@@ -0,0 +24,18 @@
+	return x.ep
+}
+
+// NewJobContainer creates the container the job runs in.
+func (x *ExecutionEnvironment) NewJobContainer(input *actcontainer.NewContainerInput) actcontainer.ExecutionsEnvironment {
+	return NewContainer(x.ep, input)
+}
+
+// NewServiceContainer creates a service container for the job.
+func (x *ExecutionEnvironment) NewServiceContainer(input *actcontainer.NewContainerInput) actcontainer.ExecutionsEnvironment {
+	return NewContainer(x.ep, input)
+}
+
+// NewStepContainer creates the container a single step runs in (container
+// actions and `uses: docker://`).
+func (x *ExecutionEnvironment) NewStepContainer(input *actcontainer.NewContainerInput) actcontainer.ExecutionsEnvironment {
+	return NewContainer(x.ep, input)
+}

@@ -0,0 +17,4 @@
+  rpc Create(CreateRequest) returns (CreateResponse);
+
+  // Start boots a previously created environment.
+  rpc Start(StartRequest) returns (StartResponse);

@@ -0,0 +44,4 @@
+
+message CapabilitiesRequest {}
+
+message CapabilitiesResponse {

@@ -0,0 +53,4 @@
+  string default_path_variable = 6;
+  string path_separator = 7;
+  bool supports_docker_actions = 8;
+  bool manages_own_networking = 9;

@@ -0,0 +58,9 @@
+  bool environment_case_insensitive = 11;
+  map<string, string> runner_context = 12;
+  bool supports_local_copy = 13;
+  // delegates_to_docker indicates the plugin only manages an execution
+  // environment lifecycle and exposes a Docker daemon endpoint for the
+  // runner to drive containers against. When true, the runner ignores
+  // Exec/CopyIn/CopyLocal/CopyOut/UpdateEnv/IsHealthy on this plugin and
+  // talks directly to the daemon returned in CreateResponse.delegate.
+  bool delegates_to_docker = 14;

@@ -0,0 +79,4 @@
+}
+
+message CreateRequest {
+  string image = 1;

@@ -0,0 +81,4 @@
+message CreateRequest {
+  string image = 1;
+  string name = 2;
+  repeated string env = 3;

@@ -0,0 +82,4 @@
+  string image = 1;
+  string name = 2;
+  repeated string env = 3;
+  string working_dir = 4;

@@ -0,0 +83,5 @@
+  string name = 2;
+  repeated string env = 3;
+  string working_dir = 4;
+  repeated string cap_add = 5;
+  repeated string cap_drop = 6;

@@ -0,0 +85,4 @@
+  string working_dir = 4;
+  repeated string cap_add = 5;
+  repeated string cap_drop = 6;
+  repeated ServiceContainer services = 7;

@@ -0,0 +86,4 @@
+  repeated string cap_add = 5;
+  repeated string cap_drop = 6;
+  repeated ServiceContainer services = 7;
+  map<string, string> backend_options = 8;

@@ -0,0 +89,4 @@
+  map<string, string> backend_options = 8;
+  // force_pull asks the plugin to re-fetch the image. Plugins that cannot
+  // honor it should still succeed using the cached image.
+  bool force_pull = 9;

@@ -0,0 +92,4 @@
+  bool force_pull = 9;
+  // platform is the OS/arch (e.g. "linux/amd64") the runner label selected for
+  // image pulls and container creation. Empty means auto-detect.
+  string platform = 10;

@@ -0,0 +97,4 @@
+
+message CreateResponse {
+  string environment_id = 1;
+  // delegate is set iff CapabilitiesResponse.delegates_to_docker is true.

@@ -0,0 +100,4 @@
+  // delegate is set iff CapabilitiesResponse.delegates_to_docker is true.
+  // Carries the Docker daemon endpoint and TLS material the runner uses
+  // to drive containers inside the plugin-managed environment.
+  DockerDelegate delegate = 2;

@@ -0,0 +111,4 @@
+  string endpoint = 1;
+  bytes tls_ca = 2;
+  bytes tls_cert = 3;
+  bytes tls_key = 4;

@@ -0,0 +123,4 @@
+}
+
+message StartResponse {
+  map<string, string> image_env = 1;

@@ -0,0 +130,4 @@
+message ExecRequest {
+  string environment_id = 1;
+  repeated string command = 2;
+  map<string, string> env = 3;