feat(kubernetes): support OpenShift restricted SCC via AGENT_SECURITY_CONTEXT

.github/workflows/pr-ci.yml

@@ -415,6 +415,12 @@ jobs:
             install-kind: true
             requires-secret: false
 
+          - label: up-provider-kubernetes-restricted-scc
+            runner: ubuntu-latest
+            free-disk-space: true
+            install-kind: true
+            requires-secret: false
+
           - label: up-provider-podman-rootless-basic
             runner: ubuntu-latest
             free-disk-space: false
@@ -702,7 +708,7 @@ jobs:
         uses: actions/cache@55cc8345863c7cc4c66a329aec7e433d2d1c52a9 # v6.1.0
         with:
           path: ${{ runner.temp }}/kind.exe
-          key: ${{ runner.os }}-${{ runner.arch }}-kind-v0.24.0
+          key: ${{ runner.os }}-${{ runner.arch }}-kind-v0.33.0
 
       - name: setup kind (Windows)
         if: matrix.install-kind == true && runner.os == 'Windows' && (matrix.requires-secret == false || needs.can-read-secret.outputs.secret-set == 'true')
@@ -712,8 +718,8 @@ jobs:
           DOCKER_HOST: npipe:////./pipe/podman-machine-default
         run: |
           if [ "${{ steps.kind-cache-windows.outputs.cache-hit }}" != "true" ]; then
-            curl -Lo "$RUNNER_TEMP/kind.exe" "https://github.com/kubernetes-sigs/kind/releases/download/v0.24.0/kind-windows-amd64"
-            expected="6f724188289cc79395f45afae0f2b85e0d220c2b84c6ed2f5047d9d0c9a67028"
+            curl -Lo "$RUNNER_TEMP/kind.exe" "https://github.com/kubernetes-sigs/kind/releases/download/v0.33.0/kind-windows-amd64"
+            expected="4b22adaa135368c5a465d56bbd8e520cbea87272a06ca00b6078e7b81515c9fc"
             actual=$(sha256sum "$RUNNER_TEMP/kind.exe" | awk '{print $1}' | sed 's/^[^a-f0-9]*//')
             if [ "$actual" != "$expected" ]; then
               echo "SHA256 mismatch for kind.exe! Expected: $expected, Got: $actual"
@@ -726,16 +732,16 @@ jobs:
           echo "$RUNNER_TEMP" >> "$GITHUB_PATH"
 
           CLUSTER_NAME=$(python -c "import uuid; print(uuid.uuid4().hex)")
-          kind create cluster --name "$CLUSTER_NAME" --image kindest/node:v1.34.0@sha256:7416a61b42b1662ca6ca89f02028ac133a309a2a30ba309614e8ec94d976dc5a
+          kind create cluster --name "$CLUSTER_NAME" --image kindest/node:v1.36.4@sha256:099e049362a1526b2db71494e1947aae99bd16290d7c895f2b7ea312e3cbfaed
 
       # NOTE: skevetter/setup-kind does not work on Windows runners
       - name: setup kind
         if: matrix.install-kind == true && runner.os != 'Windows' && (matrix.requires-secret == false || needs.can-read-secret.outputs.secret-set == 'true')
         uses: skevetter/setup-kind@7febac2ed35df332069b3bb687c6b1fa00fc0883 # v1
         with:
           name: ${{ steps.uuid.outputs.result }}
-          version: v0.24.0
-          image: kindest/node:v1.34.0@sha256:7416a61b42b1662ca6ca89f02028ac133a309a2a30ba309614e8ec94d976dc5a
+          version: v0.33.0
+          image: kindest/node:v1.36.4@sha256:099e049362a1526b2db71494e1947aae99bd16290d7c895f2b7ea312e3cbfaed
           skipClusterLogsExport: true
 
       - name: cache podman installer (Linux)

Taskfile.yml

@@ -144,7 +144,45 @@ tasks:
 
