Skip to content

[$600] Support rootless Podman as a container engine in the run-spaceapp launcher #63

Open
Open
[$600] Support rootless Podman as a container engine in the run-spaceapp launcher#63
#178 (+9)
Labels
enhancementNew feature or requesthelp wantedExtra attention is needed💎 BountyCash bounty paid after merge; terms in the issue

Description

@oll4com
oll4com
opened on Oct 16, 2026

Context

The run-spaceapp launcher (packages/run-spaceapp) installs and runs SpaceApp as a Docker Compose stack (templates/compose.yml: core, CLI, browser, PostgreSQL/pgvector, Temporal). Docker is the only supported engine. The launcher detects Docker and installs it if missing, and every lifecycle command (install, up, down, status, logs, update, rollback, backup, restore, doctor, repair, uninstall, factory-reset, provider install, credentials set, owner …) runs docker compose … or docker … (composeCommand in src/index.mjs, spawnTrustedCommand in src/cli.mjs, probes in src/prerequisites.mjs and src/storage.mjs).

Many developers cannot or will not run a root Docker daemon: Fedora, RHEL and openSUSE ship Podman, some companies do not license Docker Desktop, and rootless containers are the safer default on a shared workstation. Today these users cannot install SpaceApp at all.

Goal

run-spaceapp runs the full stack on rootless Podman on Linux, and on Podman machine on macOS, with the same commands and the same data safety as on Docker. Docker stays the default, and nothing changes for Docker users.

Acceptance criteria

  • Engine selection: --engine docker|podman on install, saved in the launcher configuration and used by every later command. install without --engine keeps using Docker when it works. If only Podman is present it offers Podman (or picks it with --non-interactive) instead of installing Docker. The choice also works through --answers.
  • Compose: the launcher uses podman compose (state the supported compose provider and minimum versions, for example Podman ≥ 5 with docker-compose v2 as provider) and keeps all features the template uses: profiles, file-based secrets, depends_on health conditions (including required: false), init, mem_limit/cpus, named volumes shared between services for the Unix sockets, --wait, and exec/run with --user 10001:10001.
  • Linux rootless (Podman ≥ 5, cgroup v2): install, up, status, logs, down, update (with its checkpoint), rollback, backup, restore, doctor, doctor --fix, provider install opencode, uninstall and uninstall --purge-data all work for the small, medium and large profiles. The web app answers on http://127.0.0.1:4911 and /readyz reports ok.
  • Bind mounts registered with workspace add (read-write and --read-only) work on a host with SELinux enforcing (for example Fedora), and agents can read and write files there with correct ownership on the host.
  • macOS: install --engine podman --profile small works on a Podman machine. The launcher checks that the machine has enough CPU, memory and disk for the profile and explains how to resize it if not.
  • doctor reports the engine, version, rootless or rootful, the cgroup version and whether CPU/memory limits are delegated. If a limit cannot be applied it says so clearly instead of failing late. support-bundle includes the same facts, without secrets.
  • Data safety: switching engines on an existing installation is refused with a clear message (Docker volumes are not visible to Podman), unless an explicit, documented migration path through backup/restore is implemented and tested.
  • --access host-root is refused on Podman with a clear message. It may be supported instead, but only with tests.
  • Unit tests in packages/run-spaceapp/tests cover command construction and engine detection for both engines. The existing tests pass unchanged for Docker.
  • CI: a job on ubuntu-latest (it ships Podman) installs the small profile with --engine podman --non-interactive, waits for /readyz, runs backup, then uninstall --purge-data, and leaves nothing running.
  • Docs: the launcher README, the main README prerequisites and docs/getting-started.md describe Podman support and its limits.

How to test

ELECTRON_SKIP_BINARY_DOWNLOAD=1 npm ci
npm test -w run-spaceapp
npm run check -w run-spaceapp
# On a Linux host with rootless Podman (for example a Fedora VM):
node packages/run-spaceapp/bin/spaceapp.mjs install --engine podman --profile small
node packages/run-spaceapp/bin/spaceapp.mjs doctor
node packages/run-spaceapp/bin/spaceapp.mjs backup
node packages/run-spaceapp/bin/spaceapp.mjs uninstall --purge-data

Repeat with --profile large (browser service included), and on macOS with podman machine. Put the terminal output of each run in the PR.

