Use Podman for static Qt browser bundle

ober

95bcdf40f5c6b78f309f1717299b7fb93dc2e3fe

diff --git a/Dockerfile.qt b/Dockerfile.qt
index 40e5d6d..14a5afb 100644
--- a/Dockerfile.qt
+++ b/Dockerfile.qt
@@ -1,6 +1,6 @@
-# Docker recipe for building the bundled jerboa-browser Linux Qt artifact.
+# OCI container recipe for building the bundled jerboa-browser Linux Qt artifact.
 #
-# This mirrors the jerboa-emacs static-qt workflow: build inside Docker, create a
+# This mirrors the jerboa-emacs static-qt workflow: build inside Podman, create a
 # container, and copy the finished artifact from /out. Unlike jemacs-qt, this
 # project uses Qt WebEngine, so the result is not a single fully static Qt
 # executable. The tarball contains the native Jerboa browser binary, the Qt
@@ -8,11 +8,11 @@
 # and WebEngine resource files.
 #
 # Usage:
-#   docker build -f Dockerfile.qt -t jerboa-browser-qt-builder .
-#   id=$(docker create jerboa-browser-qt-builder)
-#   docker cp $id:/out/jerboa-browser-static-qt.tar.gz . && docker rm $id
+#   podman build -f Dockerfile.qt -t jerboa-browser-qt-builder .
+#   id=$(podman create jerboa-browser-qt-builder)
+#   podman cp $id:/out/jerboa-browser-static-qt.tar.gz . && podman rm $id
 
-ARG JERBOA_IMAGE=jerboa21/jerboa
+ARG JERBOA_IMAGE=docker.io/jerboa21/jerboa
 FROM ${JERBOA_IMAGE} AS builder
 
 ENV DEBIAN_FRONTEND=noninteractive
diff --git a/Makefile b/Makefile
index d75ad8e..f2caf2c 100644
--- a/Makefile
+++ b/Makefile
@@ -30,10 +30,10 @@ SANDBOX_DIR ?= dist/webengine-sandbox
 CC ?= cc
 CARGO ?= cargo
 CARGO_AUDIT ?= $(shell command -v cargo-audit 2>/dev/null || printf '%s/.cargo/bin/cargo-audit' "$$HOME")
-DOCKER ?= docker
-DOCKER_PLATFORM ?= linux/amd64
-DOCKER_BUILD_FLAGS ?=
-JERBOA_IMAGE ?= jerboa21/jerboa
+PODMAN ?= podman
+PODMAN_PLATFORM ?= linux/amd64
+PODMAN_BUILD_FLAGS ?=
+JERBOA_IMAGE ?= docker.io/jerboa21/jerboa
 STATIC_QT_IMAGE ?= jerboa-browser-qt-builder
 STATIC_QT_TARBALL ?= jerboa-browser-static-qt-linux-amd64.tar.gz
 
@@ -79,7 +79,7 @@ lib/libyubikey_native.$(SOEXT): vendor-yubikey
 
 yubikey-native: lib/libyubikey_native.$(SOEXT)
 
-.PHONY: all build binary install run test test-all test-keymap test-minibuffer test-commands test-keys test-nav test-hint test-pass test-polish test-securestore test-adblock test-gui test-buffers test-native repl security audit sbom reproducibility-report binary-smoke webengine-sandbox-evidence verify release-evidence clean help check-jerbuild check-docker ensure-jerboa-tools static-qt docker-static-qt vendor-yubikey yubikey-native
+.PHONY: all build binary install run test test-all test-keymap test-minibuffer test-commands test-keys test-nav test-hint test-pass test-polish test-securestore test-adblock test-gui test-buffers test-native repl security audit sbom reproducibility-report binary-smoke webengine-sandbox-evidence verify release-evidence clean help check-jerbuild check-podman ensure-jerboa-tools static-qt podman-static-qt vendor-yubikey yubikey-native
 .DEFAULT_GOAL := help
 
 all: binary
@@ -103,9 +103,11 @@ ensure-jerboa-tools:
 	  exit 1; \
 	}
 
-check-docker:
-	@command -v $(DOCKER) >/dev/null 2>&1 || \
-	  { echo "ERROR: Docker executable '$(DOCKER)' not found. Install Docker or set DOCKER=/path/to/docker."; exit 1; }
+check-podman:
+	@command -v $(PODMAN) >/dev/null 2>&1 || \
+	  { echo "ERROR: Podman executable '$(PODMAN)' not found. Install Podman or set PODMAN=/path/to/podman."; exit 1; }
+	@$(PODMAN) info >/dev/null 2>&1 || \
+	  { echo "ERROR: Podman executable '$(PODMAN)' is installed but not reachable. On macOS/Windows, run 'podman machine start' and retry."; exit 1; }
 
 # Build the self-contained native ./jerboa-browser via .jerbuild.
 binary: check-jerbuild vendor-yubikey $(FUSE_SHIM)
@@ -320,20 +322,20 @@ release-evidence: verify
 repl:
 	$(JEXEC) scheme/browser-repl.ss
 
-# Docker wrapper matching the jerboa-emacs static-qt workflow. Qt WebEngine is
+# Podman wrapper matching the jerboa-emacs static-qt workflow. Qt WebEngine is
 # not emitted as one fully static executable; the artifact is a bundled Linux
 # tarball with the native browser binary plus the Qt WebEngine runtime.
-static-qt: docker-static-qt
+static-qt: podman-static-qt
 
