mirror of
https://github.com/windmill-labs/windmill.git
synced 2026-08-21 16:02:28 +00:00
Ruben Fiszel
40a387a17b
docker-compose.yml / README: remove the legacy dind sidecar and the
DOCKER_HOST/host-socket opt-in comments (confusing now that podman is the way).
Present a single clean path: a dedicated windmill_worker_docker group with the
rootless podman runtime (full image, user 1000, privileged + /dev/fuse,
CONTAINER_RUNTIME=podman, WORKER_TAGS=docker). `# docker` scripts are tagged by
language ("bash"), so routing is via a custom "docker" tag — documented. The
legacy externally-provided DOCKER_HOST / mounted /var/run/docker.sock still works
in the backend; it's just no longer advertised in the quickstart.
DockerfileFull/FullEe: two fixes required for podman-in-container (found by
testing a containerized worker):
- chmod u+s newuidmap/newgidmap — rootless subuid mapping fails if the package's
file caps are lost in image layers.
- default rootless networking to slirp4netns (containers.conf.d) — the netavark
bridge default fails rootless on hosts without the needed nftables setup.
Verified e2e (podman-in-docker): a containerized worker ran a # docker job via
per-job rootless podman with both fixes + privileged + /dev/fuse; confinement held.
Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>