Containerize local builds with rootless nerdctl

README.md

@@ -0,0 +1,45 @@
+# Lazaret
+
+Rootless gVisor sandbox for development tools and coding agents.
+
+## Status
+
+- Early development
+- Source only; no binary releases
+- Linux x86-64, kernel 6.9 or newer
+
+## Host requirements
+
+- Unprivileged user namespaces
+- Contiguous subordinate UID and GID ranges of at least 65,536 IDs
+- `/usr/bin/newuidmap`, `/usr/bin/newgidmap`, and `/usr/bin/slirp4netns`
+- `/dev/fuse`, `fuse-overlayfs`, and `fusermount3`
+- Rootless nerdctl with BuildKit
+- `cmp`, `install`, and `sha256sum`
+
+## Build and install
+
+```sh
+tools/install-to-host
+```
+
+The default destination is `~/.local/bin`. Pass `--install-dir DIRECTORY` to override it.
+
+## Configure and run
+
+```sh
+mkdir -p ~/.config/lazaret
+cp docs/example.toml ~/.config/lazaret/config.toml
+lazaret default
+lazaret default -- COMMAND ARGUMENT...
+```
+
+Edit the example network allowlists and persistent volume paths before use.
+
+## Repository
+
+- [Product specification](docs/spec/lazaret.md)
+- [Example configuration](docs/example.toml)
+- [Verification entry point](tools/verify)
+- [Apache License 2.0](LICENSE)
+- [Third-party notices](THIRD_PARTY_NOTICES.md)