replace ContainerRuntime CLI to Bollard crate (default: docker socket)

limit tool result to open router tool response (with truncated info for
ai)

Hard kill if graceful shutdown is too long

crates/devcontainer-rs/src/lib.rs

@@ -38,6 +38,12 @@ pub struct DevContainerSchema {
     #[serde(rename = "remoteUser", default)]
     pub remote_user: Option<String>,
 
+    /// Arguments passés à `docker run`.
+    ///
+    /// Lus pour rester fidèle au format `devcontainer.json`, mais
+    /// **délibérément pas transmis** au runtime : ils viennent d'une pull
+    /// request non fiable et pourraient casser l'isolation de la sandbox (voir
+    /// [`DevContainer::run_args`]).
     #[serde(rename = "runArgs", default)]
     pub run_args: Vec<String>,
 }
@@ -52,7 +58,6 @@ pub struct DevContainer {
     pub post_create_command: Option<String>,
     pub post_start_command: Option<String>,
     pub remote_user: Option<String>,
-    pub run_args: Vec<String>,
 }
 
 #[derive(Debug, thiserror::Error)]
@@ -114,7 +119,6 @@ impl TryFrom<(DevContainerSchema, PathBuf)> for DevContainer {
             post_create_command: schema.post_create_command,
             post_start_command: schema.post_start_command,
             remote_user: schema.remote_user,
-            run_args: schema.run_args,
         })
     }
 }
@@ -203,8 +207,7 @@ mod tests {
                 "containerEnv": {
                     "RUST_LOG": "debug"
                 },
-                "remoteUser": "dev",
-                "runArgs": ["--userns=keep-id"]
+                "remoteUser": "dev"
             }"#,
         )
         .unwrap();
@@ -217,7 +220,6 @@ mod tests {
         assert_eq!(config.container_env.get("RUST_LOG").unwrap(), "debug");
         assert_eq!(config.workspace_folder.as_deref(), Some("/workspace"));
         assert_eq!(config.remote_user.as_deref(), Some("dev"));
-        assert_eq!(config.run_args, vec!["--userns=keep-id"]);
     }
 
     #[test]