T-4: DockerOrchestrator — container lifecycle via bollard

runner/src/config.rs

@@ -70,17 +70,32 @@ pub struct AuthConfig {
 
 /// Docker configuration for container execution
 #[derive(Debug, Deserialize, Clone)]
-#[allow(dead_code)] // Fields consumed by Wave-2 DockerOrchestrator (T-4)
+#[allow(dead_code)] // Fields consumed by DockerOrchestrator (T-4)
 pub struct DockerConfig {
     /// Path to Docker socket (default: /var/run/docker.sock)
     #[serde(default = "default_docker_socket")]
     pub socket_path: String,
+    /// Default Docker image for new sessions
+    #[serde(default = "default_docker_image")]
+    pub default_image: String,
     /// List of allowed image references; empty list means all images allowed
     #[serde(default)]
     pub allowed_images: Vec<String>,
     /// Timeout in seconds for exec operations (default: 30)
     #[serde(default = "default_exec_timeout")]
     pub exec_timeout_secs: u64,
+    /// Memory limit per container (e.g. "2g", "512m"). Default: "2g"
+    #[serde(default = "default_memory_limit")]
+    pub memory_limit: String,
+    /// Memory+swap limit (equal to memory_limit disables swap). Default: "2g"
+    #[serde(default = "default_memory_swap")]
+    pub memory_swap: String,
+    /// CPU limit per container. Default: 2.0
+    #[serde(default = "default_cpu_limit")]
+    pub cpu_limit: f64,
+    /// Path to seccomp profile JSON. None = Docker default profile.
+    #[serde(default)]
+    pub seccomp_profile: Option<String>,
 }
 
 /// Git configuration for clone operations and security
@@ -132,6 +147,22 @@ fn default_exec_timeout() -> u64 {
     30
 }
 
+fn default_docker_image() -> String {
+    "ubuntu:24.04".to_string()
+}
+
+fn default_memory_limit() -> String {
+    "2g".to_string()
+}
+
+fn default_memory_swap() -> String {
+    "2g".to_string()
+}
+
+fn default_cpu_limit() -> f64 {
+    2.0
+}
+
 fn default_clone_timeout() -> u64 {
     300
 }
@@ -169,8 +200,13 @@ impl Default for DockerConfig {
     fn default() -> Self {
         Self {
             socket_path: default_docker_socket(),
+            default_image: default_docker_image(),
             allowed_images: Vec::new(),
             exec_timeout_secs: default_exec_timeout(),
+            memory_limit: default_memory_limit(),
+            memory_swap: default_memory_swap(),
+            cpu_limit: default_cpu_limit(),
+            seccomp_profile: None,
         }
     }
 }
@@ -206,8 +242,13 @@ mod tests {
         let toml_str = "[docker]";
         let config: Config = toml::from_str(toml_str).expect("should parse docker section");
         assert_eq!(config.docker.socket_path, "/var/run/docker.sock");
+        assert_eq!(config.docker.default_image, "ubuntu:24.04");
         assert!(config.docker.allowed_images.is_empty());
         assert_eq!(config.docker.exec_timeout_secs, 30);
+        assert_eq!(config.docker.memory_limit, "2g");
+        assert_eq!(config.docker.memory_swap, "2g");
+        assert!((config.docker.cpu_limit - 2.0).abs() < f64::EPSILON);
+        assert!(config.docker.seccomp_profile.is_none());
     }
 
     #[test]
@@ -315,6 +356,8 @@ max_sessions = 50
         assert_eq!(config.max_sessions, 50);
         assert_eq!(config.rest_port, 8080); // default
         assert_eq!(config.docker.socket_path, "/var/run/docker.sock"); // default
+        assert_eq!(config.docker.default_image, "ubuntu:24.04"); // default
+        assert_eq!(config.docker.memory_limit, "2g"); // default
         assert_eq!(config.git.clone_timeout_secs, 300); // default
         assert!(config.profiles.is_empty()); // default
     }