_ADMIN"],
+				arches: ["s390", "s390x"]
+			}
+		},
+		{
+			names: ["clone"],
+			action: "SCMP_ACT_ALLOW",
+			args: [{
+				index: 1,
+				value: 2114060288,
+				op: "SCMP_CMP_MASKED_EQ"
+			}],
+			comment: "s390 parameter ordering for clone is different",
+			includes: { arches: ["s390", "s390x"] },
+			excludes: { caps: ["CAP_SYS_ADMIN"] }
+		},
+		{
+			names: ["clone3"],
+			action: "SCMP_ACT_ERRNO",
+			errnoRet: 38,
+			excludes: { caps: ["CAP_SYS_ADMIN"] }
+		},
+		{
+			names: ["reboot"],
+			action: "SCMP_ACT_ALLOW",
+			includes: { caps: ["CAP_SYS_BOOT"] }
+		},
+		{
+			names: ["chroot"],
+			action: "SCMP_ACT_ALLOW",
+			includes: { caps: ["CAP_SYS_CHROOT"] }
+		},
+		{
+			names: [
+				"delete_module",
+				"init_module",
+				"finit_module"
+			],
+			action: "SCMP_ACT_ALLOW",
+			includes: { caps: ["CAP_SYS_MODULE"] }
+		},
+		{
+			names: ["acct"],
+			action: "SCMP_ACT_ALLOW",
+			includes: { caps: ["CAP_SYS_PACCT"] }
+		},
+		{
+			names: [
+				"kcmp",
+				"pidfd_getfd",
+				"process_madvise",
+				"process_vm_readv",
+				"process_vm_writev",
+				"ptrace"
+			],
+			action: "SCMP_ACT_ALLOW",
+			includes: { caps: ["CAP_SYS_PTRACE"] }
+		},
+		{
+			names: ["iopl", "ioperm"],
+			action: "SCMP_ACT_ALLOW",
+			includes: { caps: ["CAP_SYS_RAWIO"] }
+		},
+		{
+			names: [
+				"settimeofday",
+				"stime",
+				"clock_settime",
+				"clock_settime64"
+			],
+			action: "SCMP_ACT_ALLOW",
+			includes: { caps: ["CAP_SYS_TIME"] }
+		},
+		{
+			names: ["vhangup"],
+			action: "SCMP_ACT_ALLOW",
+			includes: { caps: ["CAP_SYS_TTY_CONFIG"] }
+		},
+		{
+			names: [
+				"get_mempolicy",
+				"mbind",
+				"set_mempolicy",
+				"set_mempolicy_home_node"
+			],
+			action: "SCMP_ACT_ALLOW",
+			includes: { caps: ["CAP_SYS_NICE"] }
+		},
+		{
+			names: ["syslog"],
+			action: "SCMP_ACT_ALLOW",
+			includes: { caps: ["CAP_SYSLOG"] }
+		},
+		{
+			names: ["bpf"],
+			action: "SCMP_ACT_ALLOW",
+			includes: { caps: ["CAP_BPF"] }
+		},
+		{
+			names: ["perf_event_open"],
+			action: "SCMP_ACT_ALLOW",
+			includes: { caps: ["CAP_PERFMON"] }
+		}
+	]
+};
+//#endregion
+//#region ../sandbox-docker/src/engine.ts
+let seccompFile;
+/**
+* Docker's default seccomp profile as a file Podman can read, written once per content under the
+* temp directory (a compiled reeval has no real file of its own to point at).
+*/
+function dockerSeccompFile() {
+	if (seccompFile && existsSync(seccompFile)) return seccompFile;
+	const json = JSON.stringify(DOCKER_SECCOMP_PROFILE);
+	const hash = createHash("sha256").update(json).digest("hex").slice(0, 16);
+	const path = join(tmpdir(), `reeval-seccomp-${hash}.json`);
+	if (!existsSync(path)) {
+		const partial = `${path}.${process.pid}.tmp`;
+		writeFileSync(partial, json);
+		renameSync(partial, path);
+	}
+	seccompFile = path;
+	return path;
+}
+const ENGINES = {
+	docker: {
+		bin: "docker",
+		name: "Docker",
+		fn: "docker",
+		stateFormat: "{{.ServerVersion}} {{.OSType}}",
+		capacityFormat: "{{.NCPU}} {{.MemTotal}}",
+		imageId: ".Id",
+		rmForce: ["rm", "-f"],
+		runArgs: () => [],
+		createsWorkdir: true
+	},
+	podman: {
+		bin: "podman",
+		name: "Podman",
+		fn: "podman",
+		stateFormat: "{{.Version.Version}} {{.Host.OS}}",
+		capacityFormat: "{{.Host.CPUs}} {{.Host.MemTotal}}",
+		imageId: ".ID",
+		rmForce: [
+			"rm",
+			"-f",
+			"--time",
+			"0"
+		],
+		runArgs: () => [
+			"--network",
+			"bridge",
+			"--security-opt",
+			`seccomp=${dockerSeccompFile()}`
+		],
+		createsWorkdir: false
+	}
+};
+const engineSpec = (engine = "docker") => ENGINES[engine];
+/**
+* The `CONTAINER_HOST` that reaches a `podman machine` straight through its API socket (macOS) or
+* named pipe (Windows), from `podman machine inspect`'s JSON.
+*/
+function machineHost(inspect, platform) {
+	const machine = Array.isArray(inspect) ? inspect[0] : void 0;
+	const info = machine?.ConnectionInfo;
+	const name = machine?.Name ?? "podman-machine-default";
+	if (platform === "darwin" && info?.PodmanSocket?.Path) {
+		const path = info.PodmanSocket.Path;
+		return {
+			host: `unix://${path}`,
+			path,
+			name
+		};
+	}
+	if (platform === "win32" && info?.PodmanPipe?.Path) {
+		const path = info.PodmanPipe.Path;
+		return {
+			host: `npipe://${path.replaceAll("\\", "/")}`,
+			path,
+			name
+		};
+	}
+	return null;
+}
+/**
+* The environment every podman command gets. On macOS and Windows the client talks to the
+* machine's VM over SSH, a connection per command, and sshd's `MaxStartups` drops some of a burst
+* (exit 125, `ssh: handshake failed`), so commands go through the machine's API socket instead.
+* Not when the user picked a host (`CONTAINER_HOST`, `CONTAINER_CONNECTION`, or a default
+* connection that isn't the machine's), or the socket isn't there.
+*/
+function podmanHostEnv(inputs) {
+	const { platform, env } = inputs;
+	if (platform !== "darwin" && platform !== "win32") return {};
+	if (env.CONTAINER_HOST || env.CONTAINER_CONNECTION) return {};
+	const machine = machineHost(inputs.inspect(), platform);
+	if (!machine || !inputs.exists(machine.path)) return {};
+	const connections = inputs.connections();
+	const chosen = Array.isArray(connections) ? connections.find((c) => c.Default)?.Name : void 0;
+	if (chosen && chosen !== machine.name && chosen !== `${machine.name}-root`) return {};
+	return { CONTAINER_HOST: machine.host };
+}
+const readJson = (bin, args) => {
+	try {
+		const out = execFileSync(bin, args, {
+			encoding: "utf8",
+			stdio: [
+				"ignore",
+				"pipe",
+				"ignore"
+			],
+			timeout: 1e4,
+			windowsHide: true
+		});
+		return JSON.parse(out);
+	} catch {
+		return;
+	}
+};
+let podmanEnv;
+/** What every command on `engine` adds to its environment; read once per process. */
+function engineEnv(engine = "docker") {
+	if (engine !== "podman") return {};
+	podmanEnv ??= podmanHostEnv({
+		platform: process.platform,
+		env: process.env,
+		inspect: () => readJson("podman", ["machine", "inspect"]),
+		connections: () => readJson("podman", [
+			"system",
+			"connection",
+			"list",
+			"--format",
+			"json"
+		]),
+		exists: existsSync
+	});
+	return podmanEnv;
+}
+/** Docker's ids are `sha256:…`; Podman's are the bare hex. */
+const normalizeImageId = (id) => id.includes(":") ? id : `sha256:${id}`;
+//#endregion
 //#region ../sandbox-docker/src/build-failure.ts
 var ImageBuildError = class extends Error {
 	name = "ImageBuildError";
@@ -27,6 +1094,7 @@ const stripAnsi = (text) => text.replace(/\x1b\[[0-9;]*[A-Za-z]/g, "");
 /** The failing step and its output from `--progress plain` build output. */
 function parseBuildOutput(text) {
 	const lines = stripAnsi(text).split(/\r?\n/);
+	if (!lines.some((l) => /^(?:#\d+ )?ERROR: /.test(l)) && lines.some((l) => l.startsWith("Error: "))) return parseBuildahOutput(lines);
 	let step = null;
 	let error = null;
 	for (const line of lines) {
@@ -47,14 +1115,35 @@ function parseBuildOutput(text) {
 		exitCode: code ? Number(code) : null
 	};
 }
+/**
+* buildah's output (`podman build`): `STEP n/m: …` headers, each step's output as is, then
+* `Error: building at STEP "…": …`. Its own warnings are `time="…" level=…` lines.