   cli:test:e2e:kind:setup:
     desc: setup kind cluster for e2e tests
-    cmd: kind create cluster --image kindest/node:v1.34.0@sha256:7416a61b42b1662ca6ca89f02028ac133a309a2a30ba309614e8ec94d976dc5a
+    cmd: |
+      kind_version="$(kind version -q)"
+      kind_version="${kind_version#v}"
+      kind_major="${kind_version%%.*}"
+      kind_minor_patch="${kind_version#*.}"
+      kind_minor="${kind_minor_patch%%.*}"
+      kind_patch="${kind_minor_patch#*.}"
+      kind_version_valid=true
+      case "$kind_version" in
+        *.*.*) ;;
+        *) kind_version_valid=false ;;
+      esac
+      case "$kind_major" in
+        ''|*[!0-9]*) kind_version_valid=false ;;
+      esac
+      case "$kind_minor" in
+        ''|*[!0-9]*) kind_version_valid=false ;;
+      esac
+      case "$kind_patch" in
+        ''|*[!0-9]*) kind_version_valid=false ;;
+      esac
+      if [ "$kind_version_valid" != true ]; then
+        echo "kind v0.33.0 or newer is required for Kubernetes v1.36.4 (found $kind_version)" >&2
+        exit 1
+      fi
+      case "$kind_major" in
+        0)
+          if [ "$kind_minor" -lt 33 ]; then
+            echo "kind v0.33.0 or newer is required for Kubernetes v1.36.4 (found $kind_version)" >&2
+            exit 1
+          fi
+          ;;
+        [1-9]|[1-9][0-9]*) ;;
+        *)
+          echo "kind v0.33.0 or newer is required for Kubernetes v1.36.4 (found $kind_version)" >&2
+          exit 1
+          ;;
+      esac
+      kind create cluster --image kindest/node:v1.36.4@sha256:099e049362a1526b2db71494e1947aae99bd16290d7c895f2b7ea312e3cbfaed
 
   cli:test:e2e:kind:teardown:
     desc: teardown kind cluster for e2e tests

cmd/internal/agentcontainer/setup.go

@@ -229,6 +229,7 @@ func (cmd *SetupContainerCmd) prepareWorkspace(
 	cleanupFunc := cmd.setupGitCredentials(
 		ctx,
 		state.tunnelClient,
+		config.GetRemoteUser(state.setupInfo),
 	)
 
 	cloneErr := cmd.cloneRepositoryIfNeeded(
@@ -520,6 +521,7 @@ func skipSnapshotRestore(target string) bool {
 func (cmd *SetupContainerCmd) setupGitCredentials(
 	ctx context.Context,
 	tunnelClient tunnel.TunnelClient,
+	remoteUser string,
 ) func() {
 	if !cmd.InjectGitCredentials {
 		return nil
@@ -531,7 +533,11 @@ func (cmd *SetupContainerCmd) setupGitCredentials(
 	}
 
 	cancelCtx, cancel := context.WithCancel(ctx)
-	cleanupFunc, err := configureSystemGitCredentials(cancelCtx, tunnelClient)
+	cleanupFunc, err := configureSystemGitCredentials(
+		cancelCtx,
+		tunnelClient,
+		remoteUser,
+	)
 	if err != nil {
 		cancel()
 		log.Errorf("error configuring git credentials: %v", err)
@@ -701,7 +707,6 @@ func (cmd *SetupContainerCmd) installIDE(
 	if newServer, ok := jetbrainsServers[ide.Name]; ok {
 		return newServer(config.GetRemoteUser(setupInfo), ide.Options).Install(setupInfo)
 	}
-
 	switch ide.Name {
 	case string(config2.IDENone):
 		return nil
@@ -871,11 +876,8 @@ func (cmd *SetupContainerCmd) startBrowserExtensionsInstall(
 func configureSystemGitCredentials(
 	ctx context.Context,
 	client tunnel.TunnelClient,
+	remoteUser string,
 ) (func(), error) {
-	if !command.Exists("git") {
-		return nil, errors.New("git not found")
-	}
-
 	serverPort, err := credentials.StartCredentialsServer(ctx, client)
 	if err != nil {
 		return nil, err
@@ -894,20 +896,77 @@ func configureSystemGitCredentials(
 	_ = os.Setenv(config2.EnvGitHelperPort, strconv.Itoa(serverPort))
 
 	gitConfig := git.At("", git.WithStrictHostKeyChecking(false)).Config()
-	if err = gitConfig.Add(ctx, "credential.helper", gitCredentials, git.ScopeSystem); err != nil {
-		return nil, fmt.Errorf("add git credential helper: %w", err)
+	gitConfig, scope, err := addGitCredentialHelper(
+		ctx,
+		gitConfig,
+		gitCredentials,
+		remoteUser,
+	)
+	if err != nil {
+		return nil, err
 	}
 
 	cleanup := func() {
-		log.Debug("unset setup system credential helper")
-		if err = gitConfig.Unset(ctx, "credential.helper", git.ScopeSystem); err != nil {
-			log.Errorf("unset system credential helper %v", err)
+		log.Debug("unset setup credential helper")
+		if err = gitConfig.UnsetValue(ctx, "credential.helper", gitCredentials, scope); err != nil {
+			log.Errorf("unset credential helper %v", err)
 		}
 	}
 
