fix: run tool terminal sessions as container user instead of root

- Remove compose-level user: 0:0 override from manifest_compiler.py so the
  entrypoint can start as root, fix mount ownership, and drop privileges to
  the container user internally.
- Add get_manifest_container_user() helper to resolve the manifest-declared
  container user (with uid:gid fallback).
- Pass container user through TerminalSession, TerminalManager, and the
  terminal WebSocket handler so docker exec is invoked with --user <user>.
- Update and add unit tests for the manifest compiler and terminal session.
- Record the additional root-user fix in the fix-pi-container-mount-permissions
  OpenSpec change/tasks.

Quality gates: pytest tests/unit/ (226 passed), pytest tests/services/test_terminal_manager_multi.py (7 passed), ruff check on changed files (clean), mypy on changed files (clean)

This commit is contained in:

Developer

2026-06-17 20:51:46 +00:00

parent 3e59a257dc

commit 9f720930ea

28 changed files with 358 additions and 131 deletions

									
										.atl/.skill-registry.cache.json
									
		+1
		-1
	
												View File
												
				@@ -1,3 +1,3 @@

				{

				  "fingerprint": "639c16d45210921c3c8ece071ef18bbe0c426ea2"

				  "fingerprint": "e7b3130f52a328d4051e75364e5394ac63df60c6"

				}