Add resource and workspace mount controls

[abhishek-anand]

Summary

• add validated CPU and memory options with environment variable overrides
• add explicit host directory mounts scoped to /workspace
• make additional mounts read-only by default with an explicit :rw opt-in
• persist normalized creation settings and refuse mismatched resume attempts
• keep default behavior at 8 CPUs, 4 GB memory, and no additional mounts

Testing

• verified 3 CPU and 2 GB limits with Apple container 1.2.2
• verified read-only mounts reject writes
• verified read-write mounts persist files to the host
• verified identical settings resume successfully and changed settings fail closed
• verified default resource values and zero additional workspace mounts

[cursor]

Bugbot is not enabled for your account, so this pull request was not reviewed.

Enable Bugbot in the Cursor dashboard to get automatic reviews on future PRs.

[Copilot]

Pull request overview

Adds configurable resource limits and controlled host workspace mounts to the coderunner installer workflow, with persisted creation settings to prevent resuming a container under different constraints.

Changes:

• Added --cpus, --memory, and --mount options (plus env var defaults) with validation and /workspace-scoped mount enforcement.
• Added read-only-by-default mount behavior with explicit :rw opt-in and persisted container creation settings via ~/.coderunner/container-config.
• Documented resource limit and workspace mount usage in README.md.

Reviewed changes

Copilot reviewed 2 out of 2 changed files in this pull request and generated 3 comments.

File	Description
README.md	Documents CPU/memory flags/env vars and /workspace mount rules (ro default, :rw opt-in).
install.sh	Implements resource/mount parsing + validation, applies settings to container run, and persists/validates creation config for safe resume.

Suppressed comments (1)

install.sh:246

• If container start coderunner fails but the container still exists (e.g., corrupted/unhealthy), this path proceeds to container run --name coderunner, which will typically fail due to the existing name. Add a guard here to fail closed and instruct the user to delete/recreate the container instead of attempting a new run.

echo "Starting coderunner with $CPUS CPUs and $MEMORY memory..."
if container run \
  --volume "$ASSETS_SRC/skills/user:/app/uploads/skills/user" \
  --volume "$ASSETS_SRC/outputs:/app/uploads/outputs" \
  "${VOLUME_ARGS[@]}" \
  --name coderunner \
  --detach \
  --cpus "$CPUS" \
  --memory "$MEMORY" \

---

💡 Add a code-review agent skill or configure MCP servers for context-aware, tailored reviews. Learn more in the docs.