Add nested podman Dockerfile variant

[petr-muller]

Adds a separate Dockerfile (images/Dockerfile.nested-podman) and entrypoint
script that enable running podman commands inside CI containers. The setup
mirrors the upstream ci/nested-podman image configuration from
openshift/release: installs podman, shadow-utils, and fuse-overlayfs, sets up
rootless podman permissions (setcap, subuid/subgid), and uses catatonit as
init process chaining through an entrypoint script that configures podman
storage and user namespaces at container startup.

Summary by CodeRabbit

• New Features
  • Added a new container image tailored for running Podman in nested, rootless environments.
  • Introduced a containerized Claude CLI experience with a non-root default user and safer startup configuration.
  • Added an entrypoint that auto-initializes container registry and storage settings, and sets up user/subuid mappings needed for rootless compatibility.

[coderabbitai]

No actionable comments were generated in the recent review. 🎉

ℹ️ Recent review info

⚙️ Run configuration

Configuration used: Path: .coderabbit.yaml

Review profile: CHILL

Plan: Enterprise

Run ID: 46571bfd-7f56-4e9d-99a8-8d7b89f2006e

📥 Commits

Reviewing files that changed from the base of the PR and between 41f66ff and e3ad6f9.

📒 Files selected for processing (2)

• images/Dockerfile.nested-podman
• images/nested-podman-entrypoint.sh

🚧 Files skipped from review as they are similar to previous changes (2)

• images/nested-podman-entrypoint.sh
• images/Dockerfile.nested-podman

---

Walkthrough

Adds a nested-Podman container image and startup script. The Dockerfile sets up packages, users, capabilities, and entrypoint wiring, and the script initializes Podman config, storage settings, and subuid/subgid mappings before launching the container command.

Changes

Nested Podman image bootstrap

Layer / File(s)	Summary
Build stages and tooling images/Dockerfile.nested-podman	Adds the claude-latest stage, external repo and GPG wiring, system package installation, Python 3.11 selection, and copied claude and PCP tooling.
User and workspace setup images/Dockerfile.nested-podman	Creates the claude user, copies ai-helpers into /opt/ai-helpers, seeds /home/claude/.claude, creates /workspace, and adjusts ownership and permissions.
Podman runtime wiring images/Dockerfile.nested-podman	Copies the nested-podman entrypoint, sets BUILDAH_ISOLATION, adjusts passwd/group access, grants newuidmap/newgidmap capabilities, and initializes subuid/subgid files.
Entrypoint runtime config images/nested-podman-entrypoint.sh	Creates HOME, writes Podman registries and storage config, adds passwd/group entries when needed, writes subordinate ID mappings, and execs the container command.

Sequence Diagram(s)

sequenceDiagram
  participant ContainerRuntime
  participant catatonit
  participant nested-podman-entrypoint.sh
  participant Filesystem
  ContainerRuntime->>catatonit: start ENTRYPOINT
  catatonit->>nested-podman-entrypoint.sh: hand off command
  nested-podman-entrypoint.sh->>Filesystem: write Podman config and ID mappings
  nested-podman-entrypoint.sh->>ContainerRuntime: exec "$@"

Loading

Estimated code review effort

🎯 4 (Complex) | ⏱️ ~45 minutes

Possibly related PRs

• openshift-eng/ai-helpers#518: Updates the Dockerfile DNF repo and GPG wiring that this PR extends in the nested-Podman image.
• openshift-eng/ai-helpers#545: Introduces the claude-latest multi-stage build pattern used here to copy the claude binary from the claude-latest stage.

Suggested reviewers

• mrunalp
• brandisher

🚥 Pre-merge checks | ✅ 10

✅ Passed checks (10 passed)

Check name	Status	Explanation
Description Check	✅ Passed	Check skipped - CodeRabbit’s high-level summary is enabled.
Title check	✅ Passed	The title clearly describes the main change: adding a nested podman Dockerfile variant.
Docstring Coverage	✅ Passed	No functions found in the changed files to evaluate docstring coverage. Skipping docstring coverage check.
Linked Issues check	✅ Passed	Check skipped because no linked issues were found for this pull request.
Out of Scope Changes check	✅ Passed	Check skipped because no linked issues were found for this pull request.
No Real People Names In Style References	✅ Passed	No style/example references using real-person names appear in the added Dockerfile or entrypoint; repo searches found none in the PR files.
No Assumed Git Remote Names	✅ Passed	Touched files contain no git remote commands or origin/upstream references; repo search found none under images/.
Git Push Safety Rules	✅ Passed	No added files contain git push, force-push, or main/master push commands; the PR only adds a Dockerfile and entrypoint for nested podman.
No Untrusted Mcp Servers	✅ Passed	Added files only install podman/claude-related packages and local settings; no MCP server deps, npx @...mcp installs, or untrusted MCP sources appear.
Ai-Helpers Overlap Detection	✅ Passed	PR only adds image assets (Dockerfile and entrypoint); it does not touch plugins//commands, plugins//skills, or agents, so overlap detection is inapplicable.

✨ Finishing Touches

🧪 Generate unit tests (beta)

• Create PR with unit tests

---

_{Comment @coderabbitai help to get the list of available commands.}

[coderabbitai]

Actionable comments posted: 3

🤖 Prompt for all review comments with AI agents

Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.

Inline comments:
In `@images/Dockerfile.nested-podman`:
- Line 87: The nested-podman image sets CLAUDE_CONFIG_DIR but does not
explicitly define HOME, even though nested-podman-entrypoint.sh relies on HOME
for Podman config paths. Update the image environment so HOME is set to the
expected claude home directory alongside CLAUDE_CONFIG_DIR, keeping the
entrypoint contract consistent and ensuring Podman writes config to the correct
location.

In `@images/nested-podman-entrypoint.sh`:
- Around line 46-50: The subordinate ID mapping in the nested Podman entrypoint
is using an end ID instead of the required count, which can break rootless setup
for high random UIDs. Update the logic around USER, START_ID, and the
/etc/subuid and /etc/subgid writes so the third field is a positive range count
derived from the available IDs, not 65536 minus START_ID, and keep the mapping
creation in the same entrypoint block.
- Around line 8-35: The Podman setup in nested-podman-entrypoint.sh only writes
registries.conf and storage.conf inside the .config/containers directory
creation block, so both files are skipped when that directory already exists.
Update the entrypoint logic around the Podman config generation to create the
directory only if needed, but write registries.conf and storage.conf
independently so a pre-existing or partially mounted containers config still
gets the expected settings.

🪄 Autofix (Beta)

Fix all unresolved CodeRabbit comments on this PR:

• Push a commit to this branch (recommended)
• Create a new PR with the fixes

---

ℹ️ Review info

⚙️ Run configuration

Configuration used: Path: .coderabbit.yaml

Review profile: CHILL

Plan: Enterprise

Run ID: 3766293a-f354-4f35-9c72-f38a06219f30

📥 Commits

Reviewing files that changed from the base of the PR and between 3919daa and 41f66ff.

📒 Files selected for processing (2)

• images/Dockerfile.nested-podman
• images/nested-podman-entrypoint.sh

[stbenjam]

/lgtm

[openshift-ci]

[APPROVALNOTIFIER] This PR is APPROVED

This pull-request has been approved by: petr-muller, stbenjam

The full list of commands accepted by this bot can be found here.

The pull request process is described here

Details

Needs approval from an approver in each of these files:

• images/OWNERS [stbenjam]

Approvers can indicate their approval by writing /approve in a comment
Approvers can cancel approval by writing /approve cancel in a comment