Support Podman in `run-docker.sh` by playday3008 · Pull Request #28785 · termux/termux-packages

playday3008 · 2026-03-05T10:13:56Z

Auto-detects Docker or Podman (override via TERMUX_CONTAINER_RUNTIME). Podman runs rootless with user namespaces — no sudo, no host permission changes.

robertkirkman · 2026-03-05T10:30:47Z

It's kind of a good idea, but the challenge is that it might be difficult to implement.

If you wait some time then I can install podman in a computer and test this PR and let you know what happens.

playday3008 · 2026-03-05T10:34:06Z

It's kind of a good idea, but the challenge is that it might be difficult to implement.

If you wait some time then I can install podman in a computer and test this PR and let you know what happens.

Sure thing, I'm using Podman myself, I don't have Docker, so, for me it was kinda crucial to have this. It's better test whether Docker build still works.

Here I ran package build with new run-docker.sh (which uses Docker)

playday3008 · 2026-03-05T13:13:35Z

For now committed minimal required changes for Podman and Docker to coexist.
Testing Podman locally, and Docker on CI

@robertkirkman You might want to take a look.

playday3008 · 2026-03-05T14:12:15Z

So, locally with Podman works:

Docker in CI works too

playday3008 · 2026-03-06T07:50:06Z

@robertkirkman Hey, have you tried Podman? You said you'd try, haven't heard back, everything ok?

robertkirkman · 2026-03-06T08:41:28Z

I will in a while, currently I am working on PRs related to updating to Python 3.13

TomJo2000

I'm feeling pretty optimistic about this PR.
The changeset is a lot more manageable than I would have initially expected.

I just have a couple style notes.

TomJo2000 · 2026-03-07T17:57:08Z

+# Execute command in container
+if [ "$RUNTIME" = "podman" ]; then
+	$SUDO $RUNTIME exec $CI_OPT \
+		--user root \
+		--env HOME=$CONTAINER_HOME_DIR \
+		--env "DOCKER_EXEC_PID_FILE_PATH=$DOCKER_EXEC_PID_FILE_PATH" \
+		--interactive $DOCKER_TTY \
+		$TERMUX_DOCKER_EXEC_EXTRA_ARGS \
+		$CONTAINER_NAME \
+		"$@"
+else
+	$SUDO $RUNTIME exec $CI_OPT \
+		--env "DOCKER_EXEC_PID_FILE_PATH=$DOCKER_EXEC_PID_FILE_PATH" \
+		--interactive $DOCKER_TTY \
+		$TERMUX_DOCKER_EXEC_EXTRA_ARGS \
+		$CONTAINER_NAME \
+		"$@"
+fi


As mentioned above (Support Podman in run-docker.sh #28785 (comment)) I think the docker handling should be the "happy path" for this condition since that is the expected default runtime.

Same, else should be error, docker should be elif

This would work also here, right?

PODMAN_ARGS= if [ "$RUNTIME" = "podman" ]; then PODMAN_ARGS="--user root --env HOME=$CONTAINER_HOME_DIR" fi $SUDO $RUNTIME exec $CI_OPT \ $PODMAN_ARGS \ --env "DOCKER_EXEC_PID_FILE_PATH=$DOCKER_EXEC_PID_FILE_PATH" \ --interactive $DOCKER_TTY \ $TERMUX_DOCKER_EXEC_EXTRA_ARGS \ $CONTAINER_NAME \ "$@"

playday3008 · 2026-03-07T19:18:57Z

Just in case, I've rerun CI with new changes, to test Docker again.
Also made the same but locally with Podman.

TomJo2000 · 2026-03-07T21:46:11Z

Just in case, I've rerun CI with new changes, to test Docker again. Also made the same but locally with Podman.

You may want to add the -f flag to your package builds to ensure it actually rebuilds the packages instead of just finding that they have been built and skipping them.
That way the same package build codepaths are hit in both tests.

playday3008 · 2026-03-07T21:47:19Z

You may want to add the -f flag to your package builds to ensure it actually rebuilds the packages instead of just finding that they have been built and skipping them.
That way the same package build codepaths are hit in both tests.

