From 113e64e48172610bf1afa165a9c354be8c3b4911 Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?m=C3=BCde?= Date: Sat, 30 May 2026 22:19:22 +0200 Subject: [PATCH] nix/harness: recursive chown of /run/hive (stale root-owned files survive container restart) --- nix/templates/agent-base.nix | 2 +- nix/templates/manager.nix | 2 +- 2 files changed, 2 insertions(+), 2 deletions(-) diff --git a/nix/templates/agent-base.nix b/nix/templates/agent-base.nix index 1894998e..ffbc826b 100644 --- a/nix/templates/agent-base.nix +++ b/nix/templates/agent-base.nix @@ -45,7 +45,7 @@ in # `+` runs ExecStartPre as root (before the User= drop) so # we can chown the bind onto the agent user every start — # robust against activation-script timing on first boot. - ExecStartPre = "+${pkgs.coreutils}/bin/chown ${userName}:${userName} /run/hive"; + ExecStartPre = "+${pkgs.coreutils}/bin/chown -R ${userName}:${userName} /run/hive"; # Run the harness as the per-agent user (#658). claude itself # spawned by the harness then runs as that user too — drops # root inside the container while sudo (`NOPASSWD: ALL` by diff --git a/nix/templates/manager.nix b/nix/templates/manager.nix index 5fa7fd15..394ab374 100644 --- a/nix/templates/manager.nix +++ b/nix/templates/manager.nix @@ -55,7 +55,7 @@ in # `+` runs ExecStartPre as root (before the User= drop) so # we can chown the bind onto the agent user every start — # robust against activation-script timing on first boot. - ExecStartPre = "+${pkgs.coreutils}/bin/chown ${userName}:${userName} /run/hive"; + ExecStartPre = "+${pkgs.coreutils}/bin/chown -R ${userName}:${userName} /run/hive"; # Same drop-from-root as agent-base.nix (#658). Manager # interactions with the host (rebuild approvals, config # writes) still happen via the dedicated unix sockets