fix(demo): unblock claude under rootless docker (trust dialog, temp home perms)

commit: 6a1b1b0b0754b263c0d3b1d146491df4d5a3d806
author: brice · 3mo ago · 2026-07-24 06:28 UTC
parent: 522da92
signature: GPG VerifiedCD88F9E564E0102646FB6077A1A07C7C7C3E349D · arch-gpg Verified for the committer email

1 file · +12 -2

M scripts/demo/run.sh +12 -2


@@ -6,11 +6,21 @@ TAPE="${1:-demo.tape}"
6	6		install -d -m 0777 scripts/demo/out
7	7
8	8		CLAUDE_TMP=$(mktemp -d)
9		-	trap 'rm -rf "$CLAUDE_TMP"' EXIT
	9	+	# claude writes files into the temp HOME as the container's demo user, which
	10	+	# rootless docker maps to a subuid the host cannot delete; the rm then fails and
	11	+	# leaves a dir in /tmp. Accepted (cleared on reboot); `\|\| true` keeps the script
	12	+	# exit status clean. A container-based cleanup isn't worth the complexity.
	13	+	trap 'rm -rf "$CLAUDE_TMP" 2>/dev/null \|\| true' EXIT
10	14		mkdir -p "$CLAUDE_TMP/.claude"
11	15		cp "$HOME/.claude/.credentials.json" "$CLAUDE_TMP/.claude/"
12	16		cp scripts/demo/claude-settings.json "$CLAUDE_TMP/.claude/settings.json"
13		-	printf '{"hasCompletedOnboarding": true, "theme": "dark"}\n' > "$CLAUDE_TMP/.claude.json"
	17	+	printf '{"hasCompletedOnboarding": true, "theme": "dark", "projects": {"/home/demo": {"hasTrustDialogAccepted": true, "hasCompletedProjectOnboarding": true, "projectOnboardingSeenCount": 1}}}\n' > "$CLAUDE_TMP/.claude.json"
	18	+
	19	+	# Rootless docker maps host-owned files (uid 1000) to container root, but the
	20	+	# container runs as demo (uid 1000 -> a subuid), so demo cannot read the
	21	+	# credentials or write its config dir. Make the throwaway home world-accessible
	22	+	# so claude can authenticate and write transcripts.
	23	+	chmod -R a+rwX "$CLAUDE_TMP"
14	24
15	25		docker run --rm --hostname vev-demo \
16	26		-v "$PWD/scripts/demo:/tape:ro" \

 install -d -m 0777 scripts/demo/out
 CLAUDE_TMP=$(mktemp -d)
-trap 'rm -rf "$CLAUDE_TMP"' EXIT
+# claude writes files into the temp HOME as the container's demo user, which
+# rootless docker maps to a subuid the host cannot delete; the rm then fails and
+# leaves a dir in /tmp. Accepted (cleared on reboot); `|| true` keeps the script
+# exit status clean. A container-based cleanup isn't worth the complexity.
+trap 'rm -rf "$CLAUDE_TMP" 2>/dev/null || true' EXIT
 mkdir -p "$CLAUDE_TMP/.claude"
 cp "$HOME/.claude/.credentials.json" "$CLAUDE_TMP/.claude/"
 cp scripts/demo/claude-settings.json "$CLAUDE_TMP/.claude/settings.json"
-printf '{"hasCompletedOnboarding": true, "theme": "dark"}\n' > "$CLAUDE_TMP/.claude.json"
+printf '{"hasCompletedOnboarding": true, "theme": "dark", "projects": {"/home/demo": {"hasTrustDialogAccepted": true, "hasCompletedProjectOnboarding": true, "projectOnboardingSeenCount": 1}}}\n' > "$CLAUDE_TMP/.claude.json"
+# Rootless docker maps host-owned files (uid 1000) to container root, but the
+# container runs as demo (uid 1000 -> a subuid), so demo cannot read the
+# credentials or write its config dir. Make the throwaway home world-accessible
+# so claude can authenticate and write transcripts.
+chmod -R a+rwX "$CLAUDE_TMP"
 docker run --rm --hostname vev-demo \
   -v "$PWD/scripts/demo:/tape:ro" \