starred/windmill
1
0
Fork 0
mirror of https://github.com/windmill-labs/windmill.git synced 2026-08-25 08:00:59 +00:00
Code Issues Packages Projects Releases Wiki Activity

build(docker): ship rootless podman in the full images

Browse Source 
Add podman + crun + uidmap + fuse-overlayfs + slirp4netns and a windmill user
(uid 1000) with a subuid/subgid range to DockerfileFull and DockerfileFullEe, so
the `container_runtime: podman` worker-group option works out of the box on the
*-full images. Run the docker worker group as `user: "1000:1000"` for a rootless
(unprivileged) daemon; root still works but is rootful.

Base/slim images are untouched (kept lean). Verified on debian:bookworm-slim:
packages resolve (podman 4.3.1), user + subuid set up, ~103MB layer delta
(rounding error on the multi-GB full image).

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
This commit is contained in:
Ruben Fiszel
2026-06-03 12:51:22 +00:00
parent 52f39a0e04
commit aeee148723
2 changed files with 40 additions and 0 deletions
Download Patch File Download Diff File Expand all files Collapse all files
docker/DockerfileFull
+20
View File
@@ -31,6 +31,26 @@ RUN apt-get install -y ruby ruby-bundler
RUN apt-get install -y r-base-dev \
&& Rscript -e 'install.packages("renv", lib="/usr/lib/R/library", repos="https://cloud.r-project.org")'
# Rootless container runtime (podman) for docker-mode jobs. Set the
# `container_runtime: podman` worker-group option to run `# docker` scripts
# without a privileged dind sidecar or the host Docker socket. Run the docker
# worker group as `user: "1000:1000"` for a rootless (unprivileged) daemon;
# running as root still works but is rootful (less isolated).
RUN apt-get -y update \
&& apt-get install -y --no-install-recommends \
podman \
uidmap \
fuse-overlayfs \
slirp4netns \
crun \
&& apt-get clean \
&& rm -rf /var/lib/apt/lists/*
RUN useradd -u 1000 -m -s /bin/bash windmill 2>/dev/null || true
# Ensure a subuid/subgid range exists for rootless podman (useradd usually adds
# one already; only append if it didn't, to avoid a duplicate range).
RUN grep -q '^windmill:' /etc/subuid || echo "windmill:100000:65536" >> /etc/subuid; \
grep -q '^windmill:' /etc/subgid || echo "windmill:100000:65536" >> /etc/subgid
# Fix UV cache permissions for non-root user support (uid 1000, etc.)
# The uv tool install ansible command populates the UV cache with root-owned files
RUN chmod -R a+rw /tmp/windmill/cache/uv && \
docker/DockerfileFullEe
+20
View File
@@ -61,6 +61,26 @@ RUN apt-get install -y iptables
# Kerberos runtime
RUN apt-get install -y libsasl2-modules-gssapi-mit krb5-user
# Rootless container runtime (podman) for docker-mode jobs. Set the
# `container_runtime: podman` worker-group option to run `# docker` scripts
# without a privileged dind sidecar or the host Docker socket. Run the docker
# worker group as `user: "1000:1000"` for a rootless (unprivileged) daemon;
# running as root still works but is rootful (less isolated).
RUN apt-get -y update \
&& apt-get install -y --no-install-recommends \
podman \
uidmap \
fuse-overlayfs \
slirp4netns \
crun \
&& apt-get clean \
&& rm -rf /var/lib/apt/lists/*
RUN useradd -u 1000 -m -s /bin/bash windmill 2>/dev/null || true
# Ensure a subuid/subgid range exists for rootless podman (useradd usually adds
# one already; only append if it didn't, to avoid a duplicate range).
RUN grep -q '^windmill:' /etc/subuid || echo "windmill:100000:65536" >> /etc/subuid; \
grep -q '^windmill:' /etc/subgid || echo "windmill:100000:65536" >> /etc/subgid
# Fix UV cache permissions for non-root user support (uid 1000, etc.)
# The uv tool install ansible command populates the UV cache with root-owned files
RUN chmod -R a+rw /tmp/windmill/cache/uv && \