[Feature Request] Add NsJail direct sandbox with baked pkgs

[snapydziuba]

We currently added to the Dockerfile the following target

#   - sandbox-runner-direct-baked: copies rootfs AND bakes /pkgs from package-builder
#                           (no PVC needed; runner can spread across nodes)
#                           this enables NsJail to run the sandbox directly

FROM sandbox-runner-base AS sandbox-runner-direct-baked

COPY --from=sandbox-build / /sandbox-rootfs/
COPY --from=package-builder /pkgs /sandbox-rootfs/pkgs

RUN sed -i '/^cgroup_mem_swap_max/d' /sandbox-rootfs/sandbox_api/config/sandbox.cfg

And updating the direct-start-sandbox.sh with:

-    if [ -d /host-packages ]; then
-        mount --bind /host-packages /pkgs 2>/dev/null || \
-            echo "WARNING: could not bind /host-packages - sandbox will run without packages"
-    fi
+    # PATCH: If /host-packages is empty we use a baked image /pkgs instead.
+    if [ -d /host-packages ] && [ "$(ls -A /host-packages 2>/dev/null)" ]; then
+        mount --bind /host-packages /pkgs 2>/dev/null || \
+            echo "WARNING: could not bind /host-packages - using packages from $ROOTFS/pkgs"
+    else
+        echo "INFO: /host-packages is empty or missing - using packages from $ROOTFS/pkgs"
+    fi

This allows to set workerSandbox.packages.initJob.enabled: false and workerSandbox.packages.persistence.enabled: false and prebake the pkgs as already done in KVM mode with sandbox-runner-baked. As a ReadOnlyMany PVCs are a hassle as well as the Helm Init Job and this allows for multiple Replicas of stateless Runners where the pkg update is a new OCI layer updated by actions.

Would this be a change that would be accepted and we could merge upstream?
Then i would gladly provide a PR.