RFC 0005 milestone 1: run service images as non-root #3

2026-09-10T20:18:54+02:00

mi commented

2026-09-10 20:18:54 +02:00

No description provided.

mi added 4 commits 2026-09-10 20:18:54 +02:00

RFC 0005: service images, instance lifecycle, and the road to Testcontainers fce0cc1d69

Podman before Docker where the two differ; one uid; verbs as frontends
over one service; four milestones that each stand alone.

Co-Authored-By: Claude Fable 5.1 <noreply@anthropic.com>

run: --user, --userns=keep-id, image USER and VOLUME (RFC 0005 milestone 1) 785ee6e348

The caller stays the sandbox's only user, but which uid is now docker's
choice: --user USER[:GROUP] resolved in the image's passwd/group, else
--userns=keep-id (podman), else the image's USER, else 0. HOME follows
the passwd entry. VOLUME paths become anonymous tmpfs unless a mount
covers them; import -c takes USER and VOLUME. postgres:16-alpine runs
initdb, server, psql, stop with --user postgres. Version 0.4.0.

Co-Authored-By: Claude Fable 5.1 <noreply@anthropic.com>

run: /run is an implicit tmpfs, beside /tmp and /root eb80a4953d

Services keep pid files, locks and sockets under /run (/var/run's
target in practically every image) without declaring a VOLUME; postgres
failed on /var/run/postgresql in the read-only rootfs.

Co-Authored-By: Claude Fable 5.1 <noreply@anthropic.com>

run: set each environment variable once 5c05668328

An image's PATH or HOME replaced werkdock's default in place instead of
being passed to bwrap a second time.

Co-Authored-By: Claude Fable 5.1 <noreply@anthropic.com>

mi merged commit a335ed02ca into main

2026-09-10 20:19:12 +02:00

mi deleted branch services

2026-09-10 20:19:12 +02:00

Sign in to join this conversation.

1 Participants

Notifications

Due Date

No due date set.

Dependencies

No dependencies set.

Reference: mi/werkdock#3