feat(container-runner): add container runner crate and e2e harness

.dockerignore

@@ -53,3 +53,17 @@ LICENSE*
 !engine/sdks/typescript/*/dist/
 !shared/typescript/*/dist/
 
+
+# Container runner examples: e2e local state + Unity editor artifacts. The Unity Linux
+# server build stays included: Dockerfile.unity copies Builds/ServerLinux/ into the image.
+container-runner/examples/e2e-test/.bin/
+container-runner/examples/e2e-test/.host-data/
+container-runner/examples/e2e-test/.host-logs/
+container-runner/examples/e2e-test/.rivet-data/
+container-runner/examples/unity-demo/Library/
+container-runner/examples/unity-demo/Temp/
+container-runner/examples/unity-demo/Obj/
+container-runner/examples/unity-demo/Logs/
+container-runner/examples/unity-demo/UserSettings/
+container-runner/examples/unity-demo/Builds/DemoMac/
+container-runner/examples/unity-demo/Builds/ServerMac/

.gitignore

@@ -90,3 +90,24 @@ scripts/ralph/codex-streams/
 # Agent working files now live user-scoped in ~/.agents (or $AGENTS_DIR).
 # This entry is a safety net so a stray in-repo .agent/ never gets committed.
 .agent/
+
+# Container runner examples: e2e local state
+container-runner/examples/e2e-test/.bin/
+container-runner/examples/e2e-test/.host-data/
+container-runner/examples/e2e-test/.host-logs/
+container-runner/examples/e2e-test/.rivet-data/
+# .last-cloud-* files hold gateway tokens and must never be committed.
+container-runner/examples/e2e-test/.last-*
+
+# Container runner examples: Unity editor and build artifacts
+container-runner/examples/unity-demo/Library/
+container-runner/examples/unity-demo/Temp/
+container-runner/examples/unity-demo/Obj/
+container-runner/examples/unity-demo/Logs/
+container-runner/examples/unity-demo/UserSettings/
+container-runner/examples/unity-demo/Builds/
+container-runner/examples/unity-demo/.bayou/
+container-runner/examples/unity-demo/packages-lock.json
+container-runner/examples/unity-demo/*.csproj
+container-runner/examples/unity-demo/*.sln
+container-runner/examples/unity-demo/.vsconfig

Cargo.toml

@@ -78,7 +78,8 @@ members = [
   "engine/packages/profiling",
   "engine/packages/ups-broadcast",
   "examples/chat-room-rust",
-  "examples/hello-world-rust"
+  "examples/hello-world-rust",
+  "container-runner"
 ]
 
   [workspace.package]

container-runner/Cargo.toml

@@ -0,0 +1,34 @@
+[package]
+name = "rivet-container-runner"
+description = "Rivet serverless runner that hosts one actor by spawning a child game-server process and proxying Rivet's tunneled traffic to it."
+publish = false
+autoexamples = false
+version.workspace = true
+authors.workspace = true
+license.workspace = true
+edition.workspace = true
+
+[[bin]]
+name = "rivet-container-runner"
+path = "src/main.rs"
+
+[dependencies]
+anyhow.workspace = true
+axum.workspace = true
+bytes.workspace = true
+clap = { workspace = true, features = ["env"] }
+futures.workspace = true
+futures-util.workspace = true
+http.workspace = true
+nix = { workspace = true, features = ["process"] }
+reqwest = { workspace = true, features = ["stream"] }
+rivet-envoy-client = { workspace = true, features = ["native-transport"] }
+serde.workspace = true
+serde_json.workspace = true
+tokio.workspace = true
+tokio-stream.workspace = true
+tokio-tungstenite.workspace = true
+tokio-util = { workspace = true, features = ["rt"] }
+tracing.workspace = true
+tracing-subscriber.workspace = true
+url.workspace = true

container-runner/Dockerfile.release

@@ -0,0 +1,24 @@
+# syntax=docker/dockerfile:1
+#
+# Produces the standalone linux/amd64 `rivet-container-runner` binary that ships in the
+# release pipeline (the artifact users curl into their Dockerfile).
+#
+# Extract it to ./dist:
+#   docker build --platform linux/amd64 -f container-runner/Dockerfile.release \
+#     --target artifact --output type=local,dest=./dist .
+# -> ./dist/rivet-container-runner  (x86_64 ELF)
+
+FROM --platform=linux/amd64 rust:1-bookworm AS builder
+WORKDIR /build
+# The crate depends on in-repo workspace crates (rivet-envoy-client), so the whole
+# workspace is the build context. Build from the rivet repo root.
+COPY . .
+RUN --mount=type=cache,target=/usr/local/cargo/registry \
+    --mount=type=cache,target=/usr/local/cargo/git \
+    --mount=type=cache,target=/build/target \
+    cargo build --release -p rivet-container-runner --bin rivet-container-runner \
+    && cp target/release/rivet-container-runner /rivet-container-runner
+
+# Export just the binary.
+FROM scratch AS artifact
+COPY --from=builder /rivet-container-runner /rivet-container-runner