|
| 1 | +# Using Podman |
| 2 | + |
| 3 | +VibePod works with [Podman](https://podman.io/) as an alternative to Docker. Rootless Podman is fully supported — no `sudo` required. |
| 4 | + |
| 5 | +## Prerequisites |
| 6 | + |
| 7 | +- Podman 4.0+ |
| 8 | +- The rootless Podman socket enabled: |
| 9 | + |
| 10 | +```bash |
| 11 | +systemctl --user enable --now podman.socket |
| 12 | +``` |
| 13 | + |
| 14 | +Verify the socket is active: |
| 15 | + |
| 16 | +```bash |
| 17 | +systemctl --user status podman.socket |
| 18 | +``` |
| 19 | + |
| 20 | +## Selecting the runtime |
| 21 | + |
| 22 | +VibePod auto-detects available runtimes. If only Podman is installed, it is used automatically. When both Docker and Podman are available, VibePod prompts you to choose (and remembers your choice). |
| 23 | + |
| 24 | +You can also set the runtime explicitly using any of the methods below. They are listed in priority order — the first one found wins: |
| 25 | + |
| 26 | +### 1. CLI flag |
| 27 | + |
| 28 | +Pass `--runtime` to any command: |
| 29 | + |
| 30 | +```bash |
| 31 | +vp run claude --runtime podman |
| 32 | +vp stop --all --runtime podman |
| 33 | +vp logs start --runtime podman |
| 34 | +``` |
| 35 | + |
| 36 | +### 2. Environment variable |
| 37 | + |
| 38 | +Set `VP_CONTAINER_RUNTIME` to skip the prompt entirely: |
| 39 | + |
| 40 | +```bash |
| 41 | +export VP_CONTAINER_RUNTIME=podman |
| 42 | +vp run claude |
| 43 | +``` |
| 44 | + |
| 45 | +This is useful in CI or shell profiles where you always want a specific runtime. |
| 46 | + |
| 47 | +### 3. Global config |
| 48 | + |
| 49 | +Add `container_runtime` to `~/.config/vibepod/config.yaml`: |
| 50 | + |
| 51 | +```yaml |
| 52 | +container_runtime: podman |
| 53 | +``` |
| 54 | +
|
| 55 | +When VibePod prompts you to choose a runtime interactively, it saves your answer here automatically so you are not asked again. |
| 56 | +
|
| 57 | +Set it back to `auto` to re-enable detection: |
| 58 | + |
| 59 | +```yaml |
| 60 | +container_runtime: auto |
| 61 | +``` |
| 62 | + |
| 63 | +## How it works |
| 64 | + |
| 65 | +VibePod uses the standard [Docker SDK for Python](https://docker-py.readthedocs.io/) to communicate with Podman through its Docker-compatible REST API. No additional Python packages are needed. |
| 66 | + |
| 67 | +The rootless Podman socket is discovered via `$XDG_RUNTIME_DIR/podman/podman.sock` (falling back to `/run/user/<uid>/podman/podman.sock`). The rootful socket at `/run/podman/podman.sock` is only used when running as root. |
| 68 | + |
| 69 | +## Known limitations |
| 70 | + |
| 71 | +### Interactive attach |
| 72 | + |
| 73 | +The `attach_socket()` call in Podman's Docker-compat layer has minor gaps under rootless mode. If you experience rendering issues while attached to a container, try running with `--detach` and using `podman attach` directly: |
| 74 | + |
| 75 | +```bash |
| 76 | +vp run claude -d |
| 77 | +podman attach vibepod-claude-<id> |
| 78 | +``` |
| 79 | + |
| 80 | +### Volume permissions |
| 81 | + |
| 82 | +Rootless Podman uses user-namespace remapping: your host UID is mapped to root inside the container, while other UIDs are mapped to subordinate ranges. Container images that drop privileges via `su` or `gosu` may encounter permission errors on bind-mounted files. |
| 83 | + |
| 84 | +VibePod handles this automatically for its own managed directories (agent config, proxy data, CA certificates) by adjusting permissions before and during container startup. Your workspace directory is mounted as-is and is not modified. |
| 85 | + |
| 86 | +If you still see permission errors on workspace files, adjust permissions for the owner first. For collaborative setups that share a group, you can optionally grant group write access as well. Avoid making the workspace world-writable. |
| 87 | + |
| 88 | +```bash |
| 89 | +chmod -R u+rwX ~/my-project |
| 90 | +# Optional for shared group workspaces: |
| 91 | +chmod -R g+rwX ~/my-project |
| 92 | +``` |
| 93 | + |
| 94 | +### Rootful Podman |
| 95 | + |
| 96 | +VibePod targets rootless Podman. The rootful socket (`/run/podman/podman.sock`) is only probed when running as root. If you need rootful Podman as a non-root user, set `DOCKER_HOST` explicitly: |
| 97 | + |
| 98 | +```bash |
| 99 | +export DOCKER_HOST=unix:///run/podman/podman.sock |
| 100 | +``` |
| 101 | + |
| 102 | +Note that this will require elevated privileges (e.g. via `sudo` or polkit). |
0 commit comments