From 1d9490931696d75960ffaef6f549d4178278d12d Mon Sep 17 00:00:00 2001 From: Nick Vigilante Date: Thu, 13 Aug 2026 05:36:19 +0000 Subject: [PATCH 1/3] docs(docs/admin/templates/extending-templates): fix broken template examples Fixes example drift found in the DOCS-637 sweep (verified against main and the CLI): - dynamic-parameters: the Dynamic Validation snippet referenced an undefined `show_cpu_cores` via a stray `count` line copied from the Hide/Show Options example, failing `terraform validate` standalone. Remove the `count` line so the snippet is self-contained and on-topic. - docker-in-workspaces: `echo "kubernetes-with-podman" | coder templates init` used a template id that is not a built-in starter, so the command never scaffolds anything. The linked template is a community template, so clone coder/community-templates and create from its kubernetes-podman directory instead. Excludes the external-auth.md dangling "See" sentence (third item in the issue): the correct link target needs a decision, handled separately. > This PR was created with AI assistance (Coder Agents). --- .../templates/extending-templates/docker-in-workspaces.md | 4 ++-- .../admin/templates/extending-templates/dynamic-parameters.md | 3 --- 2 files changed, 2 insertions(+), 5 deletions(-) diff --git a/docs/admin/templates/extending-templates/docker-in-workspaces.md b/docs/admin/templates/extending-templates/docker-in-workspaces.md index 22f7ad709fc..2ad9b7eb27b 100644 --- a/docs/admin/templates/extending-templates/docker-in-workspaces.md +++ b/docs/admin/templates/extending-templates/docker-in-workspaces.md @@ -252,8 +252,8 @@ Before using Podman, please review the following documentation: example template, or make your own. ```sh - echo "kubernetes-with-podman" | coder templates init - cd ./kubernetes-with-podman + git clone https://github.com/coder/community-templates + cd community-templates/kubernetes-podman coder templates create ``` diff --git a/docs/admin/templates/extending-templates/dynamic-parameters.md b/docs/admin/templates/extending-templates/dynamic-parameters.md index 6d0e47ed999..5e415cec9b5 100644 --- a/docs/admin/templates/extending-templates/dynamic-parameters.md +++ b/docs/admin/templates/extending-templates/dynamic-parameters.md @@ -526,9 +526,6 @@ data "coder_parameter" "git_repo" { } data "coder_parameter" "cpu_cores" { - # Only show this parameter if the previous box is selected. - count = data.coder_parameter.show_cpu_cores.value ? 1 : 0 - name = "cpu_cores" display_name = "CPU Cores" type = "number" From 883da90218b3f34b308046860c472717391d32a0 Mon Sep 17 00:00:00 2001 From: Nick Vigilante Date: Fri, 14 Aug 2026 17:33:00 +0000 Subject: [PATCH 2/3] docs(docs/admin/templates/extending-templates): base rootless podman example on kubernetes starter --- .../docker-in-workspaces.md | 59 +++++++++++++++++-- 1 file changed, 53 insertions(+), 6 deletions(-) diff --git a/docs/admin/templates/extending-templates/docker-in-workspaces.md b/docs/admin/templates/extending-templates/docker-in-workspaces.md index 2ad9b7eb27b..6c7e16acb78 100644 --- a/docs/admin/templates/extending-templates/docker-in-workspaces.md +++ b/docs/admin/templates/extending-templates/docker-in-workspaces.md @@ -247,14 +247,61 @@ Before using Podman, please review the following documentation: 3. For systems running SELinux (typically Fedora-, CentOS-, and Red Hat-based systems), you might need to disable SELinux or set it to permissive mode. -4. Use this - [kubernetes-with-podman](https://github.com/coder/community-templates/tree/main/kubernetes-podman) - example template, or make your own. +4. Create a template from the built-in `kubernetes` starter, then adapt it for + rootless Podman: ```sh - git clone https://github.com/coder/community-templates - cd community-templates/kubernetes-podman - coder templates create + coder templates init --id kubernetes ./kubernetes-podman + cd ./kubernetes-podman + ``` + + The `kubernetes` starter already runs the workspace pod as a non-root user + (`run_as_user = 1000`, `fs_group = 1000`, `run_as_non_root = true`), which + rootless Podman requires. In the generated `main.tf`, apply the Podman + changes to the `kubernetes_deployment_v1.main` pod template (marked + `# Podman` below): + + ```tf + spec { + template { + metadata { + # ... + # Podman: allow Podman to create nested containers. The annotation + # key must match the container name below (`dev`). + annotations = { + "container.apparmor.security.beta.kubernetes.io/dev" = "unconfined" + } + } + spec { + # The starter already sets these; rootless Podman requires them. + security_context { + run_as_user = 1000 + fs_group = 1000 + run_as_non_root = true + } + + container { + name = "dev" + # Podman: base image with Podman and fuse-overlayfs preinstalled. + image = "ghcr.io/coder/podman:ubuntu" + # ... + resources { + limits = { + # ... + # Podman: FUSE device exposed by smarter-device-manager (step 1). + "github.com/fuse" = "1" + } + } + } + } + } + } + ``` + + Push the template to your deployment: + + ```sh + coder templates push ``` > For more information around the requirements of rootless podman pods, see: From b2e6ffd5913b89d3343b4c6d8a2d2ddd3183ed2c Mon Sep 17 00:00:00 2001 From: Nick Vigilante Date: Fri, 14 Aug 2026 20:57:28 +0000 Subject: [PATCH 3/3] docs(docs/admin/templates/extending-templates): apply review feedback on podman example Collapse the two wrapped prose sentences in step 4 onto single lines and reword the main.tf pointer from "below" to "in the following snippet". --- .../extending-templates/docker-in-workspaces.md | 9 ++------- 1 file changed, 2 insertions(+), 7 deletions(-) diff --git a/docs/admin/templates/extending-templates/docker-in-workspaces.md b/docs/admin/templates/extending-templates/docker-in-workspaces.md index 6c7e16acb78..9ca7e785565 100644 --- a/docs/admin/templates/extending-templates/docker-in-workspaces.md +++ b/docs/admin/templates/extending-templates/docker-in-workspaces.md @@ -247,19 +247,14 @@ Before using Podman, please review the following documentation: 3. For systems running SELinux (typically Fedora-, CentOS-, and Red Hat-based systems), you might need to disable SELinux or set it to permissive mode. -4. Create a template from the built-in `kubernetes` starter, then adapt it for - rootless Podman: +4. Create a template from the built-in `kubernetes` starter, then adapt it for rootless Podman: ```sh coder templates init --id kubernetes ./kubernetes-podman cd ./kubernetes-podman ``` - The `kubernetes` starter already runs the workspace pod as a non-root user - (`run_as_user = 1000`, `fs_group = 1000`, `run_as_non_root = true`), which - rootless Podman requires. In the generated `main.tf`, apply the Podman - changes to the `kubernetes_deployment_v1.main` pod template (marked - `# Podman` below): + The `kubernetes` starter already runs the workspace pod as a non-root user (`run_as_user = 1000`, `fs_group = 1000`, `run_as_non_root = true`), which rootless Podman requires. In the generated `main.tf`, apply the Podman changes to the `kubernetes_deployment_v1.main` pod template (marked `# Podman` in the following snippet): ```tf spec {