85c71fb01e
### Problem When the working directory is set to a directory that doesn't exists (for example, as `plugin-git` does), kubelet will pre-create it with ownership set to `root:root` and permissions `0755` . This makes pods running as non-root unable to write to it, causing permission errors. ### Solution Added a `podInitContainer` function that conditionally creates an init container to pre-create the working directory with the correct permissions before the main step container starts. ### Behavior - If the pod runs as root (`RunAsUser == 0` or unset), no init container is created. Kubelet handles directory creation automatically - If the working directory matches a volume mount path exactly, no init container is needed. `FSGroupChangePolicy` handles permissions - An init container is only created when the working directory is nested within a volume mount path - The init container uses `busybox:stable-musl` with minimal resource limits (5m CPU, 5Mi memory) and drops all capabilities. ### Related issues and PRs - Solves the error mentioned in https://github.com/woodpecker-ci/woodpecker/issues/5346#issuecomment-3211408746 without requiring a previous step. - In addition to #6307 and #6310, this will make it easier to run woodpecker ci workloads in a namespace that enforces [Pod Security Standards](https://kubernetes.io/docs/concepts/security/pod-security-standards/)
Woodpecker
Woodpecker is a simple, yet powerful CI/CD engine with great extensibility.
Installation & Resources
Woodpecker can be installed in various ways (see the Installation Instructions) and runs with SQLite as database by default. It requires around 100 MB of RAM (Server) and 30 MB (Agent) at runtime in idle mode.
Support
You can support the project by becoming a backer on Open Collective or via GitHub Sponsors.
Documentation
Our documentation can be found at https://woodpecker-ci.org/docs/intro.
Translation
We have a self-hosted Weblate instance at translate.woodpecker-ci.org.
An overview of the current translation state is available at https://translate.woodpecker-ci.org/projects/woodpecker-ci/#languages.
Public Woodpecker Instances
Woodpecker is used as the main CI/CD engine at Codeberg, an alternative Git hosting platform with a focus on privacy and free software development.
Plugins
Woodpecker can be extended via plugins. The plugin overview website helps browsing available plugins. It combines both plugins by the Woodpecker core team and community-maintained ones.
Star History
License
Woodpecker is Apache 2.0 licensed. The source files have a header indicating which license they are under and what copyrights apply.
Everything in docs/ is licensed under the Creative Commons Attribution-ShareAlike 4.0 International Public License.