Podman setup for late -i-promise-i-have-backups...

[aa956]

Inspired by pi-coding-agent-container but significantly simplified as podman is rootless.

Also, creates SSH keys for late that I've added to my local forgejo install.

With this setup my workflow is:

$ make build
$ make run
$ # Command to late: checkout `ssh://git@local-forgejo-machine/repo`, review the file
$ # Discussion / correction
$ # Command to late: proceed with implementation, after implementation run `git commit && git push`

Containerfile / Dockerfile:

FROM docker.io/debian:trixie-slim AS base

# Set environment variables for non-interactive installation
ENV DEBIAN_FRONTEND=noninteractive
ENV LANG=C.UTF-8

# Install essential system tools required by late coding agent and common dev workflows
# - git: Required for version control operations
# - curl/wget: For downloading external resources
# - procps: For process monitoring
# - ca-certificates: Ensure SSL connections work
# - python3/python3-venv/build-essential/golang/make: Common dev dependencies
# - openssh-client: SSH support, for git to be able to clone from ssh://
# Add
#     --mount=type=bind,source=./etc/apt/apt.conf.d/30proxy,target=/etc/apt/apt.conf.d/30proxy \
# if you have some apt caching proxy on your network.
RUN --mount=type=cache,target=/var/cache/apt \
    apt-get update && \
    apt-get install -y --no-install-recommends \
    ca-certificates \
    openssh-client \
    git \
    curl \
    wget \
    procps \
    python3 \
    python3-venv \
    build-essential \
    golang \
    && rm -rf /var/lib/apt/lists/*

FROM base AS release

# Create a non-root user setup
# We create a dedicated 'late' user (UID 1000)
RUN groupadd -r late && \
    useradd -r -m -g late -s /bin/bash late && \
    mkdir -p /workspace && \
    mkdir -p /home/late/.local/share/late && \
    mkdir -p /home/late/.ssh && \
    chown -R late:late /home/late /workspace


# Download the late binary from GitHub releases
# Use --build-arg LATE_VERSION=v1.1.2 to pin a specific version
#ARG LATE_VERSION=v1.1.2
#RUN curl -fsSL "https://github.com/mlhher/late/releases/download/${LATE_VERSION}/late-linux-amd64" \
#    -o /usr/local/bin/late && \
#    chmod 755 /usr/local/bin/late

# ~~YOLO~~ get the latest release:
RUN curl -fsSL "https://github.com/mlhher/late/releases/latest/download/late-linux-amd64" \
    -o /usr/local/bin/late && \
    chmod 755 /usr/local/bin/late

# Optional: Default OpenAI configuration (override at runtime with -e)
ENV OPENAI_BASE_URL=""
ENV OPENAI_MODEL=""
ENV OPENAI_API_KEY=""
ENV LATE_SUBAGENT_MODEL=""
ENV LATE_SUBAGENT_BASE_URL=""
ENV LATE_SUBAGENT_API_KEY=""

# Set the working directory to the project workspace
WORKDIR /workspace

# Switch to non-root user for security
USER late

# Set global git configuration for this user
# otherwise we'll get prompts on first git operation
RUN git config --global user.name "late" && \
    git config --global user.email "late@noreply.localhost"

# Verify installation (gracefully handles missing binary during build if needed)
RUN late --version

# Default entrypoint for the coding agent
ENTRYPOINT ["late", "-i-promise-i-have-backups-and-will-not-file-issues"]
CMD []

And makefile so you can make run:

# Helper Makefile to simplify running the agent container
# Usage: make run

.PHONY: build run run-args shell clean rebuild


# --- Configuration ---
IMAGE_NAME         = localhost/late-coding-agent
TAG                = latest
FULL_IMAGE         = $(IMAGE_NAME):$(TAG)
HOST_WORKSPACE_DIR = ./workspace
HOST_AGENT_DOT_DIR = ./late-home/.late
HOST_SSH_DIR       = ./late-home/.ssh
AGENT_SSH_KEY      = $(HOST_SSH_DIR)/id_ed25519
CONTAINER_NAME     = late_coding_agent
# Podman's host machine IP on default network:
OPENAI_BASE_URL    = http://10.124.232.1:8080
OPENAI_MODEL       = qwen3.6

# Common runtime flags for Podman
# - userns=keep-id: Maps host user to container user 1:1
# - :Z: SELinux relabeling
# - :U: Recursive chown to match container user
RUN_FLAGS = --rm -it \
            --userns=keep-id \
            -v $(HOST_WORKSPACE_DIR):/workspace:Z,U \
            -v $(HOST_AGENT_DOT_DIR):/home/late/.local/share/late:Z,U \
            -v $(HOST_SSH_DIR):/home/late/.ssh:Z,U \
            -e OPENAI_BASE_URL="$(OPENAI_BASE_URL)" \
            -e OPENAI_MODEL="$(OPENAI_MODEL)" \
            --name $(CONTAINER_NAME)

$(AGENT_SSH_KEY):
	mkdir -p $(HOST_AGENT_DOT_DIR)
	mkdir -p $(HOST_WORKSPACE_DIR)
	mkdir -p $(HOST_SSH_DIR)
	ssh-keygen -a 128 -t ed25519 -C 'late@noreply.localhost' -N '' -f $(AGENT_SSH_KEY)

# Build the image from source
build:
	podman build -t $(FULL_IMAGE) .

# Run the agent - now depends on the SSH key existing
run: $(SSH_KEY)
	podman run $(RUN_FLAGS) $(FULL_IMAGE)

# Run the agent with arguments
run-args: $(SSH_KEY)
	podman run $(RUN_FLAGS) $(FULL_IMAGE) $(args)

# Access the container shell for debugging
shell: $(SSH_KEY)
	podman run $(RUN_FLAGS) --entrypoint /bin/bash $(FULL_IMAGE)

# Clean up images, stopped containers. Keep keys.
clean:
	podman rm -f $(CONTAINER_NAME) || true
	podman image rm $(FULL_IMAGE) || true
	#rm -rf $(HOST_SSH_DIR)

[mlhher]

This is a good idea might try it out.
Thanks for posting it!

:Z: SELinux relabeling

👍

[aa956]

Just in case re-check it vs the docs https://docs.podman.io/en/latest/markdown/podman-run.1.html

I'm running this on debian host so no SELinux by default.

[mlhher]

There are some permission issues with SELinux but these seem host only and it does seem to work great inside the container. It also made me realize that there aren't really much things that require permission at least for me outside of "go build" and "go test" (and respective similar commands I assume).

Also it seems the TUI looks very different inside the container I guess this is due to the environment it is running in.

I think going the AST route with the Always allow is the best route for now. I can see though this being very helpful for some people thanks again for sharing.