fix(docker): chown install dirs on HERMES_UID remap (#27221)#27243
Closed
Linux2010 wants to merge 1 commit into
Closed
fix(docker): chown install dirs on HERMES_UID remap (#27221)#27243Linux2010 wants to merge 1 commit into
Linux2010 wants to merge 1 commit into
Conversation
When HERMES_UID is remapped (e.g. to 99 for Unraid/Synology), usermod -u only auto-updates ownership inside the user's home directory. Files under $INSTALL_DIR/ui-tui/ and $INSTALL_DIR/gateway/ retain build-time UID 10000, causing EACCES on: - TUI dashboard esbuild writes to dist/ - Python __pycache__ creation under gateway/ Fix: add a loop to chown ui-tui/ and gateway/ to the remapped hermes user, following the same pattern as the existing .venv chown. Test: add tests/docker/test_entrypoint_uid_remap.py to verify the chown logic for both directories is present and guarded.
This comment was marked as spam.
This comment was marked as spam.
This comment was marked as spam.
This comment was marked as spam.
This comment was marked as spam.
This comment was marked as spam.
Contributor
Author
|
Closing due to multiple CI failures (attribution + test + ruff). PR is stale (created May 17). Will re-create if still needed after attribution fix. |
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
3 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
What broke
When
HERMES_UIDis remapped (e.g. to 99 for Unraid/Synology),usermod -uonly auto-updates ownership inside the user's home directory ($HERMES_HOME). Files under$INSTALL_DIR/ui-tui/and$INSTALL_DIR/gateway/retain build-time UID 10000, causing:dist/→ EACCES__pycache__undergateway/→ permission errorsRoot cause
In
docker/entrypoint.sh, theusermod -uchown block only covers$HERMES_HOMEand$INSTALL_DIR/.venv. The install directoriesui-tui/andgateway/are not included, so they keep their build-time owner after UID remap.Why this fix is minimal
Adds a loop to chown
ui-tui/andgateway/to the remapped hermes user, following the exact same pattern as the existing.venvchown. Each directory is guarded by-d(existence check) andstat -c %u(UID comparison) so it only runs when needed. Non-rootless Podman users and unremapped installs are unaffected.What I tested
Added
tests/docker/test_entrypoint_uid_remap.py:test_ui_tui_chown_present— ui-tui/ referenced in needs_chown blocktest_gateway_chown_present— gateway/ referenced in needs_chown blocktest_chown_uses_hermes_user— loop useshermes:hermestest_chown_guarded_by_directory_check—-dguard presenttest_chown_guarded_by_uid_check—stat -c %uguard presentWhat I intentionally did not change
$HERMES_HOMEchown behavior.venvchown behavior