Document and support rootless Podman agents #8

New issue

Open

opened 2026-05-03 06:21:59 +00:00 by lambadalambda · 0 comments

lambadalambda commented

2026-05-03 06:21:59 +00:00

Owner

Problem

A Fedora Asahi M1 runner used rootless Podman. It worked with Woodpecker's Docker backend, but required non-obvious setup.

Important details:

user lingering had to be enabled for the service to survive logout/reboot
podman.socket had to be enabled as a user service
the agent used WOODPECKER_BACKEND_DOCKER_HOST=unix:///run/podman/podman.sock
directly bind-mounting the socket file did not work in this setup
bind-mounting the socket directory worked instead: %t/podman:/run/podman
SELinux required disabling labels for the agent container in this setup: --security-opt label=disable
a user systemd service and cleanup timer had to be built manually

Desired behavior

Add first-class documentation or support for rootless Podman agents:

official rootless Podman systemd user service example
recommended socket mount pattern
SELinux notes for Fedora
cleanup/prune recommendation
explanation of supported/unsupported Docker API behavior
optional native Podman backend if Docker API compatibility is not enough

Why this matters

Podman is common on Fedora and other Linux distributions. Rootless agents are attractive for security, but the current setup is easy to get subtly wrong.

## Problem A Fedora Asahi M1 runner used rootless Podman. It worked with Woodpecker's Docker backend, but required non-obvious setup. Important details: - user lingering had to be enabled for the service to survive logout/reboot - podman.socket had to be enabled as a user service - the agent used WOODPECKER_BACKEND_DOCKER_HOST=unix:///run/podman/podman.sock - directly bind-mounting the socket file did not work in this setup - bind-mounting the socket directory worked instead: %t/podman:/run/podman - SELinux required disabling labels for the agent container in this setup: --security-opt label=disable - a user systemd service and cleanup timer had to be built manually ## Desired behavior Add first-class documentation or support for rootless Podman agents: - official rootless Podman systemd user service example - recommended socket mount pattern - SELinux notes for Fedora - cleanup/prune recommendation - explanation of supported/unsupported Docker API behavior - optional native Podman backend if Docker API compatibility is not enough ## Why this matters Podman is common on Fedora and other Linux distributions. Rootless agents are attractive for security, but the current setup is easy to get subtly wrong.

No labels

No milestone

No project

No assignees

1 participant

Notifications

Due date

The due date is invalid or out of range. Please use the format "yyyy-mm-dd".

No due date set.

Dependencies

No dependencies set.

Reference

pleroma/woodpecker#8

No description provided.

Rows
Columns