Add HOST_USERS environment variable support for user namespace configuration

Adds support for injecting the HOST_USERS environment variable into workspace
containers based on the workspace configuration. When hostUsers is set to false,
containers receive HOST_USERS=false to indicate they're running in a dedicated
user namespace, allowing container images to adjust their behavior accordingly.

Changes:
- Add DefaultHostUsers constant (default: true)
- Add DevWorkspaceHostUsers environment variable name constant
- Inject HOST_USERS=false when workspace config has hostUsers set to false

Co-Authored-By: Claude Sonnet 4.5 <noreply@anthropic.com>

Author: tolusha

pkg/constants/constants.go

@@ -100,6 +100,12 @@ const (
 
 	// ProjectCloneDisable specifies that project cloning should be disabled.
 	ProjectCloneDisable = "disable"
+
+	// DefaultHostUsers is the default value for spec.hostUsers in pod security context.
+	// When true (default), containers run in the host's user namespace. When false,
+	// Kubernetes creates a dedicated user namespace for the pod (requires user namespace support).
+	// See: https://kubernetes.io/docs/concepts/workloads/pods/user-namespaces/
+	DefaultHostUsers = true
 )
 
 const (

pkg/constants/env.go

@@ -34,6 +34,12 @@ const (
 	// DevWorkspaceIdleTimeout contains env var name which value is the suggested idle timeout
 	DevWorkspaceIdleTimeout = "DEVWORKSPACE_IDLE_TIMEOUT"
 
+	// DevWorkspaceHostUsers contains the env var name whose value indicates whether the container
+	// runs in the host's user namespace. When set to "false", container images should adjust their
+	// logic to work in a dedicated user namespace (e.g., file permissions, UID/GID handling).
+	// See: https://github.com/devfile/developer-images/pull/232
+	DevWorkspaceHostUsers = "HOST_USERS"
+
 	// DevWorkspaceComponentName contains env var name which indicates from which devfile container component
 	// the container is created from. Note the flattened devfile is used to evaluate it.
 	DevWorkspaceComponentName = "DEVWORKSPACE_COMPONENT_NAME"

pkg/library/env/workspaceenv.go

@@ -19,12 +19,12 @@ import (
 	"fmt"
 	"os"
 
-	"github.com/devfile/devworkspace-operator/pkg/provision/workspace"
-
 	dw "github.com/devfile/api/v2/pkg/apis/workspaces/v1alpha2"
 	"github.com/devfile/devworkspace-operator/apis/controller/v1alpha1"
 	devfileConstants "github.com/devfile/devworkspace-operator/pkg/library/constants"
+	"github.com/devfile/devworkspace-operator/pkg/provision/workspace"
 	corev1 "k8s.io/api/core/v1"
+	"k8s.io/utils/pointer"
 
 	"github.com/devfile/devworkspace-operator/pkg/common"
 	"github.com/devfile/devworkspace-operator/pkg/constants"
@@ -84,6 +84,14 @@ func commonEnvironmentVariables(workspaceWithConfig *common.DevWorkspaceWithConf
 		},
 	}
 
+	hostUsers := pointer.BoolDeref(workspaceWithConfig.Config.Workspace.HostUsers, constants.DefaultHostUsers)
+	if !hostUsers {
+		envvars = append(envvars, corev1.EnvVar{
+			Name:  constants.DevWorkspaceHostUsers,
+			Value: "false",
+		})
+	}
+
 	envvars = append(envvars, getProxyEnvVars(workspaceWithConfig.Config.Routing.ProxyConfig)...)
 	envvars = append(envvars, getSshAskPassEnvVars()...)