[renatoathaydes]

DevPod no longer pulls anything from ghcr.io/loft-sh at runtime or in its tests. (The dev container's image is replaced in #32.)

dockerless

Kubernetes workspaces build their dev container with dockerless: the pod starts from its image, and kaniko builds the Dockerfile straight into the pod's file system. It was ghcr.io/loft-sh/dockerless:0.2.0, built on loft-sh's patched copy of Google's kaniko 1.9.2, which is archived.

• dockerless/ is imported from loft-sh/dockerless v0.2.0 with git subtree, keeping its history and authors (53 commits), with vendor/ filtered out of that history. It's MPL-2.0, like DevPod.
• It's now built on the maintained osscontainertools/kaniko v1.28.6. loft-sh's only kaniko patch added Unpack, which always unpacks the final stage into the container; the fork has that upstream as Materialize.
• It's a separate Go module (github.com/loft-sh/devpod/dockerless), so kaniko's dependencies stay out of the CLI and the agent, and isn't vendored. Its Dockerfile builds it from source with pinned base images. loft-sh's goreleaser, Justfile, workflows and dev container are dropped.
• .github/workflows/dockerless.yaml builds, vets, lints (golangci-lint v2) and license-checks it, and builds the image for amd64 and arm64, on PRs that touch it; on a dockerless-v<version> tag it publishes ghcr.io/curityio/dockerless:<version>.
• DevPod's default is ghcr.io/curityio/dockerless:0.3.0 (DOCKERLESS_IMAGE still overrides it). The e2e workflow builds the image from the checkout under that name and loads it into kind, so the kubernetes tests use the code under test.

Fixes from a review of dockerless

A review of dockerless/, limited to how DevPod uses it, found no regression from the kaniko change, and these problems, all inherited from loft-sh's v0.2.0 except the compression level:

• USER forms: start --user only accepted a name or a uid with a passwd entry, so a Dockerfile ending in USER 1000:1000, or a base image whose user is an unknown uid, stopped the pod after the build. It now accepts every form docker does (unit tests in cmd/start_test.go).
• Root from a workspace user: /.dockerless was world-writable and on PATH before busybox, and DevPod runs sh -c and su in the pod as root, so any user could plant an sh that root then ran. It is now 755 and off PATH; DevPod always calls dockerless by its full path.
• TLS: --insecure defaulted to true, so every base-image pull and registry-cache request accepted any certificate (and plain HTTP), with the user's registry credentials. It now defaults to false; the kubernetes provider's new DOCKERLESS_INSECURE option passes --insecure for an in-cluster cache that needs it.
• Disk: kaniko's copy of every changed file stayed in /.dockerless/layers, doubling the pod's ephemeral storage; the build now removes it (config.CleanupBuild).
• image.json: written by renaming a complete file, and start --wait retries one it can't parse, instead of the pod dying on a half-written file.
• Env: the started processes (feature entrypoints, DevPod's container daemon) now get the pod's variables, such as containerEnv, minus dockerless's own, as with docker.
• Docker Hub lookups: without a registry cache, kaniko looked for cached layers in index.docker.io/library/local/cache; layer caching is now only on with a registry cache.
• Compression level: the new kaniko ignores CompressionLevel without CompressionLevelSet (only affects cache pushes).

vcluster feature

The e2e compose features test and examples/simple used ghcr.io/loft-sh/devcontainer-features/vcluster. The test now installs gh 2.62.0 with the devcontainers github-cli feature and checks its version; the example drops it.

Before the next release

• Push the dockerless-v0.3.0 tag after merging, so the image exists.
• Make the dockerless package public in the curityio package settings; GHCR creates it private.

Both are in TODO.md.

Testing

• go build, go vet and golangci-lint v2.15.0 (0 issues) for dockerless (GOOS=linux), go-licenses v2 check passes.
• In the image: a Dockerfile with a RUN builds and unpacks (base files, the RUN output, the image config's env); a FROM-only Dockerfile still unpacks the base image (the case loft-sh's patch was for); dockerless start runs the entrypoint with the image's env.
• After the review fixes, running the image as DevPod does (start --wait --user 1000:1000 as PID 1, then build through exec): the process ran as uid/gid 1000 with HOME=/, the pod's MY_VAR and the image's env and PATH; /.dockerless is 755, PATH has no /.dockerless, /.dockerless/layers was removed after a 50 MB RUN, and the build log has no Docker Hub cache lookup. --insecure still works.
• With a CLI built from this branch on Docker Desktop's Kubernetes, before and after the fixes, the build kubernetes dockerless e2e testdata came up with the locally built ghcr.io/curityio/dockerless:0.3.0 and ssh returned test456; with DOCKERLESS_INSECURE=true the agent passed --insecure.
• Root module: go build ./... and go test ./pkg/devcontainer/.... The e2e suites themselves (kind, compose features) run in CI.

🤖 Generated with Claude Code