T-4: DockerOrchestrator — container lifecycle via bollard

[kirich1409]

Summary

• Add DockerOrchestrator in runner/src/docker.rs — full container lifecycle management via bollard: create/start/stop/remove, exec with TTY attach, image pull (skip if local), per-session Docker network isolation, resource limits (CPU, memory, PIDs), seccomp profile support, image whitelist enforcement
• Extend DockerConfig with default_image, memory_limit, memory_swap, cpu_limit, seccomp_profile fields (backward-compatible defaults)
• Containers created with labels relay.managed=true and relay.session_id=<id>

Acceptance Criteria

• create_container -> exec_attach -> bidirectional I/O
• resize_exec changes PTY dimensions
• stop_container with configurable timeout (SIGTERM -> SIGKILL)
• Resource limits (memory, cpu, pids) applied at creation
• ensure_image skips pull if image exists locally
• Image whitelist enforcement (empty list = all allowed)
• Labels: relay.managed=true, relay.session_id=<id>
• Seccomp profile applied via SecurityOpt
• Unit tests: image allowlist, memory parsing, pattern matching, config defaults

Test plan

• cargo build — compiles
• cargo fmt --check — formatted
• cargo clippy --all-targets --all-features -- -D warnings — no warnings
• cargo test — 118 tests pass (including new docker module tests)
• Integration test with Docker daemon (requires running Docker)

Closes #21

[Copilot]

Pull request overview

Adds a production-ready Docker orchestration layer to the runner, enabling end-to-end container lifecycle management via bollard with configurable defaults and resource/security controls.

Changes:

• Introduces DockerOrchestrator (runner/src/docker.rs) supporting image ensure/pull, per-session network creation, container create/start/stop/remove, and exec attach + PTY resize.
• Extends DockerConfig with default image + resource/security settings (memory, swap, CPU, seccomp profile) and updates config parsing defaults/tests.
• Wires the new docker module into the runner crate (mod docker;).

Reviewed changes

Copilot reviewed 3 out of 3 changed files in this pull request and generated 7 comments.

File	Description
runner/src/main.rs	Registers the new docker module in the runner crate.
runner/src/docker.rs	Implements the new Docker orchestration API, helpers, and unit tests.
runner/src/config.rs	Adds new Docker configuration fields with defaults and expands config tests.

---

💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.