feat: support docker as container runtime in container-run.sh#10368
Merged
Conversation
Add an optional `docker` backend to ci/container/container-run.sh,
selected via the CONTAINER_RUNTIME env var (defaults to `podman`, so
existing behaviour is unchanged). The podman code paths are left
identical with master.
When CONTAINER_RUNTIME is 'docker':
- run unprivileged (no `sudo`) with the minimal isolation flags the
nested rootless podman used by the IC-OS build needs: --device
/dev/fuse, unconfined seccomp/apparmor, disabled labelling,
systempaths=unconfined, --cap-add SYS_ADMIN and --network=host
(much narrower than podman's --privileged);
- use `image inspect` instead of podman's `image exists`;
- treat /.dockerenv as a nested-container marker;
- source the ict_testnets dir from the cache dir rather than host /tmp
(some namespaced docker daemons can't bind-mount the host's /tmp).
A small entrypoint shim (ci/container/docker-init.sh) opens up /dev/fuse
(docker exposes it 0600 root:root) and ensures /tmp/zig-cache exists, via
the image's passwordless sudo.
nmattia
commented
Jun 2, 2026
Contributor
There was a problem hiding this comment.
Pull request overview
Adds optional Docker support to the existing container development/build entrypoint (ci/container/container-run.sh) while keeping Podman as the default, and introduces a small Docker-specific entrypoint shim to adjust permissions/paths needed for nested rootless Podman use cases (IC-OS build).
Changes:
- Add
CONTAINER_RUNTIMEselection (podmandefault, optionaldocker) and adjust runtime command selection and image existence checks. - Adjust bind-mount strategy for
ict_testnetsunder Docker to avoid host/tmpbind-mount limitations. - Add
ci/container/docker-init.shentrypoint shim to fix/dev/fusepermissions and prepare/tmp/zig-cache.
Reviewed changes
Copilot reviewed 2 out of 2 changed files in this pull request and generated 4 comments.
| File | Description |
|---|---|
| ci/container/container-run.sh | Adds Docker runtime option, runtime-specific run args, and Docker-specific mount handling. |
| ci/container/docker-init.sh | New Docker-only entrypoint shim to adjust /dev/fuse perms and ensure /tmp/zig-cache exists/is writable. |
💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.
nmattia
commented
Jun 2, 2026
Co-authored-by: Nicolas Mattia <nicolas@nmattia.com>
basvandijk
approved these changes
Jun 3, 2026
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Add an optional
dockerbackend to ci/container/container-run.sh, selected via the CONTAINER_RUNTIME env var (defaults topodman, so existing behaviour is unchanged). The podman code paths are left identical with master.When CONTAINER_RUNTIME is 'docker':
sudo) with the minimal isolation flags the nested rootless podman used by the IC-OS build needs: --device /dev/fuse, unconfined seccomp/apparmor, disabled labelling, systempaths=unconfined, --cap-add SYS_ADMIN and --network=host (much narrower than podman's --privileged);image inspectinstead of podman'simage exists;A small entrypoint shim (ci/container/docker-init.sh) opens up /dev/fuse (docker exposes it 0600 root:root) and ensures /tmp/zig-cache exists, via the image's passwordless sudo.