feat(driver-podman): add per-sandbox user namespace mode

crates/openshell-driver-podman/README.md

@@ -50,11 +50,20 @@ The container spec in `container.rs` sets these security-critical fields:
 
 The restricted agent child does not retain these supervisor privileges.
 
-## Driver Config Mounts
+## Per-Sandbox Driver Config
 
 The gateway forwards the `podman` block from `--driver-config-json` to this
-driver. The driver accepts user-supplied `mounts` entries with these Podman
-mount types:
+driver.
+
+`userns_mode`: optional per-sandbox user namespace mode. Requires
+`allow_userns = true` in the gateway config (analogous to
+`enable_bind_mounts`). Permitted modes are `keep-id`,
+`keep-id:uid=N,gid=N`, `auto`, and `nomap`. Escape modes (`host`,
+`ns:…`) are rejected unconditionally. For `keep-id`, uid/gid option
+values must be non-negative integers.
+
+The driver also accepts user-supplied `mounts` entries with these Podman mount
+types:
 
 - `bind`: mounts an absolute host path when `[openshell.drivers.podman]`
   has `enable_bind_mounts = true`.
@@ -89,6 +98,14 @@ openshell sandbox create \
   -- claude
 ```
 
+Example per-sandbox user namespace selection:
+
+```shell
+openshell sandbox create \
+  --driver-config-json '{"podman":{"userns_mode":"keep-id:uid=998,gid=998"}}' \
+  -- claude
+```
+
 ### Capability Breakdown
 
 | Capability | Purpose |

crates/openshell-driver-podman/src/config.rs

@@ -126,6 +126,18 @@ pub struct PodmanComputeConfig {
     /// `template.driver_config`.
     #[serde(default)]
     pub enable_bind_mounts: bool,
+    /// Allow sandboxes to select a user namespace mode via `userns_mode` in
+    /// per-sandbox driver config.
+    ///
+    /// When `false` (the default), any non-empty `userns_mode` in a sandbox
+    /// request is rejected. When `true`, sandboxes may request the following
+    /// safe modes: `keep-id`, `auto`, and `nomap`. Escape modes (`host`,
+    /// `ns:`, etc.) are always rejected regardless of this setting.
+    ///
+    /// Analogous to [`enable_bind_mounts`][Self::enable_bind_mounts]: the
+    /// operator explicitly opts in to tenant-controlled namespace selection.
+    #[serde(default)]
+    pub allow_userns: bool,
     /// Health check interval in seconds for sandbox containers.
     ///
     /// Podman runs the health check command at this interval to determine
@@ -261,6 +273,7 @@ impl Default for PodmanComputeConfig {
             guest_tls_key: None,
             sandbox_pids_limit: DEFAULT_SANDBOX_PIDS_LIMIT,
             enable_bind_mounts: false,
+            allow_userns: false,
             health_check_interval_secs: DEFAULT_HEALTH_CHECK_INTERVAL_SECS,
         }
     }
@@ -284,6 +297,7 @@ impl std::fmt::Debug for PodmanComputeConfig {
             .field("guest_tls_key", &self.guest_tls_key)
             .field("sandbox_pids_limit", &self.sandbox_pids_limit)
             .field("enable_bind_mounts", &self.enable_bind_mounts)
+            .field("allow_userns", &self.allow_userns)
             .field(
                 "health_check_interval_secs",
                 &self.health_check_interval_secs,