[draft] DockerSandboxedSpawnRunner: support custom container runtimes (like sysbox-runc)

src/main/java/com/google/devtools/build/lib/sandbox/DockerCommandLineBuilder.java

@@ -31,6 +31,7 @@ final class DockerCommandLineBuilder {
   private Path dockerClient;
   private String imageName;
   private List<String> commandArguments;
+  private String containerRuntime;
   private Path sandboxExecRoot;
   private Map<String, String> environmentVariables;
   private Duration timeout;
@@ -66,6 +67,12 @@ public DockerCommandLineBuilder setCommandArguments(List<String> commandArgument
     return this;
   }
 
+  @CanIgnoreReturnValue
+  public DockerCommandLineBuilder setContainerRuntime(String containerRuntime) {
+    this.containerRuntime = containerRuntime;
+    return this;
+  }
+
   @CanIgnoreReturnValue
   public DockerCommandLineBuilder setSandboxExecRoot(Path sandboxExecRoot) {
     this.sandboxExecRoot = sandboxExecRoot;
@@ -137,6 +144,9 @@ public ImmutableList<String> build() {
 
     dockerCmdLine.add(dockerClient.getPathString());
     dockerCmdLine.add("run");
+    if (!containerRuntime.isEmpty()) {
+      dockerCmdLine.add("--runtime=" + containerRuntime);
+    }
     dockerCmdLine.add("--rm");
     if (createNetworkNamespace) {
       dockerCmdLine.add("--network=none");

src/main/java/com/google/devtools/build/lib/sandbox/DockerSandboxedSpawnRunner.java

@@ -45,6 +45,8 @@
 import com.google.devtools.build.lib.util.ProcessUtils;
 import com.google.devtools.build.lib.vfs.Path;
 import com.google.devtools.build.lib.vfs.PathFragment;
+
+import javax.annotation.Nullable;
 import java.io.ByteArrayInputStream;
 import java.io.ByteArrayOutputStream;
 import java.io.IOException;
@@ -147,6 +149,8 @@ public static boolean isSupported(CommandEnvironment cmdEnv, Path dockerClient)
   private final ProcessWrapper processWrapper;
   private final Path sandboxBase;
   private final String defaultImage;
+  @Nullable
+  private final String containerRuntime;
   private final LocalEnvProvider localEnvProvider;
   private final String commandId;
   private final Reporter reporter;
@@ -174,6 +178,8 @@ public static boolean isSupported(CommandEnvironment cmdEnv, Path dockerClient)
       Path dockerClient,
       Path sandboxBase,
       String defaultImage,
+      @Nullable
+      String containerRuntime,
       boolean useCustomizedImages,
       TreeDeleter treeDeleter) {
     super(cmdEnv);
@@ -184,6 +190,7 @@ public static boolean isSupported(CommandEnvironment cmdEnv, Path dockerClient)
     this.processWrapper = ProcessWrapper.fromCommandEnvironment(cmdEnv);
     this.sandboxBase = sandboxBase;
     this.defaultImage = defaultImage;
+    this.containerRuntime = containerRuntime;
     this.localEnvProvider = LocalEnvProvider.forCurrentOs(cmdEnv.getClientEnv());
     this.commandId = cmdEnv.getCommandId().toString();
     this.reporter = cmdEnv.getReporter();
@@ -259,6 +266,9 @@ protected SandboxedSpawn prepareSpawn(Spawn spawn, SpawnExecutionContext context
                 || Spawns.requiresNetwork(spawn, getSandboxOptions().defaultSandboxAllowNetwork)))
         .setCommandId(commandId)
         .setUuid(uuid);
+    if (containerRuntime != null) {
+      cmdLine.setContainerRuntime(containerRuntime);
+    }
     // If uid / gid are -1, we are on an operating system that doesn't require us to set them on the
     // Docker invocation. If they're 0, it means we are running as root and don't need to set them.
     if (uid > 0) {

src/main/java/com/google/devtools/build/lib/sandbox/SandboxModule.java

@@ -322,6 +322,7 @@ private void setup(CommandEnvironment cmdEnv, SpawnStrategyRegistry.Builder buil
                     pathToDocker,
                     sandboxBase,
                     defaultImage,
+                    options.containerRuntime,
                     useCustomizedImages,
                     treeDeleter));
         spawnRunners.add(spawnRunner);

src/main/java/com/google/devtools/build/lib/sandbox/SandboxOptions.java

@@ -256,6 +256,14 @@ public ImmutableSet<Path> getInaccessiblePaths(FileSystem fs) {
               + " run', so it supports the same syntax and mechanisms as Docker itself.")
   public String dockerImage;
 
+  @Option(
+          name = "experimental_container_runtime",
+          defaultValue = "",
+          documentationCategory = OptionDocumentationCategory.EXECUTION_STRATEGY,
+          effectTags = {OptionEffectTag.EXECUTION},
+          help = "specify a custom container runtime like sysbox-runc")
+  public String containerRuntime;
+
   @Option(
       name = "experimental_docker_use_customized_images",
       defaultValue = "true",