feat(FN-4642): wire container sandbox backends into resolver

Fusion-Task-Id: FN-4642
Fusion-Task-Lineage: a42a36f8-2d2a-43fe-b7c1-d7cf1ad321c3

packages/engine/src/sandbox/__tests__/resolve.test.ts

@@ -22,6 +22,18 @@ describe("resolveSandboxBackend", () => {
     expect(backend).toBeInstanceOf(NativeSandboxBackend);
   });
 
+  it("returns container backend for podman", () => {
+    expect(resolveSandboxBackend({ backendId: "podman" }).capabilities().id).toBe("podman");
+  });
+
+  it("returns container backend for docker", () => {
+    expect(resolveSandboxBackend({ backendId: "docker" }).capabilities().id).toBe("docker");
+  });
+
+  it("returns native for unknown backend", () => {
+    expect(resolveSandboxBackend({ backendId: "unknown-backend" as any })).toBeInstanceOf(NativeSandboxBackend);
+  });
+
   it("returns sandbox-exec on darwin when requested", async () => {
     const { SandboxExecBackend } = await import("../sandbox-exec-backend.js");
     const backend = resolveSandboxBackend({ backendId: "sandbox-exec" });

packages/engine/src/sandbox/index.ts

@@ -1,4 +1,5 @@
 import { BubblewrapBackend } from "./bubblewrap-backend.js";
+import { ContainerSandboxBackend } from "./container.js";
 import { NativeSandboxBackend } from "./native.js";
 import { SandboxExecBackend } from "./sandbox-exec-backend.js";
 import { withSandboxAudit } from "./audit.js";
@@ -41,6 +42,10 @@ export function resolveSandboxBackend(options?: {
       return new BubblewrapBackend();
     }
 
+    if (options?.backendId === "podman" || options?.backendId === "docker") {
+      return new ContainerSandboxBackend({ runtime: options.backendId });
+    }
+
     if (options?.backendId === "sandbox-exec") {
       if (process.platform === "darwin") {
         return new SandboxExecBackend();