That was done intentionally, first run to build, second run to check

TomJo2000 · 2026-03-07T21:52:35Z

Oh I thought one run was with Docker, one was with Podman.
I'm guessing both were with Podman then?

playday3008 · 2026-03-07T21:53:25Z

Oh I thought one run was with Docker, one was with Podman.
I'm guessing both were with Podman then?

Yep, both with Podman, just ran same command twice

TomJo2000 · 2026-03-07T21:53:41Z

Alright that makes sense then.

TomJo2000

This looks good to me at this point.
I do have one more suggestion, but other than that I think this is solid.

playday3008 · 2026-03-11T16:40:12Z

CI rerun
My rerun: Success (I forgot to make screenshot)

robertkirkman · 2026-03-12T05:15:55Z

@robertkirkman Hey, have you tried Podman? You said you'd try, haven't heard back, everything ok?

Sorry, I was busy with other PRs, but now I finally started testing this PR, and the first problem I have encountered is this,

[tacokoneko@archvm termux-packages]$ scripts/run-docker.sh -d ./build-package.sh -I -f grep
Running container 'termux-package-builder' from image 'ghcr.io/termux/package-builder' (runtime: podman)...
Creating new container...
Trying to pull ghcr.io/termux/package-builder:latest...
Getting image source signatures
Copying blob 86dc3f13cb5a done   | 
Copying blob 01d7766a2e4a done   | 
Copying blob d7ed36062ac5 done   | 
Copying blob 4f4fb700ef54 done   | 
Copying blob 08d425d90510 done   | 
Copying blob b9edb339ca66 done   | 
Copying blob c9935a1ae365 done   | 
Copying blob ca4351e57aa9 done   | 
Copying blob de398c4629bd done   | 
Error: unable to copy from source docker://ghcr.io/termux/package-builder:latest: writing blob: adding layer with blob "sha256:01d7766a2e4a62b74e0bebf2cd12c47e675e9221174f6570854203e84ffe68b0"/""/"sha256:efafae78d70c98626c521c246827389128e7d7ea442db31bc433934647f0c791": unpacking failed (error: exit status 1; output: potentially insufficient UIDs or GIDs available in user namespace (requested 0:42 for /etc/gshadow): Check /etc/subuid and /etc/subgid if configured locally and run "podman system migrate": lchown /etc/gshadow: invalid argument)
[tacokoneko@archvm termux-packages]$

Do you happen to know what should be done if this happens? I tried just podman system migrate, but it didn't change anything.

playday3008 · 2026-03-12T06:52:48Z

@robertkirkman Arch Linux user?

Your user likely has no subordinate ID ranges configured. Check:

grep $(whoami) /etc/subuid /etc/subgid

If empty or missing, allocate them:

sudo usermod --add-subuids 100000-165535 --add-subgids 100000-165535 $(whoami)

Then apply changes:

podman system migrate

If the pull still fails, do a full reset (removes all local containers/images):

podman system reset

Then retry scripts/run-docker.sh.

Source: https://wiki.archlinux.org/title/Podman#Rootless_Podman

robertkirkman · 2026-03-12T06:57:45Z

Yes, I am using an Arch Linux Virtual Machine that is able to run regular Docker normally.

Thanks, I tried those commands, but unfortunately for me they don't seem to make a difference:

