Problem
The container user claude is created with plain useradd -m (docker/Dockerfile). Ubuntu 24.04's base image already ships an ubuntu user at UID 1000, so claude lands on UID 1001.
On macOS (OrbStack / Docker Desktop) this is invisible because virtiofs maps ownership. On a native Linux host, bind mounts preserve real UIDs — the project directory is typically owned by UID 1000, so:
- Claude may be unable to write to the mounted project at all (depending on permissions)
- Files Claude creates are owned by UID 1001; the host user can't edit them without
sudo chown
- git fails with
fatal: detected dubious ownership in repository because the repo owner ≠ the running user, and nothing configures safe.directory
Nothing in the launcher maps the container UID to the host UID (--user, userns remap, or entrypoint-time usermod).
Impact
dclaude is effectively macOS-only for real work; on Linux hosts the core promise (path-mirrored file operations) is broken in the most common setup.
Possible fixes
- Pass host UID/GID at container creation (
-e HOST_UID=$(id -u)) and have the entrypoint usermod -u/groupmod -g the claude user before dropping privileges (entrypoint already runs as root)
- Or run with
--user $(id -u):$(id -g) on Linux (requires rethinking the home-dir/volume ownership story)
- At minimum, set
git config --global safe.directory '*' … though that only papers over the git symptom, not write permissions
Option 1 is the standard pattern for dev-tool containers and fits the existing entrypoint structure.
Related: #67 (entrypoint user-switch fallback) — both touch the same entrypoint logic.
Found during a full-project code review.
Problem
The container user
claudeis created with plainuseradd -m(docker/Dockerfile). Ubuntu 24.04's base image already ships anubuntuuser at UID 1000, soclaudelands on UID 1001.On macOS (OrbStack / Docker Desktop) this is invisible because virtiofs maps ownership. On a native Linux host, bind mounts preserve real UIDs — the project directory is typically owned by UID 1000, so:
sudo chownfatal: detected dubious ownership in repositorybecause the repo owner ≠ the running user, and nothing configuressafe.directoryNothing in the launcher maps the container UID to the host UID (
--user, userns remap, or entrypoint-timeusermod).Impact
dclaude is effectively macOS-only for real work; on Linux hosts the core promise (path-mirrored file operations) is broken in the most common setup.
Possible fixes
-e HOST_UID=$(id -u)) and have the entrypointusermod -u/groupmod -gtheclaudeuser before dropping privileges (entrypoint already runs as root)--user $(id -u):$(id -g)on Linux (requires rethinking the home-dir/volume ownership story)git config --global safe.directory '*'… though that only papers over the git symptom, not write permissionsOption 1 is the standard pattern for dev-tool containers and fits the existing entrypoint structure.
Related: #67 (entrypoint user-switch fallback) — both touch the same entrypoint logic.
Found during a full-project code review.