alex/headquarter
1
1
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

fix: run manifest containers as root and drop privileges in entrypoint

Browse Source 
The compose file was forcing the container to run as uid 1001, so the
entrypoint could not create /workspace even with sudo configured.

- Remove Dockerfile USER directive so containers start as root
- Make compile_compose use user: 0:0 when the manifest declares a user
- Make the entrypoint drop to the container user via  after setup,
  preserving environment variables and command arguments
- Update unit tests to assert root startup and privilege drop

Quality gates:
- pytest tests/unit: 210 passed
- ruff: clean on changed files
- mypy: clean on changed files
This commit is contained in:
Developer
2026-06-14 21:32:27 +00:00
parent 47de2a0133
commit a4e6c46a47
11 changed files with 74 additions and 20 deletions
Download Patch File Download Diff File Expand all files Collapse all files
apps/.pi-map.md
+2 -2
View File
@@ -4,10 +4,10 @@ dir: apps
index: apps/.pi-map.index.md
## role
Contains the deployable application entry points and executable configurations for the project.
Contains the deployable application entry points and main executables for the project.
## files
## arch
Multi-app workspace structure with separate application boundaries, likely following micro-frontend or modular monolith patterns where each sub-directory represents an independent deployable unit.
Typically follows a multi-app workspace pattern where each subdirectory represents a standalone application with its own main.ts, configuration, and dependency injection setup, often sharing common libraries from other packages.
## tags
-
## symbols