+*/
+function parseBuildahOutput(lines) {
+	let error = null;
+	let output = [];
+	for (const line of lines) if (/^STEP \d+\/\d+: /.test(line)) output = [];
+	else if (line.startsWith("Error: ")) error = line.slice(7);
+	else if (!error && line.trim() && !/^time="[^"]*" level=|^--> /.test(line)) output.push(line);
+	error = (error ?? "").replace(/^building at STEP "(?:[^"\\]|\\.)*": /, "").replace(/ &imagebuilder\.Step\{.*$/, "").trim() || null;
+	const code = /exit status (\d+)$/.exec(error ?? "")?.[1];
+	return {
+		error,
+		output: output.slice(-8),
+		exitCode: code ? Number(code) : null
+	};
+}
 /** ENOSPC or a SIGKILL (137, usually the out-of-memory killer), from anything the build printed. */
 function failureCause(text, exitCode) {
 	if (/no space left on device|ENOSPC/i.test(text)) return "enospc";
-	if (exitCode === 137 || /exit(?:ed| code:?) 137\b|signal: killed|OOMKilled/i.test(text)) return "oom";
+	if (exitCode === 137 || /exit(?:ed| code:?| status) 137\b|signal: killed|OOMKilled/i.test(text)) return "oom";
 	return null;
 }
-const causeLine = (cause) => cause === "enospc" ? "out of disk space (ENOSPC): free space for Docker (docker system df, reeval clean --images) and rerun" : "killed (exit 137): usually out of memory; give Docker more memory or lower the concurrency";
-const DETERMINISTIC = /did not complete successfully|dockerfile parse error|unknown instruction|should not be blank|pull access denied|repository does not exist|manifest unknown|not found: manifest|: not found\b|unauthorized|denied:|reeval needs a Debian or Ubuntu based image/i;
+const causeLine = (cause, engine) => {
+	const { name, bin } = engineSpec(engine);
+	return cause === "enospc" ? `out of disk space (ENOSPC): free space for ${name} (${bin} system df, reeval clean --images) and rerun` : `killed (exit 137): usually out of memory; give ${name} more memory or lower the concurrency`;
+};
+const DETERMINISTIC = /did not complete successfully|while running runtime: exit status|did not resolve to an alias|requested access to the resource is denied|dockerfile parse error|unknown instruction|should not be blank|pull access denied|repository does not exist|manifest unknown|not found: manifest|: not found\b|unauthorized|denied:|reeval needs a Debian or Ubuntu based image/i;
 const TRANSIENT = /EAI_AGAIN|ECONNRESET|ETIMEDOUT|ECONNREFUSED|i\/o timeout|TLS handshake timeout|no such host|temporary failure in name resolution|connection reset by peer|dial tcp|net\/http: request canceled|unexpected EOF|\b(?:500|502|503|504) |429 Too Many Requests|toomanyrequests|Service Unavailable|Bad Gateway|Gateway Timeout|ENOTFOUND/i;
 /** A registry or network error: a pull, a metadata lookup, or a download in the harness bootstrap. */
 const isTransient = (text) => !DETERMINISTIC.test(text) && TRANSIENT.test(text);
@@ -77,7 +1166,7 @@ const RETRY_DELAYS = [2e3, 8e3];
 */
 function failureMessage(parts) {
 	const lines = [parts.headline];
-	if (parts.cause) lines.push(causeLine(parts.cause));
+	if (parts.cause) lines.push(causeLine(parts.cause, parts.engine));
 	if (parts.output.length) lines.push(...parts.output.map((l) => `  | ${l}`));
 	if (parts.log) lines.push(`(full log: ${parts.log})`);
 	return lines.join("\n");
@@ -87,6 +1176,119 @@ function outputTail(text, max = 8) {
 	return stripAnsi(text).split(/\r?\n/).map((l) => l.trimEnd()).filter((l) => l.trim()).slice(-max);
 }
 //#endregion
+//#region ../sandbox-docker/src/process.ts
+const CMD_META = /([()\][%!^"`<>&|;, *?])/g;
+const cmdEscape = (arg, twice) => {
+	const quoted = `"${arg.replace(/(\\*)"/g, "$1$1\\\"").replace(/(\\*)$/, "$1$1")}"`.replace(CMD_META, "^$1");
+	return twice ? quoted.replace(CMD_META, "^$1") : quoted;
+};
+/**
+* How to spawn `cmd` on Windows, where npm, npx and pnpm are `.cmd` scripts that only cmd.exe
+* runs: the program PATH and PATHEXT find, and for a script, cmd.exe with every argument escaped.
+*/
+function windowsSpawn(cmd, args, env = process.env, exists = existsSync) {
+	const exts = (env.PATHEXT ?? ".COM;.EXE;.BAT;.CMD").split(";").filter(Boolean);
+	const file = (/[\\/]/.test(cmd) ? [""] : (env.PATH ?? env.Path ?? "").split(";").filter(Boolean)).flatMap((dir) => {
+		const base = dir ? win32.join(dir, cmd) : cmd;
+		return [...win32.extname(cmd) ? [base] : [], ...exts.map((ext) => base + ext.toLowerCase())];
+	}).find(exists) ?? cmd;
+	if (!/\.(cmd|bat)$/i.test(file)) return {
+		file,
+		args,
+		verbatim: false
+	};
+	const twice = /node_modules[\\/]\.bin[\\/][^\\/]+\.cmd$/i.test(file);
+	const line = [win32.normalize(file).replace(CMD_META, "^$1"), ...args.map((a) => cmdEscape(a, twice))].join(" ");
+	return {
+		file: env.ComSpec ?? "cmd.exe",
+		args: [
+			"/d",
+			"/s",
+			"/c",
+			`"${line}"`
+		],
+		verbatim: true
+	};
+}
+/**
+* Kills a process and everything it started: its process group on POSIX (a detached child leads
+* one), its process tree with `taskkill` on Windows, which has neither groups nor signals.
+*/
+function killTree(pid) {
+	if (process.platform === "win32") {
+		spawn("taskkill", [
+			"/pid",
+			String(pid),
+			"/t",
+			"/f"
+		], {
+			stdio: "ignore",
+			windowsHide: true
+		}).on("error", () => {});
+		return;
+	}
+	try {
+		process.kill(-pid, "SIGKILL");
+	} catch {
+		try {
+			process.kill(pid, "SIGKILL");
+		} catch {}
+	}
+}
+/** `s` as one single-quoted POSIX shell word. */
+const shellQuote = (s) => `'${s.replaceAll("'", `'\\''`)}'`;
+function run(cmd, args, options = {}) {
+	const { signal } = options;
+	return new Promise((resolve, reject) => {
+		if (signal?.aborted) return reject(signal.reason);
+		const detached = options.detached ?? true;
+		const target = process.platform === "win32" ? windowsSpawn(cmd, args, options.env ? {
+			...process.env,
+			...options.env
+		} : process.env) : {
+			file: cmd,
+			args,
+			verbatim: false
+		};
+		const child = spawn(target.file, target.args, {
+			cwd: options.cwd,
+			stdio: "pipe",
+			detached: detached && !target.verbatim,
+			windowsHide: true,
+			windowsVerbatimArguments: target.verbatim,
+			env: options.env ? {
+				...process.env,
+				...options.env
+			} : process.env
+		});
+		const out = [];
+		let stderr = "";
+		child.stdout.on("data", (d) => out.push(d));
+		child.stderr.on("data", (d) => {
+			stderr += d;
+		});
+		const onAbort = () => {
+			if ((detached || process.platform === "win32") && child.pid) killTree(child.pid);
+			else child.kill("SIGKILL");
+		};
+		signal?.addEventListener("abort", onAbort, { once: true });
+		child.on("error", reject);
+		child.on("close", (code) => {
+			signal?.removeEventListener("abort", onAbort);
+			if (signal?.aborted) return reject(signal.reason);
+			const stdout = Buffer.concat(out);
+			resolve({
+				exitCode: code ?? 1,
+				stdout: options.binary ? stdout : stdout.toString(),
+				stderr
+			});
+		});
+		if (child.pid) options.onSpawn?.(child.pid);
+		child.stdin.on("error", () => {});
+		child.stdin.end(options.input ?? "");
+	});
+}
+//#endregion
 //#region ../sandbox-docker/src/trace.ts
 /** Most of each stream a trace keeps; the rest is counted. */
 const MAX_STREAM = 4096;
@@ -104,9 +1306,10 @@ function streamPreview(data) {
 	if (data.includes(0) || !isUtf8(data)) return `<${data.length} bytes>`;
 	return clip(data.toString("utf8"), MAX_STREAM);
 }
-function traceDocker(args, startedAt, result) {
+function traceDocker(args, startedAt, result, bin = "docker") {
 	if (!listener) return;
 	const base = {
+		bin,
 		args: args.map((a) => clip(a, MAX_ARG)),
 		ms: Date.now() - startedAt
 	};
@@ -133,107 +1336,199 @@ function traceDocker(args, startedAt, result) {
 }
 //#endregion
 //#region ../sandbox-docker/src/docker-cli.ts
-/** Runs the docker CLI. `env` values are passed via the CLI's environment, never argv. */
+/** How long to wait before each retry of a command that never reached Podman. */
+const CONNECTION_RETRY_MS = [
+	100,
+	250,
+	500,
+	1e3,
+	2e3
+];
+/**
+* Whether a podman command failed before reaching the engine: the remote client's SSH handshake
+* or socket connection to `podman machine`, so running it again is safe.