[tacokoneko@archvm termux-packages]$ grep $(whoami) /etc/subuid /etc/subgid
/etc/subuid:tacokoneko:100000:65536
/etc/subgid:tacokoneko:100000:65536
[tacokoneko@archvm termux-packages]$ sudo usermod --add-subuids 100000-165535 --add-subgids 100000-165535 $(whoami)
[tacokoneko@archvm termux-packages]$ grep $(whoami) /etc/subuid /etc/subgid
/etc/subuid:tacokoneko:100000:65536
/etc/subgid:tacokoneko:100000:65536
[tacokoneko@archvm termux-packages]$ podman system migrate
[tacokoneko@archvm termux-packages]$ grep $(whoami) /etc/subuid /etc/subgid
/etc/subuid:tacokoneko:100000:65536
/etc/subgid:tacokoneko:100000:65536
[tacokoneko@archvm termux-packages]$ podman system reset
WARNING! This will remove:
        - all containers
        - all pods
        - all images
        - all networks
        - all build cache
        - all machines
        - all volumes
        - the graphRoot directory: "/home/tacokoneko/.local/share/containers/storage"
        - the runRoot directory: "/run/user/1000/containers"
Are you sure you want to continue? [y/N] y
[tacokoneko@archvm termux-packages]$ grep $(whoami) /etc/subuid /etc/subgid
/etc/subuid:tacokoneko:100000:65536
/etc/subgid:tacokoneko:100000:65536
[tacokoneko@archvm termux-packages]$ scripts/run-docker.sh -d ./build-package.sh -I -f grep
Running container 'termux-package-builder' from image 'ghcr.io/termux/package-builder' (runtime: podman)...
Creating new container...
Trying to pull ghcr.io/termux/package-builder:latest...
Getting image source signatures
Copying blob 86dc3f13cb5a done   | 
Copying blob 4f4fb700ef54 done   | 
Copying blob b9edb339ca66 done   | 
Copying blob 08d425d90510 done   | 
Copying blob 01d7766a2e4a done   | 
Copying blob d7ed36062ac5 done   | 
Copying blob c9935a1ae365 done   | 
Copying blob ca4351e57aa9 done   | 
Copying blob de398c4629bd done   | 
Error: unable to copy from source docker://ghcr.io/termux/package-builder:latest: writing blob: adding layer with blob "sha256:01d7766a2e4a62b74e0bebf2cd12c47e675e9221174f6570854203e84ffe68b0"/""/"sha256:efafae78d70c98626c521c246827389128e7d7ea442db31bc433934647f0c791": unpacking failed (error: exit status 1; output: potentially insufficient UIDs or GIDs available in user namespace (requested 0:42 for /etc/gshadow): Check /etc/subuid and /etc/subgid if configured locally and run "podman system migrate": lchown /etc/gshadow: invalid argument)
[tacokoneko@archvm termux-packages]$

playday3008 · 2026-03-12T07:24:17Z

@robertkirkman To be honest, I've never used Podman on Arch, I'm using Fedora, which out of box uses Podman, so, I suppose I wouldn't be able help much with on Arch

robertkirkman · 2026-03-12T07:41:17Z

Hmm, I will install a Fedora virtual machine with everything default from this iso and try to reproduce your setup https://download.fedoraproject.org/pub/fedora/linux/releases/43/Workstation/x86_64/iso/Fedora-Workstation-Live-43-1.6.x86_64.iso

robertkirkman · 2026-03-12T08:40:21Z

+			$TERMUX_DOCKER_RUN_EXTRA_ARGS \
+			$TERMUX_BUILDER_IMAGE_NAME
+		__change_builder_uid_gid
+	else


The shared arguments could be written together in a similar way to my other suggestion here also, right?

The remaining concern I have is about the arguments here. The arguments $SUDO, $RUNTIME, run, $RUNTIME_RUN_ARGS, and $TERMUX_BUILDER_IMAGE_NAME are all the same and could be shared, right?

Yes, I'll check it, after testing

Factor shared arguments for `run` and `exec` into RUNTIME_RUN_ARGS and RUNTIME_EXEC_ARGS variables, so each runtime branch only specifies its own flags.

robertkirkman · 2026-03-12T09:37:43Z

When I started using Fedora, Podman immediately started working for basic packages like grep, thanks!

Next, I started testing some of the complicated packages that rely on particular Docker-specific behaviors or features that often prevent them from building outside of Docker.

When I use scripts/run-docker.sh ./build-package.sh -I -f -a arm gnucash in clean installed Fedora with only the preinstalled Podman, I see this:

-- Using guile-3.0.x
CMake Error at common/cmake_modules/GncAddSchemeTargets.cmake:63 (message):
  Could not determine Guile prefix:

  error getting old personality value: Function not implemented

  libc: error getting old personality value: Function not implemented
Call Stack (most recent call first):
  common/cmake_modules/GncAddSchemeTargets.cmake:85 (find_one_guile_dir)
  CMakeLists.txt:409 (find_guile_dirs)