Out of scope

  • Windows (Podman Desktop on WSL).
  • Installing Podman itself. The launcher may print install instructions per distribution.
  • Kubernetes manifests, Quadlet/systemd units, or Podman-specific images (the published images must stay the same).
  • Other engines (nerdctl, Colima's containerd mode).

Pointers

  • packages/run-spaceapp/src/index.mjs (composeCommand, compose file generation, workspace and host-access overrides)
  • packages/run-spaceapp/src/cli.mjs (spawnTrustedCommand: commands are dispatched statically on purpose, keep it that way for code scanning; doctor; update/checkpoint logic)
  • packages/run-spaceapp/src/prerequisites.mjs (engine detection and installation), packages/run-spaceapp/src/storage.mjs (docker info and image inspect probes)
  • packages/run-spaceapp/templates/compose.yml
  • packages/run-spaceapp/tests/*.test.mjs, .github/workflows/platform-matrix.yml
  • Before opening a PR, run the checks in CONTRIBUTING.md.

💎 Bounty: $600 USD

This issue carries a cash bounty of $600 USD, paid by the SpaceApp maintainers.

How it works

  1. Comment on this issue that you are working on it (optional, but it helps avoid duplicate work).
  2. Open a pull request that closes this issue and meets every acceptance criterion above, with tests.
  3. The bounty goes to the author of the first pull request that is merged as the solution. If several PRs arrive, we review them in the order they were opened.
  4. We pay within 7 days of the merge, by PayPal, Wise or bank transfer; we agree the method with you in this issue.

Terms

  • One bounty per issue; the amount is never lowered once posted.
  • AI-assisted work is welcome when you have reviewed and tested it yourself. Untested or generated-only PRs are closed without review.
  • Contributions are accepted under the repository's license (see LICENSE).
  • The "Verify export provenance" CI step fails on outside pull requests by design (this repository is exported from the maintainers' source); reviewers ignore that step. Every other check must pass.
  • You are responsible for any taxes on the payment. We cannot pay where sanctions forbid it.

If SpaceApp is useful to you, a ⭐ on the repository helps the project grow. It is not required for the bounty.

Activity

  1. oll4com
    added
    enhancementNew feature or request
    help wantedExtra attention is needed
    💎 BountyCash bounty paid after merge; terms in the issue
    on Oct 16, 2026
  2. oll4com
    changed the title [-]Support rootless Podman as a container engine in the run-spaceapp launcher[/-] [+][$150] Support rootless Podman as a container engine in the run-spaceapp launcher[/+] on Oct 16, 2026

  3. t3ratech commented on Oct 16, 2026

    @t3ratech
    t3ratech
    on Oct 16, 2026

    /attempt

  4. oll4com
    changed the title [-][$150] Support rootless Podman as a container engine in the run-spaceapp launcher[/-] [+][$600] Support rootless Podman as a container engine in the run-spaceapp launcher[/+] on Oct 16, 2026

  5. hieutran0413 commented on Oct 16, 2026

    @hieutran0413
    hieutran0413
    on Oct 16, 2026

    /attempt #63

    Plan: I will start by reproducing the reported issue locally, then implement a focused fix with regression coverage, run the repo's test suite, and submit a PR with /claim #63.

    (Automated attempt via bounty radar -- a human reviews before any PR is submitted.)

  6. infser commented on Oct 16, 2026

    @infser
    infser
    on Oct 16, 2026 – with ChatGPT Codex Connector

    /attempt #63

    I’m taking a zero-cost, AI-assisted attempt at the full rootless Podman scope. I’ll keep Docker behavior unchanged, cover engine selection/persistence, rootless Linux + macOS Podman-machine checks, SELinux-safe workspace mounts, doctor/support-bundle engine facts, data-safety refusal when switching engines, tests, CI and docs. I won’t claim unsupported platform results: any environment-dependent validation will be reported exactly as executed. No deposit, paid service, wallet, or external account is required for this work.