+*/
+const isConnectionFailure = (r) => r.exitCode === 125 && /ssh: handshake failed|unable to connect to Podman socket/.test(r.stderr);
+const sleep = (ms, signal) => new Promise((resolve) => {
+	const timer = setTimeout(done, ms);
+	function done() {
+		clearTimeout(timer);
+		signal?.removeEventListener("abort", done);
+		resolve();
+	}
+	signal?.addEventListener("abort", done, { once: true });
+});
+/**
+* Runs `attempt` again, after each of `delays`, while its result is a connection failure (see
+* {@link isConnectionFailure}), and returns the last result.
+*/
+async function retryConnection(attempt, options = {}) {
+	const { delays = CONNECTION_RETRY_MS, signal, wait = sleep } = options;
+	let r = await attempt();
+	for (const ms of delays) {
+		if (!isConnectionFailure(r) || signal?.aborted) break;
+		await wait(ms, signal);
+		r = await attempt();
+	}
+	return r;
+}
+/** Runs the docker (or podman) CLI. `env` values are passed via the CLI's environment, never argv. */
 async function docker(args, options = {}) {
-	const startedAt = Date.now();
+	const { engine, ...rest } = options;
+	const { bin } = engineSpec(engine);
 	const stdin = options.input?.length ?? 0;
-	try {
-		const r = await run("docker", args, {
-			...options,
-			binary: true
-		});
-		traceDocker(args, startedAt, {
-			...r,
-			stdin
-		});
-		return r;
-	} catch (error) {
-		traceDocker(args, startedAt, { error });
-		throw error;
-	}
+	const env = {
+		...engineEnv(engine),
+		...rest.env
+	};
+	const once = async () => {
+		const startedAt = Date.now();
+		try {
+			const r = await run(bin, args, {
+				...rest,
+				env,
+				binary: true
+			});
+			traceDocker(args, startedAt, {
+				...r,
+				stdin
+			}, bin);
+			return r;
+		} catch (error) {
+			traceDocker(args, startedAt, { error }, bin);
+			throw error;
+		}
+	};
+	return engine === "podman" ? retryConnection(once, { signal: options.signal }) : once();
 }
 async function dockerOk(args, opts) {
 	const r = await docker(args, opts);
-	if (r.exitCode !== 0) throw new Error(`docker ${args[0]} failed: ${r.stderr.trim()}`);
+	if (r.exitCode !== 0) throw new Error(`${engineSpec(opts?.engine).bin} ${args[0]} failed: ${r.stderr.trim()}`);
 	return r.stdout.toString("utf8").trim();
 }
-/** Removes a container in its own process group, so removal survives this process being killed. */
-function removeContainerDetached(id) {
-	return new Promise((resolve) => {
+/** Whether `rm -f` left the container gone: it removed it, or it was already gone. */
+const removalDone = (r) => r.exitCode === 0 || /no such container/i.test(r.stderr);
+/** How long to wait before each retry of a removal that failed. */
+const REMOVAL_RETRY_MS = [
+	250,
+	500,
+	1e3,
+	2e3,
+	4e3
+];
+/**
+* Removes a container in its own process group, so removal survives this process being killed,
+* and tries again while it fails. Resolves either way.
+*/
+async function removeContainerDetached(id, engine, options = {}) {
+	const { bin, rmForce } = engineSpec(engine);
+	const { delays = REMOVAL_RETRY_MS, wait = sleep } = options;
+	const args = [...rmForce, id];
+	const env = {
+		...process.env,
+		...engineEnv(engine)
+	};
+	const once = () => new Promise((resolve) => {
 		const keepAlive = setInterval(() => {}, 1e3);
 		const startedAt = Date.now();
-		const args = [
-			"rm",
-			"-f",
-			id
-		];
+		let stderr = "";
+		let settled = false;
 		const done = (exitCode) => {
+			if (settled) return;
+			settled = true;
 			clearInterval(keepAlive);
-			traceDocker(args, startedAt, { exitCode });
-			resolve();
+			traceDocker(args, startedAt, {
+				exitCode,
+				stderr
+			}, bin);
+			resolve({
+				exitCode,
+				stderr
+			});
 		};
-		const child = spawn("docker", args, {
+		const child = spawn(bin, args, {
 			detached: true,
-			stdio: "ignore",
-			windowsHide: true
+			stdio: [
+				"ignore",
+				"ignore",
+				"pipe"
+			],
+			windowsHide: true,
+			env
+		});
+		child.stderr.on("data", (d) => {
+			stderr += d;
+		});
+		child.on("error", (error) => {
+			stderr += String(error);
+			done(null);
 		});
-		child.on("error", () => done(null));
 		child.on("close", done);
 	});
+	let r = await once();
+	for (const ms of delays) {
+		if (removalDone(r) || r.exitCode === null) return;
+		await wait(ms);
+		r = await once();
+	}
 }
 /**
 * Removes every container with `label` (`key=value`) for the next few seconds, in its own process
 * group so it outlives this process. For a `docker run` killed mid-way: the daemon may create the
 * container after the CLI dies, and its id never came back.
 */
-function sweepLabelDetached(label, seconds = 15) {
+function sweepLabelDetached(label, seconds = 15, engine) {
+	const { bin, rmForce } = engineSpec(engine);
 	const child = spawn(process.execPath, [
 		"-e",
 		`const { execFileSync } = require('node:child_process')
-const [filter, seconds] = process.argv.slice(1)
+const [filter, seconds, bin, ...rm] = process.argv.slice(1)
 const o = { encoding: 'utf8', stdio: ['ignore', 'pipe', 'ignore'], windowsHide: true }
 for (let i = 0; i < Number(seconds); i++) {
   try {
-    const ids = execFileSync('docker', ['ps', '-aq', '--filter', filter], o).split(/\\s+/).filter(Boolean)
-    if (ids.length) execFileSync('docker', ['rm', '-f', ...ids], o)
+    const ids = execFileSync(bin, ['ps', '-aq', '--filter', filter], o).split(/\\s+/).filter(Boolean)
+    if (ids.length) execFileSync(bin, [...rm, ...ids], o)
   } catch {}
   Atomics.wait(new Int32Array(new SharedArrayBuffer(4)), 0, 0, 1000)
 }`,
 		`label=${label}`,
-		String(seconds)
+		String(seconds),
+		bin,
+		...rmForce
 	], {
 		detached: true,
 		stdio: "ignore",
 		windowsHide: true,
 		env: {
 			...process.env,
+			...engineEnv(engine),
 			BUN_BE_BUN: "1"
 		}
 	});
 	child.on("error", () => {});
 	child.unref();
 }
-async function dockerState() {
+async function dockerState(engine) {
 	const r = await docker([
 		"info",
 		"--format",
-		"{{.ServerVersion}} {{.OSType}}"
-	]).catch(() => null);
+		engineSpec(engine).stateFormat
+	], { engine }).catch(() => null);
 	const [version, os] = r?.exitCode === 0 ? r.stdout.toString("utf8").trim().split(/\s+/) : [];
 	if (!version) return "down";
 	return os === "windows" ? "windows-containers" : "running";
 }
-/** Whether Docker is running Linux containers, as every sandbox needs. */
-async function dockerAvailable() {
-	return await dockerState() === "running";
+/** Whether Docker (or Podman) is running Linux containers, as every sandbox needs. */
+async function dockerAvailable(engine) {
+	return await dockerState(engine) === "running";
 }
-/** CPUs and memory of the machine containers run on (the VM, under Docker Desktop). */
-async function dockerCapacity() {
+/** CPUs and memory of the machine containers run on (the VM, under Docker Desktop or `podman machine`). */
+async function dockerCapacity(engine) {
 	const r = await docker([
 		"info",
 		"--format",
-		"{{.NCPU}} {{.MemTotal}}"
-	]).catch(() => null);
+		engineSpec(engine).capacityFormat
+	], { engine }).catch(() => null);
 	if (r?.exitCode !== 0) return null;
 	const [cpus, memoryBytes] = r.stdout.toString("utf8").trim().split(/\s+/).map(Number);
 	return cpus && memoryBytes ? {
@@ -247,23 +1542,51 @@ async function dockerCapacity() {
 * their bare local name (`reeval-sandbox@sha256:…`). A bare name is Docker Hub's `library/`
 * namespace, which only official images can push to, so only a digest whose name has a registry
 * host or a namespace counts. Official images such as `busybox` count as local; no image with
-* the harness baked in is one.
