Skip to content

fix(docker): HOME=/tmp in --docker sandbox to fix EROFS for tools needing writable $HOME #18

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Merged
tbrandenburg merged 1 commit into from
Sep 6, 2026
Merged

fix(docker): HOME=/tmp in --docker sandbox to fix EROFS for tools needing writable $HOME #18

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
1 commit
Select commit
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
3 changes: 3 additions & 0 deletions src/docker-run.js
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -10,6 +10,8 @@
* - `--rm -i` (always disposable, interactive stdin)
* - `--network none`, unless `networkNeeded` (i.e. `--node-modules` is set)
* - `--read-only` root filesystem + a `/tmp` tmpfs mount
* - `-e HOME=/tmp`, so tools needing a writable `$HOME` (config/cache dirs)
* land on the writable `/tmp` tmpfs instead of the read-only rootfs
* - `--cap-drop=ALL`
* - `--security-opt=no-new-privileges`
*
Expand All @@ -35,6 +37,7 @@ function buildRunArgs(image, { networkNeeded, volumeName }) {
const args = ["run", "--rm", "-i"];
if (!networkNeeded) args.push("--network", "none");
args.push("--read-only", "--tmpfs", "/tmp", "--cap-drop=ALL", "--security-opt=no-new-privileges");
args.push("-e", "HOME=/tmp");
if (networkNeeded) {
// --node-modules runs a real `npm install`, which needs a writable cache
// dir; point it at the /tmp tmpfs since the root filesystem is read-only.
Expand Down
4 changes: 4 additions & 0 deletions test/unit/docker-run.unit.test.js
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -45,6 +45,8 @@ test("unit: buildRunArgs applies --network none by default and sandboxing flags"
"/tmp",
"--cap-drop=ALL",
"--security-opt=no-new-privileges",
"-e",
"HOME=/tmp",
"some-image"
]);
});
Expand All @@ -58,13 +60,15 @@ test("unit: buildRunArgs omits --network none when networkNeeded (e.g. --node-mo
args.includes("npm_config_cache=/tmp/.npm-cache"),
"npm cache must be redirected off the read-only rootfs"
);
assert.ok(args.includes("HOME=/tmp"), "HOME must be redirected off the read-only rootfs");
});

test("unit: buildRunArgs mounts a named volume, never a bind mount, when volumeName is given", () => {
const args = buildRunArgs("some-image", { networkNeeded: false, volumeName: "node-red-cli-userdir-abc" });
const volumeIndex = args.indexOf("-v");
assert.ok(volumeIndex !== -1);
assert.equal(args[volumeIndex + 1], `node-red-cli-userdir-abc:${CONTAINER_USER_DIR}`);
assert.ok(args.includes("HOME=/tmp"));
});

test("unit: volumeNameFor is deterministic for the same --user-dir path", () => {
Expand Down