Study container runtime alternatives to podman

[troglobit]

Investigate possibility of replacing podman with something closer to our core values of immutability, security, and usability.

At the time of this, 2025-10-06:

• AppTainer — "Secure. Portable. Encryptable."
• Lilypod — "a simple¹ container manager"
• Incus — Continuation of the lxd project, which was the high-level tool for lxc, but with OCI support, aimed at system containers. See also https://linuxcontainers.org/incus-os/introduction/

Footnotes

1. Note, no seccomp, no cgroups, no capabilities. For more information on this, see these notes. However, these are properties that we could add to Finit services and benefit from with regular system services as well 🤔 ↩

[wkz]

CCB:

Requirement: Being able run from a Squash or EROFS (immutable image)

Pick up this work in ~Jan timeframe