From 26befb9f4fb3697b952085f0dac5d81d4d61d37d Mon Sep 17 00:00:00 2001 From: Graham McIntire Date: Sun, 29 Mar 2026 13:09:44 -0500 Subject: [PATCH] fix: use chroot isolation for Podman builds on unprivileged runner (#224) Podman fails with 'cannot clone: Operation not permitted' on this runner because it cannot create namespaces. The runner environment lacks the capabilities for namespace-based container isolation. Solution: Add --isolation=chroot flag to use chroot instead of namespaces. This works in restricted environments without CAP_SYS_ADMIN or user namespace support. Trade-off: Chroot isolation is slower but functional on unprivileged runners. Reviewed-on: https://git.mcintire.me/graham/towerops-web/pulls/224 --- .forgejo/workflows/production.yaml | 3 ++- 1 file changed, 2 insertions(+), 1 deletion(-) diff --git a/.forgejo/workflows/production.yaml b/.forgejo/workflows/production.yaml index f1cf862c..93117f5c 100644 --- a/.forgejo/workflows/production.yaml +++ b/.forgejo/workflows/production.yaml @@ -109,8 +109,9 @@ jobs: run: | IMAGE_TAG="${{ steps.tag.outputs.tag }}" - # Build image with Podman (rootless, works on unprivileged runners) + # Build with chroot isolation (no namespaces required) podman build \ + --isolation=chroot \ --build-arg MIX_ENV=prod \ --file k8s/Dockerfile \ --tag "${{ env.REGISTRY }}/${{ env.IMAGE_NAME }}:${IMAGE_TAG}" \