devcontainer: add podman support for CI integration tests

[redhat-chai-bot]

What

Adds podman, fuse-overlayfs, and rootless podman setup to the devcontainer Dockerfile so it can serve as the base image for running integration tests in CI with ci-operator's nested_podman mode.

Deletes Dockerfile.integration — the CI integration test image is now defined inline in the ci-operator config (openshift/release) using dockerfile_literal, so this file is no longer needed.

Changes

.devcontainer/Dockerfile

• Added podman, fuse-overlayfs, shadow-utils to the dnf install
• Added rootless podman setup block (entrypoint script copy, setcap, subuid/subgid permissions)
• No ENTRYPOINT or ENV HOME changes — the devcontainer's existing vscode user (uid 1000) with home at /home/vscode handles that

Dockerfile.integration

• Deleted — the 3-line CI adapter (FROM sippy-devcontainer / COPY / WORKDIR) is now defined inline via dockerfile_literal in the ci-operator config in openshift/release

Why

Reviewer feedback on openshift/release#82968 requested using .devcontainer/Dockerfile instead of maintaining a separate Dockerfile.integration. Using dockerfile_literal in the ci-operator config eliminates the file entirely — one less thing to maintain in this repo.

Companion PR: openshift/release#83006

Jira: TRT-2865

[openshift-merge-bot]

Pipeline controller notification
This repo is configured to use the pipeline controller. Second-stage tests will be triggered either automatically or after lgtm label is added, depending on the repository configuration. The pipeline controller will automatically detect which contexts are required and will utilize /test Prow commands to trigger the second stage.

For optional jobs, comment /test ? to see a list of all defined jobs. To trigger manually all jobs from second stage use /pipeline required command.

This repository is configured in: automatic mode

[coderabbitai]

Walkthrough

The development container now installs and configures rootless nested Podman. The integration image now inherits sippy-devcontainer, copies the repository to /workspace, and removes its duplicate Podman setup.

Changes

Rootless Podman containers

Layer / File(s)	Summary
Development container Podman setup .devcontainer/Dockerfile	The image installs Podman support and configures Buildah isolation, subordinate ID files, permissions, and UID/GID mapping capabilities for nested Podman.
Integration image rebase Dockerfile.integration	The image now uses sippy-devcontainer, copies the repository to /workspace with ownership, sets the working directory, and removes the previous nested-Podman entrypoint, environment, and command configuration.

Estimated code review effort: 2 (Simple) | ~10 minutes

Suggested reviewers: smg247, stbenjam

🚥 Pre-merge checks | ✅ 21

✅ Passed checks (21 passed)

Check name	Status	Explanation
Docstring Coverage	✅ Passed	No functions found in the changed files to evaluate docstring coverage. Skipping docstring coverage check.
Linked Issues check	✅ Passed	Check skipped because no linked issues were found for this pull request.
Out of Scope Changes check	✅ Passed	Check skipped because no linked issues were found for this pull request.
Go Error Handling	✅ Passed	The patch changes only .devcontainer/Dockerfile and Dockerfile.integration; it adds no Go files or Go error-handling code.
Sql Injection Prevention	✅ Passed	The PR changes only Dockerfiles and Podman setup; added lines contain no SQL queries, query construction, or database API calls.
Excessive Css In React Should Use Styles	✅ Passed	The pull request changes only Dockerfiles; neither changed file contains React, JSX, inline style objects, or styling declarations.
Test Coverage For New Features	✅ Passed	The commit changes only .devcontainer/Dockerfile and Dockerfile.integration. It adds container configuration and package setup, which the check explicitly exempts as configuration-only changes.
Single Responsibility And Clear Naming	✅ Passed	The changes use clear, contextual names and keep responsibilities cohesive: the devcontainer owns Podman setup, while Dockerfile.integration only copies source and sets the workdir.
Feature Documentation	✅ Passed	The PR changes only CI/devcontainer Docker setup; it adds no data model, data flow, API endpoint, or documented core concept that requires a docs/features update.
Stable And Deterministic Test Names	✅ Passed	The commit changes only two Dockerfiles. It adds no Ginkgo test declarations or test titles, so no unstable test name is introduced.
Test Structure And Quality	✅ Passed	The pull request changes only two Dockerfiles; it adds no Ginkgo tests or cluster operations, so the five test-quality requirements are not applicable.
Microshift Test Compatibility	✅ Passed	The pull request changes only two Dockerfiles and adds no Ginkgo e2e tests or MicroShift-sensitive test references.
Single Node Openshift (Sno) Test Compatibility	✅ Passed	The PR changes only two Dockerfiles and adds no Ginkgo e2e tests, so the SNO compatibility check is not applicable.
Topology-Aware Scheduling Compatibility	✅ Passed	The pull request changes only Dockerfiles and adds Podman setup; it does not add or modify deployment manifests, operators, controllers, or scheduling constraints.
Ote Binary Stdout Contract	✅ Passed	HEAD changes only two Dockerfiles; no OTE binary, Ginkgo suite, or OTE process-level code is added or modified, so this stdout contract does not apply.
Ipv6 And Disconnected Network Test Compatibility	✅ Passed	The commit changes only two Dockerfiles; it adds no Ginkgo e2e tests, IPv4 assumptions, or test external-connectivity requirements.
No-Weak-Crypto	✅ Passed	The PR only changes Dockerfiles for Podman setup and source copying; its added lines contain no weak crypto algorithms, custom crypto, or secret/token comparisons.
Container-Privileges	✅ Passed	The PR adds no privileged/host namespace settings or SYS_ADMIN; root-only setup is for rootless Podman, and both images use the non-root vscode runtime user.
No-Sensitive-Data-In-Logs	✅ Passed	The PR changes only two Dockerfiles; added lines contain package and permission setup, with no logging commands or sensitive values. The entrypoint, including its existing output, is unchanged.
Description Check	✅ Passed	Check skipped - CodeRabbit’s high-level summary is enabled.
Title check	✅ Passed	The title clearly and concisely describes the main change: adding Podman support to the devcontainer for CI integration tests.

