fix(docker): mkdir HERMES_HOME as root in stage2 before chown / privilege drop (#18488)#33078
Merged
Merged
Conversation
…lege drop (#18488) When HERMES_HOME points at a custom path whose parent directories only root can create (e.g. HERMES_HOME=/home/hermes/.hermes in a Compose file, or any path under a fresh / not pre-populated by the image), stage2-hook.sh fails on first boot: [stage2] Warning: chown failed (rootless container?) - continuing mkdir: cannot create directory '/custom': Permission denied mkdir: cannot create directory '/custom': Permission denied ... (one per s6-setuidgid hermes mkdir invocation) cont-init: info: /etc/cont-init.d/01-hermes-setup exited 1 The mkdirs fail because s6-setuidgid drops to hermes (UID 10000) before invoking mkdir -p, and the runtime user has no permission to create root-owned ancestor directories. 02-reconcile-profiles then crashes with FileNotFoundError, .install_method never lands, and the container limps on in a half-initialized state. Bootstrap HERMES_HOME with mkdir -p while still root, before the ownership normalization. Idempotent on the default /opt/data path (directory already exists from the Dockerfile RUN mkdir -p) and on any subsequent restart. (#18482) Retargeted from the original PR's docker/entrypoint.sh (now a deprecated shim) to docker/stage2-hook.sh where the related chown logic moved during the s6-overlay rework. Co-authored-by: wpengpeng168 <133926080+wpengpeng168@users.noreply.github.com>
Contributor
🔎 Lint report:
|
Merged
19 tasks
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
2 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Salvages #18488 (@wpengpeng168) — fixes #18482.
Problem
When
HERMES_HOMEpoints at a custom path whose parent directories only root can create (e.g.HERMES_HOME=/home/hermes/.hermesin a Compose file, or any path under a fresh root not pre-populated by the image),stage2-hook.shfails on first boot:The mkdirs fail because
s6-setuidgid hermesdrops to UID 10000 before invokingmkdir -p, and the runtime user has no permission to create root-owned ancestor directories like/home/or/custom/.02-reconcile-profilesthen crashes with threeFileNotFoundErrors,.install_methodnever lands, and the container limps on in a half-initialized state.This was originally reported as #18482 and #18488 attempted to fix the pre-s6
docker/entrypoint.sh. The shim is deprecated now but the underlying bug moved intodocker/stage2-hook.shduring the s6-overlay rework.Fix
Bootstrap
HERMES_HOMEwithmkdir -pwhile still root, before the ownership normalization and thes6-setuidgid hermes mkdir -pblock. Idempotent on the default/opt/datapath (directory already exists from the Dockerfile'sRUN mkdir -p) and on any subsequent container restart.Validation
Bug reproduction (baseline vs salvage)
Built an isolated E2E that runs
docker run -e HERMES_HOME=/custom/hermes-home/.hermes <tag> --version(no volume — exercises the in-container fs) and inspects the stage2 log + post-run filesystem state. Compares baseline (origin/main) against this salvage:01-hermes-setup exited 0mkdir EACCESerrorsFileNotFoundErrorin 02-reconcile-profilesHERMES_HOMEdirectory created on diskcron/,logs/, ....install_methodstamp writtenHERMES_HOME=/opt/datastill boots cleanlyRegression battery (all on the salvage image)
--version,hermes_cli, TUI launcher, lazy_deps, gcc)Authorship
Original change by @wpengpeng168 in #18488 — they identified and patched the same root cause in the pre-s6
docker/entrypoint.sh. Retargeted todocker/stage2-hook.shand adjusted the placement to fit the s6-overlay cont-init flow. Preserved attribution viaCo-authored-by:.Closes #18488.
Fixes #18482.