Stop depending on ghcr.io/loft-sh images

.github/workflows/dockerless.yaml

@@ -0,0 +1,88 @@
+name: dockerless
+
+# dockerless is the image DevPod builds dev containers with on Kubernetes, without a docker
+# daemon (see dockerless/). It is its own Go module: checked on pull requests that change it,
+# and published as ghcr.io/curityio/dockerless:<version> when a dockerless-v<version> tag is
+# pushed. pkg/devcontainer/single.go pins the version DevPod uses.
+on:
+  pull_request:
+    branches:
+      - main
+    paths:
+      - .github/workflows/dockerless.yaml
+      - dockerless/**
+  push:
+    tags:
+      - dockerless-v*
+  workflow_dispatch: {}
+
+concurrency:
+  group: ${{ github.workflow }}-${{ github.head_ref || github.ref }}
+  cancel-in-progress: true
+
+defaults:
+  run:
+    working-directory: dockerless
+
+jobs:
+  check:
+    runs-on: ubuntu-latest
+    steps:
+      - uses: actions/checkout@v4
+
+      - uses: actions/setup-go@v4
+        with:
+          go-version-file: dockerless/go.mod
+          cache-dependency-path: dockerless/go.sum
+
+      - name: Build, vet and test
+        run: |
+          go build ./...
+          go vet ./...
+          go test ./...
+
+      - uses: golangci/golangci-lint-action@v9
+        with:
+          version: v2.15.0
+          working-directory: dockerless
+
+      - name: Check licenses
+        run: |
+          go install github.com/google/go-licenses/v2@v2.0.1
+          go-licenses check ./... --ignore github.com/loft-sh/devpod
+
+  image:
+    needs: check
+    runs-on: ubuntu-latest
+    permissions:
+      contents: read
+      packages: write
+    steps:
+      - uses: actions/checkout@v4
+
+      # dockerless-v0.3.0 is published as 0.3.0. Anything else is only built, for both platforms.
+      - name: Get the version
+        id: version
+        run: |
+          if [[ "$GITHUB_REF" == refs/tags/dockerless-v* ]]; then
+            echo "version=${GITHUB_REF_NAME#dockerless-v}" >> "$GITHUB_OUTPUT"
+          fi
+
+      - uses: docker/setup-qemu-action@v4
+
+      - uses: docker/setup-buildx-action@v4
+
+      - name: Log in to ghcr.io
+        if: steps.version.outputs.version != ''
+        uses: docker/login-action@v4
+        with:
+          registry: ghcr.io
+          username: ${{ github.actor }}
+          password: ${{ secrets.GITHUB_TOKEN }}
+
+      - uses: docker/build-push-action@v7
+        with:
+          context: dockerless
+          platforms: linux/amd64,linux/arm64
+          push: ${{ steps.version.outputs.version != '' }}
+          tags: ghcr.io/curityio/dockerless:${{ steps.version.outputs.version || 'test' }}

.github/workflows/e2e-tests.yaml

@@ -14,6 +14,7 @@ on:
       - "!**_test.go" # exclude test files to ignore unit test changes
       - "e2e/**_test.go" # include test files in e2e again
       - ".github/workflows/e2e-tests.yaml"
+      - "dockerless/**"
 
 concurrency:
   group: ${{ github.workflow }}-${{ github.event.pull_request.number || github.ref }}
@@ -69,6 +70,14 @@ jobs:
           echo "kubectl config current-context:" $(kubectl config current-context)
           echo "KUBECONFIG env var:" ${KUBECONFIG}
 
+      # The kubernetes tests build with dockerless. Build its image from this checkout, under the
+      # name DevPod uses by default, so that they test this version rather than a published one.
+      - name: Build the dockerless image and load it into kind
+        run: |
+          image=$(sed -n 's/^var dockerlessImage = "\(.*\)"$/\1/p' pkg/devcontainer/single.go)
+          docker build -t "$image" dockerless
+          kind load docker-image "$image"
+
       - name: Build binary and copy to the E2E directory
         working-directory: ./e2e
         run: |

