fix(bootstrap): pre-create daemon staging dir in agent jails #134

Merged

clawdie merged 1 commit from jail-staging-dir into main

2026-06-21 17:28:51 +02:00

clawdie commented

2026-06-21 17:28:42 +02:00

Owner

Follow-up intended for #131 (which merged at its first commit before this one landed). Fixes the second root cause of the jail-spawn EACCES found via truss (docs #132).

For staged spawns the daemon writes launch.sh/env.sh under <jail_root>/var/run/colibri-stage/<stage_id>/, but nothing ever created /var/run/colibri-stage. The daemon runs as clawdie and can't mkdir under root-owned /var/run, so staging failed with Permission denied.

agent-jail-bootstrap.sh now pre-creates the dir owned by the daemon user, mode 0700 — replacing the runtime chmod 777 workaround from #132: durable across jail rebuilds and not world-writable (staged files are sourced as shell, so world-writable would be a privilege footgun). DAEMON_USER is overridable, defaulting to clawdie. sh -n clean.

Together with #131 this closes the spawn EACCES end-to-end.

🤖 Generated with Claude Code

Follow-up intended for #131 (which merged at its first commit before this one landed). Fixes the **second** root cause of the jail-spawn EACCES found via truss (docs #132). For staged spawns the daemon writes `launch.sh`/`env.sh` under `<jail_root>/var/run/colibri-stage/<stage_id>/`, but nothing ever created `/var/run/colibri-stage`. The daemon runs as `clawdie` and can't `mkdir` under root-owned `/var/run`, so staging failed with Permission denied. `agent-jail-bootstrap.sh` now pre-creates the dir owned by the daemon user, mode `0700` — replacing the runtime `chmod 777` workaround from #132: durable across jail rebuilds and not world-writable (staged files are sourced as shell, so world-writable would be a privilege footgun). `DAEMON_USER` is overridable, defaulting to `clawdie`. `sh -n` clean. Together with #131 this closes the spawn EACCES end-to-end. 🤖 Generated with Claude Code

clawdie added 1 commit 2026-06-21 17:28:44 +02:00

fix(bootstrap): pre-create daemon staging dir in agent jails

CI / rust (pull_request) Has been cancelled

Details

CI / markdown (pull_request) Has been cancelled

Details

CI / port (pull_request) Has been cancelled

Details

CI / agent-jail-pkgs (pull_request) Has been cancelled

Details

4623f8c209

Second root cause of the jail-spawn EACCES (found via truss, docs PR #132):
for staged spawns the daemon writes launch.sh/env.sh under
<jail_root>/var/run/colibri-stage/<stage_id>/, but nothing created
/var/run/colibri-stage. The daemon runs as clawdie and cannot mkdir under
root-owned /var/run, so staging failed with Permission denied.

agent-jail-bootstrap.sh now pre-creates the dir owned by the daemon user
(0700), replacing the runtime `chmod 777` workaround — durable across jail
rebuilds and not world-writable (staged files are sourced as shell, so a
world-writable staging dir would be a privilege footgun). DAEMON_USER is
overridable, defaulting to clawdie.

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>