From 0ff11d8ed7f0f71e1ac3e6ec47c84d9146df8f81 Mon Sep 17 00:00:00 2001 From: codex Date: Tue, 21 Jul 2026 17:38:04 +0000 Subject: [PATCH] fix(agent-images): own Git config directory --- bot_bottle/contrib/claude/Dockerfile | 5 +++++ bot_bottle/contrib/codex/Dockerfile | 2 ++ bot_bottle/contrib/pi/Dockerfile | 3 ++- docs/prds/prd-new-modernize-built-in-agent-images.md | 3 +++ tests/unit/test_builtin_agent_images.py | 7 +++++++ 5 files changed, 19 insertions(+), 1 deletion(-) diff --git a/bot_bottle/contrib/claude/Dockerfile b/bot_bottle/contrib/claude/Dockerfile index 4abc514..fd8520d 100644 --- a/bot_bottle/contrib/claude/Dockerfile +++ b/bot_bottle/contrib/claude/Dockerfile @@ -47,6 +47,11 @@ RUN apt-get update \ RUN npm install -g --no-fund --no-audit @anthropic-ai/claude-code@2.1.172 \ && npm cache clean --force +# Git reads both ~/.gitconfig and ~/.config/git/config. Keep its XDG config +# path traversable by the non-root runtime user so permission errors do not +# suppress bot-bottle's git-gate insteadOf rules. +RUN install -d -o node -g node -m 755 /home/node/.config /home/node/.config/git + # Run as a non-root user. The node image already provides a `node` user # (uid 1000) with a home directory, which is where claude-code will write # its session state. diff --git a/bot_bottle/contrib/codex/Dockerfile b/bot_bottle/contrib/codex/Dockerfile index 16414c2..56216c2 100644 --- a/bot_bottle/contrib/codex/Dockerfile +++ b/bot_bottle/contrib/codex/Dockerfile @@ -24,6 +24,8 @@ RUN apt-get update \ && apt-get install -y --no-install-recommends python3 python3-pip python3-venv \ && rm -rf /var/lib/apt/lists/* +RUN install -d -o node -g node -m 755 /home/node/.config /home/node/.config/git + USER node WORKDIR /home/node diff --git a/bot_bottle/contrib/pi/Dockerfile b/bot_bottle/contrib/pi/Dockerfile index aa24671..02564fd 100644 --- a/bot_bottle/contrib/pi/Dockerfile +++ b/bot_bottle/contrib/pi/Dockerfile @@ -23,7 +23,8 @@ RUN apt-get update \ RUN npm install -g --ignore-scripts --no-fund --no-audit @earendil-works/pi-coding-agent \ && npm cache clean --force -RUN mkdir -p /home/node/.pi/agent \ +RUN install -d -o node -g node -m 755 /home/node/.config /home/node/.config/git \ + && mkdir -p /home/node/.pi/agent \ /home/node/.pi/context-mode/sessions \ /tmp/pi-subagents-uid-1000 \ && chown -R node:node /home/node/.pi /tmp \ diff --git a/docs/prds/prd-new-modernize-built-in-agent-images.md b/docs/prds/prd-new-modernize-built-in-agent-images.md index 788b552..a0c4843 100644 --- a/docs/prds/prd-new-modernize-built-in-agent-images.md +++ b/docs/prds/prd-new-modernize-built-in-agent-images.md @@ -25,6 +25,9 @@ modify the bottle or cannot run at all. `node:22-trixie-slim`, based on Debian 13 (the current stable release). - Every built-in agent image installs Podman from Debian stable. - Every built-in agent image retains an SSH client for Git-over-SSH workflows. +- The non-root agent user owns a traversable XDG Git configuration directory, + so Git can load bot-bottle's global git-gate rewrites without permission + errors. - A shared test enforces both requirements for current and future built-in providers. diff --git a/tests/unit/test_builtin_agent_images.py b/tests/unit/test_builtin_agent_images.py index df9ab68..61fa961 100644 --- a/tests/unit/test_builtin_agent_images.py +++ b/tests/unit/test_builtin_agent_images.py @@ -37,6 +37,13 @@ class TestBuiltinAgentImages(unittest.TestCase): re.compile(r"(?m)^\s*openssh-client(?:\s|\\|$)"), ) + def test_all_prepare_node_git_config_directory(self): + for dockerfile in _AGENT_DOCKERFILES: + with self.subTest(provider=dockerfile.parent.name): + dockerfile_text = dockerfile.read_text() + self.assertIn("install -d -o node -g node", dockerfile_text) + self.assertIn("/home/node/.config/git", dockerfile_text) + if __name__ == "__main__": unittest.main()