You signed in with another tab or window. Reload to refresh your session.You signed out in another tab or window. Reload to refresh your session.You switched accounts on another tab or window. Reload to refresh your session.Dismiss alert
Add an opt-in rootless-Podman gateway runtime to nemoclaw onboard, keeping Docker the default for every existing install. An operator who sets NEMOCLAW_GATEWAY_RUNTIME=podman (on a Docker-driver platform with a reachable rootless Podman socket) would get the OpenShell podman compute driver under mTLS instead of the docker-group/rootful-docker default.
Why
OpenShell ships a first-class Podman compute driver (RPM default, dedicated driver, CI-tested), but nemoclaw onboard only wires the Docker driver. OpenShell's own security best-practices doc recommends running under user namespaces (rootless) for defense-in-depth — so this opt-in simply lets onboarding follow that guidance: run the gateway as an unprivileged rootless-Podman user rather than the rootful docker-group identity. It's an onboarding/parity gap, not a new runtime.
Shape (opt-in; Docker default byte-identical)
NEMOCLAW_GATEWAY_RUNTIME=podman selects the podman path only on an exact opt-in; unset / docker / anything else keeps the Docker default unchanged.
The podman path writes ~/.config/openshell/gateway.toml (compute_drivers = ["podman"], socket_path, a digest-pinned supervisor_image, and guest_tls_* material for the gateway↔supervisor mTLS channel), binds 0.0.0.0 so the sandbox can reach the gateway via the host-gateway resolver — mTLS enforces the boundary — and registers the https endpoint via gateway add --local.
Scope / related:#5513 tracks the same loopback-bind issue on the Docker-default (WSL2) path; this proposal is scoped to the new podman opt-in and intentionally leaves the default-path fix to that issue and its assignee.
Status
Working implementation with 42 unit tests (the opt-in gate keeps the Docker default byte-identical; the podman path is asserted against OpenShell's real [openshell.drivers.podman] schema), validated end-to-end on a clean-room rootless-Podman host (OpenShell 0.0.44, netavark backend): onboarding brings the gateway up under rootless Podman (Connected over https, mTLS), and a sandbox reaches Ready with the digest-pinned supervisor and posture CapEff:0x0 / NoNewPrivs:1 / Seccomp:2 / no /run/docker.sock (the workload runs as an unprivileged uid). A small prerequisite — making the preflight runtime guard socket-aware so a supported Podman host isn't rejected outright — is a separate, self-contained fix. Happy to share the tests and a sanitized reproduction recipe if useful.
Question for maintainers
Would you welcome a PR (the preflight guard + the opt-in), with the Docker default unchanged? Happy to bring the tests and bench evidence, and to adapt the shape (e.g. a config key instead of an env var) if you'd prefer.
reacted with thumbs up emoji reacted with thumbs down emoji reacted with laugh emoji reacted with hooray emoji reacted with confused emoji reacted with heart emoji reacted with rocket emoji reacted with eyes emoji
Uh oh!
There was an error while loading. Please reload this page.
Uh oh!
There was an error while loading. Please reload this page.
Proposal
Add an opt-in rootless-Podman gateway runtime to
nemoclaw onboard, keeping Docker the default for every existing install. An operator who setsNEMOCLAW_GATEWAY_RUNTIME=podman(on a Docker-driver platform with a reachable rootless Podman socket) would get the OpenShell podman compute driver under mTLS instead of the docker-group/rootful-docker default.Why
OpenShell ships a first-class Podman compute driver (RPM default, dedicated driver, CI-tested), but
nemoclaw onboardonly wires the Docker driver. OpenShell's own security best-practices doc recommends running under user namespaces (rootless) for defense-in-depth — so this opt-in simply lets onboarding follow that guidance: run the gateway as an unprivileged rootless-Podman user rather than the rootful docker-group identity. It's an onboarding/parity gap, not a new runtime.Shape (opt-in; Docker default byte-identical)
NEMOCLAW_GATEWAY_RUNTIME=podmanselects the podman path only on an exact opt-in; unset /docker/ anything else keeps the Docker default unchanged.~/.config/openshell/gateway.toml(compute_drivers = ["podman"],socket_path, a digest-pinnedsupervisor_image, andguest_tls_*material for the gateway↔supervisor mTLS channel), binds0.0.0.0so the sandbox can reach the gateway via thehost-gatewayresolver — mTLS enforces the boundary — and registers thehttpsendpoint viagateway add --local.Scope / related: #5513 tracks the same loopback-bind issue on the Docker-default (WSL2) path; this proposal is scoped to the new podman opt-in and intentionally leaves the default-path fix to that issue and its assignee.
Status
Working implementation with 42 unit tests (the opt-in gate keeps the Docker default byte-identical; the podman path is asserted against OpenShell's real
[openshell.drivers.podman]schema), validated end-to-end on a clean-room rootless-Podman host (OpenShell 0.0.44, netavark backend): onboarding brings the gateway up under rootless Podman (Connected over https, mTLS), and a sandbox reaches Ready with the digest-pinned supervisor and postureCapEff:0x0 / NoNewPrivs:1 / Seccomp:2 / no /run/docker.sock(the workload runs as an unprivileged uid). A small prerequisite — making the preflight runtime guard socket-aware so a supported Podman host isn't rejected outright — is a separate, self-contained fix. Happy to share the tests and a sanitized reproduction recipe if useful.Question for maintainers
Would you welcome a PR (the preflight guard + the opt-in), with the Docker default unchanged? Happy to bring the tests and bench evidence, and to adapt the shape (e.g. a config key instead of an env var) if you'd prefer.
All reactions