From 23a3fd6459b4a76eca77fd6a7c8dac7408b9c4f8 Mon Sep 17 00:00:00 2001 From: Jonas Miederer Date: Mon, 14 Sep 2026 21:57:16 +0200 Subject: [PATCH 1/2] fix: give lfx runtime user a home directory --- CHANGELOG.md | 3 +++ Dockerfile.lfx | 7 +++++-- 2 files changed, 8 insertions(+), 2 deletions(-) diff --git a/CHANGELOG.md b/CHANGELOG.md index 8eab383..ffec58f 100644 --- a/CHANGELOG.md +++ b/CHANGELOG.md @@ -5,6 +5,9 @@ The format is based on [Keep a Changelog](https://keepachangelog.com/en/1.1.0/), and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0.html). ## [Unreleased] +### Fixed +- LFX runtime user gets a home directory (`useradd -m`, `HOME` set): + without one every flow run failed with "Settings service not found". ### Security - Production ops: `scripts/check_prod.py` validates `.env` secrets and modes before deploy (with tests); README production checklist diff --git a/Dockerfile.lfx b/Dockerfile.lfx index 657e531..c533199 100644 --- a/Dockerfile.lfx +++ b/Dockerfile.lfx @@ -13,8 +13,11 @@ ENV PYTHONUNBUFFERED=1 \ ARG LFX_VERSION=1.12.0 RUN pip install "lfx~=${LFX_VERSION}" requests -# Non-root runtime: uploads persist into the mounted volume. -RUN useradd -r -s /bin/false lfx && mkdir -p /flows && chown lfx /flows +# Non-root runtime: uploads persist into the mounted volume. The user needs +# a home directory: lfx resolves settings/cache paths from $HOME, and +# without one every flow run fails ("Settings service not found"). +ENV HOME=/home/lfx +RUN useradd -r -m -s /bin/false lfx && mkdir -p /flows && chown lfx /flows VOLUME /flows EXPOSE 6004 USER lfx From fd5feeaeb5b233c20df782dee69c62c5e5833871 Mon Sep 17 00:00:00 2001 From: Jonas Miederer Date: Tue, 15 Sep 2026 14:50:56 +0200 Subject: [PATCH 2/2] fix: keep shell scripts LF so dash entrypoint starts --- .gitattributes | 4 ++++ 1 file changed, 4 insertions(+) create mode 100644 .gitattributes diff --git a/.gitattributes b/.gitattributes new file mode 100644 index 0000000..f7dbbde --- /dev/null +++ b/.gitattributes @@ -0,0 +1,4 @@ +# Shell must stay LF: containers execute entrypoint scripts from the bind-mount +# and dash rejects CRLF (a `set -e\r` line aborts startup with +# "set: Illegal option -"). +*.sh text eol=lf \ No newline at end of file