Add Containerfile: build boco (musl) + slim kernel; runnable runner image

- 3-stage build: musl boco+boco-init (rust>=1.88, alpine:edge), linux-7.2
  bzImage from kernel/config (pinned tarball, sha256-verified), slim runtime
  with qemu/virtiofsd/podman.
- .containerignore: deny-all context (Cargo files, src/, init/, kernel/config)
  so the linux submodule no longer ships into every build.
- Verified end-to-end: kernel boots under KVM, ext4 rootfs, userspace init.
- NOTE: nested rootless podman cannot 'podman unshare -> container mount'
  (build path); boot path works as-is.

.containerignore

@@ -0,0 +1,10 @@
+# Build context: deny everything, then allow only what the Containerfile needs.
+# Keeps the linux submodule (and example/, .gitea/, README, etc.) out of the build.
+*
+!Cargo.toml
+!Cargo.lock
+!src/
+!src/**
+!init/
+!init/**
+!kernel/config

Containerfile

@@ -0,0 +1,66 @@
+# boco runner: compiles boco (static musl) AND the shared boco kernel (vmlinuz)
+# with the slim config checked into the boco repo, then serves as the runtime
+# image for `boco build` / `boco boot` under podman.
+#
+# Runtime requirements (boco shells out to nested rootless podman):
+#   --device /dev/kvm      KVM accel for the VMs (entrypoint chmods it)
+#   --device /dev/net/tun  only if nested container runs need pasta networking
+#   volume at /home/boco/.local/share/boco   persistent registry (images+kernel)
+#   NO --privileged: the container's own userns (single mapping) is what makes
+#   nested `podman unshare` work; ignore_chown_errors handles unmapped uids.
+#
+# Kernel source: pinned tarball linux-7.2 (= 8d3ae59288f1e7d58d76558a6ee96d533bc5019f,
+# verified == refs/tags/v7.2{} via git ls-remote), sha256-checked.
+
+FROM alpine:edge AS build
+RUN apk add --no-cache rust cargo git
+WORKDIR /src
+COPY . .
+# alpine's rust targets x86_64-alpine-linux-musl natively (static, no glibc dep)
+RUN cargo build --release -p boco -p boco-init \
+ && strip target/release/boco target/release/boco-init
+
+FROM alpine:3.22 AS kernel
+# g++ for host tools, libelf for objtool, openssl for extract-cert
+RUN apk add --no-cache make gcc g++ musl-dev perl flex bison bc \
+      elfutils-dev openssl-dev findutils tar xz zstd curl linux-headers
+WORKDIR /kbuild
+# Pinned upstream tarball: linux-7.2.tar.xz, sha256
+# f9fef3d14c0df53819026f4be74459835c2a0b0dcbf5b5bbd9ea19f0829402b3.
+# (Equivalent to user's shallow pin 8d3ae59288f1e7d58d76558a6ee96d533bc5019f
+# = refs/tags/v7.2{} — verified via `git ls-remote`; the tarball avoids
+# a multi-GB shallow clone through flaky slirp NAT.)
+RUN curl -fsSLo /tmp/linux-7.2.tar.xz https://cdn.kernel.org/pub/linux/kernel/v7.x/linux-7.2.tar.xz \
+ && echo "f9fef3d14c0df53819026f4be74459835c2a0b0dcbf5b5bbd9ea19f0829402b3  /tmp/linux-7.2.tar.xz" | sha256sum -c - \
+ && tar -xJf /tmp/linux-7.2.tar.xz \
+ && mv linux-7.2 linux
+# Install the slim kernel config checked into the boco repo; olddefconfig
+# normalizes it against this tree and fails nothing silently afterwards.
+COPY kernel/config /kbuild/linux/.config
+RUN make -C linux olddefconfig HOSTCC=gcc CC=gcc \
+ && grep -qE '^(# )?CONFIG_MODULES' linux/.config
+RUN make -C linux -j"$(nproc)" bzImage HOSTCC=gcc CC=gcc \
+ && cp linux/arch/x86/boot/bzImage /vmlinuz \
+ && ls -lh /vmlinuz
+
+FROM alpine:3.22
+RUN apk add --no-cache \
+      qemu-system-x86_64 qemu-img virtiofsd \
+      podman fuse3 openssh-client ca-certificates iptables ip6tables \
+      e2fsprogs cpio passt \
+ && adduser -D -s /bin/sh boco \
+ && echo boco:100000:65536 > /etc/subuid \
+ && echo boco:100000:65536 > /etc/subgid \
+ && mkdir -p /etc/containers \
+ && printf '[storage]\ndriver = "vfs"\nrunroot = "/run/containers/storage"\ngraphroot = "/var/lib/containers/storage"\n[storage.options]\nignore_chown_errors = "true"\n' > /etc/containers/storage.conf \
+ && printf '#!/bin/sh\n[ -e /dev/kvm ] && chmod 666 /dev/kvm\nexec /usr/local/bin/boco "$@"\n' > /usr/local/bin/entrypoint.sh \
+ && chmod 755 /usr/local/bin/entrypoint.sh
+COPY --from=build /src/target/release/boco /usr/local/bin/boco
+COPY --from=build /src/target/release/boco-init /home/boco/.local/share/boco/boco-init
+COPY --from=kernel /vmlinuz /home/boco/.local/share/boco/vmlinuz
+RUN chmod 755 /usr/local/bin/boco /home/boco/.local/share/boco/boco-init /home/boco/.local/share/boco/vmlinuz
+ENV XDG_DATA_HOME=/home/boco/.local/share
+ENV XDG_DATA_HOME=/home/boco/.local/share
+WORKDIR /data
+ENTRYPOINT ["/usr/local/bin/entrypoint.sh"]
+CMD ["image", "list"]

