---
name: "Run storkit container under gVisor (runsc) runtime"
---

# Story 360: Run storkit container under gVisor (runsc) runtime

## User Story

As a storkit operator, I want the container to run under gVisor so that even if a malicious codebase escapes the container's process namespace, it cannot make raw syscalls to the host kernel.

## Acceptance Criteria

- [ ] docker-compose.yml specifies runtime: runsc
- [ ] PTY-based agent spawning (Claude Code via PTY) works correctly under runsc
- [ ] rebuild_and_restart (exec() replacement) works correctly under runsc
- [ ] Rust compilation inside the container completes successfully under runsc
- [ ] Document host setup requirement: runsc must be installed and registered in /etc/docker/daemon.json

## Out of Scope

- TBD