-docker-static-qt: check-docker
-	@echo "=== Building jerboa-browser Linux Qt artifact with Docker ==="
-	$(DOCKER) pull $(JERBOA_IMAGE)
-	$(DOCKER) build $(DOCKER_BUILD_FLAGS) --platform $(DOCKER_PLATFORM) \
+podman-static-qt: check-podman
+	@echo "=== Building jerboa-browser Linux Qt artifact with Podman ==="
+	$(PODMAN) pull --platform $(PODMAN_PLATFORM) $(JERBOA_IMAGE)
+	$(PODMAN) build $(PODMAN_BUILD_FLAGS) --platform $(PODMAN_PLATFORM) \
 	  --build-arg JERBOA_IMAGE="$(JERBOA_IMAGE)" \
 	  -f Dockerfile.qt -t $(STATIC_QT_IMAGE) .
-	@id=$$($(DOCKER) create $(STATIC_QT_IMAGE)) && \
-	  trap '$(DOCKER) rm $$id >/dev/null 2>&1 || true' EXIT INT TERM && \
-	  $(DOCKER) cp $$id:/out/jerboa-browser-static-qt.tar.gz ./$(STATIC_QT_TARBALL)
+	@id=$$($(PODMAN) create $(STATIC_QT_IMAGE)) && \
+	  trap '$(PODMAN) rm $$id >/dev/null 2>&1 || true' EXIT INT TERM && \
+	  $(PODMAN) cp $$id:/out/jerboa-browser-static-qt.tar.gz ./$(STATIC_QT_TARBALL)
 	@echo ""
 	@ls -lh $(STATIC_QT_TARBALL)
 	@tar tzf $(STATIC_QT_TARBALL) | grep -E '/bin/jerboa-browser$$' >/dev/null || \
@@ -377,7 +379,7 @@ help:
 	@echo ""
 	@echo "  make binary   build the self-contained native ./jerboa-browser"
 	@echo "  make install  build + install to $(BIN_DIR)/jerboa-browser"
-	@echo "  make static-qt build the bundled Linux Qt/WebEngine tarball via Docker"
+	@echo "  make static-qt build the bundled Linux Qt/WebEngine tarball via Podman"
 	@echo "  make verify   run full tests, security checks, and dependency audit"
 	@echo "  make sbom     write SBOM/provenance evidence under dist/sbom"
 	@echo "  make reproducibility-report rebuild the browser binary twice"
diff --git a/README.md b/README.md
index 7e5f269..e0ccb6e 100644
--- a/README.md
+++ b/README.md
@@ -143,7 +143,7 @@ default, a protected passphrase file, or the interactive prompt.
 
 ```sh
 make binary           # the self-contained native ./jerboa-browser
-make static-qt        # bundled Linux Qt/WebEngine tarball via Docker (linux/amd64)
+make static-qt        # bundled Linux Qt/WebEngine tarball via Podman (linux/amd64)
 make vendor-yubikey   # clone https://git.sr.ht/~lisp/jerboa-yubikey into vendor/
 make yubikey-native   # build lib/libyubikey_native for direct USB YubiKey access
 make test             # (browser) suite + secure-store unit tests; also test-{keymap,…,polish}
@@ -153,7 +153,7 @@ make test-securestore # just the pure secure-store crypto/format unit tests
 make test-gui         # offline Qt snapshot harness (offscreen, headless)
 ```
 
-`make static-qt` mirrors the jerboa-emacs Docker workflow and copies out
+`make static-qt` mirrors the jerboa-emacs container workflow through Podman and copies out
 `jerboa-browser-static-qt-linux-amd64.tar.gz`. Because this backend is Qt
 WebEngine, the artifact is a bundled Linux tarball rather than a literal
 one-file static executable. It includes the native browser binary, the
diff --git a/packaging/README.md b/packaging/README.md
index 1197896..41c5ee3 100644
--- a/packaging/README.md
+++ b/packaging/README.md
@@ -97,7 +97,7 @@ Total ≈ 299 MB (dominated by QtWebEngineCore + ICU).
 ```sh
 packaging/linux/build-tarball.sh      # → qt-webengine/build/jerboa-browser-<ver>-linux-<arch>.tar.gz
 BUNDLE_QT=1 packaging/linux/build-tarball.sh
-make static-qt                        # Docker build, copies ./jerboa-browser-static-qt-linux-amd64.tar.gz
+make static-qt                        # Podman build, copies ./jerboa-browser-static-qt-linux-amd64.tar.gz
 ```
 
 The tarball always bundles the backend `libjerboa_browser.so`, the
@@ -137,6 +137,6 @@ uses an interactive terminal prompt. The packaged browser does not accept
 profile-vault secrets through process environment variables and does not embed a
 build-local fallback secret.
 
-`make static-qt` always uses `BUNDLE_QT=1` inside Docker, with the
-`jerboa21/jerboa` image plus Ubuntu Qt WebEngine packages, and validates the
+`make static-qt` always uses `BUNDLE_QT=1` inside Podman, with the
+`docker.io/jerboa21/jerboa` image plus Ubuntu Qt WebEngine packages, and validates the
 tarball in a clean Ubuntu stage with no Qt package installed.
diff --git a/packaging/linux/build-tarball.sh b/packaging/linux/build-tarball.sh
index 75c67d3..3a895b0 100755
--- a/packaging/linux/build-tarball.sh
+++ b/packaging/linux/build-tarball.sh
@@ -321,7 +321,7 @@ WRAP
         # native-rust) — the secure store needs it; without it the binary aborts
         # at startup ("no entry for jerboa_last_error"). Reuse the Makefile rule
         # (cargo build --features crypto, symlinked into ./lib). Best-effort: a
-        # stale-cargo CI host can't build a v4-lockfile crate, but the Docker
+        # stale-cargo CI host can't build a v4-lockfile crate, but the Podman
         # static-qt path (modern cargo) builds it and asserts it in the tarball.
         ( cd "$REPO" && make "lib/libjerboa_native.so" ) || true
         if [ -f "$REPO/lib/libjerboa_native.so" ]; then