Support for running Spin Applications built inside a container

It is often valuable to have reproducible build environments for applications that work across systems. This is especially true when doing continuous integration or working in teams with mixed operating systems.

Spin supports OCI artifacts for distributing applications - but not OCI containers. This means that you can't re-use existing build environments for broadly compatible Spin applications. An exception exists here - the Spin containerd shim supports regular containers too in some cases. Which means for a new tinygo application you can build a container like:

FROM --platform=${BUILDPLATFORM} tinygo/tinygo:0.30.0 AS build
WORKDIR /opt/build

COPY go.mod go.sum .
RUN go mod download
COPY . .
RUN tinygo build -target=wasi -gc=leaking -no-debug -o main.wasm main.go

FROM scratch
COPY --from=build /opt/build/main.wasm .
COPY --from=build /opt/build/spin.toml .

But this is unsupported by Spin proper (and also Fermyon Cloud).

Currently you can't effectively work around this even by running the compiler in a container as you lose build provenance, but also rely on the host spin implementation to build the OCI artifact while pushing.

Ideally we implement support similar to that in the shim to enable easier integration into existing build and release engineering practices.

Start by examining the existing containerd shim behavior for regular containers and Spin's current OCI artifact build and push flow. Define how container-built applications retain build provenance and remain usable by Spin proper and release workflows; done means container-built Spin applications are supported without relying on the host implementation.