Merge branch 'fix/entrypoint-lf'

.gitattributes

@@ -0,0 +1,4 @@
+# Shell must stay LF: containers execute entrypoint scripts from the bind-mount
+# and dash rejects CRLF (a `set -e\r` line aborts startup with
+# "set: Illegal option -").
+*.sh text eol=lf

CHANGELOG.md

@@ -5,6 +5,9 @@ The format is based on [Keep a Changelog](https://keepachangelog.com/en/1.1.0/),
 and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0.html).
 
 ## [Unreleased]
+### Fixed
+- LFX runtime user gets a home directory (`useradd -m`, `HOME` set):
+  without one every flow run failed with "Settings service not found".
 ### Security
 - Production ops: `scripts/check_prod.py` validates `.env` secrets and
   modes before deploy (with tests); README production checklist

Dockerfile.lfx

@@ -13,8 +13,11 @@ ENV PYTHONUNBUFFERED=1 \
 ARG LFX_VERSION=1.12.0
 RUN pip install "lfx~=${LFX_VERSION}" requests
 
-# Non-root runtime: uploads persist into the mounted volume.
+# Non-root runtime: uploads persist into the mounted volume. The user needs
-RUN useradd -r -s /bin/false lfx && mkdir -p /flows && chown lfx /flows
+# a home directory: lfx resolves settings/cache paths from $HOME, and
+# without one every flow run fails ("Settings service not found").
+ENV HOME=/home/lfx
+RUN useradd -r -m -s /bin/false lfx && mkdir -p /flows && chown lfx /flows
 VOLUME /flows
 EXPOSE 6004
 USER lfx