jeena/agent-container
1
0
Fork 0
Code Issues Pull requests Projects Releases 1 Packages Wiki Activity Actions
agent-container/CHANGELOG.md
Jeena 87ddc6edfb docs: Add release notes for 1.0.0 
The upgrade swaps the runtime under the user's feet, and nothing reuses
the old Docker containers or image: storage moves to
~/.local/share/containers, the image has to be rebuilt, and hosts
without subuid/subgid mappings fail on the first run. Without notes that
say so, the empty container list looks like data loss and the first
failed start looks like a broken release.
2026-10-29 02:15:25 +09:00

2 KiB
Raw Blame History

Release notes

1.0.0 — 2026-10-29

Containers now run with rootless Podman instead of Docker.

Why

Whoever can talk to /var/run/docker.sock is root on the host. A single docker run --privileged -v /:/host edits any file, including /etc/shadow and your SSH keys. Being in the docker group is therefore the same as having root, and an agent with that access leaves the project directory whenever it likes — the confinement this tool exists for holds only against accidents, not against a malicious tool call.

Rootless Podman removes the shortcut: containers run inside a user namespace owned by you, and container root maps to a subordinate UID from /etc/subuid instead of to host root. Nothing outside your own file permissions is reachable, and the docker group is not needed at all.

Upgrading

Rootless Podman has to work on the host first:

sudo pacman -S podman passt            # or slirp4netns
grep "^$USER:" /etc/subuid /etc/subgid # expect an entry like 100000:65536
podman info >/dev/null && echo ok

If the subuid/subgid entries are missing, add them with usermod --add-subuids 100000-165535 --add-subgids 100000-165535 <user>.

Existing Docker containers and images are not reused. They are left untouched, and the first Podman run builds a fresh image (localhost/agent-container:latest).

  1. Rebuild the image with Podman:

    git pull
agent-container update

  2. Remove the old Docker containers and image:

    docker ps -a --filter 'name=^ac-' --format '{{.Names}}' | xargs -r docker rm -f
docker rmi agent-container:latest

  3. Use pi, claude, and opencode as before. The first run creates a Podman container per project.

  4. Leave the docker group once nothing else on the machine needs the socket as your user, then log out and in again:

    sudo gpasswd -d "$USER" docker

Your container home ($XDG_DATA_HOME/agent-container/container-home) is untouched: logins, settings, and history carry over.