+* the harness baked in is one. Podman names local images `localhost/…`, which no one pulls from.
+*/
+const isRegistryDigest = (digest) => {
+	const name = digest.split("@")[0] ?? "";
+	return name.includes("/") && !name.startsWith("localhost/");
+};
+/** `repository:tag` of every local image in `repository`; none when the CLI fails. */
+async function imageTags(repository, engine) {
+	const r = await docker([
+		"image",
+		"ls",
+		"--format",
+		"{{.Repository}}:{{.Tag}}",
+		repository
+	], { engine }).catch(() => null);
+	if (r?.exitCode !== 0) return [];
+	return r.stdout.toString("utf8").split(/\r?\n/).filter(Boolean).map((t) => t.replace(/^localhost\//, ""));
+}
+/** `image inspect`'s answer when the engine has no such image (Docker's wording, then Podman's). */
+const isNoSuchImage = (stderr) => /no such image|image not known/i.test(stderr);
+/**
+* The image, or null when the engine says it has no such image. A CLI that can't start or a daemon
+* that doesn't answer throws instead, naming the error: that's not knowing, not a missing image.
 */
-const isRegistryDigest = (digest) => (digest.split("@")[0] ?? "").includes("/");
-async function imageInfo(image) {
+async function imageInfo(image, engine) {
+	const { bin, imageId } = engineSpec(engine);
 	const r = await docker([
 		"image",
 		"inspect",
 		"--format",
-		"{\"config\":{{json .Config}},\"id\":{{json .Id}},\"repoDigests\":{{json .RepoDigests}}}",
+		`{"config":{{json .Config}},"id":{{json ${imageId}}},"repoDigests":{{json .RepoDigests}}}`,
 		image
-	]).catch(() => null);
-	if (r?.exitCode !== 0) return null;
+	], { engine }).catch((error) => {
+		throw new Error(`${bin} image inspect ${image} couldn't run: ${error.message}`);
+	});
+	if (r.exitCode !== 0) {
+		const stderr = r.stderr.trim();
+		if (isNoSuchImage(stderr)) return null;
+		throw new Error(`${bin} image inspect ${image} failed: ${stderr || `exit ${r.exitCode}`}`);
+	}
 	const info = JSON.parse(r.stdout.toString("utf8"));
 	const repoDigests = (info.repoDigests ?? []).filter(isRegistryDigest);
 	return {
 		labels: info.config?.Labels ?? {},
-		id: info.id,
+		id: normalizeImageId(info.id),
 		repoDigests
 	};
 }
@@ -278,32 +1601,40 @@ async function imageInfo(image) {
 const HARNESS_PACKAGES = {
 	cursor: {
 		name: "@reeval/harness-cursor-sdk",
-		version: "0.1.4"
+		version: "0.1.5"
 	},
 	"claude-code": {
 		name: "@ai-sdk/harness-claude-code",
-		version: "1.0.152",
-		patch: "8edc594f"
+		version: "1.0.160",
+		patch: "907f9184"
 	},
 	antigravity: {
 		name: "@reeval/harness-antigravity",
-		version: "0.1.6"
+		version: "0.1.8"
 	},
 	opencode: {
 		name: "@reeval/harness-opencode",
-		version: "0.2.7"
+		version: "0.2.8"
 	},
 	goose: {
 		name: "@reeval/harness-goose",
-		version: "0.1.2"
+		version: "0.1.3"
 	},
 	pi: {
 		name: "@reeval/harness-pi",
-		version: "0.2.6"
+		version: "0.2.7"
 	},
 	codex: {
 		name: "@reeval/harness-codex",
-		version: "0.1.6"
+		version: "0.1.7"
+	},
+	fx: {
+		name: "@reeval/harness-fx",
+		version: "0.1.0"
+	},
+	"grok-build": {
+		name: "@reeval/harness-grok-build",
+		version: "0.1.0"
 	}
 };
 /** Every harness with an image, in {@link HARNESS_PACKAGES} order. */
@@ -668,7 +1999,9 @@ const HARNESS_HOSTS = {
 	opencode: ["generativelanguage.googleapis.com", "mcp.exa.ai"],
 	goose: ["generativelanguage.googleapis.com"],
 	pi: ["generativelanguage.googleapis.com"],
-	codex: ["api.openai.com"]
+	codex: ["api.openai.com"],
+	fx: ["ai-gateway.vercel.sh"],
+	"grok-build": ["api.x.ai"]
 };
 /** The package registries and GitHub, for a restricted policy that still installs. */
 const PACKAGE_HOSTS = Object.freeze([
@@ -1782,14 +3115,14 @@ const PROXY_PORT = 43128;
 const CA_PATH = "/usr/local/share/ca-certificates/reeval-egress.crt";
 /** Debian's system bundle, which `update-ca-certificates` rebuilds with the gateway's CA in it. */
 const CA_BUNDLE = "/etc/ssl/certs/ca-certificates.crt";
-const BUNDLED = "es:ca-bundle";
+const BUNDLED = "reeval:ca-bundle";
 const READY_TIMEOUT_MS = 15e3;
 /**
 * The gateway's side of the container runs as root, whoever the sandbox runs as: the sandbox user
 * can't signal, trace or replace the forwarder, or change the CA it installed.
 */
 const AS_ROOT = ["--user", "0:0"];
-const installCa = (containerId, cert, signal) => docker([
+const installCa = (containerId, cert, signal, engine) => docker([
 	"exec",
 	"--interactive",
 	...AS_ROOT,
@@ -1799,15 +3132,16 @@ const installCa = (containerId, cert, signal) => docker([
 	`umask 022 && mkdir -p "$(dirname ${CA_PATH})" && cat > ${CA_PATH} && { command -v update-ca-certificates >/dev/null && update-ca-certificates >/dev/null 2>&1 && grep -q "$(sed -n 2p ${CA_PATH})" ${CA_BUNDLE} && echo ${BUNDLED}; true; }`
 ], {
 	input: cert,
-	signal
+	signal,
+	engine
 });
 /**
 * Starts the egress gateway for one container: a forwarder inside it, tunnelled over one
 * `docker exec -i`, and the proxy in this process, which holds the real credentials.
 */
-async function startGateway(containerId, options, signal) {
+async function startGateway(containerId, options, signal, engine) {
 	const ca = createCertificateAuthority();
-	const installed = await installCa(containerId, ca.cert, signal);
+	const installed = await installCa(containerId, ca.cert, signal, engine);
 	if (installed.exitCode !== 0) throw new Error(`couldn't install the gateway CA: ${installed.stderr.trim()}`);
 	const bundled = installed.stdout.toString("utf8").includes(BUNDLED);
 	const proxy = createEgressProxy({
@@ -1824,14 +3158,19 @@ async function startGateway(containerId, options, signal) {
 		forwarderScript(PROXY_PORT)
 	];
 	const startedAt = Date.now();
-	const child = spawn("docker", args, {
+	const { bin } = engineSpec(engine);
+	const child = spawn(bin, args, {
 		stdio: "pipe",
-		detached: true
+		detached: true,
+		env: {
+			...process.env,
+			...engineEnv(engine)
+		}
 	});
 	child.once("close", (code) => traceDocker(args, startedAt, {
 		exitCode: code,
 		stderr
-	}));
+	}, bin));
 	let stderr = "";
 	child.stderr.on("data", (d) => {
 		stderr += d;
@@ -1982,14 +3321,21 @@ const ROOT_CAPABILITIES = [
 	"SETUID",
 	"SETGID"
 ];
-let hostCpus;
+const hostCpus = /* @__PURE__ */ new Map();
 /** Docker refuses `--cpus` above the host's count, so cap it there. */
-async function cpuLimit(cpus) {
-	hostCpus ??= dockerCapacity().then((c) => c?.cpus, () => void 0);
-	const available = await hostCpus;
+async function cpuLimit(cpus, engine = "docker") {
+	let known = hostCpus.get(engine);
+	if (!known) {
+		known = dockerCapacity(engine).then((c) => c?.cpus, () => void 0);
+		hostCpus.set(engine, known);
+	}
+	const available = await known;
 	return String(available ? Math.min(cpus, available) : cpus);
 }
-/** The `docker run` flags that confine the container: its user, capabilities and limits. */
+/**
+* The `docker run` flags that confine the container: its user, capabilities and limits, and on
+* Podman the bridge network and Docker's seccomp profile.
