From ee97daa4f07ea27f6e68424b9011140a61bf8326 Mon Sep 17 00:00:00 2001 From: JD Date: Wed, 28 Oct 2026 13:33:45 -0400 Subject: [PATCH] test(docker): leave appdata root-owned when the runner cannot chown it Root without CAP_CHOWN (--cap-drop ALL, as Codeman's own Docker case containers run) or a single-uid user namespace makes chownSync throw, which failed all five smoke tests in harness setup instead of master's two. --- test/docker-entrypoint.test.ts | 10 +++++++++- 1 file changed, 9 insertions(+), 1 deletion(-) diff --git a/test/docker-entrypoint.test.ts b/test/docker-entrypoint.test.ts index 27559e10..b9143658 100644 --- a/test/docker-entrypoint.test.ts +++ b/test/docker-entrypoint.test.ts @@ -315,7 +315,15 @@ describe('Update-Codeman.sh (the scripted major-update path — docker/README.md // agent container) the update path stopped at that guard before its // build. Give it the non-root owner docker/README.md's own // `chown -R 99:100` example sets up, as a real deployment would have. - if (process.getuid?.() === 0) chownSync(appdataPath, 99, 100); + if (process.getuid?.() === 0) { + try { + chownSync(appdataPath, 99, 100); + } catch { + // No CAP_CHOWN (root with --cap-drop ALL, as Codeman's own Docker + // case containers run) or a single-uid user namespace: leave it + // root-owned and let the scripts' own guard refuse, as before. + } + } mkdirSync(casesPath); writeFileSync(socketPath, '');