[yqiang]

(N.B - PR was created with codex and manually reviewed. My specific use case is to attach a volume to store Xcode compilation cache/swiftpm caches for runners)

Sand currently configures the disposable root disk but cannot attach independently provisioned storage. Add optional vm.additionalDisks so a runner can use a persistent data disk or read-only seed image without exposing arbitrary Tart command-line arguments.

vm:
  additionalDisks:
    - source: ~/sand-cache/build.raw
    - source: /path/to/seed.img
      readOnly: true
      synchronization: full
      caching: automatic

Each mapping decodes to a DiskAttachment value with typed synchronization/caching enums. A short keyed decoder follows existing Config conventions, including readOnly: false when omitted. Mapping-only input avoids a second shorthand parser; unknown mapping keys follow the existing config behavior. Validate empty/invalid sources and options, preserve OCI tags and NBD ports, expand local leading tildes, and forward each attachment as one canonical --disk=... argument without shell interpolation. NBD restrictions match Tart 2.40.1.

The default empty array preserves existing behavior, and rootDiskOpts still affects only the root disk. Sand does not create, erase, snapshot or delete extra disks. Writable attachments require exclusive ownership; storage provisioning and durability choices remain the operator's responsibility. Generic pass-through flags are intentionally excluded because they can conflict with Sand-managed lifecycle options.

Scope is limited to config/type/argument forwarding, docs, a sample fixture and focused tests. No host storage policy, packaging or deployment changes are included.

Validation at exact head 18050098cc0f825d9e2a5adf960e54afb9d7b597, based on upstream 96c2e9fa76e1cae9c7759115bc91e82e7201c04d:

• swift test --jobs 2: 60 XCTest and 12 Swift Testing tests passed on macOS 27.0.1 with full Xcode; parameterized tests cover additional values.
• Coverage includes defaults, mapping decoding/scalar rejection, typed options, invalid values, tilde expansion, safe argument forwarding and coexistence with managed run options.
• git diff --check passed.

GitHub checks have not yet completed; the results above are from the exact-head local guest suite. Opened as a draft for design review.