+*/
 async function confinementArgs(options) {
 	const limits = {
 		...DEFAULT_LIMITS,
@@ -2011,7 +3357,8 @@ async function confinementArgs(options) {
 		"--pids-limit",
 		String(limits.pids),
 		"--cpus",
-		await cpuLimit(limits.cpus)
+		await cpuLimit(limits.cpus, options.engine),
+		...engineSpec(options.engine).runArgs()
 	];
 }
 /** Runtime `npm i -g` goes to the sandbox user's own prefix, whose `bin` the images put on PATH. */
@@ -2023,14 +3370,14 @@ const EXEC_MARKER = "REEVAL_EXEC_ID";
 * `memory.events` and v1's `memory.oom_control` both have an `oom_kill` line. Without either,
 * Docker's `OOMKilled` says only whether there was one.
 */
-async function oomKills(id) {
+async function oomKills(id, engine) {
 	const events = await docker([
 		"exec",
 		id,
 		"sh",
 		"-c",
 		"cat /sys/fs/cgroup/memory.events 2>/dev/null || cat /sys/fs/cgroup/memory/memory.oom_control"
-	]).catch(() => null);
+	], { engine }).catch(() => null);
 	const count = events?.stdout.toString("utf8").match(/^oom_kill (\d+)$/m)?.[1];
 	if (events?.exitCode === 0 && count !== void 0) return Number(count);
 	const inspected = await docker([
@@ -2038,21 +3385,31 @@ async function oomKills(id) {
 		"--format",
 		"{{.State.OOMKilled}}",
 		id
-	]).catch(() => null);
+	], { engine }).catch(() => null);
 	if (inspected?.exitCode !== 0) return null;
 	const killed = inspected.stdout.toString("utf8").trim();
 	return killed === "true" ? 1 : killed === "false" ? 0 : null;
 }
 /** The Docker networks a container is attached to. */
-async function networksOf(id) {
+async function networksOf(id, engine) {
 	const out = await dockerOk([
 		"inspect",
 		"--format",
 		"{{json .NetworkSettings.Networks}}",
 		id
-	]);
+	], { engine });
 	return Object.keys(JSON.parse(out) ?? {});
 }
+/** How the container is networked when it's on no network: `host`, `slirp4netns`, `pasta`…  */
+async function networkMode(id, engine) {
+	const r = await docker([
+		"inspect",
+		"--format",
+		"{{.HostConfig.NetworkMode}}",
+		id
+	], { engine }).catch(() => null);
+	return r?.exitCode === 0 ? r.stdout.toString("utf8").trim() || "unknown" : "unknown";
+}
 /**
 * A harness sandbox session backed by one local Docker container. Commands and file I/O go
 * through `docker exec`. With the egress gateway, ports are reached through its tunnel whatever
@@ -2067,6 +3424,8 @@ async function createDockerSession(options) {
 	};
 	const lifetime = Math.ceil((options.lifetimeMs ?? 864e5) / 1e3);
 	const signal = options.abortSignal;
+	const { engine } = options;
+	const spec = engineSpec(engine);
 	const env = {
 		...userEnv(options),
 		...options.env
@@ -2081,20 +3440,21 @@ async function createDockerSession(options) {
 		...Object.keys(env).flatMap((k) => ["--env", k]),
 		"--publish",
 		`127.0.0.1::${BRIDGE_PORT}`,
-		"--workdir",
-		SANDBOX_ROOT,
+		...spec.createsWorkdir ? ["--workdir", SANDBOX_ROOT] : [],
 		"--entrypoint",
 		"sleep",
 		options.image,
 		String(lifetime)
 	], {
 		signal,
-		env
+		env,
+		engine
 	}).catch((error) => {
-		if (signal?.aborted) sweepLabelDetached(`${LABEL.session}=${nonce}`);
-		if (/unable to find user/i.test(error.message)) {
-			sweepLabelDetached(`${LABEL.session}=${nonce}`);
-			throw new Error(`${options.image} has no ${SANDBOX_USER} user to run the sandbox as. Images reeval builds have one: rebuild it (reeval image build), or start from reeval's image or docker({ from }). An eval that needs root at run time can opt in with docker({ root: true }).`);
+		const sweep = () => sweepLabelDetached(`${LABEL.session}=${nonce}`, void 0, engine);
+		if (signal?.aborted) sweep();
+		if (/unable to find user|no matching entries in passwd/i.test(error.message)) {
+			sweep();
+			throw new Error(`${options.image} has no ${SANDBOX_USER} user to run the sandbox as. Images reeval builds have one: rebuild it (reeval image build), or start from reeval's image or ${spec.fn}({ from }). An eval that needs root at run time can opt in with ${spec.fn}({ root: true }).`);
 		}
 		throw error;
 	});
@@ -2102,33 +3462,57 @@ async function createDockerSession(options) {
 	let removed;
 	const remove = () => {
 		gateway?.close();
-		removed ??= removeContainerDetached(id);
+		removed ??= removeContainerDetached(id, engine);
 		return removed;
 	};
 	if (signal?.aborted) {
 		await remove();
 		throw signal.reason;
 	}
+	if (!spec.createsWorkdir) {
+		const made = await docker([
+			"exec",
+			"--user",
+			"0:0",
+			id,
+			"mkdir",
+			"-p",
+			SANDBOX_ROOT
+		], {
+			engine,
+			signal
+		}).catch((error) => ({
+			exitCode: 1,
+			stderr: error.message
+		}));
+		if (made.exitCode !== 0) {
+			await remove();
+			if (signal?.aborted) throw signal.reason;
+			throw new Error(`Couldn't create ${SANDBOX_ROOT} in the container: ${made.stderr.trim()}`);
+		}
+	}
 	const egressOptions = options.egress === true ? {} : options.egress || void 0;
 	let egress;
 	let detached = [];
 	const attach = async (policy) => {
 		if (isRestricted(policy) && detached.length === 0) {
-			detached = await networksOf(id);
+			detached = await networksOf(id, engine);
+			const mode = detached.length === 0 ? await networkMode(id, engine) : "none";
+			if (detached.length === 0 && mode !== "none") throw new Error(`the container's network is ${mode}, which ${spec.name} can't detach it from, so a restricted policy would still have a route out`);
 			for (const n of detached) await dockerOk([
 				"network",
 				"disconnect",
 				"--force",
 				n,
 				id
-			]);
+			], { engine });
 		} else if (!isRestricted(policy) && detached.length > 0) {
 			for (const n of detached) await dockerOk([
 				"network",
 				"connect",
 				n,
 				id
-			]);
+			], { engine });
 			detached = [];
 		}
 	};
@@ -2139,7 +3523,7 @@ async function createDockerSession(options) {
 			gateway = await startGateway(id, {
 				...rest,
 				policy
-			}, signal);
+			}, signal, engine);
 			egress = { active: true };
 		} catch (error) {
 			if (signal?.aborted || isRestricted(policy)) {
@@ -2182,14 +3566,15 @@ async function createDockerSession(options) {
 		"sh",
 		"-c",
 		`for e in /proc/[0-9]*/environ; do grep -qsxzF ${shellQuote(`${EXEC_MARKER}=${marker}`)} "$e" && kill -9 "$(basename "$(dirname "$e")")" 2>/dev/null; done; true`
-	]).then(() => {}, () => {});
+	], { engine }).then(() => {}, () => {});
 	const run = async (o) => {
 		const env = envFor(o.env);
 		const marker = nextMarker();
 		try {
 			const r = await docker(execArgs(o.command, marker, o.workingDirectory, env), {
 				env,
-				signal: o.abortSignal
+				signal: o.abortSignal,
+				engine
 			});
 			return {
 				exitCode: r.exitCode,
@@ -2208,7 +3593,10 @@ async function createDockerSession(options) {
 			"cat",
 			"--",
 			posix.resolve(SANDBOX_ROOT, o.path)
-		], { signal: o.abortSignal });
+		], {
+			signal: o.abortSignal,
+			engine
+		});
 		return r.exitCode === 0 ? new Uint8Array(r.stdout) : null;
 	};
 	const writeBinaryFile = async (o) => {
