feat: support ascend and nvidia accelerators with runc

[mhsong1998-dot]

Status

Ready for review. The implementation and physical-device validation are complete. On 2026-09-04, the feature commit was replayed unchanged onto sandboxd main at 3696d0515d7e520436e2dc54afe10fdcd9d81531; the PR is currently mergeable.

Summary

• generalize XPU allocation, exclusive leasing, release, and recovery across providers
• add an optional Ascend provider backed by a separate JSON OCI adapter process
• own the ascend-oci-adapter source, optional build target, default mount profile, and pinned MindCluster dependency in sandboxd
• discover and validate physical Ascend 310P3 and 910 A2/A3 devices
• derive the trusted runtime family from local inventory and accept request-side type + device_ids
• validate provider-generated OCI devices, cgroup rules, mounts, capabilities, and environment variables
• support NVIDIA whole-device allocation with runsc/nvproxy or native runc/NVIDIA Container Toolkit
• keep native-runc GPU availability independent from the runsc nvproxy driver-version gate

The adapter remains a separate executable. Moving its source into this repository changes ownership only; sandboxd communicates with it through the version/discover/edits JSON protocol and does not link MindCluster into the daemon.

Current commit

• c7e4ae37194c feat: support xpu devices in runc sandboxes
• base: 3696d0515d7e (main)
• the feature patch is identical to the previously validated e364c40f9134 patch (git range-diff reported =)

Cross-repository status

• openeuler/yuanrong-functionsystem#449: merged on 2026-09-03, head ae496f191f0c
• openeuler/yuanrong-sandbox-sdk#31: merged on 2026-09-03, head 4877a2d78dcd
• openeuler/yuanrong#1020: merged on 2026-09-03, head 315ad8d03692
• feat: support ascend and nvidia accelerators with runc AKernel#45: open; its refreshed head eb9e16b2c9a3 now points to this PR head

Validation

Current head and conflict resolution

• git range-diff e364c40f9134^! c7e4ae37194c^! reported an identical patch
• AKernel's previous sandboxd gitlink 5970730acc01 is an ancestor of c7e4ae37194c, resolving the parent PR's non-trivial gitlink conflict
• commit subject/signoff audit passed: 1 commit, 0 invalid subjects, 0 missing author signoffs
• git diff --check origin/main..HEAD passed
• Linux amd64 compile validation passed for pkg/xpumanager, pkg/runtime/..., and internal/server
• tools/ascend-oci-adapter: go test ./... passed locally

Previously completed no-hardware and hardware validation

The following validation used the pre-rebase feature head e364c40f9134. The feature patch is unchanged after the base sync, but no new package was produced from c7e4ae37194c in this update.

• cn-north-4 no-hardware E2E passed GPU/runsc, GPU/runc, NPU/runc, and NPU release/reallocation
• full mock E2E passed twice through AKernel SDK -> FunctionSystem scheduling -> sandboxd -> mock adapter -> runc; the validation-only mock harness was not committed
• Tesla T4 passed full SDK -> FunctionSystem -> sandboxd E2E for both runsc/nvproxy and native runc/NVIDIA Container Toolkit; in-sandbox nvidia-smi and CUDA vectorAdd passed
• Atlas 300I Pro / Ascend 310P3 passed DCMI discovery, resource reporting and scheduling, runc device/driver injection, in-sandbox npu-smi, real CANN Add, exclusive leasing, release/reallocation, and post-restart allocation
• final sandbox/runtime/device process state was empty after validation

Merge order

1. merge this sandboxd PR;
2. update feat: support ascend and nvidia accelerators with runc AKernel#45 from the temporary contributor-fork submodule URL to the upstream sandboxd URL and merged SHA;
3. perform the final AKernel merge-readiness check.