feat(launcher): support rootless Podman as container engine (fixes #63)

README.md

@@ -92,14 +92,18 @@ Coordinate multi-step tasks conversationally through the Room Agent or speak nat
 - **Hardware**:
   - Minimum (`small` profile): 4 CPU cores, 8 GB-class RAM (at least 7 GiB reported by the operating system), 6.5 GiB free disk.
   - `large` profile (adds the managed browser): 8 CPU cores, 15 GiB RAM, 11 GiB free disk.
-- **Docker**: If Docker is not installed, the installer automatically installs official Docker Desktop (Windows/macOS) or Docker Engine (Linux).
+- **Container Engine**: Docker or Podman.
+  - **Docker** (default): If Docker is not installed, the installer automatically installs official Docker Desktop (Windows/macOS) or Docker Engine (Linux).
+  - **Podman**: Rootless Podman (≥ 5 with `podman-compose`) is supported on Linux and macOS (`podman machine`). Pass `--engine podman` to select it.
 
 ### Run the Installation Command
 
 Run the universal command in your terminal:
 
 ```bash
 npx --yes run-spaceapp@latest install
+# Or explicitly select Podman:
+npx --yes run-spaceapp@latest install --engine podman
 ```
 
 > **Windows 11 Tip**: Use **Command Prompt** (`cmd.exe`) or the Command Prompt profile in Windows Terminal. If PowerShell has a restricted execution policy, run `npx.cmd --yes run-spaceapp@latest install`.

docs/getting-started.md

@@ -87,6 +87,29 @@ the installer resumes automatically in Command Prompt without entering the
 command again. SpaceApp reuses Docker Desktop's WSL2 Linux environment and does
 not install a second full virtual machine.
 
+## Podman support (rootless Linux and macOS)
+
+SpaceApp supports rootless **Podman** (Podman ≥ 5 with `podman-compose` or `docker-compose` as compose provider) on Linux and macOS (`podman machine`).
+
+To install using Podman:
+
+```bash
+npx --yes run-spaceapp@latest install --engine podman
+```
+
+Key considerations and operational details:
+- **Engine Selection**: Specifying `--engine podman` records the engine in `config.json`. All future lifecycle and operational commands (`up`, `down`, `logs`, `status`, `backup`, `restore`, `doctor`, `uninstall`) automatically use `podman compose`. If `--engine` is omitted, Docker is preferred if detected. If only Podman is available, the launcher suggests Podman or selects it automatically when `--non-interactive` is passed.
+- **SELinux Enforcing**: On distributions like Fedora, Red Hat Enterprise Linux, and CentOS Stream where SELinux is set to Enforcing, workspace bind mounts (`workspace add`) are automatically configured with the `:z` flag (`bind: { selinux: "z" }`) so that rootless containers can access workspace files with correct file labels.
+- **Data Safety & Engine Isolation**: Docker and Podman use separate container storage and named volumes. Switching engines in-place on an existing installation is blocked to prevent accidental data loss. To migrate between Docker and Podman, export your database with `spaceapp backup`, reinstall with the target `--engine`, and then restore with `spaceapp restore`.
+- **Security Boundaries**: Host-root mode (`--access host-root`) is **strictly refused** under Podman.
+- **macOS Podman Machine**: On macOS, Podman operates inside a virtual machine managed by `podman machine`. The launcher verifies that the active machine has sufficient CPU, RAM, and disk for your chosen profile. If machine resources are insufficient, the launcher provides specific commands to reconfigure it:
+  ```bash
+  podman machine stop
+  podman machine set --cpus 4 --memory 8192 --disk-size 50
+  podman machine start
+  ```
+- **Diagnostics (`doctor`)**: Running `spaceapp doctor` with a Podman installation reports the Podman version, compose provider status, rootless status, cgroup version (cgroup v2), and whether CPU/memory limits are delegated.
+
 ## Installation profiles
 
 The universal install command defaults to `--profile auto`:

packages/run-spaceapp/README.md

@@ -41,7 +41,22 @@ credential-free config so Docker Desktop's graphical credential helper is never
 invoked outside an interactive logon.
 
 The launcher selects `small`, `medium`, or `large` automatically using CPU,
-RAM and free disk. Docker's CPU and RAM allocation is checked as well.
+RAM and free disk. Docker and Podman resource allocations are checked as well.
+
+### Container Engines: Docker and Podman
+
+The launcher defaults to Docker. It also supports **rootless Podman** (Podman ≥ 5 with `podman-compose` or `docker-compose` provider) on Linux and macOS (`podman machine`):
+
+```bash
+npx --yes run-spaceapp@latest install --engine podman
+```
+
+- **Selection**: Pass `--engine docker|podman`. The selected engine is saved in `config.json` and reused by all subsequent commands (`up`, `down`, `backup`, `restore`, `doctor`, etc.). When `--engine` is omitted, Docker is preferred if available. If only Podman is detected, interactive setup prompts to use it (or selects it automatically with `--non-interactive`).
+- **SELinux**: On Linux distributions with SELinux enforcing (such as Fedora/RHEL), bind mounts configured via `workspace add` are automatically tagged with `:z` (`selinux: "z"`) to ensure correct permissions.
+- **Data safety**: Docker volumes are not accessible to Podman (and vice-versa). Directly switching engines on an existing installation is blocked. To switch engines safely, run `spaceapp backup` to export an archive, reinstall with `--engine <new-engine>`, and run `spaceapp restore`.
+- **Host-root access**: `--access host-root` is strictly refused when running on Podman.
+- **macOS Podman Machine**: On macOS, the launcher inspects CPU, memory, and disk allocated to the default `podman machine` and guides you to resize it (`podman machine stop`, `podman machine set --cpus ... --memory ...`, `podman machine start`) if requirements are not met.
+
 
 | Profile | CPU | Usable RAM | Fresh free space | Services |
 | --- | --- | --- | --- | --- |