CMake Error at common/cmake_modules/GncAddSchemeTargets.cmake:18 (string):
  string sub-command REGEX, mode REPLACE needs at least 6 arguments total to
  command.
Call Stack (most recent call first):
  common/cmake_modules/GncAddSchemeTargets.cmake:68 (make_unix_path)
  common/cmake_modules/GncAddSchemeTargets.cmake:85 (find_one_guile_dir)
  CMakeLists.txt:409 (find_guile_dirs)

do you happen to know if there's a way Podman can be configured to behave any closer to how Docker behaves, to see if it's able to build the Termux gnucash package?

playday3008 · 2026-03-12T09:47:45Z

I'll try to build gnucash for x86_64 and then arm, if errors any of that, I'll try to fix it

x86_64: done, succeeded
arm: failed, I'll check it

Podman's default seccomp profile only allows personality() with specific argument values. The arg comparison fails for qemu-arm's personality(0xffffffff) call, breaking proot-based cross-compilation (e.g. gnucash's guile dependency). Apply the same custom seccomp profile (profile.json) to both Docker and Podman, and add fchmodat2 to the profile for modern glibc compatibility. Extract the common SEC_OPT setup out of the per-runtime branches.

playday3008 · 2026-03-12T11:21:49Z

@robertkirkman Try again please.

robertkirkman · 2026-03-12T11:50:44Z

@playday3008 Ok, thanks! Now gnucash is building successfully, so it looks like that worked.

Next, I tried this command:

scripts/run-docker.sh ./build-package.sh -I -f -a arm pypy3

and I see this:

151.101.129.227 rubygems.org
151.101.129.227 index.rubygems.org
104.16.11.34 registry.npmjs.org
104.16.1.34 registry.yarnpkg.com
Ability to run this command as root has been disabled permanently for safety purposes.
tacokoneko@localhost-live:~/code/termux-packages$

This is one of the challenging packages. Do you think you can make Podman build this package?

thunder-coding · 2026-03-12T18:11:28Z

                "fchdir",
                "fchmod",
                "fchmodat",
+                "fchmodat2",


This is the default since moby/profiles@91990ca, so just remind me to properly do a diff of profile.json with the older copy in github.com/moby/moby and rebase it against the new location in github.com/moby/profiles once this PR is merged

Running as --user root in the Podman container caused Termux's patched apt (which refuses uid 0) to fail when invoked through proot during cross-compilation builds like pypy3. Switch to explicit --uidmap/--gidmap that maps the host user to the image's builder account (uid/gid 1001). This keeps bind-mount permissions correct while running as non-root inside the container.

playday3008 · 2026-03-12T19:40:51Z

@robertkirkman Supposedly fixed

playday3008 · 2026-03-12T20:03:28Z

Packages: gnucash, pypy3, dotnet-host, dotnet10.0, netstandard-targeting-pack-2.1

CI rerun
My runs:
- x86_64: Succeeded
- arm: Succeeded

playday3008 · 2026-03-12T20:18:07Z

I have so many questions

robertkirkman · 2026-03-12T20:30:35Z

I know it's a "mandelbrot fractal", but I don't know why it's there.

Yes, it seems like this is building packages very well now! Good job!

playday3008 · 2026-03-12T20:33:30Z

I know that as well, but how it's in any way used in/helpful for pypy3 compilation is the real question for me

playday3008 · 2026-03-12T20:37:24Z

Oh my god, I like it so much: https://stackoverflow.com/questions/21708359/whats-the-output-during-pypy-build-means

playday3008 · 2026-03-12T21:57:50Z

@robertkirkman Runs and builds fine

playday3008 requested review from Grimler91 and thunder-coding as code owners March 5, 2026 10:13

playday3008 force-pushed the feat/podman-support branch from 8a4b55f to 140423d Compare March 5, 2026 10:24

robertkirkman self-requested a review March 5, 2026 10:29

robertkirkman reviewed Mar 5, 2026

View reviewed changes

Comment thread scripts/utils/docker/docker.sh Outdated

playday3008 force-pushed the feat/podman-support branch from 140423d to c81fa2a Compare March 5, 2026 13:12

robertkirkman reviewed Mar 5, 2026

View reviewed changes

Comment thread scripts/run-docker.sh Outdated

playday3008 force-pushed the feat/podman-support branch from 9f54f7e to 2100868 Compare March 5, 2026 13:56

