Skip to content

fix(docker): repair bind mount ownership#1281

Merged
Aaronontheweb merged 1 commit into
netclaw-dev:devfrom
Aaronontheweb:fix/docker-bind-mount-ownership
Jun 1, 2026
Merged

fix(docker): repair bind mount ownership#1281
Aaronontheweb merged 1 commit into
netclaw-dev:devfrom
Aaronontheweb:fix/docker-bind-mount-ownership

Conversation

@Aaronontheweb

@Aaronontheweb Aaronontheweb commented Jun 1, 2026

Copy link
Copy Markdown
Collaborator

Summary

  • repair Docker bind-mount ownership in the entrypoint before dropping to the netclaw runtime user
  • add actionable directory initialization errors for startup permission failures
  • add a Docker image validation smoke test for host-owned bind mounts

Fixes #1277

Validation

  • dotnet test src/Netclaw.Configuration.Tests/Netclaw.Configuration.Tests.csproj
  • dotnet build src/Netclaw.Daemon/Netclaw.Daemon.csproj
  • dotnet test src/Netclaw.Daemon.Tests/Netclaw.Daemon.Tests.csproj
  • IMAGE_REPO=netclawd-pr scripts/docker/build-image.sh bind-mount-local
  • local Docker minimal health smoke
  • local Docker host-owned bind-mount smoke
  • dotnet slopwatch analyze
  • pwsh ./scripts/Add-FileHeaders.ps1 -Verify

@Aaronontheweb Aaronontheweb added the docker Docker image packaging, publishing, and containerized workflows label Jun 1, 2026

@Aaronontheweb Aaronontheweb left a comment

Copy link
Copy Markdown
Collaborator Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

LGTM

@Aaronontheweb Aaronontheweb merged commit 60601c6 into netclaw-dev:dev Jun 1, 2026
14 checks passed
@Aaronontheweb Aaronontheweb deleted the fix/docker-bind-mount-ownership branch June 1, 2026 16:53
Comment thread docker/Dockerfile
&& useradd --uid 1654 --gid netclaw --create-home netclaw \
&& mkdir -p /home/netclaw/.netclaw \
&& chown netclaw:netclaw /home/netclaw/.netclaw
&& mkdir -p /home/netclaw/.netclaw /tools \

Copy link
Copy Markdown
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

@Aaronontheweb it seems /tools snuck in this PR

Aaronontheweb added a commit that referenced this pull request Jun 4, 2026
…l dirs for non-root agent (0.23.0-beta.2) (#1321)

* fix(docker): don't crash on read-only /tools; give non-root agent writable on-PATH install dirs

The bind-mount ownership repair added in 0.23.0-beta.1 (#1281) ran a
recursive chown over /tools and aborted fatally on a read-only mount,
crash-looping the container. /tools is a PATH directory the agent only
reads from, so the entrypoint now treats it as best-effort: never
recursive-chowns it, never fatal on a read-only/already-correct mount.

#1281 also dropped the daemon to the non-root netclaw user, which left
no writable directory on its PATH for runtime tool installs (the agent
can't apt-get or write system dirs). The image now ships writable,
on-PATH locations (~/.local/bin, ~/.dotnet, ~/.dotnet/tools, /tools/bin)
and a default PATH that includes them, so a runtime-installed dotnet /
pip --user tool / .NET global tool resolves as a bare command in the
agent's non-interactive shell.

Bumps to 0.23.0-beta.2.

* docs: fill in PR number 1321 in release notes
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

docker Docker image packaging, publishing, and containerized workflows

Projects

None yet

Development

Successfully merging this pull request may close these issues.

Docker startup crash on bind-mount due to UID mismatch

2 participants