refactor(driver-sdk): carve out the driver SDK and container-runtime crate

AGENTS.md

@@ -40,6 +40,8 @@ Do not rely on this file for a full inventory. The detailed public and contribut
 | `crates/openshell-otel-test-support/` | OpenTelemetry test support | Shared loopback OTLP collector fixture for tracing tests |
 | `crates/openshell-crypto/` | Crypto backend | Backend-neutral primitives and TLS, PKI, JWT adapters; AWS-LC implementation |
 | `crates/openshell-core/` | Shared core | Common types, configuration, error handling |
+| `crates/openshell-driver-sdk/` | Driver SDK | Narrow contract shared by core and the compute drivers: compute-driver proto, sandbox environment, JWT session tokens, extension protocol, admission and mount validation; `openshell-core` re-exports it |
+| `crates/openshell-container-runtime/` | Container runtime helpers | Code used only by the desktop compute drivers (Docker, Podman, VM): CDI GPU selection, local API socket discovery, supervisor cache and tar helpers; depends on the SDK, never on `openshell-core` |
 | `crates/openshell-extension-core/` | Extension core | Shared extension identity, JWT claims, bearer-token rotation, and TLS transport primitives |
 | `crates/openshell-gateway/` | Gateway binary composition | Links selected first-party compute drivers into the backend-agnostic server registry |
 | `crates/openshell-sdk/` | Shared client SDK | Async Rust gateway client (gRPC transport, TLS, OIDC refresh, edge tunnel); consumed by CLI, TUI, and `@openshell/sdk` |

CONTRIBUTING.md

@@ -381,6 +381,8 @@ These are the primary `mise` tasks for day-to-day development:
 | --------------- | --------------------------------------------- |
 | `crates/`       | Rust crates                                   |
 | `crates/openshell-policy-schema/` | Canonical authored policy DTOs and bounded YAML/JSON parser |
+| `crates/openshell-driver-sdk/` | Narrow contract shared by core and the compute drivers; `openshell-core` re-exports it |
+| `crates/openshell-container-runtime/` | Code shared only by the desktop compute drivers (Docker, Podman, VM) |
 | `crates/openshell-prover-cli/` | Standalone local policy boundary checker |
 | `python/`       | Python SDK and bindings                       |
 | `sdk/go/`       | Go SDK (types, gRPC clients, converters)      |

crates/openshell-container-runtime/Cargo.toml

@@ -0,0 +1,26 @@
+# SPDX-FileCopyrightText: Copyright (c) 2025-2026 NVIDIA CORPORATION & AFFILIATES. All rights reserved.
+# SPDX-License-Identifier: Apache-2.0
+
+[package]
+name = "openshell-container-runtime"
+description = "Code shared by the OpenShell desktop compute drivers (Docker, Podman, VM)"
+version.workspace = true
+edition.workspace = true
+rust-version.workspace = true
+license.workspace = true
+repository.workspace = true
+
+[dependencies]
+miette = { workspace = true }
+serde = { workspace = true }
+tonic = { workspace = true }
+rustls = { workspace = true }
+tar = "0.4"
+tempfile = "3"
+openshell-driver-sdk = { path = "../openshell-driver-sdk" }
+
+[dev-dependencies]
+serde_json = { workspace = true }
+
+[lints]
+workspace = true

crates/openshell-container-runtime/README.md

@@ -0,0 +1,19 @@
+# openshell-container-runtime
+
+Code used only by the desktop compute drivers (Docker, Podman, and VM). It
+moves with those drivers when they leave this repository.
+
+Anything that `openshell-core` consumers (the gateway, supervisor, or the
+Kubernetes driver) also use lives in `openshell-driver-sdk` instead. This crate
+depends on the SDK and never on `openshell-core`.
+
+## Contents
+
+- `gpu`: CDI GPU inventory and selection, and VM specific-device validation.
+- `local_api_socket`: container-runtime socket discovery helpers.
+- `driver_utils`: supervisor image cache, tar extraction, ELF validation,
+  SPIFFE socket mounts, and workspace-validation conditions.
+- `resource_admission`: provenance labels for Docker and Podman containers.
+- `network_trust`: destination-trust generation labels for Podman containers.
+- `config`: defaults for the container drivers.
+- `proto_struct`: the serde helper for driver configuration string lists.

crates/openshell-container-runtime/src/config.rs

@@ -0,0 +1,40 @@
+// SPDX-FileCopyrightText: Copyright (c) 2025-2026 NVIDIA CORPORATION & AFFILIATES. All rights reserved.
+// SPDX-License-Identifier: Apache-2.0
+
+//! Configuration defaults used only by the desktop compute drivers.
+
+use std::num::NonZeroI64;
+
+// ── Public default constants ────────────────────────────────────────────
+//
+// Canonical source for default values used across multiple crates.
+// Clap `default_value_t` annotations and runtime fallbacks should
+// reference these constants instead of hardcoding literals.
+
+/// Default SSH port inside sandbox containers.
+pub const DEFAULT_SSH_PORT: u16 = 2222;
+
+/// Default cgroup PID limit for local container sandboxes.
+pub const DEFAULT_SANDBOX_PIDS_LIMIT: i64 = 2048;
+
+/// Typed default cgroup PID limit for local container sandboxes.
+#[must_use]
+pub fn default_sandbox_pids_limit() -> Option<NonZeroI64> {
+    NonZeroI64::new(DEFAULT_SANDBOX_PIDS_LIMIT)
+}
+
+/// CDI device identifier for requesting all NVIDIA GPUs.
+pub const CDI_GPU_DEVICE_ALL: &str = "nvidia.com/gpu=all";
+
+#[cfg(test)]
+mod tests {
+    use super::*;
+
+    #[test]
+    fn typed_sandbox_pids_default_matches_positive_constant() {
+        assert_eq!(
+            default_sandbox_pids_limit().map(NonZeroI64::get),
+            Some(DEFAULT_SANDBOX_PIDS_LIMIT)
+        );
+    }
+}