diff --git a/marketplace b/marketplace index 42b87895..d0d55ccc 160000 --- a/marketplace +++ b/marketplace @@ -1 +1 @@ -Subproject commit 42b8789543f8ed06b7cac099284eb3871c582efc +Subproject commit d0d55ccc77326baaf18b8d2254548ce06cb4dfbf diff --git a/src/content/docs/recipes/automation/crabbox-deploy.md b/src/content/docs/recipes/automation/crabbox-deploy.md index 2285284a..c48efaa6 100644 --- a/src/content/docs/recipes/automation/crabbox-deploy.md +++ b/src/content/docs/recipes/automation/crabbox-deploy.md @@ -15,7 +15,7 @@ Crabbox (https://github.com/openclaw/crabbox) leases or selects a runner, syncs the current working tree, runs commands remotely, streams output, records evidence, and releases the target. In OpenCharly the CLI (`layer-crabbox` candy), the Node.js/PostgreSQL coordinator -(`pod-crabbox` candy, supervised, postgres-backed), and the `crabbox:` +(`pod-crabbox-coordinator` candy, supervised, postgres-backed), and the `crabbox:` check verb (`plugin-crabbox`) compose into a FULLY-LOCAL control plane: CLI -> broker at loopback :8080 -> postgres :5432 -> leases via `--provider local-container` on the box's nested rootless podman. @@ -42,7 +42,7 @@ For container lifecycle use `charly` commands -- see [`/charly-core:service`](/r - `layer-crabbox` (v2026.247.0855) — the CLI binary at /usr/local/bin/crabbox (pinned GoReleaser archive), prerequisites composed (layer-gh / layer-ssh-client / rsync / curl), plan checks: version/providers/doctor. -- `pod-crabbox` (v2026.247.1016) — the coordinator: built from the pinned +- `pod-crabbox-coordinator` (v2026.247.1016) — the coordinator: built from the pinned upstream tag in-image, supervised at priority 20 (after postgres), port 8080, /v1/health + /v1/ready, start wrapper waiting for the database. - `plugin-crabbox` (v2026.247.1021) — the `crabbox:` check verb (three diff --git a/src/content/docs/recipes/check/crabbox.md b/src/content/docs/recipes/check/crabbox.md index 0e2ea867..28f689a3 100644 --- a/src/content/docs/recipes/check/crabbox.md +++ b/src/content/docs/recipes/check/crabbox.md @@ -16,7 +16,7 @@ and its optional local Node.js/PostgreSQL coordinator, served out-of-process over go-plugin gRPC by `opencharly/plugin-crabbox`. Install the CLI with [`/charly-tools:crabbox-cli`](/recipes/tools/crabbox-cli/) (opencharly/layer-crabbox) and the coordinator with [`/charly-crabbox:crabbox-coordinator`](/recipes/crabbox/crabbox-coordinator/) -(opencharly/pod-crabbox). +(opencharly/pod-crabbox-coordinator). ## Why it is not the `command:`/`http:` verbs diff --git a/src/content/docs/recipes/index.md b/src/content/docs/recipes/index.md index bdc863aa..412f1499 100644 --- a/src/content/docs/recipes/index.md +++ b/src/content/docs/recipes/index.md @@ -280,7 +280,7 @@ Self-contained skills for running the comfyui image-generation/diffusion image. ### charly-crabbox -Self-contained skills for the crabbox image family: the Crabbox CLI (layer-crabbox), the local Node/PostgreSQL coordinator (pod-crabbox) and the `crabbox:` check verb (plugin-crabbox) — the fully-local remote-execution control plane. +Self-contained skills for the crabbox image family: the Crabbox CLI (layer-crabbox), the local Node/PostgreSQL coordinator (pod-crabbox-coordinator) and the `crabbox:` check verb (plugin-crabbox) — the fully-local remote-execution control plane. - [crabbox-coordinator](/recipes/crabbox/crabbox-coordinator/) @@ -590,7 +590,7 @@ Development internals for charly contributors — Go source map, install-plan IR - [marketplace](/recipes/internals/marketplace/) - [ovmf](/recipes/internals/ovmf/) - [plugin](/recipes/internals/plugin/) -- [plugin-nerdctl](/recipes/internals/plugin-nerdctl/) +- [plugin-containerd](/recipes/internals/plugin-containerd/) - [repo-setup](/recipes/internals/repo-setup/) - [root-cause-analyzer](/recipes/internals/root-cause-analyzer/) - [skills](/recipes/internals/skills/) diff --git a/src/content/docs/recipes/internals/plugin-nerdctl.md b/src/content/docs/recipes/internals/plugin-containerd.md similarity index 67% rename from src/content/docs/recipes/internals/plugin-nerdctl.md rename to src/content/docs/recipes/internals/plugin-containerd.md index 8bd2aaee..d4fd11c3 100644 --- a/src/content/docs/recipes/internals/plugin-nerdctl.md +++ b/src/content/docs/recipes/internals/plugin-containerd.md @@ -1,5 +1,5 @@ --- -title: "plugin-nerdctl" +title: "plugin-containerd" description: "The out-of-tree charly ENGINE plugin serving engine:containerd (verb:containerd / command:containerd) — every engine op delegates to container.InvokeEngineOp." --- @@ -7,7 +7,7 @@ description: "The out-of-tree charly ENGINE plugin serving engine:containerd (ve *Recipe card from the `charly-internals` plugin (Development — contributor internals).* -# plugin-nerdctl +# plugin-containerd The out-of-tree charly ENGINE plugin serving `engine:containerd` (plus the `verb:containerd` / `command:containerd` convenience words). @@ -55,7 +55,25 @@ mode-split workload users, `address`, `namespace`, `privilege_prefix`, `substrates`, `runtime_handlers`) is served by the spec module's engine body — one table, no copy here. +## The read-only check verb (`verb:containerd`) + +`containerd: ` is a READ-ONLY check verb (W3.9). Its typed input is +`#ContainerdInput` with `method` as the PRIMARY field, so `containerd: info` +desugars to `{method: "info"}`. It drives the venue's own tooling over the host +executor reverse channel; each method catches a defect nothing else does: + +| method | measures | visible skip (names the mechanism) | +|---|---|---| +| `info` | daemon id + mode from `nerdctl info` **SecurityOptions** (never `Plugins`) | — | +| `runtimes` | the declared CRI handlers (`crictl info`) | `crictl` not installed | +| `cdi_devices` | devices in the **client's** CDI spec dirs (`/etc/cdi`, `/var/run/cdi`) | — (an absent dir is an empty, passing list; a malformed spec FAILS) | +| `criu_preflight` | `criu check --unprivileged --feature seccomp_suspend`: rc **and** the supported line; `--extra` is never used | `criu` not installed | +| `krun_guest` | one throwaway probe guest (`--rm`): kernel, arch, CPU features | no probe `image:`, no `/dev/kvm`, handler not declared | +| `image` | an image present in a **named** namespace | — | + +A skip is never a silent pass: an assertion that cannot run is not green. + ## Use when -Working with the `engine:containerd` provider, the plugin-nerdctl candy, or the -engine provider-class placement model. +Working with the `engine:containerd` provider, the `containerd:` check verb, the +plugin-containerd candy, or the engine provider-class placement model.