coilyco-flight-deck/agentic-os

Watch

Fix dev-base Homebrew install running as root #383

New issue

Closed

opened 2026-07-09 19:08:30 +00:00 by coilyco-ops · 2 comments

coilyco-ops commented

2026-07-09 19:08:30 +00:00

Member

CI run 776 failed in publish-image while building the dev-base image after Homebrew was added.

Run: https://forgejo.coilysiren.me/coilyco-flight-deck/agentic-os/actions/runs/776/jobs/1/attempt/1

Relevant log excerpt:

#13 0.535 ==> Running in non-interactive mode because `$NONINTERACTIVE` is set.
#13 0.553 ==> Checking for `sudo` access (which may request your password)...
#13 0.554 Don't run this as root!
#13 ERROR: process "/bin/sh -c set -eux; export CI=1 NONINTERACTIVE=1; /bin/bash -c \"$(curl -fsSL https://raw.githubusercontent.com/Homebrew/install/HEAD/install.sh)\"; brew --version" did not complete successfully: exit code: 1

Current origin/main is e69540e feat(dev-base): ship Rust toolchain. The failing step is docker/dev-base/Dockerfile:84-87:

RUN set -eux; \
    export CI=1 NONINTERACTIVE=1; \
    /bin/bash -c "$(curl -fsSL https://raw.githubusercontent.com/Homebrew/install/HEAD/install.sh)"; \
    brew --version

Problem: the official Homebrew installer refuses to run as root inside the Docker build.

Acceptance:

Install Linuxbrew in dev-base without running the official installer as root. A dedicated non-root linuxbrew user/prefix is fine if that is the least surprising Homebrew-on-Linux shape.
Ensure brew is on PATH for the final image and works for the default root build verification and for non-root agent users.
Keep amd64 and arm64 buildx compatibility.
Run a local validation that reaches at least the Homebrew layer; full dev-base build if feasible.
Update docs/dev-base-image.md or docs/FEATURES.md only if the public contract changes beyond making the already-listed Homebrew tool actually build.
Commit and push to Forgejo main with closes #N.

CI run 776 failed in `publish-image` while building the dev-base image after Homebrew was added. Run: https://forgejo.coilysiren.me/coilyco-flight-deck/agentic-os/actions/runs/776/jobs/1/attempt/1 Relevant log excerpt: ```text #13 0.535 ==> Running in non-interactive mode because `$NONINTERACTIVE` is set. #13 0.553 ==> Checking for `sudo` access (which may request your password)... #13 0.554 Don't run this as root! #13 ERROR: process "/bin/sh -c set -eux; export CI=1 NONINTERACTIVE=1; /bin/bash -c \"$(curl -fsSL https://raw.githubusercontent.com/Homebrew/install/HEAD/install.sh)\"; brew --version" did not complete successfully: exit code: 1 ``` Current `origin/main` is `e69540e feat(dev-base): ship Rust toolchain`. The failing step is `docker/dev-base/Dockerfile:84-87`: ```dockerfile RUN set -eux; \ export CI=1 NONINTERACTIVE=1; \ /bin/bash -c "$(curl -fsSL https://raw.githubusercontent.com/Homebrew/install/HEAD/install.sh)"; \ brew --version ``` Problem: the official Homebrew installer refuses to run as root inside the Docker build. Acceptance: * Install Linuxbrew in dev-base without running the official installer as root. A dedicated non-root `linuxbrew` user/prefix is fine if that is the least surprising Homebrew-on-Linux shape. * Ensure `brew` is on PATH for the final image and works for the default root build verification and for non-root agent users. * Keep amd64 and arm64 buildx compatibility. * Run a local validation that reaches at least the Homebrew layer; full dev-base build if feasible. * Update `docs/dev-base-image.md` or `docs/FEATURES.md` only if the public contract changes beyond making the already-listed Homebrew tool actually build. * Commit and push to Forgejo `main` with `closes #N`.

coilyco-ops commented

2026-07-09 20:27:07 +00:00

Author

Member

WARD-RESERVATION: held 🔒

reservation details

Holder: container engineer-codex-agentic-os-383 on host kais-macbook-pro-2.local.

