fix(claude-mem,claude-ollama): enumerate chown paths under ~/.claude - #276
Merged
Conversation
mdelapenya
force-pushed
the
fix-readonly-skills-chown-mem-ollama
branch
from
September 7, 2026 11:49
9b285e7 to
60cfd96
Compare
dvdksn
reviewed
Sep 8, 2026
dvdksn
previously approved these changes
Sep 8, 2026
The shared skills directory under ~/.claude is mounted read-only by default; chown -R agent:agent /home/agent/.claude recurses into it and fails — a hard create failure in claude-ollama's install step, and silent root-owned leftovers from claude-mem's startup trap. Chown exactly the paths each root step creates instead, and update the SPEC-v2.md ownership example, which taught the recursive idiom. Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com> Signed-off-by: Manuel de la Peña <manuel.delapena@docker.com>
… helper The helper only defused chown -R agent:agent, so a kit using the enumerated chown agent:agent <paths> form runs it live in the test — a silent no-op when the test user is agent, a set -e abort in CI where it is not. Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com> Signed-off-by: Manuel de la Peña <manuel.delapena@docker.com>
The enumerated chown named settings.json unconditionally, so when the script exited before that file existed the trap's chown failed on a missing path. Under `set -e` a failing command inside an EXIT trap replaces the script's exit status, which turned a tolerated early failure into a failed install command, and so a failed sandbox creation. The recursive form it replaced did not have this problem: it simply found nothing to chown. Each enumerated path is now existence-checked, so absence is tolerated while a genuine chown failure still surfaces. Verified under dash, which is what runs these commands. Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com> Signed-off-by: Manuel de la Peña <manuel.delapena@docker.com>
…t mode The guidance justified enumerating paths by asserting that a recursive chown over the parent fails because the shared skills directory is mounted read-only there. That couples normative guidance to one particular runtime mechanism, which is in flux. The durable reason is ownership scope: ~/.claude holds runtime-managed content a kit does not own, so recursing over the parent claims paths outside the kit's control. The advice is unchanged; only its justification is, so the text now holds regardless of how the runtime exposes the store. Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com> Signed-off-by: Manuel de la Peña <manuel.delapena@docker.com>
The comment credited a trailing space that is not in either pattern. What actually prevents double-substitution is that "chown -R agent:agent" does not contain "chown agent:agent" as a substring, because "-R " sits between them. Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com> Signed-off-by: Manuel de la Peña <manuel.delapena@docker.com>
mdelapenya
force-pushed
the
fix-readonly-skills-chown-mem-ollama
branch
from
September 9, 2026 08:50
cd9cb04 to
24c3d18
Compare
kiview
approved these changes
Sep 9, 2026
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
3 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Same root cause as the claude-sbx-statusline fix in #275: the shared skills directory under ~/.claude is mounted read-only by default, and a recursive chown over the parent recurses into it and fails.
Validation:
Note: this touches spec/, which expands the e2e matrix to all kits — the ecc nightly leg is expected red (docker/sandboxes#5539).