[coder]

Description

Adds droopy4096/podman-setup: configures the rootless Podman that the workspace image provides, for non-privileged Kubernetes workspaces (no Sysbox, no privileged pod), following the setup proven in coder/dogfood#732. It installs nothing; Podman and the rootless prerequisites belong to the image.

• Checks that podman and every command in required_tools (for example ["buildah", "skopeo"]) are in the image. If any are missing, the install script fails with one error that lists them and the package to add on Debian/Ubuntu, Fedora/UBI and Alpine.
• native_overlay (default on): writes ~/.config/containers/storage.conf with kernel overlayfs (mount_program = ""), overriding images that pin fuse-overlayfs. A user-managed file is left alone.
• socket (default on): runs podman system service on socket_path (/tmp/podman.sock) and sets DOCKER_HOST, so Docker clients, Testcontainers and Dev Containers tooling work.
• disable_buildkit (default on): sets DOCKER_BUILDKIT=0 for the Docker CLI against Podman.
• docker_shim (default on): when the image has no docker command, links docker to podman in /usr/local/bin (directly or with passwordless sudo), falling back to ~/.local/bin with a warning if that isn't on PATH. An existing docker CLI is kept and talks to Podman through DOCKER_HOST. Notes when docker compose has no provider (docker-compose/podman-compose).
• Logs the Podman, Buildah and Skopeo versions it finds. README covers prerequisites (image, user namespaces, kernel 5.13+, PVC with fs_group_change_policy = "OnRootMismatch"), required tools, and air-gapped use.

Renamed from podman-rootless during review: the module sets up what the image ships rather than providing Podman. An earlier revision installed Buildah and Skopeo at runtime; that was dropped so tools come from the image like Podman does, and the module never installs packages or needs network access.

Type of Change

• New module

Module Information

Path: registry/droopy4096/modules/podman-setup
New version: v1.0.0
Breaking change: [ ] Yes [x] No

Testing & Validation

• terraform test: 7 passed
• bun test: 10 passed (container tests with stubbed tools: native overlay config, user-managed storage.conf left alone, missing podman, all missing required_tools listed in one error with nothing configured, required tools present, Buildah/Skopeo optional by default, docker linked via sudo, ~/.local/bin fallback without sudo, existing docker CLI kept, docker_shim = false)
• Code formatted (bun fmt), scripts/terraform_validate.sh, readmevalidation, shellcheck on the rendered install script
• Ran the rendered install script as coder in codercom/example-podman:ubuntu: with required_tools = ["buildah", "skopeo"] it failed listing both (that image ships neither) and passed the check once they were installed. Rootless podman info itself could not run in that nested test container (newuidmap not permitted), which is an environment limit, not the module.
• Docker shim against the real codercom/example-podman:ubuntu: the published image already ships a real docker CLI (29.x), which is kept; with /usr/bin/docker removed, the script linked /usr/local/bin/docker -> /usr/bin/podman and docker --version ran Podman 5.7.
• Not yet tested at runtime: needs a run on the dogfood EKS pool with codercom/example-podman:ubuntu (coder/dogfood#773)

Related Issues

coder/dogfood#732

Created on behalf of @droopy4096

[github-actions]

Module Scorecard Check

droopy4096/podman-setup: first scorecard, 81 / 100

No specific score is required to contribute, but modules with higher scores are more likely to be approved by the Coder team and widely used.

Full scorecard for this PR

Presentation & Onboarding	Credential Hygiene	Restricted-Environment Readiness	Engineering Quality	Overall
12 / 17	16 / 20	1 / 2 (18 pts N/A)	10 / 10	81 / 100

Drilldown

Track: Utility (configures rootless Podman in a workspace image; not an IDE or AI agent tool)

Presentation & Onboarding — 12 / 17

Criterion	Max	Score	Notes
Configuration-mode examples	12	12	README provides a default Kubernetes pod example, a "Podman CLI only" example (socket = false, disable_buildkit = false), and a required_tools example, each with sensible defaults. Major option surfaces (socket vs. CLI-only, required tools, docker shim behavior) are all documented.
Visual preview	5	0	No image, GIF, or video anywhere in the README.

Credential Hygiene — 16 / 20

Criterion	Max	Score	Notes
Secrets marked sensitive	16	16	Module has no secret/credential inputs at all; no inline keys appear anywhere in README examples. Nothing to leak.
Non-hardcoded auth path	4	0	Module has no auth concept (no API keys, no IAM/ServiceAccount flow), and no such path is documented. Per rubric, missing support outside if-applicable criteria scores zero.

Restricted-Environment Readiness — 1 / 2 (18 pts N/A)

Criterion	Max	Score	Notes
Mirrorable artifact source	5	N/A	README states "It installs nothing." No download/install URL exists to override. Excluded per "download-related criteria go N/A when the module installs nothing of its own."
Bring-your-own binary	10	N/A	Same reasoning — the module never downloads or installs the tool; it only configures Podman already present in the image. Concern doesn't exist by construction.
Egress transparency	3	N/A	Module makes no external network calls of its own (only operates on the local Unix socket and local config files). Explicitly listed as N/A-eligible when nothing is downloaded.
Runs without sudo	2	1	install.sh.tftpl only invokes sudo for the optional docker-shim symlink when /usr/local/bin isn't writable, and falls back to ~/.local/bin/docker without sudo if sudo -n fails. Core functionality (storage.conf, env vars, tool checks) never requires sudo. Optional feature + working non-root fallback = half credit.

Engineering Quality — 10 / 10

Criterion	Max	Score	Notes
Input quality	6	6	All 8 variables (agent_id, native_overlay, socket, socket_path, disable_buildkit, docker_shim, required_tools, icon) have clear descriptions and sensible defaults. validation blocks enforce socket_path is absolute and required_tools entries are plain command names (no shell injection).
Test coverage	4	4	podman-setup.tftest.hcl covers defaults, socket toggling, buildkit toggling, custom socket path, and validation failure cases (business logic). main.test.ts runs real container-based end-to-end tests covering overlay config, user-managed storage.conf preservation, missing-tool failures, docker shim linking/fallback, and docker_shim = false behavior.

Overall — 81 / 100

Raw 38 / 47 → round(38 / 47 × 100) = 81

Tip

You can run this locally by telling your agent: "review this module against .github/scorecard/SCORECARD.md".

---

Scored against SCORECARD.md with solstice-1. Language-model scores are advisory.