The kernel was the last bundled asset (needing scripts/fetch-kernel.sh +
codesign-time bundling). Now it's acquired automatically on first use like the
vminitd initfs and the sandbox image — nothing is bundled and the user runs no
setup step.
- ContainerEngine.ensureKernel: resolve order = NUCLEIC_KERNEL_PATH → on-disk
cache → bundled Resources (optional) → reuse Apple `container`'s installed
kernel (no download) → download the kernel release asset. The asset is hosted
on a GitHub release (ProjectSandbox.kernelRelease*) and fetched with the app's
GitHub token when the repo is private (same token as the sandbox image).
NUCLEIC_KERNEL_NO_REUSE forces the download (testing / incompatible local kernel).
- isSupported/unsupportedReason now gate only on Apple silicon; the kernel is no
longer a precondition. Settings copy + package-app.sh + BUILD.md updated;
bundling is an optional offline fast-path.
- registryAuth: scope credentials to the sandbox image's registry host, so a
configured token is never attached to a different registry (e.g. docker.io
public bases, which 401 on unrelated Basic creds). Fixes anonymous base pulls.
- Verified end-to-end on macOS 27 / Apple silicon: forced kernel download +
anonymous docker.io base pull + boot + exec + stdout. Builds clean; 21 tests pass.
Co-Authored-By: Claude Opus 4.8 <[email protected]>