TomJo2000 reviewed Mar 7, 2026

View reviewed changes

playday3008 force-pushed the feat/podman-support branch from 1a6fddf to c174789 Compare March 7, 2026 19:16

TomJo2000 approved these changes Mar 8, 2026

View reviewed changes

Comment thread scripts/run-docker.sh

robertkirkman reviewed Mar 9, 2026

View reviewed changes

Comment thread scripts/utils/docker/docker.sh Outdated

thunder-coding reviewed Mar 9, 2026

View reviewed changes

Comment thread scripts/run-docker.sh

playday3008 force-pushed the feat/podman-support branch from 577109b to 513d276 Compare March 11, 2026 16:28

robertkirkman reviewed Mar 12, 2026

View reviewed changes

playday3008 added 4 commits March 12, 2026 10:24

scripts(run-docker): add podman runtime support

45bb486

scripts(run-docker): better superuser detection

b77d7d5

scripts(run-docker): style cleanup and explicit runtime guards

3ce5558

scripts(run-docker): add run0 as privilege escalation fallback

15f5c63

playday3008 force-pushed the feat/podman-support branch from 513d276 to 15f5c63 Compare March 12, 2026 09:24

scripts(run-docker): extract common runtime run/exec arguments

1c9db49

Factor shared arguments for `run` and `exec` into RUNTIME_RUN_ARGS and RUNTIME_EXEC_ARGS variables, so each runtime branch only specifies its own flags.

robertkirkman reviewed Mar 12, 2026

View reviewed changes

Comment thread scripts/run-docker.sh Outdated

playday3008 requested a review from licy183 as a code owner March 12, 2026 11:21

thunder-coding reviewed Mar 12, 2026

View reviewed changes

Uh oh!

Conversation

playday3008 commented Mar 5, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

robertkirkman commented Mar 5, 2026

Uh oh!

playday3008 commented Mar 5, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

Uh oh!

playday3008 commented Mar 5, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

Uh oh!

playday3008 commented Mar 5, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

playday3008 commented Mar 6, 2026

Uh oh!

robertkirkman commented Mar 6, 2026

Uh oh!

TomJo2000 left a comment

Choose a reason for hiding this comment

Uh oh!

Uh oh!

Uh oh!

Uh oh!

TomJo2000 Mar 7, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Choose a reason for hiding this comment

Uh oh!

playday3008 Mar 7, 2026

Choose a reason for hiding this comment

Uh oh!

robertkirkman Mar 12, 2026

Choose a reason for hiding this comment

Uh oh!

Uh oh!

playday3008 commented Mar 7, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

TomJo2000 commented Mar 7, 2026

Uh oh!

playday3008 commented Mar 7, 2026

Uh oh!

TomJo2000 commented Mar 7, 2026

Uh oh!

playday3008 commented Mar 7, 2026

Uh oh!

TomJo2000 commented Mar 7, 2026

Uh oh!

TomJo2000 left a comment

Choose a reason for hiding this comment

Uh oh!

Uh oh!

Uh oh!

Uh oh!

playday3008 commented Mar 11, 2026

Uh oh!

robertkirkman commented Mar 12, 2026

Uh oh!

playday3008 commented Mar 12, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

robertkirkman commented Mar 12, 2026

Uh oh!

playday3008 commented Mar 12, 2026

Uh oh!

robertkirkman commented Mar 12, 2026

Uh oh!

robertkirkman Mar 12, 2026

Choose a reason for hiding this comment

Uh oh!

robertkirkman Mar 12, 2026

Choose a reason for hiding this comment

Uh oh!

playday3008 Mar 12, 2026

Choose a reason for hiding this comment

Uh oh!

playday3008 commented Mar 5, 2026 •

edited

Loading

playday3008 commented Mar 5, 2026 •

edited

Loading

playday3008 commented Mar 5, 2026 •

edited

Loading

playday3008 commented Mar 5, 2026 •

edited

Loading

TomJo2000 Mar 7, 2026 •

edited

Loading

playday3008 commented Mar 7, 2026 •

edited

Loading

playday3008 commented Mar 12, 2026 •

edited

Loading

playday3008 commented Mar 12, 2026 •

edited

Loading

thunder-coding Mar 12, 2026 •

edited

Loading

playday3008 commented Mar 12, 2026 •

edited

Loading