I'm looking to implement a RunLauncher to submit jobs to a queue, that a worker in a restricted environment can poll for work. But besides being able to access the docker image and the job spec, what does the dagster runner actually need to be able to do? I couldn't tell from a cursory glance if it's making grpc calls directly to the dagster API to stream back logs etc? Given this is a restricted environment, I might struggle to ensure connectivity directly from the worker to the dagster API.

the run launchers are just responsible starting the dagster run process, usually allocating some compute resource and then invoking

dagster api execute_run

The run process (or further delegated step processes) communicate to the “dagster instance” directly. In an open source deployment this is just direct DB access, for cloud users its web requests to dagster.cloud.