fix(docker): add -m flag to useradd so workspace home dir is created - #415
Closed
daoyuan wants to merge 1 commit into
Closed
fix(docker): add -m flag to useradd so workspace home dir is created#415daoyuan wants to merge 1 commit into
daoyuan wants to merge 1 commit into
Conversation
Without -m, the system account has no /home/workspace directory. The auth middleware tries to write the session store at /home/workspace/.hermes/workspace-sessions.json; mkdirSync fails with EACCES because /home/ is root-owned (755), causing the 'Failed to persist session store' warning and a 500 on every authenticated route. Adding -m causes useradd to create and chown /home/workspace correctly so the session store can be written on first login.
There was a problem hiding this comment.
Pull request overview
Fixes a Docker runtime permission/ENOENT issue caused by the workspace user lacking a created home directory, which breaks session-store persistence and can trigger 500s on authenticated routes.
Changes:
- Add
-mto theuseraddinvocation in the runtime image so/home/workspaceis created with correct ownership.
💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.
Owner
|
Closing as superseded by #432. The validated fix was folded into the consolidated batch branch |
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Problem
When running in Docker, the server logs:
The
workspaceuser is created withuseradd -r(system account) without the-mflag,so
/home/workspace/is never created. The auth middleware resolves the session store path viahomedir()→/home/workspace/.hermes/workspace-sessions.json, then callsmkdirSynctocreate the directory. This fails with EACCES because
/home/is root-owned (755) and theworkspaceprocess cannot create subdirectories inside it.On some code paths the missing home directory causes a module-load-time ENOENT, resulting in
500 responses on all authenticated routes.
Fix
Add
-mto theuseraddinvocation in the runtime stage so/home/workspace/is createdwith correct
workspace:workspaceownership.useradd -r -g workspace -u 10010 workspaceuseradd -r -g workspace -u 10010 -m workspace