You signed in with another tab or window. Reload to refresh your session.You signed out in another tab or window. Reload to refresh your session.You switched accounts on another tab or window. Reload to refresh your session.Dismiss alert
Now that OpenLambda uses cgroups v2 it should be possible to run it not as the root-user. That should make testing easier and also prevent some potential attacks.
This might be a fun "first issue" for someone new to the project.
Tried running ol worker init without sudo in GitHub Codespaces (cgroups v2). After relaxing the sudo checks for init + cgroup pool ownership, init still fails in initOLBaseDir when creating /dev nodes:
mknod ... Operation not permitted (even after creating the dev/ directory).
So beyond cgroups delegation, rootless support also needs an alternative to mknod during base extraction, e.g.:
bind-mount host /dev/{null,random,urandom} into the base, or
skip device creation and rely on existing nodes in the extracted image (if present), or
gate this step behind a “root-required” path and document it.
Repro (Codespaces):
make ol imgs/ol-min
./ol worker init -p myworker -i ol-min -> fails at mknod with EPERM
Activity
adajani commentedon Aug 16, 2025
I have opend a pull request to run Openlambda as regular user.
yiquanlin212 commentedon Mar 3, 2026
Tried running
ol worker initwithout sudo in GitHub Codespaces (cgroups v2). After relaxing the sudo checks for init + cgroup pool ownership, init still fails ininitOLBaseDirwhen creating /dev nodes:mknod ... Operation not permitted(even after creating the dev/ directory).So beyond cgroups delegation, rootless support also needs an alternative to
mknodduring base extraction, e.g.:/dev/{null,random,urandom}into the base, orRepro (Codespaces):
make ol imgs/ol-min./ol worker init -p myworker -i ol-min-> fails atmknodwith EPERM