  7. taha-rafi commented on Oct 16, 2026

    @taha-rafi
    taha-rafi
    on Oct 16, 2026 – with ChatGPT Codex Connector

    /attempt #63

    I’m taking an AI-assisted attempt at the complete rootless Podman scope from my fork. I’ll preserve Docker behavior, cover engine selection and persistence, command construction, safety refusals, doctor/support-bundle facts, CI, tests and docs, and report platform validation exactly as executed. I understand this does not reserve the bounty and that existing attempts retain their place in the race; I will only open a PR after the available acceptance checks pass.

  8. jdjioe5-cpu commented on Oct 16, 2026

    @jdjioe5-cpu
    jdjioe5-cpu
    on Oct 16, 2026

    Working on this! Implementing full rootless Podman support with SELinux bind mounts, engine selection in config, Podman machine validation, doctor probes, matrix CI job, and tests.

  9. jdjioe5-cpu commented on Oct 16, 2026

    @jdjioe5-cpu
    jdjioe5-cpu
    on Oct 16, 2026

    I have completed the full implementation and opened PR #77 resolving all acceptance criteria:

    • Complete rootless Podman container engine support alongside Docker
    • Engine selection and config persistence with automatic detection
    • Exact Compose specs preservation under podman compose
    • SELinux bind: { selinux: "z" } mount tagging for workspaces
    • macOS Podman machine resource inspection and guidance
    • Data safety switching protection and host-root refusal under Podman
    • Diagnostic engine telemetry in doctor and support-bundle
    • Dedicated Ubuntu Podman CI gate job in platform-matrix.yml
    • Full unit test coverage (171/171 passing, 0 failing) and comprehensive documentation updates

    Ready for maintainer review in PR #77 !

  10. gelismarvel commented on Oct 16, 2026

    @gelismarvel
    gelismarvel
    on Oct 16, 2026

    I have submitted a pull request implementing rootless Podman support for the run-spaceapp launcher: #81

    Summary of verification:

    • npm test -w run-spaceapp (172 pass / 0 fail, including tests/podman.test.mjs)
    • node --test scripts/tests/public-suite.test.mjs (117 pass / 0 fail)
    • node scripts/space-hygiene-check.mjs --preflight
    • End-to-end Linux rootless Podman smoke test on Ubuntu 24.04 (podman 4.9.3, non-root user): verified install --engine podman --profile small, /readyz HTTP 200, workspace add + up with keep-id:uid=10001,gid=10001 host-UID file creation, doctor, backup, and uninstall --purge-data.

  11. aihanhook-ops commented on Oct 16, 2026

    @aihanhook-ops
    aihanhook-ops
    on Oct 16, 2026

    Hi, I'm reaching out on behalf of Sergei, an independent developer based in South Korea, with Codex assisting the development and verification work.

    We're interested in the rootless Podman task. The proposed scope would cover engine selection and persistence, Compose compatibility, rootless Linux/SELinux behavior, macOS Podman-machine checks, data-safety guards, and the required tests, CI and documentation. We would report the environments and checks actually executed and arrange the account owner's review before submitting a PR.

    I see the existing PRs and understand that this does not reserve the issue: only the first qualifying merged solution receives the $600 bounty. Before adding another implementation, are there acceptance gaps still open in the current submissions, and would a complete PR delivered by 20 October still be considered?

    For payment planning, can the bounty be paid by Wise or bank transfer to a recipient in South Korea? Does the posted seven-day payment window mean initiating the transfer or funds reaching the recipient? Our target is funds received by 30 October 2026.

  12. markankamaransheogarat-sys commented on Oct 16, 2026

    @markankamaransheogarat-sys
    markankamaransheogarat-sys
    on Oct 16, 2026

    /attempt #63

    Working on this:

    1. Adding --engine docker|podman (and --answers support) to install, persisted in config.json, with automatic Podman fallback when Docker is absent and Podman is available on PATH, refusal of in-place engine switching, and refusal of --access host-root on Podman.
    2. Routing all lifecycle Compose operations through podman compose, injecting userns_mode: "keep-id:uid=10001,gid=10001" and SELinux :z relabeling in renderWorkspaceCompose for Podman bind mounts, and inspecting Podman storage/layer metadata and podman machine resources on macOS.
    3. Extending doctor and support-bundle to report engine, version, rootless/rootful mode, cgroup v2 status, and CPU/memory controller delegation, plus unit tests, CI job on ubuntu-latest, and documentation updates.

