Stage credentials in a per-user dir and surface write failures - #10
Merged
Conversation
The credentials staging dir was a fixed /tmp/devc-credentials. Once created
by another user (e.g. a root-run devc), writes from a normal user fail with
EACCES — and ExtractCredentials silently ignored write errors, so containers
came up with gh auth and git identity missing and no hint why.
- Host staging moves to /tmp/devc-credentials-{uid}; the container mount
target stays /tmp/devc-credentials.
- Write failures during staging are now returned as errors instead of
being discarded. Unavailable sources (gh not installed / not logged in)
remain non-fatal skips.
- Stale credential files from a previous run are still cleared so revoked
credentials never leak into new containers.
Existing containers keep their old mount source until recreated; `devc up`
re-runs setup with host-side reads from the new dir, so a rebuild is only
needed if the old fixed dir was unwritable.
Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
概要
認証情報ステージングディレクトリが固定パス
/tmp/devc-credentialsだったため、別ユーザー（例: root で devc を実行した場合）が先に作成すると以後のユーザーは書き込めず、さらにExtractCredentialsが書き込みエラーを黙殺していたため、コンテナに gh 認証と git identity が入らないまま原因不明で起動する問題を修正する。実際に palletizy_ws のワークスペースで発生した（root 所有の
/tmp/devc-credentialsが残存 → gh-token が書けず、コンテナ内ghが未ログインのまま）。変更内容
/tmp/devc-credentials-{uid}のユーザー別パスに変更（コンテナ側マウント先は/tmp/devc-credentialsのまま）config.CredentialsDir()/config.CredentialsTargetに集約extractCredentialsをソース注入可能な形に分離しユニットテストを追加検証
make test全パス（新規テスト4件 + 既存テスト更新）make testは Docker 内 root のため CI では skip される。非 root のローカルgo testで有効）互換性
既存コンテナは旧マウント元を保持したままだが、
devc up時の Setup はホスト側の新ディレクトリを読むため git identity は更新される。コンテナ内の gh auth は旧固定ディレクトリが書き込み可能なら従来通り動作し、不可なら再作成（rebuild）で解消する。🤖 Generated with Claude Code