lea · Help

Known limitations

• What an agent starts in the nested Podman (docker, docker compose, podman, through its own Podman service) is removed when the agent ends, and stopped (not removed) once the agent has been idle LEA_STACK_IDLE minutes (10): the agent starts it again when it needs it. What you start from a deck shell is neither. Every lea removes what the agents that are gone left, stops the stacks of agents idle for that long already, and names the containers no agent started.

• docker compose with its own networks does not work inside lea yet: the nested Podman's network backend (netavark) sets net/ipv4/conf/<bridge>/route_localnet to 1 in its rootless network namespace, which Docker's read-only /proc/sys refuses. It skips the write when the value is already 1, but that namespace takes its defaults from the host's net.ipv4.conf.default, where it is 0 on most hosts. docker run works.

• The AppArmor profile (apparmor/lea.tmpl) omits docker-default's /proc write denies and mount narrowing for now: they may break rootless Podman and are pending validation.