Rootless Podman for attempt containers on SSH workers

クローズ
  • 何か問題がありますか？
#792 コメント 0 件 リアクション 0 件 担当者 0 名 GitHub で見る

メンテナーはふだん 1 日以内に返信

関連するプルリクエストがすでにマージされています。

  • #804 @usine-phildl による — マージ済み

評価

難易度
4/5
見積もり時間
3〜5日
初心者へのやさしさ
45/100
issue の種類
機能追加
明瞭さ
おおむね明確
活発さ
活発
技術スタック
debian, docker, linux, typescript
領域
backend, devops, infrastructure

調査の方向性

Read docs/research/rootless-attempt-containers.md for the plan. Edit infra/hetzner/cloud-init.yaml to install Podman and remove Docker group, and update packages/executor/src/ssh for runtime choice and Podman CLI ops. Run unit tests for runtime detection with a fake shell. Done when a disposable worker passes the validation table and PR records runtime details.

索引モデルが issue の本文から書いたものです。

説明

Implements the recommendation of docs/research/rootless-attempt-containers.md (#728, merged as ac3ee650). Today attempts run in Docker containers on the worker and the usine SSH user is in the docker group, which is root-equivalent on the machine (#555 item 6). With rootless Podman and --userns=keep-id, containers run as the unprivileged usine user, the docker group goes away, and an attempt that escapes its container has the rights of an ordinary user.

Decision of 2026-10-30: do it, after the rest of wave 2 (#776 roles is the last large item before it). Docker stays a supported runtime during the transition; the cloud-init selects one.

Change, in the order of the research document's "Recommendation and required changes"

  1. infra/hetzner/cloud-init.yaml (and the gateway overlay): install Podman, crun, uidmap and the Debian systemd user-session pieces; allocate non-overlapping subordinate UID and GID ranges for usine; enable lingering so detached containers survive SSH disconnects; drop the Docker proxy drop-in and daemon.json on Podman workers while keeping /etc/environment, nftables, gateway DNS, the gh socket service and metadata protection; remove usine from the docker group on Podman workers.
  2. Executor (packages/executor/src/ssh): an explicit runtime choice carried through the container operations and ShellContainer.runtime, with Podman detection from its structured info (rootless, cgroup v2, delegated controllers); start, exec, inspect, restart, cancellation, OOM recording, removal and label-scoped sweeping validated against Podman's CLI output and errors, secrets kept on stdin; the pulled attempt image unchanged (--userns=keep-id keeps the image's non-root user and host-owned mounts).
  3. Preflight: fails with a remediation when cgroup delegation, subordinate ranges or lingering are missing.
  4. Docs: add-a-worker guide and infra/hetzner README describe the Podman worker and how to rebuild the snapshot; ADR amendment recording the runtime choice.

Acceptance

The research document's "Validation required for implementation" table, run on a disposable worker built from the new cloud-init: boot and non-interactive SSH, resource enforcement, OOM lifecycle, file ownership across two concurrent attempts, network and pulls (gateway routes, proxy downloads, metadata denial, cold GHCR pull, Boat tailnet path), harnesses (Claude, Codex, Pi, Chromium without privileged mode), lifetime and cleanup. Record runtime, OCI runtime, kernel, cgroup version and delegated controllers in the PR. Unit tests cover the runtime detection and the operations against a fake shell for both runtimes.

Large: cloud-init and executor can be two PRs; the worker validation is the operator's dogfood step after the executor PR merges, not a task for the factory.

主要言語
TypeScript
スター
1
フォーク
0
平均マージ
3時間 47分
マージ済み PR（30日）
388

環境構築

このプロジェクトには開発コンテナ、Dockerfile、コントリビューションガイドがありません。まず README を読み、一般的な手順ははじめてのコントリビューションガイドを参照してください。

はじめの一歩

  1. issue を最後まで読み、次にプロジェクトのコントリビューションガイドを読みます。
  2. 着手することを issue にコメントします — 二人が同じ作業をするのを防げます。
  3. リポジトリをフォークし、ブランチを切って変更します。
  4. issue 番号を参照したプルリクエストを送ります。

basaltbytes/usine のほかの issue

basaltbytes/usine の issue をすべて見る

似ている issue

TypeScript の issue をもっと見る

新しい issue をメールで受け取る

初心者向けの GitHub issue を短くまとめたダイジェスト。