nx_container.nx

nx_container.nx -- sovereign container runtime (Docker replacement). One process per container. Substrate forks, child: 1. unshare(CLONE_NEWUTS|CLONE_NEWPID|CLONE_NEWNS|CLONE_NEWIPC) 2. mount root filesystem of the container image 3. pivot_root or chroot into it 4. mount /proc, /sys, /dev pseudo-fs inside the new root 5. execve(entrypoint, argv) Parent waits via sys_wait4 and returns the child's exit code. What it ISN'T (yet): network namespacing with veth pair, full cgroupv2 resource accounting, image pull from a registry, overlayfs union mounts. Those are L8b/c/d in the roadmap; each is a named improvement queued behind the basic case. What it IS: a sovereign primitive that is enough to run our own services (nishi_web, gitea, sshd) inside chrooted PID-namespace isolation, with CAS-pinned root filesystems. No Docker daemon. No /var/lib/docker. No vendored Go runtime. No yaml. Sealed enums per cardinal feedback-honest-perf-verdict. genealogy_id: linux_namespaces_2002 + lmctfy_2013 + runc_2016 + oci_runtime_spec_v1 + bocker_jpetazzo_2015 lineage_id: nishi_run_sovereign_q10