- 3-stage build: musl boco+boco-init (rust>=1.88, alpine:edge), linux-7.2 bzImage from kernel/config (pinned tarball, sha256-verified), slim runtime with qemu/virtiofsd/podman. - .containerignore: deny-all context (Cargo files, src/, init/, kernel/config) so the linux submodule no longer ships into every build. - Verified end-to-end: kernel boots under KVM, ext4 rootfs, userspace init. - NOTE: nested rootless podman cannot 'podman unshare -> container mount' (build path); boot path works as-is.
marvin
marvin