Track runtime ownership to prevent cross-runtime status corruption

When multiple runtimes coexist (e.g., podman and go-microvm), running
CLI commands with one runtime active permanently corrupts the status
files of workloads managed by the other runtime, marking them as
"unhealthy." This happens because the reconciliation logic assumes all
workloads belong to the single active runtime.

Add a RuntimeName field to RunConfig that records which runtime created
a workload, and a Name() method to the Runtime interface so the active
runtime can identify itself. During reconciliation, skip workloads whose
owning runtime differs from the active one. Legacy workloads without a
RuntimeName are conservatively treated as owned by the active runtime.

Fixes #4432

Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>

Author: JAORMX

cmd/thv/app/run.go

@@ -243,6 +243,10 @@ func runSingleServer(ctx context.Context, runFlags *RunFlags, serverOrImage stri
 		return err
 	}
 
+	// Record which runtime owns this workload so that reconciliation logic
+	// does not corrupt its status file when a different runtime is active.
+	runnerConfig.RuntimeName = rt.Name()
+
 	// Enforce policy in the main process before saving state or spawning a
 	// detached worker, so violations surface synchronously with a non-zero
 	// exit code rather than silently failing in the background log.
@@ -469,6 +473,7 @@ func runFromConfigFile(ctx context.Context) error {
 
 	// Set the runtime in the config
 	runConfig.Deployer = rt
+	runConfig.RuntimeName = rt.Name()
 
 	// Create workload manager
 	workloadManager, err := workloads.NewManagerFromRuntime(rt)

pkg/api/v1/workload_service.go

@@ -100,6 +100,9 @@ func (s *WorkloadService) CreateWorkloadFromRequest(ctx context.Context, req *cr
 		return nil, err
 	}
 
+	// Record which runtime owns this workload for cross-runtime reconciliation.
+	runConfig.RuntimeName = s.containerRuntime.Name()
+
 	// Enforce policy before saving state or starting the workload, so
 	// violations are returned as API errors rather than creating the server
 	// in a broken state.

pkg/api/v1/workloads_test.go

@@ -261,6 +261,7 @@ func TestCreateWorkload(t *testing.T) {
 			mockRuntime := runtimemocks.NewMockRuntime(ctrl)
 			mockGroupManager := groupsmocks.NewMockManager(ctrl)
 
+			mockRuntime.EXPECT().Name().Return("docker").AnyTimes()
 			tt.setupMock(t, mockWorkloadManager, mockRuntime, mockGroupManager)
 			expectedServerOrImage := tt.expectedServerOrImage
 			if expectedServerOrImage == "" {
@@ -281,6 +282,7 @@ func TestCreateWorkload(t *testing.T) {
 				workloadService: &WorkloadService{
 					groupManager:      mockGroupManager,
 					workloadManager:   mockWorkloadManager,
+					containerRuntime:  mockRuntime,
 					imageRetriever:    mockRetriever,
 					imagePuller:       func(_ context.Context, _ string) error { return nil },
 					configProvider:    config.NewDefaultProvider(),
@@ -502,6 +504,7 @@ func TestUpdateWorkload(t *testing.T) {
 				workloadService: &WorkloadService{
 					groupManager:      mockGroupManager,
 					workloadManager:   mockWorkloadManager,
+					containerRuntime:  mockRuntime,
 					imageRetriever:    mockRetriever,
 					imagePuller:       func(_ context.Context, _ string) error { return nil },
 					configProvider:    config.NewDefaultProvider(),

pkg/container/docker/client.go

@@ -651,6 +651,11 @@ func (c *Client) AttachToWorkload(ctx context.Context, workloadName string) (io.
 	return resp.Conn, stdoutReader, nil
 }
 
+// Name returns the registered name of this runtime.
+func (*Client) Name() string {
+	return RuntimeName
+}
+
 // IsRunning checks the health of the container runtime.
 // This is used to verify that the runtime is operational and can manage workloads.
 func (c *Client) IsRunning(ctx context.Context) error {

pkg/container/kubernetes/client.go

@@ -787,6 +787,11 @@ func (*Client) StopWorkload(_ context.Context, _ string) error {
 	return nil
 }
 
+// Name returns the registered name of this runtime.
+func (*Client) Name() string {
+	return RuntimeName
+}
+
 // IsRunning checks the health of the container runtime.
 // This is used to verify that the runtime is operational and can manage workloads.
 func (c *Client) IsRunning(ctx context.Context) error {

pkg/container/runtime/mocks/mock_runtime.go

@@ -180,6 +180,11 @@ type Runtime interface {
 	// IsRunning checks the health of the container runtime.
 	// This is used to verify that the runtime is operational and can manage workloads.
 	IsRunning(ctx context.Context) error
+
+	// Name returns the registered name of this runtime (e.g., "docker", "kubernetes").
+	// Used to track which runtime owns a workload so that reconciliation logic
+	// does not corrupt status files of workloads managed by a different runtime.
+	Name() string
 }
 
