Runner image is OpenShift-incompatible (restricted-v2 SCC, venv write)

[yoavkatz]

Summary

In-cluster Job on OpenShift (OCP) fails because uv rewrites /app/.venv/ at startup (removes .gitignore, rebuilds venv). Under the restricted-v2 SCC, the random UID assigned by OCP cannot write there.

Setting HOME=/tmp UV_CACHE_DIR=/tmp/uv-cache gets past the cache-miss error but not the .venv mutation, so the Job still fails.

Workarounds / fix options

1. Standard OCP Dockerfile hardening:

   RUN chown -R 0:0 /app && chmod -R g+rwX /app

2. Invoke exgentic-a2a-runner via uv run from /app/.venv/bin/uv run so uv manages the venv path.

Note: on kind the Job works perfectly — this is OCP-specific.

Found in

PR #33 review by @kellyaa.