Add microapp platform scaffold

microapps/runtime/Dockerfile

@@ -0,0 +1,22 @@
+FROM debian:bookworm-slim
+
+ARG DENO_VERSION=2.6.4
+
+RUN apt-get update \
+  && apt-get install --yes --no-install-recommends ca-certificates curl tini unzip \
+  && rm -rf /var/lib/apt/lists/*
+
+RUN curl -fsSL "https://dl.deno.land/release/v${DENO_VERSION}/deno-x86_64-unknown-linux-gnu.zip" -o /tmp/deno.zip \
+  && unzip /tmp/deno.zip -d /usr/local/bin \
+  && chmod +x /usr/local/bin/deno \
+  && rm /tmp/deno.zip
+
+WORKDIR /workspace
+
+COPY microapps/runtime/entrypoint.sh /usr/local/bin/microapp-entrypoint
+
+RUN chmod +x /usr/local/bin/microapp-entrypoint
+
+ENV DENO_DIR=/deno-dir
+
+ENTRYPOINT ["/usr/bin/tini", "--", "/usr/local/bin/microapp-entrypoint"]

microapps/runtime/entrypoint.sh

@@ -0,0 +1,15 @@
+#!/usr/bin/env sh
+set -eu
+
+APP_DIR="${APP_DIR:-/workspace/app}"
+ENTRYPOINT_FILE="${ENTRYPOINT_FILE:-$APP_DIR/main.ts}"
+ALLOW_READ="${ALLOW_READ:-$APP_DIR}"
+ALLOW_ENV="${ALLOW_ENV:-PORT,POCKETBASE_URL,POCKETBASE_SERVICE_EMAIL,POCKETBASE_SERVICE_PASSWORD,APP_OWNER_TEAM_ID,APP_SLUG}"
+ALLOW_NET="${ALLOW_NET:-127.0.0.1,localhost}"
+
+exec deno run \
+  --no-prompt \
+  --allow-read="$ALLOW_READ" \
+  --allow-env="$ALLOW_ENV" \
+  --allow-net="$ALLOW_NET" \
+  "$ENTRYPOINT_FILE"

microapps/runtime/run-with-gvisor.sh

@@ -0,0 +1,17 @@
+#!/usr/bin/env sh
+set -eu
+
+IMAGE_NAME="${IMAGE_NAME:-clientflow/microapp-runtime}"
+APP_DIR="${APP_DIR:-$(pwd)/microapps/templates/pocketbase-deno-dashboard}"
+ALLOW_NET="${ALLOW_NET:-127.0.0.1,localhost}"
+
+docker run \
+  --rm \
+  --runtime=runsc \
+  --memory=256m \
+  --cpus=0.5 \
+  --pids-limit=128 \
+  -e APP_DIR=/workspace/app \
+  -e ALLOW_NET="$ALLOW_NET" \
+  -v "$APP_DIR:/workspace/app:ro" \
+  "$IMAGE_NAME"