Podman Runtime Control

Nimbus-Orch

Evidence-gated Podman controller for checkpoint, recover, and branch movement. Runtime movement should require evidence, not just access.

Movement model Practical README

Status: Private distribution

Podman • Go Evidence-gated movement Executed inspect first No trust by restore

What it does

Read posture

Builds target status and target reports from Podman inspect/status surfaces before movement.

Write posture

Gates checkpoint, recover, branch, and pause-class movement behind readiness, ownership, pressure, and allowlisted action checks.

Pointer posture

Keeps process-local roster and record-start control posture without pretending controller memory is durable truth.

Nimbus-Orch is aimed at bounded Podman movement, not general orchestration. It is not Copr, and it does not replace generic Zipproc per-executable runs.

Movement model

Before write-class Podman movement, Nimbus-Orch checks:

readiness is ready
target is normalized
Podman action is allowlisted
Podman inspect observation was actually executed
claimed Nimbus ownership posture is valid
pressure posture is not critical

observe
-> classify
-> pressure / ownership / zipproc posture
-> allow one gated Podman action
-> record controller action
-> observe again

Boundary

Not generic Zipproc

Generic Zipproc remains per-executable: zipproc run --exe .... Nimbus-Orch uses zipproc language only for Podman target read/write/ptr posture.

Not trust by restore

A restored container is inspectable. It is not automatically trusted. Recovery is movement, not proof of safety.

No key in image

The controller image should not ship the Podman socket, privileged mode, or host write authority. That is the key to the kingdom.

HTTP surface

Read/report

GET  /podman/targets
GET  /podman/target/status
GET  /podman/target/report
POST /podman/target/report/record

Checkpoint/recover

POST /podman/checkpoint/eval
POST /podman/checkpoint/take
GET  /podman/checkpoint/roster
POST /podman/recover/eval
POST /podman/recover/start

Branch/preflight

POST /podman/preflight
POST /podman/branch/eval
POST /podman/branch/start

Scope

This package is

a Podman-facing controller surface for evidence-gated checkpoint, recover, and branch movement.

This package is not

a general orchestrator, cluster scheduler, malware scanner, host-wide shell, generic Zipproc runner, or Copr per-executable runner.

Commercial direction

Private distribution while packaging, runbooks, and buyer-facing evidence surfaces stabilize.