  13. Rohank143 commented on Oct 16, 2026

    @Rohank143
    Rohank143
    on Oct 16, 2026

    I have completed the task and submitted the full solution in Pull Request #110 (commit 2eed436d6e09cb8fcb697ee1ca87767b482f7545).

    What was completed & verified:

    • Engine Selection: Added --engine docker|podman support on install, persisted in config.json, non-interactive --answers, and auto-detection of Podman if Docker is absent.
    • Compose & Namespaces: podman compose support with dynamic injection of compose.podman.yml specifying userns_mode: "keep-id:uid=10001,gid=10001" across core, cli, and browser services.
    • SELinux Support: Automatic bind: { selinux: "z" } relabeling on workspace mounts and static directories (./backups, ./secrets/providers).
    • macOS Machine Inspection: Added checkPodmanMachineResources to validate CPUs, memory, and DiskSize without shrinking existing disk.
    • Diagnostics: Extended doctor to check Podman CLI, Compose, rootless mode, cgroup v2, and controller delegation (cpu, memory, pids).
    • Data Safety: Refuses destructive engine switches on existing installations (including legacy Docker installs), blocks --access host-root on Podman, and preserves the configured engine on factory-reset.
    • Testing: Added 10 dedicated test suites in packages/run-spaceapp/tests/podman.test.mjs (100% pass rate across all 174 test cases with zero regressions on Docker).
    • CI & Docs: Added a dedicated rootless Podman test job in .github/workflows/platform-matrix.yml and updated packages/run-spaceapp/README.md, README.md, and docs/getting-started.md.

    Please verify and review when you have a moment!

  14. 15 remaining items

  15. 773041335 commented on Oct 18, 2026

    @773041335
    773041335
    on Oct 18, 2026

    /attempt #63

  16. 773041335 commented on Oct 18, 2026

    @773041335
    773041335
    on Oct 18, 2026

    /attempt #63

  17. honru09 commented on Oct 18, 2026

    @honru09
    honru09
    on Oct 18, 2026

    I'll work on this. Implementation in progress, PR to follow.

  18. Anekenonso commented on Oct 18, 2026

    @Anekenonso
    Anekenonso
    on Oct 18, 2026

    I have implemented rootless Podman container engine support meeting all acceptance criteria in PR #183.

    Summary:

    • --engine docker|podman CLI flag and config storage.
    • Auto-fallback on Linux when Docker is missing and Podman is ready.
    • Automatic SELinux :z volume bind flags on workspace mounts.
    • macOS podman machine inspection, sizing check, and resize instructions.
    • Engine diagnostics (doctor), rootless, cgroup v2, and limit delegation reporting.
    • Sanitized support-bundle engine facts.
    • Reject engine migration on existing setups and reject --access host-root on Podman.
    • 100% test pass rate (180/180) + 14 new dedicated unit tests (tests/podman.test.mjs) + CI rootless e2e workflow.

  19. GL1NoMe5 commented on Oct 18, 2026

    @GL1NoMe5
    GL1NoMe5
    on Oct 18, 2026

    Hi @oll4com, I see several implementations already queued for #63, so I am not claiming another full Podman implementation. Do you have a remaining verification gap you would fund separately, for example reproducible Windows Podman-machine setup/diagnostics checks with a written test report and regression tests?

    If so, could you define the acceptance scope and budget? Also, can your bank-transfer payout route support a contributor based in Kazakhstan? I would like to settle eligibility before starting; no bank details need to be posted publicly.

  20. oll4com commented on Oct 18, 2026

    @oll4com
    oll4com
    on Oct 18, 2026
    OwnerAuthor

    @GL1NoMe5 answers from the posted terms:

    1. There are no separate paid tasks, only the posted bounties. This issue's bounty is for the complete solution of the acceptance criteria above.
    2. We cannot confirm a specific route for Kazakhstan before the merge. It depends on whether PayPal, Wise or a bank transfer reaches the account; we agree the method with the winner in the issue after the merge and ask only for what that service needs to send the payment. We cannot pay where sanctions forbid it.