init/src/main.rs

@@ -245,13 +245,7 @@ fn setup_virtiofs_shares(workdir: &str) {
             };
 
             try_io(&format!("mkdir {dest}"), || fs::create_dir_all(&dest));
-            try_mount(
-                Some(tag),
-                &dest,
-                Some("virtiofs"),
-                MsFlags::empty(),
-                None,
-            );
+            try_mount(Some(tag), &dest, Some("virtiofs"), MsFlags::empty(), None);
         }
     }
 }

src/qemu.rs

@@ -1,13 +1,4 @@
-//! QEMU: boot a registry entry with qemu-system-x86_64 using direct kernel
-//! boot (-kernel/-initrd or -drive). The kernel is shared across all VMs
-//! at $XDG_DATA_HOME/boco/registry/vmlinuz. A universal /boco/init script (injected
-//! at build time) handles VM bootstrap; /boco/exec runs the container's
-//! CMD/ENTRYPOINT. Runtime overrides are delivered as `boco.cmd=<base64>`
-//! on the kernel cmdline. Host directories are shared into the guest via
-//! virtio-fs: one virtiofsd daemon (under `podman unshare` for rootless
-//! UID mapping) per `--mount`, plus a `-chardev socket` + `-device
-//! vhost-user-fs-pci` pair on the QEMU side. The guest mounts each share
-//! with `mount -t virtiofs <tag> <dest>` (see `boco.mount=` cmdline).
+//! See [`boot`]
 
 use anyhow::{Context, Result, bail};
 use base64::Engine;
@@ -16,7 +7,7 @@ use std::{fmt::Write as _, process::Command};
 
 use crate::{
     forward::PortForward,
-    registry::{registry_base_dir, registry_dir},
+    registry::{registry_dir, vmlinuz_path},
     virtiofs::{self, VirtiofsShare},
 };
 
@@ -46,6 +37,10 @@ pub struct BootCmd {
     mount: Vec<String>,
 }
 
+/// Invoke `qemu` to boot a boco image. See [`BootCmd`] for options
+///
+/// This uses qemu's direct-kernel-boot with `-kernel`, so it does not require a bootloader.
+/// The boco image is just an ext4 rootfs.
 pub(crate) fn boot(
     BootCmd {
         name,
@@ -56,13 +51,13 @@ pub(crate) fn boot(
     }: BootCmd,
 ) -> Result<()> {
     let reg_dir = registry_dir(&name)?;
-    let vmlinuz_path = registry_base_dir()?.join("vmlinuz");
+    let vmlinuz_path = vmlinuz_path()?;
     let initrd_path = reg_dir.join("initrd");
     let qcow2_path = reg_dir.join("image.qcow2");
     if !vmlinuz_path.exists() {
         // TODO: guide user in how to set up a kernel
         bail!(
-            "No kernel available. Place a vmlinuz at {}",
+            "No kernel available. Expected vmlinuz at {}",
             vmlinuz_path.display()
         );
     }

src/registry.rs

@@ -26,6 +26,12 @@ pub(crate) fn validate_image_name(name: &str) -> Result<()> {
     Ok(())
 }
 
+pub(crate) fn vmlinuz_path() -> Result<PathBuf> {
+    let base = xdg::BaseDirectories::with_prefix("boco");
+    base.place_data_file("vmlinuz")
+        .context("Failed to create XDG_DATA_HOME subdirectory")
+}
+
 pub(crate) fn registry_base_dir() -> Result<PathBuf> {
     let base = xdg::BaseDirectories::with_prefix("boco");
     base.create_data_directory("registry")