From c4e15d4e1b8cb58ef197bf386cdc12c36e0991ff Mon Sep 17 00:00:00 2001
From: Augustinas Malinauskas <augustinasmal@gmail.com>
Date: Sun, 1 Feb 2026 17:51:55 -0800
Subject: [PATCH] feat: add --runtime support for custom docker run options

This enables users to specify container runtimes like gVisor (runsc)
via the Custom Docker Run Options field.

Example usage: --runtime=runsc

This is useful for running untrusted workloads in sandboxed runtimes
that provide additional isolation beyond standard runc.

Co-Authored-By: Claude Opus 4.5 <noreply@anthropic.com>
---
 bootstrap/helpers/docker.php               | 13 ++++++++++-
 tests/Feature/DockerCustomCommandsTest.php | 25 ++++++++++++++++++++++
 2 files changed, 37 insertions(+), 1 deletion(-)

diff --git a/bootstrap/helpers/docker.php b/bootstrap/helpers/docker.php
index b0d401b5f..f300dcc88 100644
--- a/bootstrap/helpers/docker.php
+++ b/bootstrap/helpers/docker.php
@@ -1009,6 +1009,7 @@ function convertDockerRunToCompose(?string $custom_docker_run_options = null)
         '--gpus' => 'gpus',
         '--hostname' => 'hostname',
         '--entrypoint' => 'entrypoint',
+        '--runtime' => 'runtime',
     ]);
     foreach ($matches as $match) {
         $option = $match[1];
@@ -1029,6 +1030,16 @@ function convertDockerRunToCompose(?string $custom_docker_run_options = null)
                 $options[$option] = array_unique($options[$option]);
             }
         }
+        if ($option === '--runtime') {
+            // Match --runtime=value or --runtime value (e.g., --runtime=runsc, --runtime runc)
+            $regexForParsingRuntime = '/--runtime(?:=|\s+)([^\s]+)/';
+            preg_match($regexForParsingRuntime, $custom_docker_run_options, $runtime_matches);
+            $value = $runtime_matches[1] ?? null;
+            if ($value && ! empty(trim($value))) {
+                $options[$option][] = $value;
+                $options[$option] = array_unique($options[$option]);
+            }
+        }
         if ($option === '--entrypoint') {
             $value = null;
             // Match --entrypoint=value or --entrypoint value
@@ -1097,7 +1108,7 @@ function convertDockerRunToCompose(?string $custom_docker_run_options = null)
                 }
             });
             $compose_options->put($mapping[$option], $ulimits);
-        } elseif ($option === '--shm-size' || $option === '--hostname') {
+        } elseif ($option === '--shm-size' || $option === '--hostname' || $option === '--runtime') {
             if (! is_null($value) && is_array($value) && count($value) > 0 && ! empty(trim($value[0]))) {
                 $compose_options->put($mapping[$option], $value[0]);
             }
diff --git a/tests/Feature/DockerCustomCommandsTest.php b/tests/Feature/DockerCustomCommandsTest.php
index 5d9dcd174..f420dab52 100644
--- a/tests/Feature/DockerCustomCommandsTest.php
+++ b/tests/Feature/DockerCustomCommandsTest.php
@@ -198,3 +198,28 @@ test('ConvertEntrypointSingleQuotedWithDoubleQuotesInside', function () {
         'entrypoint' => 'python -c "print(\"hi\")"',
     ]);
 });
+
+test('RuntimeWithEquals', function () {
+    $input = '--runtime=runsc';
+    $output = convertDockerRunToCompose($input);
+    expect($output)->toBe([
+        'runtime' => 'runsc',
+    ]);
+});
+
+test('RuntimeWithoutEquals', function () {
+    $input = '--runtime runsc';
+    $output = convertDockerRunToCompose($input);
+    expect($output)->toBe([
+        'runtime' => 'runsc',
+    ]);
+});
+
+test('RuntimeWithOtherOptions', function () {
+    $input = '--runtime=runsc --cap-drop=ALL --security-opt=no-new-privileges';
+    $output = convertDockerRunToCompose($input);
+    expect($output)->toHaveKeys(['runtime', 'cap_drop', 'security_opt'])
+        ->and($output['runtime'])->toBe('runsc')
+        ->and($output['cap_drop'])->toBe(['ALL'])
+        ->and($output['security_opt'])->toBe(['no-new-privileges']);
+});