fix(create): mount the rootless marker so init doesn't misdetect rootful

Rootless podman/docker create now mounts /dev/null:/run/.distrobox.rootless:ro
(distrobox-create:577), so distrobox-init skips the /etc/shadow heuristic that
false-positives on Docker Desktop/macOS.

Signed-off-by: Luca Di Maio <luca.dimaio1@gmail.com>

pkg/containermanager/providers/docker.go

@@ -393,6 +393,13 @@ func (d *Docker) makeCreateCommand(
 		options = append(options, "--volume", "/dev/null:/run/.nopasswd:ro")
 	}
 
+	// Signal rootless mode explicitly so distrobox-init does not rely solely on
+	// the /etc/shadow heuristic, which gives false positives on Docker Desktop /
+	// macOS where the container always has root over the VM filesystem.
+	if !d.root {
+		options = append(options, "--volume", "/dev/null:/run/.distrobox.rootless:ro")
+	}
+
 	// Add additional flags
 	options = append(options, containerAdditionalFlags...)
 

pkg/containermanager/providers/docker_internal_test.go

@@ -100,6 +100,7 @@ func TestDocker_makeCreateCommand(t *testing.T) {
  --volume /var/log/journal
  --volume /etc/hosts:/etc/hosts:ro
  --volume /etc/resolv.conf:/etc/resolv.conf:ro
+ --volume /dev/null:/run/.distrobox.rootless:ro
  --volume /path/to/my-volume:/var/local/my-volume:ro
  --volume /path/to/distrobox-init:/usr/bin/entrypoint:ro
  --entrypoint /usr/bin/entrypoint

pkg/containermanager/providers/podman.go

@@ -379,6 +379,13 @@ func (p *Podman) makeCreateCommand(
 		options = append(options, "--volume", "/dev/null:/run/.nopasswd:ro")
 	}
 
+	// Signal rootless mode explicitly so distrobox-init does not rely solely on
+	// the /etc/shadow heuristic, which gives false positives on Docker Desktop /
+	// macOS where the container always has root over the VM filesystem.
+	if !p.root {
+		options = append(options, "--volume", "/dev/null:/run/.distrobox.rootless:ro")
+	}
+
 	// Add additional flags
 	options = append(options, containerAdditionalFlags...)
 

pkg/containermanager/providers/podman_internal_test.go

@@ -68,6 +68,7 @@ func TestPodman_makeCreateCommand(t *testing.T) {
 		"--ulimit host",
 		"--systemd=always",
 		"--userns keep-id",
+		"--volume /dev/null:/run/.distrobox.rootless:ro",
 	}
 
 	for _, flag := range requiredFlags {
@@ -141,8 +142,9 @@ func TestPodman_makeCreateCommandRootful(t *testing.T) {
 
 	cmdStr := strings.Join(cmd, " ")
 
-	// Rootful mode should NOT have --userns keep-id
+	// Rootful mode should NOT have --userns keep-id, nor the rootless marker
 	assert.NotContains(t, cmdStr, "--userns keep-id")
+	assert.NotContains(t, cmdStr, "/run/.distrobox.rootless")
 
 	// Should still have other Podman-specific flags
 	assert.Contains(t, cmdStr, "--annotation run.oci.keep_original_groups=1")