AGENTS.md

@@ -15,6 +15,7 @@ VMs). [CHANGELOG.md](CHANGELOG.md) lists what the fork changed and [TODO.md](TOD
 | `providers/` | The built-in `docker` and `kubernetes` provider definitions, embedded into the binary. Other providers live in separate repos. |
 | `desktop/` | The desktop app: Tauri 2 (Rust, `desktop/src-tauri`) with a React/TypeScript UI (`desktop/src`). It runs the `devpod` CLI as a sidecar. |
 | `docs/` | Docusaurus documentation site, deployed to [devpod.curityio.net](https://devpod.curityio.net/) (GitHub Pages with a custom domain, so `baseUrl` is `/`) by `.github/workflows/docs.yaml` on pushes to `main`. |
+| `dockerless/` | The image the kubernetes driver builds dev containers with, without a docker daemon (kaniko). A separate Go module; see its `Readme.md`. |
 | `e2e/` | Ginkgo end-to-end tests that run the real CLI against Docker, Podman and a kind cluster. |
 | `hack/` | Build and test scripts. |
 | `examples/` | Sample devcontainer projects, also used by the e2e tests. |
@@ -85,6 +86,10 @@ cd src-tauri && cargo +stable check
   `pkg/log/table`, `pkg/log/survey`), and the SSH server that runs in the container is `pkg/ssh/sshd`, a copy of
   `gliderlabs/ssh` with unix socket forwarding added. Check that a new dependency is maintained before adding
   it.
+- **`dockerless/` is a separate Go module** (`github.com/loft-sh/devpod/dockerless`), with its own `go.mod`, no
+  `vendor/`, a newer Go and golangci-lint v2 (its `.golangci.yaml`). Commands run at the root don't see it: run
+  them in `dockerless/`, with `GOOS=linux`. Its image is published from a `dockerless-v<version>` tag; DevPod pins
+  the version in `pkg/devcontainer/single.go`, so a change to `dockerless/` needs a new tag and that pin bumped.
 - **gRPC tunnel code is generated.** After editing `pkg/agent/tunnel/tunnel.proto`, regenerate with
   `hack/build-grpc.sh` (needs `protoc`; existing code uses protoc-gen-go v1.36.4 and protoc-gen-go-grpc v1.5.1).
 - **CI quirks:**

CHANGELOG.md

@@ -20,6 +20,20 @@ Add new entries to the top of the "Unreleased" section.
 
 ### Changed
 
+- Kubernetes workspaces build their dev container with `ghcr.io/curityio/dockerless:0.3.0` instead of
+  `ghcr.io/loft-sh/dockerless:0.2.0`. Its source is now in this repository (`dockerless/`), built on the maintained
+  [osscontainertools/kaniko](https://github.com/osscontainertools/kaniko) v1.28 instead of loft-sh's patched copy
+  of Google's archived kaniko 1.9.2. The `DOCKERLESS_IMAGE` option of the kubernetes provider still overrides it.
+  It also fixes these dockerless problems:
+  - It checks registries' TLS certificates. It used to accept any certificate, and plain HTTP, for base images
+    and the registry cache; the kubernetes provider's new `DOCKERLESS_INSECURE` option allows that again.
+  - Workspace users can no longer run commands as root: `/.dockerless` was writable by everyone and on `PATH`,
+    where DevPod's commands, which run as root, looked for `sh` and `su`.
+  - A Dockerfile's `USER` can be a uid without a passwd entry, or have a group (`1000:1000`); the pod used to stop.
+  - The container's processes get the variables the pod was started with, such as `containerEnv`, as with docker.
+  - The build no longer leaves a copy of the files it changed on the pod's disk, no longer looks for cached
+    layers on Docker Hub when no registry cache is set, and writes the image config so that the pod can't
+    read it half-written.
 - `devpod upgrade` only upgrades to a newer stable release: it compares versions instead of installing the latest
   release whenever it differs from the running one, which could downgrade the CLI, and it never picks a
   pre-release or a tag that isn't a plain `major.minor.patch` version. It checks that it can replace the binary

TODO.md

@@ -18,6 +18,15 @@ For each provider we keep: fork it to `curityio`, then update its references in
 (provider sources, `providers/*/provider.yaml`, docs, desktop app and e2e tests).
 Providers we don't keep should be removed from the code and docs.
 
