[BUG]

[Tojaj]

Bug Description

The container usage instructions in the README do not work on systems with SELinux enabled (Fedora, RHEL) when using rootless Podman.

Multiple issues prevent successful execution:

• volume mount permissions
• Git safe directory checks
• Write permission errors

To Reproduce

Steps to reproduce the behavior:

1. Use Fedora or RHEL with SELinux enabled
2. Run rootless Podman
3. Follow the documented container instructions:

   mkdir -p ~/agentready-reports
   podman run --rm \
     -v /tmp/agentready:/repo:ro \
     -v ~/agentready-reports:/reports \
     ghcr.io/ambient-code/agentready:latest \
     assess /repo --output-dir /reports

4. See errors (details below)

Expected Behavior

The container should successfully assess the repository and write reports to the output directory as documented.

Actual Behavior

Multiple errors occur in sequence when attempting to run the documented commands:
Error 1 - Volume not readable:

Error: Invalid value for '--output-dir' / '-o': Path '/reports' is not readable.

Error 2 - After adding :Z SELinux label:

Error: Invalid value for '[REPOSITORY]': Path '/repo' is not readable.

Error 3 - After fixing both volume labels:

Error during assessment: SHA is empty, possible dubious ownership in the repository at /repo.

Error 4 - After setting GIT_CONFIG environment variables:

PermissionError: [Errno 13] Permission denied: '/reports/assessment-20260330-125042.json'

Environment

• OS: Fedora 43 (Linux 6.19.8-200.fc43.x86_64)
• Container runtime: Podman (rootless)
• SELinux: Enforcing
• agentready version: latest (ghcr.io/ambient-code/agentready:latest)

Workaround

The following command works correctly:

podman run --rm \
  --user $(id -u):$(id -g) \
  --userns=keep-id \
  -v $(pwd):/repo:ro,z \
  -v ~/agentready-reports:/reports:Z \
  ghcr.io/ambient-code/agentready:latest \
  assess /repo --output-dir /reports

Key additions required:

• --user $(id -u):$(id -g) - Run as current user
• --userns=keep-id - Preserve user namespace mapping for rootless Podman
• :z or :Z - SELinux volume labels (lowercase z for shared, uppercase Z for private)

Possible Solution

Update the container documentation to include:

1. SELinux users (Fedora/RHEL/CentOS): Add :Z labels to volume mounts
2. Rootless Podman users: Add --user and --userns=keep-id flags
3. Provide separate examples for Docker vs Podman, or a "universal" command that works for both
   Example updated documentation:

# For rootless Podman with SELinux (Fedora/RHEL):
podman run --rm \
  --user $(id -u):$(id -g) \
  --userns=keep-id \
  -v /path/to/repo:/repo:ro,z \
  -v ~/agentready-reports:/reports:Z \
  ghcr.io/ambient-code/agentready:latest \
  assess /repo --output-dir /reports

[Tojaj]

Closing as I just noticed this is already documented:
https://github.com/ambient-code/agentready/blob/main/CONTAINER.md#podman-rootless-mode