Slurm's jobs in containers: pyxis and enroot, installed by the agents

slurm.containers (ctl slurm containers on) has every Slurm machine's agent
install enroot from NVIDIA's release and build pyxis against its own
Slurm, both pinned and checked against their digests, and on GPU machines
nvidia-container-cli from NVIDIA's repository. enroot keeps each user's
containers under /run/enroot and /var/lib/enroot, needing no login
session, with the shared path in every container. The leader has Slurm
load pyxis only once every machine reports it: plugstack.conf's
"required" fails every job on a machine without the plugin.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

docs/reference.md

@@ -414,6 +414,7 @@ rather than repeated.
 | `partition` | `string` | [SlurmSettings](#slurmsettings) |
 | `shared` | `SharedStorage` | [SlurmSettings](#slurmsettings) |
 | `users` | `string` | [SlurmSettings](#slurmsettings) |
+| `containers` | `bool` | [SlurmSettings](#slurmsettings) |
 | `dir` | `string` | [StrataConfig](#strataconfig) |
 | `python` | `string` | [StrataConfig](#strataconfig) |
 | `engine` | `string` | [StrataConfig](#strataconfig) |
@@ -3599,6 +3600,15 @@ account (its login from the e-mail address, a UID of llmgw's from
 and to a node only while a job of theirs runs there (pam_slurm_adopt);
 empty leaves users to the site (a directory through sssd, or by hand).
 
+### `containers`
+
+`bool`
+
+Containers lets jobs run in containers: `srun --container-image
+nvcr.io#nvidia/pytorch:25.01-py3` (pyxis, with enroot under it),
+the GPUs and the shared path inside. The agents install both on
+every Slurm machine; jobs take it once every machine has them.
+
 ## StrataConfig
 
 ### `dir`