Conversation
YuseiIto
pushed a commit
that referenced
this pull request
Jul 3, 2026
The prebuilt image now ships iproute2 (#110), which rootlesskit needs to configure the slirp4netns tap device. Co-Authored-By: Claude Fable 5 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01QYryuMeKDCxgJro93GJxWB
YuseiIto
changed the title
YuseiIto
force-pushed
the
claude/pr-77-review-2a3gan
branch
2 times, most recently
from
July 4, 2026 05:27
471e492 to
6fa6c76
Compare
With the rootless tooling from #107 in place, the devcontainer's rootless daemon (#77) now gets as far as network setup and dies there: rootlesskit configures the slirp4netns tap device by running ip(8) inside the namespace, and the image has no iproute2 — 'nsenter: failed to execute ip: No such file or directory'. Same staging as #107: land the package on main first so the prebuilt images pick it up, then #77's CI can exercise the daemon end to end. iptables, the other runtime dependency of the daemon, needs no entry here because docker-ce already hard-depends on it. Co-Authored-By: Claude Fable 5 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01QYryuMeKDCxgJro93GJxWB
YuseiIto
force-pushed
the
claude/pr-77-review-2a3gan
branch
from
July 4, 2026 05:27
6fa6c76 to
ecaa40b
Compare
Network installers that pipe curl into a shell (and release-tarball downloads) flake mid-transfer during CI image builds — connection reset / broken pipe against PyPI, GitHub, etc. Rather than hand-roll a retry loop in each cookbook, add a reusable retriable_command define to lib/custom_resources.rb that reads like execute (command + optional not_if/only_if guard, tunable retries/delay) and wraps the command in a POSIX-sh retry loop. Convert the aider cookbook, whose PyPI dependency resolution is the current repeat offender, to use it. Other curl|sh cookbooks (ollama, starship, uv, ...) can adopt it incrementally. Co-Authored-By: Claude Fable 5 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01QYryuMeKDCxgJro93GJxWB
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
2 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
背景
#107(rootless ツール導入)→ イメージ再ビルド後、#77 の CI は rootless デーモンの起動を実際に検証できるようになり、原因の切り分けが進みました:
newuidmap不在newuidmap: write to uid_map failed: Operation not permittedmap_write()が uid_map を開いたプロセスに child namespace へのCAP_SYS_ADMINを要求するため。コンテナ内では setuid バイナリも bounding set 以上には昇格できず、Docker デフォルトには SYS_ADMIN が無い。→ Replace host Docker socket bind with rootless docker-in-docker #77 側で--cap-add SYS_ADMINを追加済み(ローカルでsetprivにより再現・特定)nsenter: failed to execute ip: No such file or directory— rootlesskit は slirp4netns の tap デバイスを namespace 内でip(8)を実行して設定するが、イメージに iproute2 が無い変更内容
mitamae/cookbooks/docker/default.rb: rootless 前提パッケージにiproute2を追加mitamae/cookbooks/aider/default.rb: aider インストーラを3回リトライに変更。本日 PyPI(files.pythonhosted.org)からのダウンロードが「broken pipe」で切断され、無関係なイメージビルドジョブが4回落ちたため(本 PR の pine/arm64・LXC bamboo の失敗もこれ)。一時障害1回でビルド全体が落ちないようにするもう一つのランタイム依存である
iptablesはdocker-ceが hard-depend しているため追加不要(確認済み:Depends: containerd.io, docker-ce-cli, iptables, nftables, ...)。進め方
#107 と同じ2段階方式です。本 PR を先にマージ →
build.yamlがイメージを再ビルド → #77 の CI を再実行すると、rootless デーモンの起動からdocker run hello-worldまでがエンドツーエンドで検証されます。確認
rubocop: 105 files inspected, no offenses🤖 Generated with Claude Code
https://claude.ai/code/session_01QYryuMeKDCxgJro93GJxWB