.gitattributes

@@ -1,4 +0,0 @@
-# Shell must stay LF: containers execute entrypoint scripts from the bind-mount
-# and dash rejects CRLF (a `set -e\r` line aborts startup with
-# "set: Illegal option -").
-*.sh text eol=lf

CHANGELOG.md

@@ -5,9 +5,6 @@ The format is based on [Keep a Changelog](https://keepachangelog.com/en/1.1.0/),
 and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0.html).
 
 ## [Unreleased]
-### Fixed
-- LFX runtime user gets a home directory (`useradd -m`, `HOME` set):
-  without one every flow run failed with "Settings service not found".
 ### Security
 - Production ops: `scripts/check_prod.py` validates `.env` secrets and
   modes before deploy (with tests); README production checklist

Dockerfile.lfx

@@ -13,11 +13,8 @@ ENV PYTHONUNBUFFERED=1 \
 ARG LFX_VERSION=1.12.0
 RUN pip install "lfx~=${LFX_VERSION}" requests
 
-# Non-root runtime: uploads persist into the mounted volume. The user needs
+# Non-root runtime: uploads persist into the mounted volume.
-# a home directory: lfx resolves settings/cache paths from $HOME, and
+RUN useradd -r -s /bin/false lfx && mkdir -p /flows && chown lfx /flows
-# without one every flow run fails ("Settings service not found").
-ENV HOME=/home/lfx
-RUN useradd -r -m -s /bin/false lfx && mkdir -p /flows && chown lfx /flows
 VOLUME /flows
 EXPOSE 6004
 USER lfx