+## Publish the dockerless image
+
+`pkg/devcontainer/single.go` defaults to `ghcr.io/curityio/dockerless:0.3.0`, which
+`.github/workflows/dockerless.yaml` publishes:
+
+- [ ] Push the `dockerless-v0.3.0` tag, so the workflow publishes the image, before the next release
+- [ ] Make the `dockerless` package public in the `curityio` organization's package settings (GHCR makes it
+  private), so that clusters can pull it without credentials
+
 ## Fix links to content that only exists upstream
 
 These links still point to `loft-sh/devpod` because the issues and releases they reference don't exist

cmd/agent/container/setup.go

@@ -308,6 +308,9 @@ func dockerlessBuild(
 		log.Debug("Appending registry cache to dockerless build arguments ", dockerlessOptions.RegistryCache)
 		args = append(args, "--registry-cache", dockerlessOptions.RegistryCache)
 	}
+	if dockerlessOptions.Insecure == "true" {
+		args = append(args, "--insecure")
+	}
 
 	// ignore mounts
 	args = append(args, "--ignore-path", setupInfo.SubstitutionContext.ContainerWorkspaceFolder)

dockerless/.dockerignore

@@ -0,0 +1,6 @@
+*
+!go.mod
+!go.sum
+!main.go
+!cmd/
+!files/

dockerless/.gitignore

@@ -0,0 +1,5 @@
+/.idea
+/test
+/tools
+/dist
+/dockerless

dockerless/.golangci.yaml

@@ -0,0 +1,3 @@
+# dockerless is its own module, linted with golangci-lint v2 and its standard linters; without
+# this file, golangci-lint would read the repository root's v1 configuration.
+version: "2"

dockerless/Dockerfile

@@ -0,0 +1,49 @@
+# Built and published as ghcr.io/curityio/dockerless by .github/workflows/dockerless.yaml.
+FROM --platform=$BUILDPLATFORM golang:1.27.2-alpine AS build
+ARG TARGETOS
+ARG TARGETARCH
+WORKDIR /src
+COPY go.mod go.sum ./
+RUN go mod download
+COPY . .
+RUN CGO_ENABLED=0 GOOS=$TARGETOS GOARCH=$TARGETARCH go build -trimpath -ldflags "-s -w" -o /dockerless .
+
+FROM alpine:3.23 AS certs
+RUN apk add --no-cache ca-certificates
+
+# use musl busybox since it's staticly compiled on all platforms
+FROM busybox:1.37.0-musl AS busybox
+
+# now build from scratch
+FROM scratch
+
+# Links the package to this repository when it is first published to ghcr.io, so that it gets the
+# repository's access permissions (not its visibility, which is set in the package's settings).
+LABEL org.opencontainers.image.source=https://github.com/curityio/devpod
+
+# Only root may write to the kaniko directory: dockerless and DevPod's agent run as root, and the
+# container's other users must not be able to put files where root runs them.
+RUN --mount=from=busybox,dst=/usr/ ["busybox", "sh", "-c", "mkdir -p /.dockerless && chmod 755 /.dockerless"]
+
+COPY --from=certs /etc/ssl/certs/ca-certificates.crt /.dockerless/ssl/certs/
+COPY files/nsswitch.conf /etc/nsswitch.conf
+
+# Keep these in step with dockerlessEnv in cmd/start.go.
+ENV HOME=/root
+ENV USER=root
+ENV KANIKO_DIR=/.dockerless
+# DevPod runs commands in the container through `sh` and `su`, as root, so PATH holds no directory
+# a user could write to. dockerless itself is always called by its full path.
+ENV PATH=/usr/local/bin:/.dockerless/bin
+ENV SSL_CERT_DIR=/.dockerless/ssl/certs
+
+COPY --from=build /dockerless /.dockerless/dockerless
+COPY --from=busybox /bin /.dockerless/bin
+
+RUN ["/.dockerless/bin/sh", "-c", "echo 'root:x:0:0:root:/root:/.dockerless/bin/sh' > /etc/passwd && chmod 666 /etc/passwd"]
+
+WORKDIR /
+
+ENTRYPOINT ["/.dockerless/bin/sh", "-c"]
+
+CMD ["sleep infinity"]