Add rootless Podman support (RHEL 9+, SELinux, sibling containers) - #436
Draft
mlevans0 wants to merge 6 commits into
Draft
Add rootless Podman support (RHEL 9+, SELinux, sibling containers)#436mlevans0 wants to merge 6 commits into
mlevans0 wants to merge 6 commits into
Conversation
Contributor
|
Tested, overall looks ready to offer initial support. Some notes:
We should also draft documentation changes before making these changes available. @das7pad would you mind having a look as well? |
das7pad
reviewed
Aug 18, 2026
| if [[ "$docker_server_version" =~ ^([0-9]+)\.([0-9]+) ]]; then | ||
| local major="${BASH_REMATCH[1]}" | ||
| local minor="${BASH_REMATCH[2]}" | ||
| if [[ "$major" -lt 23 ]]; then |
Member
There was a problem hiding this comment.
https://endoflife.date/docker-engine
Only 25 and 29 are supported upstream.
|
|
||
| # This module grants the sharelatex container permission to | ||
| # interact with the rootless Podman socket under SELinux enforcing. | ||
| # The socket lives at /run/user/$UID/podman/podman.sock with context user_tmp_t. |
Member
There was a problem hiding this comment.
Can we switch the context for the socket instead?
…le and selinux module to config/
…ing git-bridge support/related checks and tune SELinux module.
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
3 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Description
Adds support for running Overleaf Server Pro on rootless Podman (RHEL 9+ family), including sibling containers and SELinux enforcing mode.
Main changes:
bin/podman-setupscript — validates and (with--apply) auto-fixes a RHEL-based host for rootless Podman: required packages, user lingering, the Podman user socket,DOCKER_HOSTwiring inconfig/overleaf.rc, the seccomp profile, and the SELinux policy module. Exit codes distinguish all-clear / warnings / failures, and dry-run is the default.lib/podman_socket_clsi.te) — allows thesharelatexcontainer to connect to the rootless Podman socket for sibling-container compiles while SELinux stays in Enforcing mode.lib/clsi-profile.json) — profile for CLSI sandboxed compiles under Podman, wired up viaSECCOMP_PROFILEinvariables.env.bin/doctorextended — now reports the container runtime (Docker vs Podman), resolved socket path,DOCKER_HOSTconfiguration, SELinux status/module/rules, seccomp profile presence, and host→socket / container→socket connectivity checks, with actionable warnings for each misconfiguration. The quay.io login check was also refactored into a shared helper.lib/shared-functions.sh— new shared helpers for Podman detection, socket path resolution, SELinux module/rule checks, seccomp config checks, and quay.io login detection, used by bothdoctorandpodman-setup.Existing Docker-based setups are unaffected: Podman-specific checks and warnings only activate when Podman is detected.
Related issues / Pull Requests
Contributor Agreement