@@ -2222,7 +3610,8 @@ async function createDockerSession(options) {
 			`mkdir -p ${shellQuote(posix.dirname(path))} && cat > ${shellQuote(path)}`
 		], {
 			input: Buffer.from(o.content),
-			signal: o.abortSignal
+			signal: o.abortSignal,
+			engine
 		});
 	};
 	const brokering = gateway ? {
@@ -2245,7 +3634,7 @@ async function createDockerSession(options) {
 	} : {};
 	const session = {
 		id,
-		description: `Docker container ${id.slice(0, 12)} (${options.image})`,
+		description: `${spec.name} container ${id.slice(0, 12)} (${options.image})`,
 		defaultWorkingDirectory: SANDBOX_ROOT,
 		ports: [BRIDGE_PORT],
 		get egress() {
@@ -2257,30 +3646,31 @@ async function createDockerSession(options) {
 		},
 		...brokering,
 		...substituting,
-		oomKills: () => oomKills(id),
+		oomKills: () => oomKills(id, engine),
 		run,
 		async spawn(o) {
 			const env = envFor(o.env);
 			const marker = nextMarker();
 			const args = execArgs(o.command, marker, o.workingDirectory, env);
 			const startedAt = Date.now();
-			const child = spawn("docker", args, {
+			const child = spawn(spec.bin, args, {
 				stdio: [
 					"ignore",
 					"pipe",
 					"pipe"
 				],
 				detached: true,
-				env: env ? {
+				env: {
 					...process.env,
+					...engineEnv(engine),
 					...env
-				} : process.env
+				}
 			});
 			const exited = new Promise((resolve) => child.on("close", (code) => {
 				traceDocker(args, startedAt, {
 					exitCode: code,
 					stdout: "<streamed>"
-				});
+				}, spec.bin);
 				resolve({ exitCode: code ?? 1 });
 			}));
 			const kill = async () => {
@@ -2329,10 +3719,10 @@ async function createDockerSession(options) {
 				"port",
 				id,
 				`${port}/tcp`
-			]);
+			], { engine });
 			const hostPort = mapped.stdout.toString("utf8").split("\n")[0]?.split(":").at(-1);
 			if (mapped.exitCode !== 0 || !hostPort) {
-				const reason = mapped.stderr.trim() || "Docker reports no host port for it";
+				const reason = mapped.stderr.trim() || `${spec.name} reports no host port for it`;
 				throw new Error(`Port ${port} of ${id.slice(0, 12)} isn't reachable: ${reason}`);
 			}
 			return { url: `${scheme}://127.0.0.1:${hostPort}` };
@@ -2363,7 +3753,7 @@ async function createDockerSession(options) {
 /** The session as an AI SDK harness sandbox provider. */
 const dockerSandboxProvider = (options) => ({
 	specificationVersion: "harness-sandbox-v1",
-	providerId: "reeval-docker",
+	providerId: options.engine === "podman" ? "reeval-podman" : "reeval-docker",
 	async createSession(o) {
 		const session = await createDockerSession({
 			...options,
@@ -2396,22 +3786,22 @@ const BOOTSTRAPS = {
 		name: "Cursor",
 		cli: "@cursor/sdk",
 		version: `node -p "'@cursor/sdk ' + require(process.env.HOME + '/.ai-sdk-harness/.harness-bootstrap/cursor-sdk/node_modules/@cursor/sdk/package.json').version"`,
-		adapter: async () => (await import("./src-sIsDHWYq.js")).createCursorSdk()
+		adapter: async () => (await import("./src-WD-zgQYZ.js")).createCursorSdk()
 	},
 	"claude-code": {
 		name: "Claude Code",
 		cli: "claude",
-		adapter: async () => (await import("./dist-CTzThfu_.js")).createClaudeCode()
+		adapter: async () => (await import("./dist-CuY4ehEk.js")).createClaudeCode()
 	},
 	antigravity: {
 		name: "Antigravity",
 		cli: "agy",
-		adapter: async () => (await import("./src-BGWuWp6I.js")).createAntigravity()
+		adapter: async () => (await import("./src-_oI9AePb.js")).createAntigravity()
 	},
 	opencode: {
 		name: "OpenCode",
 		cli: "opencode",
-		adapter: async () => (await import("./src-DLa-ESW0.js")).createOpenCode({
+		adapter: async () => (await import("./src-CLoOMVWI.js")).createOpenCode({
 			auth: { GOOGLE_GENERATIVE_AI_API_KEY: "unused" },
 			model: "google/unused"
 		})
@@ -2419,7 +3809,7 @@ const BOOTSTRAPS = {
 	goose: {
 		name: "Goose",
 		cli: "goose",
-		adapter: async () => (await import("./src-Bx2x1ekD.js")).createGoose({
+		adapter: async () => (await import("./src-qsKCqv7a.js")).createGoose({
 			auth: { GOOGLE_API_KEY: "unused" },
 			model: "unused"
 		})
@@ -2427,12 +3817,28 @@ const BOOTSTRAPS = {
 	pi: {
 		name: "pi",
 		cli: "pi",
-		adapter: async () => (await import("./src-BRt0O02i.js")).createPi({ auth: { GEMINI_API_KEY: "unused" } })
+		adapter: async () => (await import("./src-DSYYPEOj.js")).createPi({ auth: { GEMINI_API_KEY: "unused" } })
 	},
 	codex: {
 		name: "Codex",
 		cli: "codex",
-		adapter: async () => (await import("./src-cN0aB-WR.js")).createCodex({ auth: { OPENAI_API_KEY: "unused" } })
+		adapter: async () => (await import("./src-DCFtJRp0.js")).createCodex({ auth: { OPENAI_API_KEY: "unused" } })
+	},
+	fx: {
+		name: "fx",
+		cli: "fx",
+		adapter: async () => (await import("./src-BxfCKA3_.js")).createFx({
+			auth: { AI_GATEWAY_API_KEY: "unused" },
+			model: "unused/unused"
+		})
+	},
+	"grok-build": {
+		name: "Grok Build",
+		cli: "grok",
+		adapter: async () => (await import("./src-CcrQbpG8.js")).createGrokBuild({
+			auth: { XAI_API_KEY: "unused" },
+			model: "unused"
+		})
 	}
 };
 /** Keeps the image's `PATH` in login shells, which Debian's `/etc/profile` resets. */
@@ -2464,10 +3870,10 @@ WORKDIR ${SANDBOX_ROOT}/${WORKSPACE_DIR}
 `;
 const tail = (text) => text.trim().split("\n").slice(-15).join("\n");
 const clipLine = (text, max = 300) => text.length > max ? `${text.slice(0, max - 1)}…` : text;
-/** Why a `docker build` failed, in a line: the failing step's exit, or BuildKit's own error. */
-function buildReason(error) {
-	if (!error) return "docker build failed";
-	const exit = /^process ".*" did not complete successfully: exit code: (\d+)$/s.exec(error);
+/** Why a `docker build` failed, in a line: the failing step's exit, or BuildKit's (or buildah's) own error. */
+function buildReason(error, engine) {
+	if (!error) return `${engineSpec(engine).bin} build failed`;
+	const exit = /^process ".*" did not complete successfully: exit code: (\d+)$/s.exec(error) ?? /^while running runtime: exit status (\d+)$/.exec(error);
 	return exit ? `a RUN step exited ${exit[1]}` : clipLine(error.replace(/\s+/g, " "));
 }
 /**
@@ -2479,12 +3885,13 @@ function buildError(output, what, reason, keep = () => true) {
 	const text = [parsed.error ?? "", ...parsed.output].join("\n");
 	const cause = failureCause(text, parsed.exitCode);
 	parsed.output = parsed.output.filter(keep);
-	const why = reason?.(parsed) ?? buildReason(parsed.error);
+	const why = reason?.(parsed) ?? buildReason(parsed.error, what.engine);
 	return new ImageBuildError(failureMessage({
 		headline: `${what.headline} failed: ${why}`,
 		cause,
 		output: parsed.output,
-		log: what.log ?? null
+		log: what.log ?? null,
+		...what.engine ? { engine: what.engine } : {}
 	}), {
 		stage: what.stage,
 		ref: what.ref,
@@ -2499,12 +3906,12 @@ const BUILT_BY = ["--label", `${LABEL.managed}=image`];
 * Removes the images reeval built that nothing tags any more (a rebuild's old image) and the
 * intermediate `-base` tags of `from` builds. Returns how many it removed.