 	return cleanup, nil
 }
 
+// addGitCredentialHelper installs the credential helper system-wide
+// (/etc/gitconfig) so it applies regardless of which local user's git
+// invocation picks it up. A container's remoteUser can differ from the
+// process configuring it. Falls back to remoteUser's global config
+// when /etc/gitconfig is not writable (e.g. a non-root OpenShift-style pod
+// running as a single fixed UID, where that multi-user concern doesn't
+// apply), returning the config and scope actually used so the caller unsets
+// the same one.
+func addGitCredentialHelper(
+	ctx context.Context,
+	gitConfig *git.Config,
+	value string,
+	remoteUser string,
+) (*git.Config, git.ConfigScope, error) {
+	err := gitConfig.Add(ctx, "credential.helper", value, git.ScopeSystem)
+	if err == nil {
+		return gitConfig, git.ScopeSystem, nil
+	}
+	if !isGitPermissionDenied(err) {
+		return nil, git.ConfigScope{}, fmt.Errorf("add git credential helper: %w", err)
+	}
+
+	homeDir, err := command.GetHome(remoteUser)
+	if err != nil {
+		return nil, git.ConfigScope{}, fmt.Errorf(
+			"resolve remote user home for git credentials: %w",
+			err,
+		)
+	}
+	log.Debugf("system git config is not writable, falling back to %s's global config", remoteUser)
+	globalGitConfig := git.At(
+		"",
+		git.WithStrictHostKeyChecking(false),
+		git.WithEnv([]string{
+			"HOME=" + homeDir,
+			"XDG_CONFIG_HOME=" + filepath.Join(homeDir, ".config"),
+		}),
+	).Config()
+	if err := globalGitConfig.Add(ctx, "credential.helper", value, git.ScopeGlobal); err != nil {
+		return nil, git.ConfigScope{}, fmt.Errorf("add git credential helper: %w", err)
+	}
+	return globalGitConfig, git.ScopeGlobal, nil
+}
+
+func isGitPermissionDenied(err error) bool {
+	var cmdErr *git.CommandError
+	return errors.As(err, &cmdErr) &&
+		(strings.Contains(cmdErr.Stderr, "Permission denied") ||
+			strings.Contains(cmdErr.Stderr, "Read-only file system"))
+}
+
 func streamMount(
 	ctx context.Context,
 	workspaceInfo *provider2.ContainerWorkspaceInfo,

cmd/internal/agentcontainer/setup_test.go

@@ -7,10 +7,18 @@ import (
 	"path/filepath"
 	"testing"
 
+	"github.com/devsy-org/devsy/pkg/git"
 	"github.com/stretchr/testify/assert"
 	"github.com/stretchr/testify/require"
 )
 
+func TestIsGitPermissionDenied_ReadOnlyFileSystem(t *testing.T) {
+	err := &git.CommandError{
+		Stderr: "fatal: could not write config: Read-only file system",
+	}
+	require.True(t, isGitPermissionDenied(err))
+}
+
 func TestSkipSnapshotRestore_EmptyDir(t *testing.T) {
 	dir := t.TempDir()
 	assert.False(t, skipSnapshotRestore(dir))

cmd/internal/container_tunnel.go

@@ -113,11 +113,13 @@ func (cmd *ContainerTunnelCmd) Run(cobraCtx context.Context) error {
 				Stderr:  stderr,
 			})
 		},
-		User:    cmd.User,
-		Stdin:   os.Stdin,
-		Stdout:  os.Stdout,
-		Stderr:  os.Stderr,
-		Timeout: workspaceInfo.InjectTimeout,
+		User:            cmd.User,
+		Stdin:           os.Stdin,
+		Stdout:          os.Stdout,
+		Stderr:          os.Stderr,
+		Timeout:         workspaceInfo.InjectTimeout,
+		RemoteAgentPath: workspaceInfo.Agent.ContainerInstallPath(),
+		DownloadURL:     workspaceInfo.Agent.DownloadURL,
 	})
 }
 
@@ -188,7 +190,7 @@ func hasDevContainerResult(ctx context.Context, runner devcontainer.Runner) bool
 	var buf bytes.Buffer
 	err := runner.Command(ctx, devcontainer.CommandParams{
 		User:    containerRootUser,
-		Command: "cat " + pkgconfig.DevContainerResultPath,
+		Command: pkgconfig.ReadDevContainerResultCommand(),
 		Stdout:  &buf,
 		Stderr:  &buf,
 	})

cmd/workspace/ssh.go

@@ -440,7 +440,7 @@ func (cmd *SSHCmd) startTunnel(
 	workdir := resolveWorkdir(cmd.WorkDir, workspaceClient)
 
 	log.Debugf("run outer container tunnel")
-	command := cmd.buildSSHServerCommand(workdir)
+	command := cmd.buildSSHServerCommand(workdir, resolveAgentConfig(workspaceClient))
 
 	envVars, err := cmd.retrieveEnVars()
 	if err != nil {
@@ -468,6 +468,21 @@ func (cmd *SSHCmd) startTunnel(
 	})
 }
 
