Skip to content

fix(docker): add -m flag to useradd so workspace home dir is created - #415

Closed
daoyuan wants to merge 1 commit into
outsourc-e:mainfrom
daoyuan:fix/docker-workspace-home-dir
Closed

fix(docker): add -m flag to useradd so workspace home dir is created#415
daoyuan wants to merge 1 commit into
outsourc-e:mainfrom
daoyuan:fix/docker-workspace-home-dir

Conversation

@daoyuan

@daoyuan daoyuan commented May 11, 2026

Copy link
Copy Markdown
Contributor

Problem

When running in Docker, the server logs:

[auth] Failed to persist session store to /home/workspace/.hermes/workspace-sessions.json
Error: Internal Server Error

The workspace user is created with useradd -r (system account) without the -m flag,
so /home/workspace/ is never created. The auth middleware resolves the session store path via
homedir()/home/workspace/.hermes/workspace-sessions.json, then calls mkdirSync to
create the directory. This fails with EACCES because /home/ is root-owned (755) and the
workspace process cannot create subdirectories inside it.

On some code paths the missing home directory causes a module-load-time ENOENT, resulting in
500 responses on all authenticated routes.

Fix

Add -m to the useradd invocation in the runtime stage so /home/workspace/ is created
with correct workspace:workspace ownership.

  • Before: useradd -r -g workspace -u 10010 workspace
  • After: useradd -r -g workspace -u 10010 -m workspace

Without -m, the system account has no /home/workspace directory.
The auth middleware tries to write the session store at
/home/workspace/.hermes/workspace-sessions.json; mkdirSync fails with
EACCES because /home/ is root-owned (755), causing the 'Failed to
persist session store' warning and a 500 on every authenticated route.

Adding -m causes useradd to create and chown /home/workspace correctly
so the session store can be written on first login.
Copilot AI review requested due to automatic review settings May 11, 2026 15:57

Copilot AI left a comment

Copy link
Copy Markdown

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Pull request overview

Fixes a Docker runtime permission/ENOENT issue caused by the workspace user lacking a created home directory, which breaks session-store persistence and can trigger 500s on authenticated routes.

Changes:

  • Add -m to the useradd invocation in the runtime image so /home/workspace is created with correct ownership.

💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.

@outsourc-e

Copy link
Copy Markdown
Owner

Closing as superseded by #432. The validated fix was folded into the consolidated batch branch fix/issue-sweep-batch-20260514 for one review/merge path.

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

3 participants