brokerd serve: run tools in containers when [runner] is set

Implemented-By: OpenCode session (model recorded in docs/implementer-log.md)

crates/brokerd/src/main.rs

@@ -7,7 +7,8 @@ use std::sync::Arc;
 
 use brokerd::audit::{AuditError, RECOVERED_NOTICE};
 use brokerd::config::Config;
-use brokerd::runner::Refusing;
+use brokerd::container::Podman;
+use brokerd::runner::{Refusing, Runtime};
 use brokerd::serve::{self, ServeError};
 
 const USAGE: &str = "usage: brokerd serve --config <path> [--accept-break]";
@@ -44,12 +45,28 @@ fn main() -> ExitCode {
     let broker_path = cfg.broker_socket();
     let admin_path = cfg.admin_socket();
 
-    let started = match serve::start(
-        cfg,
-        accept_break,
-        Box::new(Refusing),
-        Arc::new(|line: &str| eprintln!("{line}")),
-    ) {
+    // The runtime and the line that says which. A `[runner]` runs calls in containers; without it,
+    // every call is refused, as in M3a.
+    let log: Arc<dyn Fn(&str) + Send + Sync> = Arc::new(|line: &str| eprintln!("{line}"));
+    let runtime: Box<dyn Runtime>;
+    let runtime_notice: String;
+    match &cfg.runner {
+        Some(runner) => {
+            let image = runner.image.clone();
+            runtime = Box::new(Podman::new(
+                runner.clone(),
+                cfg.egress_dir(),
+                Arc::clone(&log),
+            ));
+            runtime_notice = format!("tools run in containers from {image}");
+        }
+        None => {
+            runtime = Box::new(Refusing);
+            runtime_notice = "no [runner] section: every tool call is refused".to_string();
+        }
+    }
+
+    let started = match serve::start(cfg, accept_break, runtime, log) {
         Ok(started) => started,
         Err(ServeError::Audit(e @ AuditError::NothingToAccept)) => {
             eprintln!("brokerd: {e}");
@@ -80,6 +97,7 @@ fn main() -> ExitCode {
         broker_path.display(),
         admin_path.display()
     );
+    eprintln!("{runtime_notice}");
 
     match started.run() {
         Ok(()) => ExitCode::SUCCESS,