✨ Finishing Touches

🧪 Generate unit tests (beta)

• Create PR with unit tests

---

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands.}

[coderabbitai]

Actionable comments posted: 3

🤖 Prompt for all review comments with AI agents

Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.

Inline comments:
In `@Dockerfile.integration`:
- Line 6: Replace the broad COPY instruction with explicit COPY entries for the
files and directories required by make integration, preserving the existing
destination and ownership settings. Do not copy the entire build context; use an
auditable allowlist based on the integration build’s actual dependencies.
- Around line 5-7: Add a Dockerfile HEALTHCHECK after the existing WORKDIR setup
that verifies the Podman API Unix socket is available once the entrypoint starts
the service. Use the existing Podman socket path and a probe command suitable
for the image, ensuring CI can report an unhealthy container when the service
fails to start.
- Around line 5-7: Add an ENTRYPOINT declaration to the Dockerfile using
/nested-podman-entrypoint.sh, alongside the existing image setup, so the nested
Podman service starts before integration tests run. Preserve the existing COPY
and WORKDIR directives.

🪄 Autofix

Fix all unresolved CodeRabbit comments on this PR:

• Push a commit to this branch (recommended)
• Create a new PR with the fixes

---

ℹ️ Review info

⚙️ Run configuration

Configuration used: Repository YAML (base), Central YAML (inherited)

Review profile: CHILL

Plan: Pro Plus

Run ID: 15a107b4-4511-42b8-807a-61b2492ce512

📥 Commits

Reviewing files that changed from the base of the PR and between ff252ad and 569b476.

📒 Files selected for processing (2)

• .devcontainer/Dockerfile
• Dockerfile.integration

[openshift-merge-bot]

Scheduling required tests:
/test e2e

[openshift-merge-bot]

Scheduling required tests:
/test e2e

[redhat-chai-bot]

/retest-required

---

AI-generated. Review for accuracy.

[redhat-chai-bot]

/retest-required

---

AI-generated. Review for accuracy.

[mstaeble]

/lgtm

[openshift-ci]

[APPROVALNOTIFIER] This PR is APPROVED

This pull-request has been approved by: mstaeble, redhat-chai-bot

The full list of commands accepted by this bot can be found here.

The pull request process is described here

Details

Needs approval from an approver in each of these files:

• OWNERS [mstaeble]

Approvers can indicate their approval by writing /approve in a comment
Approvers can cancel approval by writing /approve cancel in a comment

[redhat-chai-bot]

/retest-required

---

AI-generated. Review for accuracy.

[openshift-merge-bot]

/retest-required

Remaining retests: 0 against base HEAD ff252ad and 2 for PR HEAD cc0e6be in total

[redhat-chai-bot]

/test e2e

---

AI-generated. Review for accuracy.

[redhat-chai-bot]

/test e2e

---

AI-generated. Review for accuracy.

[redhat-chai-bot]

/test e2e

---

AI-generated. Review for accuracy.

[redhat-chai-bot]

/test e2e

---

AI-generated. Review for accuracy.

[mstaeble]

/test e2e

[openshift-ci]

@redhat-chai-bot: all tests passed!

Full PR test history. Your PR dashboard.

Details

Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the kubernetes-sigs/prow repository. I understand the commands that are listed here.