Jeena
87ddc6edfb
The upgrade swaps the runtime under the user's feet, and nothing reuses the old Docker containers or image: storage moves to ~/.local/share/containers, the image has to be rebuilt, and hosts without subuid/subgid mappings fail on the first run. Without notes that say so, the empty container list looks like data loss and the first failed start looks like a broken release.
63 lines
2 KiB
Markdown
63 lines
2 KiB
Markdown
# Release notes
|
|
|
|
## 1.0.0 — 2026-10-29
|
|
|
|
Containers now run with rootless Podman instead of Docker.
|
|
|
|
### Why
|
|
|
|
Whoever can talk to `/var/run/docker.sock` is root on the host. A single
|
|
`docker run --privileged -v /:/host` edits any file, including
|
|
`/etc/shadow` and your SSH keys. Being in the `docker` group is therefore
|
|
the same as having root, and an agent with that access leaves the project
|
|
directory whenever it likes — the confinement this tool exists for holds
|
|
only against accidents, not against a malicious tool call.
|
|
|
|
Rootless Podman removes the shortcut: containers run inside a user
|
|
namespace owned by you, and container root maps to a subordinate UID from
|
|
`/etc/subuid` instead of to host root. Nothing outside your own file
|
|
permissions is reachable, and the `docker` group is not needed at all.
|
|
|
|
### Upgrading
|
|
|
|
Rootless Podman has to work on the host first:
|
|
|
|
```sh
|
|
sudo pacman -S podman passt # or slirp4netns
|
|
grep "^$USER:" /etc/subuid /etc/subgid # expect an entry like 100000:65536
|
|
podman info >/dev/null && echo ok
|
|
```
|
|
|
|
If the subuid/subgid entries are missing, add them with
|
|
`usermod --add-subuids 100000-165535 --add-subgids 100000-165535 <user>`.
|
|
|
|
Existing Docker containers and images are not reused. They are left
|
|
untouched, and the first Podman run builds a fresh image
|
|
(`localhost/agent-container:latest`).
|
|
|
|
1. Rebuild the image with Podman:
|
|
|
|
```sh
|
|
git pull
|
|
agent-container update
|
|
```
|
|
|
|
2. Remove the old Docker containers and image:
|
|
|
|
```sh
|
|
docker ps -a --filter 'name=^ac-' --format '{{.Names}}' | xargs -r docker rm -f
|
|
docker rmi agent-container:latest
|
|
```
|
|
|
|
3. Use `pi`, `claude`, and `opencode` as before. The first run creates a
|
|
Podman container per project.
|
|
|
|
4. Leave the `docker` group once nothing else on the machine needs the
|
|
socket as your user, then log out and in again:
|
|
|
|
```sh
|
|
sudo gpasswd -d "$USER" docker
|
|
```
|
|
|
|
Your container home (`$XDG_DATA_HOME/agent-container/container-home`) is
|
|
untouched: logins, settings, and history carry over.
|