replace ContainerRuntime CLI to Bollard crate (default: docker socket)

limit tool result to open router tool response (with truncated info for
ai)

Hard kill if graceful shutdown is too long

README.md

@@ -37,8 +37,8 @@ Herald reads its configuration from environment variables (a `.env` file is supp
 | `METRICS_BIND_ADDR` | *(optional)* Bind address for the Prometheus metrics endpoint (e.g. `0.0.0.0:9100`). If unset, the metrics exporter is disabled. |
 | `SENTRY_DSN` | *(optional)* Sentry DSN for error tracking |
 | `RUST_LOG` | *(optional)* Log level, defaults to `info` |
-| `CONTAINER_RUNTIME` | *(optional)* Container runtime binary used for the sandbox (`docker` or `podman`). Defaults to `docker` |
 | `SANDBOX_MAX_ITERATIONS` | *(optional)* Maximum number of tool-calling iterations per sandboxed review. Defaults to `8` |
+| `DOCKER_HOST` | *(optional)* Container daemon socket Herald drives, e.g. `unix:///run/user/1000/podman/podman.sock` for a rootless podman. Defaults to `unix:///var/run/docker.sock` |
 
 ## Sandboxed reviews
 
@@ -56,8 +56,16 @@ Herald reviews pull requests inside an ephemeral
 4. posts the review, anchoring each comment on the added or removed line it
    refers to, and removes the container and the temporary clone.
 
-The container runtime is selected with `CONTAINER_RUNTIME` (`docker` or
-`podman`). The repository must contain a `.devcontainer/devcontainer.json`.
+Herald drives the container daemon through its socket: `DOCKER_HOST` (default
+`unix:///var/run/docker.sock`), which covers both docker and podman's
+Docker-compatible socket. The repository must contain a
+`.devcontainer/devcontainer.json`.
+
+The `runArgs` of that file are read but deliberately **not** passed to the daemon:
+they come from an untrusted pull request, and one of them (`--network host`) would
+attach the container to another network and quietly
+defeat the network cut described below. A devcontainer that relies on them
+(`--gpus all`, `--cap-add`, `--shm-size`…) will not get them.
 
 Each sandbox is isolated: it gets its own image tag, container and network. The
 container starts with network access so the `postCreateCommand` /
@@ -70,7 +78,7 @@ network and image are removed when the review ends (including on failure).
 
 The easiest way to get started is with the provided [Dev Container](https://containers.dev/) (VS Code or Zed with the dev container extension).
 
-Open the project and reopen it in the container — the Rust toolchain is pre-installed.
+Open the project and reopen it in the container — the Rust toolchain is pre-installed, along with rootless podman, so sandboxed reviews can be exercised locally: start its API socket with `podman system service --time=0 &` and set `DOCKER_HOST=unix:///run/user/$(id -u)/podman/podman.sock`.
 
 **Without Dev Container**, you just need a Rust toolchain: