From 433a85784e287fdbd9402105c4319b3f30ad5d7b Mon Sep 17 00:00:00 2001 From: Renn F Date: Thu, 18 Jun 2026 18:19:45 +0200 Subject: [PATCH] fix(grok): pre-create agent-owned ~/.local in the grok image (opencode state EACCES) Running the built grok-prompter container surfaced a second EACCES the mechanism analysis missed: bind-mounting the opencode store at ~/.local/share/opencode makes docker create the intermediate ~/.local AS ROOT, so the non-root agent user then cannot create its sibling ~/.local/state and opencode dies at boot. Pre-create the ~/.local tree agent-owned in the image so the mount leaves the parents writable. Complements the orchestrator 0777 host-source pre-create (which covers the bind source on Linux). Verified live: with this fix the container starts clean, opencode serve opens the session, a POST /turn produces a real grok reply, and all chunks (thinking/text/turn_end) reach the relay endpoint. --- docker/agent-grok.Dockerfile | 9 +++++++++ 1 file changed, 9 insertions(+) diff --git a/docker/agent-grok.Dockerfile b/docker/agent-grok.Dockerfile index 8a6f46a7..959ab668 100644 --- a/docker/agent-grok.Dockerfile +++ b/docker/agent-grok.Dockerfile @@ -29,6 +29,15 @@ COPY docker/grok/secret-scrub.js /app/opencode-plugins/secret-scrub.js COPY docker/scripts/grok-agent-entrypoint.sh /app/scripts/grok-agent-entrypoint.sh RUN chmod 0755 /app/scripts/grok-agent-entrypoint.sh +# opencode persists data under ~/.local/share and state under ~/.local/state. +# When the orchestrator bind-mounts the opencode store at +# ~/.local/share/opencode, docker creates the intermediate ~/.local AS ROOT, so +# the non-root agent can no longer create its sibling ~/.local/state and opencode +# EACCESes at boot. Pre-create the tree agent-owned so the mount leaves the +# parents writable (complements the orchestrator's 0777 host-source pre-create). +RUN mkdir -p /home/agent/.local/share/opencode /home/agent/.local/state \ + && chown -R agent:agent /home/agent/.local + USER agent LABEL role="grok-runtime"