diff --git a/docs/admin/templates/extending-templates/docker-in-workspaces.md b/docs/admin/templates/extending-templates/docker-in-workspaces.md index 22f7ad709fcb7..9ca7e78556589 100644 --- a/docs/admin/templates/extending-templates/docker-in-workspaces.md +++ b/docs/admin/templates/extending-templates/docker-in-workspaces.md @@ -247,14 +247,56 @@ Before using Podman, please review the following documentation: 3. For systems running SELinux (typically Fedora-, CentOS-, and Red Hat-based systems), you might need to disable SELinux or set it to permissive mode. -4. Use this - [kubernetes-with-podman](https://github.com/coder/community-templates/tree/main/kubernetes-podman) - example template, or make your own. +4. Create a template from the built-in `kubernetes` starter, then adapt it for rootless Podman: ```sh - echo "kubernetes-with-podman" | coder templates init - cd ./kubernetes-with-podman - coder templates create + coder templates init --id kubernetes ./kubernetes-podman + cd ./kubernetes-podman + ``` + + The `kubernetes` starter already runs the workspace pod as a non-root user (`run_as_user = 1000`, `fs_group = 1000`, `run_as_non_root = true`), which rootless Podman requires. In the generated `main.tf`, apply the Podman changes to the `kubernetes_deployment_v1.main` pod template (marked `# Podman` in the following snippet): + + ```tf + spec { + template { + metadata { + # ... + # Podman: allow Podman to create nested containers. The annotation + # key must match the container name below (`dev`). + annotations = { + "container.apparmor.security.beta.kubernetes.io/dev" = "unconfined" + } + } + spec { + # The starter already sets these; rootless Podman requires them. + security_context { + run_as_user = 1000 + fs_group = 1000 + run_as_non_root = true + } + + container { + name = "dev" + # Podman: base image with Podman and fuse-overlayfs preinstalled. + image = "ghcr.io/coder/podman:ubuntu" + # ... + resources { + limits = { + # ... + # Podman: FUSE device exposed by smarter-device-manager (step 1). + "github.com/fuse" = "1" + } + } + } + } + } + } + ``` + + Push the template to your deployment: + + ```sh + coder templates push ``` > For more information around the requirements of rootless podman pods, see: diff --git a/docs/admin/templates/extending-templates/dynamic-parameters.md b/docs/admin/templates/extending-templates/dynamic-parameters.md index 6d0e47ed999d2..5e415cec9b5f1 100644 --- a/docs/admin/templates/extending-templates/dynamic-parameters.md +++ b/docs/admin/templates/extending-templates/dynamic-parameters.md @@ -526,9 +526,6 @@ data "coder_parameter" "git_repo" { } data "coder_parameter" "cpu_cores" { - # Only show this parameter if the previous box is selected. - count = data.coder_parameter.show_cpu_cores.value ? 1 : 0 - name = "cpu_cores" display_name = "CPU Cores" type = "number"