Docker tasks: --docker-runtime option (runsc support, default off)

DockerExecutor gains a runtime parameter (passed as docker --runtime
in build_run_command, after --pids-limit); worker CLI gains
--docker-runtime, wired through _build_cli_executor. Unset or empty
means no --runtime flag, so existing tasks keep docker default (runc);
an unregistered runtime fails container start (fail closed), it never
silently falls back. Tests: runsc appears in the command, default/empty
omit it, CLI wiring passes through. README documents the flag and
corrects a stale multi-tenant note (host kernel does not ban userns;
bwrap fails inside Docker containers on nested-pidns proc mount).

cloud/tests/test_docker_runtime.py

@@ -0,0 +1,70 @@
+"""Docker runtime 单测：--runtime=runsc 接入。
+
+只用假 runner，不跑真实 Docker。覆盖：显式 runtime 进命令
+（且在 --pids-limit 之后）、默认/空串不传 --runtime、
+worker CLI --docker-runtime 透传到 DockerExecutor。
+"""
+
+import sys
+import unittest
+from pathlib import Path
+from types import SimpleNamespace
+from unittest import mock
+
+try:
+    from cloud.sandbox import DockerExecutor
+    from cloud.worker import _build_cli_executor
+except ImportError:
+    sys.path.insert(0, str(Path(__file__).resolve().parents[2]))
+    from cloud.sandbox import DockerExecutor
+    from cloud.worker import _build_cli_executor
+
+
+def _executor(**kwargs):
+    def fake(cmd, timeout=None):
+        return SimpleNamespace(returncode=0, stdout="", stderr="")
+    kwargs.setdefault("env", {"XCM_API_KEY": "test-placeholder"})
+    kwargs.setdefault("runner", fake)
+    with mock.patch("cloud.sandbox.shutil.which",
+                    return_value="/usr/bin/docker"):
+        return DockerExecutor("/fake/host.py", **kwargs)
+
+
+def _cmd(ex):
+    with mock.patch("cloud.sandbox.shutil.which",
+                    return_value="/usr/bin/docker"):
+        return ex.build_run_command(
+            {"id": "t1", "worktree": "/tmp/wt"}, ["echo", "hi"])
+
+
+class DockerRuntimeTestCase(unittest.TestCase):
+    def test_runsc_appears_in_command(self):
+        cmd = _cmd(_executor(runtime="runsc", pids_limit=512))
+        self.assertIn("--runtime", cmd)
+        self.assertEqual(cmd[cmd.index("--runtime") + 1], "runsc")
+        # 顺序：--runtime 在 --pids-limit 之后。
+        self.assertLess(cmd.index("--pids-limit"), cmd.index("--runtime"))
+
+    def test_default_and_empty_omit_runtime(self):
+        self.assertNotIn("--runtime", _cmd(_executor()))
+        self.assertNotIn("--runtime", _cmd(_executor(runtime="")))
+        self.assertNotIn("--runtime", _cmd(_executor(runtime="   ")))
+
+    def test_cli_wiring(self):
+        args = SimpleNamespace(
+            executor="docker", config=None,
+            docker_image="codex-app-server:latest",
+            docker_cpus="2", docker_memory="2g", docker_user="1000:1000",
+            docker_worktrees_root=None, env_key=None, codex_config=None,
+            docker_timeout=None, docker_extra_mounts=None,
+            docker_security_opt=None, docker_pids_limit=512,
+            docker_runtime="runsc")
+        ex = _build_cli_executor(args, "/fake/host.py")
+        self.assertIsInstance(ex, DockerExecutor)
+        self.assertEqual(ex.runtime, "runsc")
+        args2 = SimpleNamespace(**{**vars(args), "docker_runtime": None})
+        self.assertIsNone(_build_cli_executor(args2, "/fake/host.py").runtime)
+
+
+if __name__ == "__main__":
+    unittest.main()