Files

T

Developer d395aaf574 fix: stage config-profile mounts as directories so ~/.config stays writable

- Switch apply_resolved_profile from per-file bind mounts to one
  directory-level bind mount per ResolvedMount target.
- Stage all configured files under instance_dir/mounts/<sanitized_target>
  and bind-mount that directory, so Docker no longer creates a root-owned
  parent directory such as ~/.config.
- Propagate read-only mode ('ro') as the 'readonly' flag on volume entries.
- Update unit tests to expect directory-level mounts and add coverage for
  readonly/writable flags.

Quality gates: python3 -m py_compile, pytest (313 passed, 34 skipped),
npm run typecheck, npm run lint.

2026-06-13 11:56:48 +00:00

1.3 KiB

Raw Blame History

Config profile directory mounts

Problem

apply_resolved_profile currently stages each config-profile mount file individually and bind-mounts each file into the container. Docker creates the parent directory (for example ~/.config) as root-owned when only files are mounted, so applications running as a non-root container user cannot write new files inside that directory.

Decision

Stage a directory per mount target and bind-mount the whole directory. The staged directory is created under instance_dir/mounts/ and is chowned to the resolved container user before the container starts, so the container user can create and modify files inside the target directory.

Scope

Change apply_resolved_profile in apps/api/src/services/config/config_profile_resolver.py to emit one directory-level volume mount per ResolvedMount target.
Continue staging all configured files under that directory.
Preserve read-only mode by setting readonly: true on the volume entry when mode is ro.
Update unit tests in apps/api/tests/unit/test_config_profile_resolver.py to expect directory-level mounts.

Non-goals

No changes to git-mount, SSH-key, workspace, or manifest mount handling.
No changes to config profile storage or resolution semantics.

1.3 KiB Raw Blame History