 */
-async function pruneImages() {
+async function pruneImages(engine) {
 	const list = async (args) => (await docker([
 		"image",
 		"ls",
 		...args
-	])).stdout.toString("utf8").split("\n").map((l) => l.trim()).filter(Boolean);
+	], { engine })).stdout.toString("utf8").split("\n").map((l) => l.trim()).filter(Boolean);
 	const dangling = [...await list([
 		"-q",
 		"--filter",
@@ -2528,46 +3935,93 @@ async function pruneImages() {
 		"image",
 		"rm",
 		ref
-	]).catch(() => null))?.exitCode === 0) removed++;
+	], { engine }).catch(() => null))?.exitCode === 0) removed++;
 	return removed;
 }
+/** Docker's names for Node's architectures, as image indexes list platforms. */
+const OCI_ARCH = {
+	x64: "amd64",
+	arm64: "arm64",
+	arm: "arm",
+	ppc64: "ppc64le"
+};
+/**
+* A registry digest for `from` without Docker's buildx: skopeo's, which is the same digest
+* buildx gives, or else this platform's manifest from `podman manifest inspect`.
+*/
+async function podmanRemoteDigest(from, signal) {
+	const skopeo = await run("skopeo", [
+		"inspect",
+		"--format",
+		"{{.Digest}}",
+		`docker://${from}`
+	], { ...signal ? { signal } : {} }).catch(() => null);
+	const digest = skopeo?.exitCode === 0 ? skopeo.stdout.trim() : "";
+	if (digest.startsWith("sha256:")) return { digest };
+	const r = await docker([
+		"manifest",
+		"inspect",
+		from
+	], {
+		signal,
+		engine: "podman"
+	}).catch(() => null);
+	if (r?.exitCode === 0) {
+		const manifest = JSON.parse(r.stdout.toString("utf8"));
+		const arch = OCI_ARCH[process.arch] ?? process.arch;
+		const own = manifest.manifests?.find((m) => m.platform?.os === "linux" && m.platform.architecture === arch)?.digest;
+		if (own?.startsWith("sha256:")) return { digest: own };
+	}
+	return { error: (r?.stderr.trim() || skopeo?.stderr.trim() || "").replace(/^(?:Error|time="[^"]*" level=fatal msg=): ?/, "").replace(/\s+/g, " ") || `${from} doesn't resolve` };
+}
 /**
 * What a `from` names now, without pulling: its registry digest, or for an image that's only
 * local, its id (`local`). `error` when neither resolves, e.g. a typo or no network.
 */
-async function resolveFrom(from, signal) {
+async function resolveFrom(from, signal, engine) {
 	const pinned = /@(sha256:[0-9a-f]{64})$/.exec(from)?.[1];
 	if (pinned) return {
 		digest: pinned,
 		local: false
 	};
-	const remote = await docker([
-		"buildx",
-		"imagetools",
-		"inspect",
-		"--format",
-		"{{json .Manifest.Digest}}",
-		from
-	], { signal }).catch(() => null);
-	const digest = remote?.exitCode === 0 ? JSON.parse(remote.stdout.toString("utf8").trim()) : null;
-	if (typeof digest === "string" && digest.startsWith("sha256:")) return {
-		digest,
-		local: false
-	};
-	const local = await imageInfo(from);
+	let error = null;
+	if (engine === "podman") {
+		const remote = await podmanRemoteDigest(from, signal);
+		if ("digest" in remote) return {
+			digest: remote.digest,
+			local: false
+		};
+		error = remote.error;
+	} else {
+		const remote = await docker([
+			"buildx",
+			"imagetools",
+			"inspect",
+			"--format",
+			"{{json .Manifest.Digest}}",
+			from
+		], { signal }).catch(() => null);
+		const digest = remote?.exitCode === 0 ? JSON.parse(remote.stdout.toString("utf8").trim()) : null;
+		if (typeof digest === "string" && digest.startsWith("sha256:")) return {
+			digest,
+			local: false
+		};
+		error = remote?.stderr.trim().replace(/^ERROR: /, "").replace(/\s+/g, " ") || null;
+	}
+	const local = await imageInfo(from, engine).catch(() => null);
 	if (local) return {
 		digest: local.id,
 		local: true
 	};
-	return { error: remote?.stderr.trim().replace(/^ERROR: /, "").replace(/\s+/g, " ") || `${from} doesn't resolve` };
+	return { error: error || `${from} doesn't resolve` };
 }
 /** Removes a tag or an image reeval replaced, unless something still uses it. */
-const removeQuietly = async (ref) => {
+const removeQuietly = async (ref, engine) => {
 	await docker([
 		"image",
 		"rm",
 		ref
-	]).catch(() => {});
+	], { engine }).catch(() => {});
 };
 /** The hash of reeval's base image build context, which its images carry as a label. */
 function contextHash() {
@@ -2587,14 +4041,14 @@ function contextHash() {
 * intermediate `-base` tag of a `from` build, are removed once the new one is committed.
 */
 async function buildImage(log, options) {
-	const { harness, from, signal } = options;
-	const resolved = from ? await resolveFrom(from, signal) : null;
+	const { harness, from, signal, engine } = options;
+	const resolved = from ? await resolveFrom(from, signal, engine) : null;
 	const digest = resolved && "digest" in resolved ? resolved.digest : null;
 	const pinned = from && digest && resolved && "local" in resolved && !resolved.local && !from.includes("@") ? `${from}@${digest}` : from;
 	const bootstrap = BOOTSTRAPS[harness];
 	const base = from ? `${harnessImageFor(harness, from)}-base` : BASE_IMAGE;
 	const target = from ? harnessImageFor(harness, from) : imageFor(harness);
-	const previous = [(await imageInfo(target))?.id, from ? null : (await imageInfo(base))?.id];
+	const previous = [(await imageInfo(target, engine))?.id, from ? null : (await imageInfo(base, engine))?.id];
 	log(`Building ${base}${from ? ` from ${from}` : ""}`);
 	const build = from ? await docker([
 		"build",
@@ -2607,7 +4061,8 @@ async function buildImage(log, options) {
 		"-"
 	], {
 		input: toolchainDockerfile(pinned ?? from),
-		signal
+		signal,
+		engine
 	}) : await docker([
 		"build",
 		"--progress",
@@ -2620,20 +4075,25 @@ async function buildImage(log, options) {
 		"--tag",
 		base,
 		DOCKER_CONTEXT
-	], { signal });
+	], {
+		signal,
+		engine
+	});
 	const output = `${build.stdout.toString("utf8")}${build.stderr}`;
 	options.output?.write(output);
 	if (build.exitCode !== 0) throw buildError(output, {
 		stage: from ? "from" : "harness",
 		ref: target,
 		headline: from ? `Building the toolchain layer FROM ${from}` : "Building reeval's base image",
-		log: options.output?.path ?? null
+		log: options.output?.path ?? null,
+		engine
 	}, (parsed) => parsed.output.find((l) => l.startsWith("reeval needs a Debian")) ?? null);
 	log(`Installing the ${bootstrap.name} harness bootstrap`);
 	const session = await createDockerSession({
 		image: base,
 		lifetimeMs: 18e5,
-		...signal ? { abortSignal: signal } : {}
+		...signal ? { abortSignal: signal } : {},
+		...engine ? { engine } : {}
 	});
 	let agentVersion;
 	try {
@@ -2653,7 +4113,7 @@ async function buildImage(log, options) {
 			"CMD [\"bash\"]",
 			session.id,
 			target
-		]);
+		], { engine });
 	} catch (error) {
 		if (signal?.aborted || error instanceof ImageBuildError) throw error;
 		const [first = "", ...rest] = error.message.split("\n");
@@ -2663,7 +4123,8 @@ async function buildImage(log, options) {
 			headline: `Baking the ${bootstrap.name} CLI onto ${from ?? "reeval-sandbox-base:latest"} failed: ${clipLine(first)}`,
 			cause,
 			output: outputTail(rest.join("\n")),
-			log: options.output?.path ?? null
+			log: options.output?.path ?? null,
+			...engine ? { engine } : {}
 		}), {
 			stage: "harness",
 			ref: target,
@@ -2674,9 +4135,9 @@ async function buildImage(log, options) {
 	} finally {
 		await session.destroy();
 	}
-	if (from) await removeQuietly(base);
-	const now = (await imageInfo(target))?.id;
-	for (const id of previous) if (id && id !== now) await removeQuietly(id);
+	if (from) await removeQuietly(base, engine);
+	const now = (await imageInfo(target, engine))?.id;
+	for (const id of previous) if (id && id !== now) await removeQuietly(id, engine);
 	return {
 		image: target,
 		agentVersion
@@ -2719,15 +4180,18 @@ function installScript(steps) {
 }
 /** Builds the install layer if it's missing. `output` gets the build's output, for a log file. */
 async function buildInstallLayer(parent, steps, options = {}) {
-	const { signal } = options;
+	const { signal, engine } = options;
 	const tag = installLayerTag(parent, steps);
 	if ((await docker([
 		"image",
 		"inspect",
 		"--format",
-		"{{.Id}}",
+		"{{.Created}}",
 		tag
-	], { signal })).exitCode === 0) return tag;
+	], {
+		signal,
+		engine
+	})).exitCode === 0) return tag;
 	const script = installScript(steps);
 	const encoded = Buffer.from(script).toString("base64");
 	const home = `$(getent passwd ${SANDBOX_USER} | cut -d: -f6)`;
@@ -2750,7 +4214,8 @@ async function buildInstallLayer(parent, steps, options = {}) {
 		"-"
 	], {
 		input: dockerfile,
-		signal
+		signal,
+		engine
 	});
 	const output = `${build.stdout.toString("utf8")}${build.stderr}`;
 	options.output?.write(`${script}\n${dockerfile}\n\n${output}`);
@@ -2760,7 +4225,8 @@ async function buildInstallLayer(parent, steps, options = {}) {
 			stage: "install",
 			ref: tag,
 			headline: `Building the install layer (${`${steps.length} command${steps.length === 1 ? "" : "s"}`})`,
-			log: options.output?.path ?? null
+			log: options.output?.path ?? null,
+			engine
 		}, () => failed ? `install ${failed[1]} exited ${failed[2]}: ${clipLine(failed[3] ?? "")}` : null, (line) => !line.startsWith("reeval: install "));
 	}
 	return tag;
@@ -2820,16 +4286,16 @@ function contextFiles(context, dockerfile) {
 	return files.sort();
 }
 /** Whether the Dockerfile starts from reeval's sandbox image, which then has to exist first. */
-const usesEsBase = (dockerfile) => new RegExp(`\\$\\{?${REEVAL_BASE_ARG}\\b`).test(readFileSync(dockerfile, "utf8"));
+const usesReevalBase = (dockerfile) => new RegExp(`\\$\\{?${REEVAL_BASE_ARG}\\b`).test(readFileSync(dockerfile, "utf8"));
 /**
 * The tag of a `docker({ dockerfile })` build for a harness: a hash of the Dockerfile, every file
 * of its build context (its directory, less `.dockerignore`) and, for a Dockerfile `FROM
 * ${REEVAL_BASE}`, the id of the harness's image it names, so an edit to any of them, or a rebuilt reeval
-* image, builds anew. `esBase` is that id (null when it isn't built).
