feat: add urunc container runtime extension

README.md

@@ -71,6 +71,7 @@ tiers based on support level:
 | [soci-snapshotter](container-runtime/soci-snapshotter) | :yellow_square: extra | [ghcr.io/siderolabs/soci-snapshotter](https://github.com/siderolabs/extensions/pkgs/container/soci-snapshotter) | `v0.15.0` |  This system extension provides AWS SOCI Snapshotter using containerd's runtime handler. |
 | [spin](container-runtime/spin) | :yellow_square: extra | [ghcr.io/siderolabs/spin](https://github.com/siderolabs/extensions/pkgs/container/spin) | `v0.25.1` |  This system extension provides support for spin runtime (WebAssembly) containers. |
 | [stargz-snapshotter](container-runtime/stargz-snapshotter) | :green_square: core | [ghcr.io/siderolabs/stargz-snapshotter](https://github.com/siderolabs/extensions/pkgs/container/stargz-snapshotter) | `v0.18.2` |  This system extension provides Stargz Snapshotter using containerd's runtime handler. |
+| [urunc](container-runtime/urunc) | :yellow_square: extra | [ghcr.io/siderolabs/urunc](https://github.com/siderolabs/extensions/pkgs/container/urunc) | `0.8.0` |  This system extension provides urunc using containerd's runtime handler. |
 | [wasmedge](container-runtime/wasmedge) | :yellow_square: extra | [ghcr.io/siderolabs/wasmedge](https://github.com/siderolabs/extensions/pkgs/container/wasmedge) | `v0.6.1` |  This system extension provides support for WasmEdge runtime (WebAssembly) containers. |
 | [youki](container-runtime/youki) | :white_large_square: contrib | [ghcr.io/siderolabs/youki](https://github.com/siderolabs/extensions/pkgs/container/youki) | `0.7.0` |  This system extension provides youki using containerd's runtime handler. |
 
@@ -233,7 +234,7 @@ The rough flow should look like the following:
 To build and push an extension to a local registry use:
 
 ```bash
-make <extension-name> PUSH=true REGISTRY=127.0.0.1:5005 USERNAME=<username> PUSH=true
+make <extension-name> PUSH=true REGISTRY=127.0.0.1:5005 USERNAME=<username>
 ```
 
 Instructions on how to set up the builder can be found [here](https://docs.siderolabs.com/talos/latest/build-and-extend-talos/custom-images-and-development/developing-talos#prepare)

container-runtime/urunc/10-urunc.part

@@ -0,0 +1,4 @@
+[plugins."io.containerd.cri.v1.runtime".containerd.runtimes.urunc]
+  runtime_type = "io.containerd.urunc.v2"
+  container_annotations = ["com.urunc.unikernel.*"]
+  pod_annotations = ["com.urunc.unikernel.*"]

container-runtime/urunc/README.md

@@ -0,0 +1,48 @@
+# urunc extension
+
+## Installation
+
+See [Installing Extensions](https://github.com/siderolabs/extensions#installing-extensions).
+
+## Usage
+
+This extension installs `urunc`, `containerd-shim-urunc-v2`, the monitor binaries, and a containerd runtime handler named `urunc`.
+
+Apply the following manifest to add the runtime class:
+
+```yaml
+apiVersion: node.k8s.io/v1
+kind: RuntimeClass
+metadata:
+  name: urunc
+handler: urunc
+```
+
+## Configuration
+
+On Talos Linux 1.14 and later, provide `/etc/urunc/config.toml` with an [`EtcFileConfig`](https://docs.siderolabs.com/talos/v1.14/reference/configuration/runtime/etcfileconfig):
+
+```yaml
+apiVersion: v1alpha1
+kind: EtcFileConfig
+name: urunc/config.toml
+mode: 0o644
+contents: |
+  [log]
+  level = "info"
+  syslog = false
+
+  [extra_binaries.virtiofsd]
+  path = "/usr/local/bin/virtiofsd"
+  options = "--cache always --sandbox none"
+```
+
+The `name` is relative to `/etc`, so the document writes the file to urunc's default configuration path without an environment override.
+
+The extension installs monitor binaries under `/usr/local/bin`; set their paths in the TOML when overriding monitor configuration.
+A complete example is available in the upstream [`config.toml`](https://github.com/urunc-dev/urunc/blob/v0.8.0/deployment/urunc-deploy/config.toml).
+
+## Downstream patch
+
+The extension applies one patch to urunc v0.8.0. It reads the nameserver from the container's OCI-mounted `/etc/resolv.conf` and passes it to Unikraft.
+This allows Kubernetes service DNS to work inside the guest instead of always using the hard-coded `8.8.8.8` fallback.

container-runtime/urunc/manifest.yaml.tmpl

@@ -0,0 +1,10 @@
+version: v1alpha1
+metadata:
+  name: urunc
+  version: "{{ .VERSION }}"
+  author: Nubificus LTD
+  description: |
+    [{{ .TIER }}] This system extension provides urunc using containerd's runtime handler.
+  compatibility:
+    talos:
+      version: ">= v1.13.0"