 // Monitor defines the interface for container monitoring

pkg/container/runtime/types.go

@@ -169,7 +169,14 @@ func buildServerConfig(
 
 	// Build the configuration
 	envVarValidator := &runner.DetachedEnvVarValidator{}
-	return runner.NewRunConfigBuilder(ctx, imageMetadata, envVars, envVarValidator, opts...)
+	cfg, err := runner.NewRunConfigBuilder(ctx, imageMetadata, envVars, envVarValidator, opts...)
+	if err != nil {
+		return nil, err
+	}
+
+	// Record which runtime owns this workload for cross-runtime reconciliation.
+	cfg.RuntimeName = rt.Name()
+	return cfg, nil
 }
 
 // configureTransport sets up transport configuration from metadata

pkg/mcp/server/run_server.go

@@ -55,6 +55,11 @@ type RunConfig struct {
 	// means unversioned (backward-compat with older operators, or non-operator callers).
 	MCPServerGeneration int64 `json:"mcpserver_generation,omitempty" yaml:"mcpserver_generation,omitempty"`
 
+	// RuntimeName is the registered name of the container runtime that owns this
+	// workload (e.g., "docker", "kubernetes"). Used during reconciliation to avoid
+	// corrupting status files of workloads managed by a different runtime.
+	RuntimeName string `json:"runtime_name,omitempty" yaml:"runtime_name,omitempty"`
+
 	// Image is the Docker image to run
 	Image string `json:"image" yaml:"image"`
 

pkg/runner/config.go

@@ -74,6 +74,38 @@ type fileStatusManager struct {
 	runConfigStore state.Store
 }
 
+// isOwnedByActiveRuntime checks whether the named workload was created by the
+// currently active runtime. It loads the runtime_name field from the persisted
+// RunConfig and compares it against f.runtime.Name(). Legacy workloads that
+// predate the runtime_name field (empty string) are conservatively treated as
+// owned by the active runtime so that existing validation behaviour is preserved.
+func (f *fileStatusManager) isOwnedByActiveRuntime(ctx context.Context, workloadName string) bool {
+	reader, err := f.runConfigStore.GetReader(ctx, workloadName)
+	if err != nil {
+		// RunConfig missing or unreadable -- assume ours so we don't silently
+		// skip validation for workloads we should be checking.
+		return true
+	}
+	defer func() {
+		if err := reader.Close(); err != nil {
+			slog.Warn("failed to close reader", "error", err)
+		}
+	}()
+
+	var config struct {
+		RuntimeName string `json:"runtime_name"`
+	}
+	if err := json.NewDecoder(reader).Decode(&config); err != nil {
+		return true // can't determine ownership -- assume ours
+	}
+
+	// Empty means legacy workload; treat as owned by active runtime.
+	if config.RuntimeName == "" {
+		return true
+	}
+	return config.RuntimeName == f.runtime.Name()
+}
+
 // isRemoteWorkload checks if a workload is remote by attempting to load its run configuration
 // and checking if it has a RemoteURL field set.
 // TODO: This is a temporary solution to check if a workload is remote
@@ -910,6 +942,12 @@ func (f *fileStatusManager) validateRunningWorkload(
 		return result, nil
 	}
 
+	// Skip validation for workloads owned by a different runtime to avoid
+	// corrupting their status files (see #4432).
+	if !f.isOwnedByActiveRuntime(ctx, workloadName) {
+		return result, nil
+	}
+
 	// Get raw container info from runtime (before label filtering)
 	containerInfo, err := f.runtime.GetWorkloadInfo(ctx, workloadName)
 	if err != nil {
@@ -964,6 +1002,12 @@ func (f *fileStatusManager) handleRuntimeMissing(
 		return fileWorkload, nil
 	}
 
+	// Skip reconciliation for workloads owned by a different runtime to avoid
+	// corrupting their status files (see #4432).
+	if !f.isOwnedByActiveRuntime(ctx, workloadName) {
+		return fileWorkload, nil
+	}
+
 	if fileWorkload.Status == rt.WorkloadStatusRunning || fileWorkload.Status == rt.WorkloadStatusStopped {
 		// The workload cannot be running or stopped if the runtime container is not found
 		contextMsg := fmt.Sprintf("workload %s not found in runtime, marking as unhealthy", workloadName)