  21. Khanhtnq commented on Oct 18, 2026

    @Khanhtnq
    Khanhtnq
    on Oct 18, 2026

    @oll4com Thanks! Here are my payout details (whichever method is easiest for you):

    • USDC / SOL (Solana Network): 6mghraUR9NV2fA187VXoLN2rVS3WLA91UhqLfjtvDdmf
    • USDT (TRON / TRC20): TJhLSmGHD33o8UULb2ZX76BDg6gP88pQ5V
    • USDT / USDC / ETH (EVM — ERC20 / BEP20 / Base / Arbitrum / Polygon): 0xcbEDbeCC127a32217075Ff40f16Ec804aa1E0533
    • BTC (Bitcoin Network): 145aR8RmdZGj4wpeip9wu7XA6zLfLwYqLv
    • Binance Pay / Binance ID: 36989869 (UID / Nickname: Khanhtnq)
    • PayPal: trankhanhkent@gmail.com

  22. Schultzenator commented on Oct 18, 2026

    @Schultzenator
    Schultzenator
    on Oct 18, 2026

    /attempt #63 - starting work. Plan: real rootless Podman on a Linux host (not dry-run), full AC coverage: engine selection, compose provider, small/medium/large profiles, bind-mount ownership, doctor engine facts, backup/restore migration, unit tests, CI job on ubuntu-latest, docs.

  23. Schultzenator commented on Oct 18, 2026

    @Schultzenator
    Schultzenator
    on Oct 18, 2026

    "/attempt #63\n\nWorking on rootless Podman support: engine selection persisted in launcher config, dispatch, userns/SELinux-safe compose overrides, doctor diagnostics, engine-switch and host-root refusals, unit tests plus a real rootless acceptance run (small profile) on ubuntu-latest. Will report terminal output in the PR."

  24. GL1NoMe5 commented on Oct 18, 2026

    @GL1NoMe5
    GL1NoMe5
    on Oct 18, 2026

    Thanks for clarifying, @oll4com. I am ready to attempt the complete #63 scope under the posted bounty rules. I will first reproduce the launcher behavior and check the existing implementations, then submit only if I can meet the full acceptance criteria with test evidence. I understand this does not reserve the bounty.

  25. Schultzenator commented on Oct 18, 2026

    @Schultzenator
    Schultzenator
    on Oct 18, 2026

    PR opening this issue: #201 (branch Schultzenator:rootless-podman-63, head ad4899d).

    The full Platform matrix is green on the fork, including the real rootless Podman acceptance job on ubuntu-latest: install of the small profile with --engine podman --non-interactive --local-images, readiness on http://127.0.0.1:4911//readyz, doctor, backup, uninstall --purge-data, and an assertion that no containers or volumes remain:

    https://github.com/Schultzenator/spaceapp/actions/runs/39152629397

    Notes from the acceptance run that may help other attempts:

    • A userns keep-id overlay on the services crash-loops the published images under rootless Podman: they must start as root and drop to 10001:10001 themselves (failed switching to "spaceapp": operation not permitted). The default subordinate UID/GID mapping is the correct mode; postgres proved it in the same run.
    • The docker-compose v2 provider needs the Podman API socket even though the plain CLI does not; the launcher probes podman compose ls and starts a detached rootless podman system service when it is absent.
    • Backup/restore execs must run as 0:0 (container root = the host user under rootless Podman); --user 10001:10001 maps to a subordinate UID and gets EACCES on the ./backups bind mount.
  26. DjonuSs
    added 4 commits that reference this issue on Oct 18, 2026

    fix(launcher): resolve CodeRabbit review findings for rootless Podman (…

    eccfe7e

    fix(launcher): resolve outside-diff-range review comments on engine s…

    a9e2cdf

    test(launcher): add full acceptance criteria evidence for rootless Po…

    b0d27f7

    fix(launcher): use Writable stream for engine info capture and valida…

    72f034d
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Metadata

Metadata

Assignees

No one assigned

    Labels

    enhancementNew feature or requesthelp wantedExtra attention is needed💎 BountyCash bounty paid after merge; terms in the issue

    Projects

    No projects

      Milestone

      No milestone

      Relationships

      None yet

      Development

      No branches or pull requests

      Issue actions