fix(docker): pre-create /state and config dirs with claude ownership #30

Merged

code-lead merged 1 commit from dev/29 into main

2026-04-17 21:46:36 +00:00

dev commented

2026-04-17 21:44:29 +00:00

Collaborator

Pre-create /state, /home/claude/.config, and /home/claude/.config/claude-code with claude:claude ownership before USER claude. Docker creates named volumes and bind-mount parent directories as root:root 0755 unless the image declares them first — this caused the first git clone inside fresh containers to fail with "Permission denied".

Also adds a static grep check in the dockerfile CI job to guard against future regression.

Closes #29

Pre-create `/state`, `/home/claude/.config`, and `/home/claude/.config/claude-code` with `claude:claude` ownership before `USER claude`. Docker creates named volumes and bind-mount parent directories as `root:root 0755` unless the image declares them first — this caused the first `git clone` inside fresh containers to fail with "Permission denied". Also adds a static `grep` check in the `dockerfile` CI job to guard against future regression. Closes #29

dev added 1 commit

2026-04-17 21:44:29 +00:00

fix(docker): pre-create /state and config dirs with claude ownership

qa / qa (pull_request) Successful in 48s

Details

qa / dockerfile (pull_request) Successful in 8s

Details

5355d4db20

Docker creates named volumes and bind-mount parent directories as
root:root 0755 unless the image already declares them with the target
ownership. Add a RUN block before USER claude that uses install -d to
pre-create /state, /home/claude/.config, and
/home/claude/.config/claude-code owned by claude:claude 0755.

Also adds a static grep check in the dockerfile CI job to guard against
future regression.

Closes #29

Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>

dev requested review from reviewer

2026-04-17 21:45:28 +00:00

reviewer approved these changes

2026-04-17 21:46:17 +00:00

reviewer left a comment

CI: ✅ green (run #1525, 56 s)

All acceptance criteria from #29 are satisfied:

Dockerfile: /state, /home/claude/.config, and /home/claude/.config/claude-code are pre-created with install -d -o claude -g claude -m 0755 in a single RUN block, before USER claude. Parent directory is correctly ordered before child.
Comment: Clear inline comment explains the Docker volume/bind-mount ownership behaviour — exactly what the issue asked for.
CI regression guard: New dockerfile job step greps for install -d -o claude; it will fail the build if the block is removed. Correctly placed before the existing USER check.
No runtime checks added: Confirmed — static grep only, consistent with the "daemonless CI" constraint.
No out-of-scope changes: justfile and src/container.ts untouched.

LGTM.

**CI**: ✅ green (run #1525, 56 s) All acceptance criteria from #29 are satisfied: - **Dockerfile**: `/state`, `/home/claude/.config`, and `/home/claude/.config/claude-code` are pre-created with `install -d -o claude -g claude -m 0755` in a single `RUN` block, before `USER claude`. Parent directory is correctly ordered before child. - **Comment**: Clear inline comment explains the Docker volume/bind-mount ownership behaviour — exactly what the issue asked for. - **CI regression guard**: New `dockerfile` job step greps for `install -d -o claude`; it will fail the build if the block is removed. Correctly placed before the existing `USER` check. - **No runtime checks added**: Confirmed — static grep only, consistent with the "daemonless CI" constraint. - **No out-of-scope changes**: `justfile` and `src/container.ts` untouched. LGTM.