diff options
| author | Claude <noreply@anthropic.com> | 2026-05-26 09:28:57 +0000 |
|---|---|---|
| committer | Claude <noreply@anthropic.com> | 2026-05-26 09:28:57 +0000 |
| commit | 561915c5182c3fb39cd6a8b6613c489b35b7c1bf (patch) | |
| tree | 10e7ba6e33784332ef15d5d359897e56ba51fde2 /internal/executor/container.go | |
| parent | fb7f8a4c07a8bf6539566aacbc8a92310c555992 (diff) | |
fix(executor): set IS_SANDBOX=1 so claude honors bypassPermissions under root
The spike found that `claude --permission-mode bypassPermissions` (emitted by
buildInnerCmd) is rejected when the process runs as root, and buildDockerArgs
maps the container --user to the host uid — which is 0 when claudomator runs as
root, breaking all claude tool execution in production.
The container is an isolated sandbox, exactly the case the claude CLI gates
behind IS_SANDBOX=1; setting it in the container env makes bypassPermissions
work regardless of the host uid. Verified empirically against claude 2.1.150
(rejected as root without it; succeeds with it). Harmless for gemini containers.
https://claude.ai/code/session_01SESwn7kQ7oP62trWw6pc39
Diffstat (limited to 'internal/executor/container.go')
| -rw-r--r-- | internal/executor/container.go | 4 |
1 files changed, 4 insertions, 0 deletions
diff --git a/internal/executor/container.go b/internal/executor/container.go index 4f8fa06..f78715d 100644 --- a/internal/executor/container.go +++ b/internal/executor/container.go @@ -496,6 +496,10 @@ func (r *ContainerRunner) buildDockerArgs(workspace, claudeHome, taskID string) "-w", "/workspace", "--env-file", hostEnvFile, "-e", "HOME=/home/agent", + // The container is an isolated sandbox; IS_SANDBOX=1 lets the claude CLI + // honor --permission-mode bypassPermissions even when the agent runs as + // root (buildDockerArgs maps --user to the host uid, which may be 0). + "-e", "IS_SANDBOX=1", "-e", "CLAUDOMATOR_API_URL=" + apiURL, "-e", "CLAUDOMATOR_TASK_ID=" + taskID, "-e", "CLAUDOMATOR_DROP_DIR=" + r.DropsDir, |