Thanks for your help on this. OneDev needs to run as root mostly because it needs to interact with docker daemon to control CI/CD container (kill container, preparing workspace, change workspace owner etc).

that makes it a bit difficult. But does it still work with the agents?

Unfortunately agent works the same way.

that wasn't what I meant to say. A rootless onedev instance could still communicate with the agents, which are still working as root?

Oh I see. But that is adding complexity and cause confusions. One benefit of OneDev is its out-of-box CI/CD without agents.