Developer
1e0f95f8bd
Move the following audited-and-implemented changes into openspec/changes/archive/2026-06-12-completed-changes-archive/: - tool-config-mount-cleanup - config-profile-directory-mounts Update archive README count and project map index/files accordingly. openspec/changes/ now contains only the archive directory. Quality gates: pytest 313 passed/34 skipped, npm run typecheck/lint clean, npm test -- --run 87 passed
22 lines
1.3 KiB
Markdown
22 lines
1.3 KiB
Markdown
# Config profile directory mounts
|
|
|
|
## Problem
|
|
|
|
`apply_resolved_profile` currently stages each config-profile mount file individually and bind-mounts each file into the container. Docker creates the parent directory (for example `~/.config`) as root-owned when only files are mounted, so applications running as a non-root container user cannot write new files inside that directory.
|
|
|
|
## Decision
|
|
|
|
Stage a directory per mount target and bind-mount the whole directory. The staged directory is created under `instance_dir/mounts/` and is chowned to the resolved container user before the container starts, so the container user can create and modify files inside the target directory.
|
|
|
|
## Scope
|
|
|
|
- Change `apply_resolved_profile` in `apps/api/src/services/config/config_profile_resolver.py` to emit one directory-level volume mount per `ResolvedMount` target.
|
|
- Continue staging all configured files under that directory.
|
|
- Preserve read-only mode by setting `readonly: true` on the volume entry when `mode` is `ro`.
|
|
- Update unit tests in `apps/api/tests/unit/test_config_profile_resolver.py` to expect directory-level mounts.
|
|
|
|
## Non-goals
|
|
|
|
- No changes to git-mount, SSH-key, workspace, or manifest mount handling.
|
|
- No changes to config profile storage or resolution semantics.
|