+// resolveAgentConfig returns the workspace's agent config when workspaceClient
+// exposes it, or a zero value otherwise.
+func resolveAgentConfig(workspaceClient client2.BaseWorkspaceClient) provider.ProviderAgentConfig {
+	full, ok := workspaceClient.(client2.WorkspaceClient)
+	if !ok {
+		return provider.ProviderAgentConfig{}
+	}
+	_, agentInfo, err := full.AgentInfo(provider.CLIOptions{})
+	if err != nil {
+		log.Debugf("resolve agent info: %v", err)
+		return provider.ProviderAgentConfig{}
+	}
+	return agentInfo.Agent
+}
+
 // setupTunnelWriter wires up the JSON log pipe and GPG agent tunnel shared by
 // both tunnel modes. buildSSHServerCommand runs `devsy internal ssh-server`,
 // which always logs structured JSON on stderr; PipeJSONStream re-emits each
@@ -556,9 +571,12 @@ func (cmd *SSHCmd) startTunnelServices(
 	go cmd.startServices(ctx, devsyConfig, containerClient, workspaceClient.WorkspaceConfig(), opts)
 }
 
-func (cmd *SSHCmd) buildSSHServerCommand(workdir string) string {
+func (cmd *SSHCmd) buildSSHServerCommand(
+	workdir string,
+	agent provider.ProviderAgentConfig,
+) string {
 	commandArgs := []string{
-		config.ContainerDevsyHelperLocation,
+		agent.ContainerInstallPath(),
 		"internal",
 		"ssh-server",
 		names.Flag(names.TrackActivity),
@@ -578,7 +596,7 @@ func (cmd *SSHCmd) buildSSHServerCommand(workdir string) string {
 		commandArgs = append(commandArgs, names.Flag(names.Debug))
 	}
 	command := shellescape.QuoteCommand(commandArgs)
-	if cmd.User != "" && cmd.User != "root" {
+	if cmd.User != "" && cmd.User != "root" && !agent.RunsFixedNonRootUser() {
 		command = shellescape.QuoteCommand([]string{"su", "-c", command, cmd.User})
 	}
 	return command

e2e/README.md

@@ -14,10 +14,11 @@ BUILDDIR=bin SRCDIR=".." ../hack/build-e2e.sh
 
 #### Kubernetes Tests Setup
 
-For tests that require Kubernetes (labeled with `up-kubernetes` or `build`), you need to set up a kind cluster:
+For Kubernetes tests, Kind v0.33.0 or newer is required for the Kubernetes v1.36.4 node image. The setup task enforces this prerequisite automatically.
 
+For tests that require Kubernetes (labeled with `up-kubernetes` or `build`), you need to set up a kind cluster:
 ```bash
-kind create cluster --image kindest/node:v1.34.0@sha256:7416a61b42b1662ca6ca89f02028ac133a309a2a30ba309614e8ec94d976dc5a
+kind create cluster --image kindest/node:v1.36.4@sha256:099e049362a1526b2db71494e1947aae99bd16290d7c895f2b7ea312e3cbfaed
 ```
 
 To delete the cluster after testing:

e2e/framework/types.go

@@ -11,8 +11,16 @@ type Pod struct {
 
 type PodSpec struct {
 	Containers []PodContainer `json:"containers,omitempty"`
+	HostUsers  *bool          `json:"hostUsers,omitempty"`
 }
 
 type PodContainer struct {
-	Image string `json:"image,omitempty"`
+	Image           string           `json:"image,omitempty"`
+	SecurityContext *SecurityContext `json:"securityContext,omitempty"`
+}
+
+type SecurityContext struct {
+	RunAsUser    *int64 `json:"runAsUser,omitempty"`
+	RunAsGroup   *int64 `json:"runAsGroup,omitempty"`
+	RunAsNonRoot *bool  `json:"runAsNonRoot,omitempty"`
 }

e2e/tests/up/helper.go

@@ -16,7 +16,11 @@ import (
 	"github.com/onsi/ginkgo/v2"
 )
 
-const secretCmd = "secret"
+const (
+	secretCmd   = "secret"
+	cmdSSH      = "ssh"
+	flagCommand = "--command"
+)
 
 // useFileSecretsBackend forces the file backend so tests do not depend on an OS
 // keyring (unavailable in CI); env is restored on cleanup.
@@ -72,7 +76,7 @@ func (btc *baseTestContext) execSSHCapture(
 ) (string, error) {
 	output, _, err := btc.f.ExecCommandCapture(
 		ctx,
-		[]string{"workspace", "ssh", "--command", command, projectName},
+		[]string{cmdWorkspace, cmdSSH, flagCommand, command, projectName},
 	)
 	return strings.TrimSpace(output), err
 }