+* image, builds anew. `reevalBase` is that id (null when it isn't built).
 */
-function dockerfileTag(dockerfile, harness, esBase = null) {
+function dockerfileTag(dockerfile, harness, reevalBase = null) {
 	const context = dirname(dockerfile);
-	const base = usesEsBase(dockerfile) ? `${imageFor(harness)}@${esBase ?? "unbuilt"}` : "";
+	const base = usesReevalBase(dockerfile) ? `${imageFor(harness)}@${reevalBase ?? "unbuilt"}` : "";
 	const hash = createHash("sha256").update(`${REEVAL_BASE_ARG}=${base}\0`);
 	for (const path of contextFiles(context, dockerfile)) {
 		const full = join(context, path);
@@ -2846,14 +4312,14 @@ function dockerfileTag(dockerfile, harness, esBase = null) {
 }
 /**
 * Builds the user's Dockerfile with plain `docker build` (so Docker's layer cache applies), from
-* its directory, with `REEVAL_BASE` set to the harness's sandbox image (whose id is `esBase`).
+* its directory, with `REEVAL_BASE` set to the harness's sandbox image (whose id is `reevalBase`).
 * Rebuilds even when the tag exists with `force`, as `reeval image build` does, and then removes the
 * image the tag pointed at before. `name` is the path failures name.
 */
 async function buildDockerfile(dockerfile, options) {
-	const { harness, signal } = options;
-	const { tag } = dockerfileTag(dockerfile, harness, options.esBase ?? null);
-	const previous = (await imageInfo(tag))?.id;
+	const { harness, signal, engine } = options;
+	const { tag } = dockerfileTag(dockerfile, harness, options.reevalBase ?? null);
+	const previous = (await imageInfo(tag, engine))?.id;
 	if (previous && !options.force) return tag;
 	const build = await docker([
 		"build",
@@ -2868,20 +4334,24 @@ async function buildDockerfile(dockerfile, options) {
 		"--tag",
 		tag,
 		dirname(dockerfile)
-	], { signal });
+	], {
+		signal,
+		engine
+	});
 	const output = `${build.stdout.toString("utf8")}${build.stderr}`;
 	options.output?.write(output);
 	if (build.exitCode !== 0) throw buildError(output, {
 		stage: "dockerfile",
 		ref: tag,
 		headline: `Building ${options.name ?? dockerfile}`,
-		log: options.output?.path ?? null
+		log: options.output?.path ?? null,
+		engine
 	});
-	const now = (await imageInfo(tag))?.id;
-	if (previous && previous !== now) await removeQuietly(previous);
+	const now = (await imageInfo(tag, engine))?.id;
+	if (previous && previous !== now) await removeQuietly(previous, engine);
 	return tag;
 }
 //#endregion
-export { onDockerCommand as $, hostAllowed as A, WORKSPACE_DIR as B, applyTransformations as C, HARNESS_HOSTS as D, DOCKER_EGRESS as E, HARNESS_PACKAGES as F, docker as G, harnessLabel as H, LABEL as I, dockerOk as J, dockerAvailable as K, SANDBOX_HOME as L, BASE_IMAGE as M, BRIDGE_PORT as N, PACKAGE_HOSTS as O, DEFAULT_IMAGE as P, removeContainerDetached as Q, SANDBOX_ROOT as R, placeholder as S, onEndpoint as T, imageFor as U, adapterVersion as V, isBakedHarness as W, imageInfo as X, dockerState as Y, isRegistryDigest as Z, ROOT_CAPABILITIES as _, buildInstallLayer as a, parseBuildOutput as at, CA_PATH as b, dockerfileTag as c, installLayerTag as d, ImageBuildError as et, installScript as f, DEFAULT_LIMITS as g, usesEsBase as h, buildImage as i, isTransient as it, BAKED_HARNESSES as j, defaultAllowedHosts as k, dockerignoreMatcher as l, resolveFrom as m, REEVAL_BASE_ARG as n, causeLine as nt, contextFiles as o, retryTransient as ot, pruneImages as p, dockerCapacity as q, buildDockerfile as r, failureCause as rt, contextHash as s, DOCKER_CONTEXT as t, RETRY_DELAYS as tt, harnessImageFor as u, createDockerSession as v, matches as w, PROXY_PORT as x, dockerSandboxProvider as y, SANDBOX_USER as z };
+export { removeContainerDetached as $, hostAllowed as A, WORKSPACE_DIR as B, applyTransformations as C, HARNESS_HOSTS as D, DOCKER_EGRESS as E, HARNESS_PACKAGES as F, docker as G, harnessLabel as H, LABEL as I, dockerOk as J, dockerAvailable as K, SANDBOX_HOME as L, BASE_IMAGE as M, BRIDGE_PORT as N, PACKAGE_HOSTS as O, DEFAULT_IMAGE as P, isRegistryDigest as Q, SANDBOX_ROOT as R, placeholder as S, onEndpoint as T, imageFor as U, adapterVersion as V, isBakedHarness as W, imageInfo as X, dockerState as Y, imageTags as Z, ROOT_CAPABILITIES as _, buildInstallLayer as a, causeLine as at, CA_PATH as b, dockerfileTag as c, parseBuildOutput as ct, installLayerTag as d, dockerSeccompFile as dt, onDockerCommand as et, installScript as f, engineSpec as ft, DEFAULT_LIMITS as g, usesReevalBase as h, buildImage as i, RETRY_DELAYS as it, BAKED_HARNESSES as j, defaultAllowedHosts as k, dockerignoreMatcher as l, retryTransient as lt, resolveFrom as m, REEVAL_BASE_ARG as n, shellQuote as nt, contextFiles as o, failureCause as ot, pruneImages as p, normalizeImageId as pt, dockerCapacity as q, buildDockerfile as r, ImageBuildError as rt, contextHash as s, isTransient as st, DOCKER_CONTEXT as t, run as tt, harnessImageFor as u, ENGINES as ut, createDockerSession as v, matches as w, PROXY_PORT as x, dockerSandboxProvider as y, SANDBOX_USER as z };
 
-//# sourceMappingURL=src-8rRXy4u9.js.map
+//# sourceMappingURL=src-ftu5wPSt.js.map