Docker tasks: --docker-runtime option (runsc support, default off)

DockerExecutor gains a runtime parameter (passed as docker --runtime
in build_run_command, after --pids-limit); worker CLI gains
--docker-runtime, wired through _build_cli_executor. Unset or empty
means no --runtime flag, so existing tasks keep docker default (runc);
an unregistered runtime fails container start (fail closed), it never
silently falls back. Tests: runsc appears in the command, default/empty
omit it, CLI wiring passes through. README documents the flag and
corrects a stale multi-tenant note (host kernel does not ban userns;
bwrap fails inside Docker containers on nested-pidns proc mount).

cloud/sandbox.py

@@ -265,7 +265,7 @@ class DockerExecutor(Executor):
                  user="1000:1000", worktrees_root=None, env=None,
                  env_key="XCM_API_KEY", timeout=None, extra_mounts=None,
                  model=None, security_opts=None, pids_limit=None,
-                 extra_env=None):
+                 runtime=None, extra_env=None):
         if host_py_path is None:
             here = os.path.dirname(os.path.abspath(__file__))
             host_py_path = os.path.join(os.path.dirname(here), "host.py")
@@ -294,6 +294,13 @@ class DockerExecutor(Executor):
         # 的 -e 名方式）。
         self.security_opts = list(security_opts or [])
         self.pids_limit = pids_limit
+        # runtime：docker --runtime（如 runsc，gVisor 沙箱）。
+        # None 或空串 = 不传 --runtime，走 docker 默认（runc），
+        # 现有任务行为不变；显式值由 docker 在起容器时校验，
+        # 未注册的 runtime 会起容器失败（fail closed）。
+        self.runtime = runtime.strip() if isinstance(runtime, str) else runtime
+        if not self.runtime:
+            self.runtime = None
         self.extra_env = dict(extra_env or {})
 
     @staticmethod
@@ -387,7 +394,7 @@ class DockerExecutor(Executor):
         顺序固定：docker run --rm --name <容器名> --user <用户>
         --cpus <核数> --memory <内存> [--cap-drop=ALL
         --security-opt=no-new-privileges] [--security-opt <自定义>]
-        [--pids-limit <n>] [--network <网络>]
+        [--pids-limit <n>] [--runtime <runtime>] [--network <网络>]
         -v <worktree>:/work -v <代码目录>:/app:ro -w /work
         [-e <env_key名>] [-e <NAME=VALUE>...] <镜像> <容器内命令...>。
         -e 只传名字，不带 =值（env_key）；extra_env 的 -e 带值，
@@ -415,6 +422,8 @@ class DockerExecutor(Executor):
                 cmd += ["--security-opt", opt]
         if self.pids_limit is not None:
             cmd += ["--pids-limit", str(self.pids_limit)]
+        if self.runtime:
+            cmd += ["--runtime", self.runtime]
         if network:
             cmd += ["--network", network]
         cmd += ["-v", "%s:/work" % self._worktree_for(task),