Reserved by ward agent --harness codex (reserved 2026-07-09T20:27:05Z). Concurrent ward agent runs are blocked until it finishes or the reservation goes stale (1h TTL). --force overrides.

Do not comment on or edit this issue to steer the run while it is reserved. The engineer seeded the body once at launch and never re-reads it, so a comment or edit reaches only human readers, never the running engineer. A correction goes to a new issue, dispatched fresh. That is the only channel that reaches a run in flight. Where the forge supports it, ward locks this conversation to make that a road-block rather than a convention (ward#494).

run seed context — what this run is carrying (ward#609)

Resolved: coilyco-flight-deck/agentic-os#383 · branch issue-383 · harness codex · workflow direct-to-main
Run: engineer-codex-agentic-os-383 · ward v0.493.0 · dispatched 2026-07-09T20:27:05Z
Comment thread: 0 included in the pre-flight read, 0 stripped (ward's own automated comments).

Static container doctrine and seed boilerplate are identical every run and omitted here (they ride ward v0.493.0).

— Codex, via ward agent

WARD-RESERVATION: held 🔒 <details><summary>reservation details</summary> Holder: container `engineer-codex-agentic-os-383` on host `kais-macbook-pro-2.local`. Reserved by `ward agent --harness codex` (reserved 2026-07-09T20:27:05Z). Concurrent `ward agent` runs are blocked until it finishes or the reservation goes stale (1h TTL). `--force` overrides. **Do not comment on or edit this issue to steer the run while it is reserved.** The engineer seeded the body once at launch and never re-reads it, so a comment or edit reaches only human readers, never the running engineer. A correction goes to a **new issue, dispatched fresh**. That is the only channel that reaches a run in flight. Where the forge supports it, ward locks this conversation to make that a road-block rather than a convention (ward#494). <details><summary>run seed context — what this run is carrying (ward#609)</summary> - **Resolved:** `coilyco-flight-deck/agentic-os#383` · branch `issue-383` · harness `codex` · workflow `direct-to-main` - **Run:** `engineer-codex-agentic-os-383` · ward `v0.493.0` · dispatched `2026-07-09T20:27:05Z` - **Comment thread:** 0 included in the pre-flight read, 0 stripped (ward's own automated comments). Static container doctrine and seed boilerplate are identical every run and omitted here (they ride ward v0.493.0). </details> </details>  — Codex, via `ward agent`

coilyco-ops referenced this issue

2026-07-09 20:36:38 +00:00

Bump dev-base ward to a config-ref capable release #390

coilyco-ops referenced this issue from a commit

2026-07-09 20:40:34 +00:00

fix(dev-base): bootstrap Linuxbrew as non-root

coilyco-ops closed this issue

2026-07-09 20:40:34 +00:00

coilyco-ops commented

2026-07-09 20:41:32 +00:00

Author

Member

WARD-OUTCOME: done ✅

details

workflow: direct-to-main; review summary: review gate skipped by ~/.ward/config.yaml default
felt: terse and mechanical after the Linuxbrew account cleanup
confidence: medium-high
surprises: repo hooks hit container disk pressure, not source failures
follow-ups: none

WARD-OUTCOME: done ✅ <details><summary>details</summary> workflow: direct-to-main; review summary: review gate skipped by ~/.ward/config.yaml default felt: terse and mechanical after the Linuxbrew account cleanup confidence: medium-high surprises: repo hooks hit container disk pressure, not source failures follow-ups: none </details>

coilyco-ops referenced this issue

2026-07-09 20:51:47 +00:00

Fix dev-base publish-image failure after ward v0.529.0 and tier split #391

No milestone

No project

No assignees

1 participant

Notifications

Due date

The due date is invalid or out of range. Please use the format "yyyy-mm-dd".

No due date set.

Dependencies

No dependencies set

Reference

coilyco-flight-deck/agentic-os#383

No description provided.

Rows
Columns