Match OCI runtimes by runtime, not by spelling

[Amitgb14]

Found by running #89's phases 1–2 on a real Rocky Linux 10.2 host.

sandbox-cli run --runtime runc is refused there — on a machine whose default
runtime is runc:

runtime "runc" is not registered with the Docker daemon
  available runtimes: io.containerd.runc.v2

One daemon, two vocabularies for the same runtime, in one command:

$ docker info --format '{{.DefaultRuntime}}'
runc
$ docker info --format '{{json .Runtimes}}'
{"io.containerd.runc.v2":{"path":"runc", …

.Runtimes is keyed by the containerd shim name. Every list in
isolation.go is written in runtime names and parseRuntimeNames takes the
JSON keys verbatim, so the two were compared as plain strings and never matched.

The fix

runtimeName reduces io.containerd.<runtime>.v<major> to <runtime> and
leaves everything else alone. StrongerRuntime, notHostDefault and
runtimeHint ask through it.

Reducing rather than expanding, because the mapping only goes one way: a shim
name yields exactly one runtime name, while a runtime name does not say which
shim major a host registered. So the raw name stays what gets displayed and
handed back to the engine — the refusal above still lists
io.containerd.runc.v2, since that is what the user will see in docker info
and must write in daemon.json.

The pattern is matched exactly rather than by splitting on dots: the prefix
alone is not enough, the .v<digits> suffix has to be there, and the separator
is taken from the right. A runtime genuinely named with dots keeps its name.

Why it is worth more than the error message

The two failure directions were not equal.

Unable to see io.containerd.runc.v2, the tool called runc unavailable and
flagged an ordinary run as being on an unusual runtime — wrong labels.

Unable to see io.containerd.kata.v2, it would not have counted a registered
Kata as a kernel of its own at all — a boundary reported absent while
installed. isolation.go documents these lists as failing only in the safe
direction ("nothing here can claim a boundary a run did not get"); a shim name
broke that, in the direction the comment rules out.

That second half is inference, not observation: this host has no Kata, and how a
given installer keys its daemon.json entry is unverified. #89's phase 3 will
answer it for gVisor, since runsc install writes the entry itself. The fix
costs nothing either way and makes both lists mean what they say on a
containerd-backed daemon, which is now the ordinary case on RHEL-family hosts.

Testing

Every added function is pure, so the whole matrix runs on a machine with neither
Kata nor gVisor installed — which is the point, since the hosts that have them
are the hosts nobody has.

Note for #88

ClassifyRuntimeGap on feat/prod-demands-a-kernel compares
containsRuntime(s.All, effective) by string too. It inherits StrongerRuntime
and notHostDefault from this change when the branch next merges main, but
that one call wants SameRuntime as well — otherwise --runtime kata against a
daemon listing io.containerd.kata.v2 reads as GapMissing.

[vercel]

The latest updates on your projects. Learn more about Vercel for GitHub.

Project	Deployment	Actions	Updated (UTC)
sandbox-cli	Ready	Preview	Aug 9, 2026 10:09am