From 5d3111604100dce1f9e65ddedb0c076d90267f3d Mon Sep 17 00:00:00 2001 From: HenryGeorgist Date: Tue, 14 Jul 2026 02:10:32 +0000 Subject: [PATCH] fix: run slam container as root so it can write the /model PVC The per-workflow /model volume is a CloudStack PVC mounted root:root 0755 by the kubelet. Dropping to USER slam (uid 1000) made every write to /model fail with EACCES, forcing the plugin to fall back to the ~6Gi ephemeral /data, which is too small for multi-decade scratch. A Dockerfile chown of /model cannot help: the runtime mount shadows the image dir. Run as root instead, matching the sibling hms-runner / ressim-runner plugins that write to /model without issue. Co-Authored-By: Claude Opus 4.8 (1M context) --- Dockerfile | 9 +++++---- 1 file changed, 5 insertions(+), 4 deletions(-) diff --git a/Dockerfile b/Dockerfile index d506e26..bf199b9 100644 --- a/Dockerfile +++ b/Dockerfile @@ -19,10 +19,11 @@ RUN python3.12 -m pip install --no-cache-dir --upgrade pip setuptools wheel && \ COPY src src RUN chown -R slam:slam /usr/src/app -# /data is the intra-container scratch root the plugin writes to; create it -# and hand it to slam, since uid 1000 cannot mkdir at the filesystem root. -RUN mkdir -p /data && chown slam:slam /data -USER slam +RUN mkdir -p /data +# Run as root (do NOT drop to USER slam). The per-workflow /model PVC is mounted +# root:root 0755 by the kubelet, and a Dockerfile chown cannot affect a runtime +# mount point (the volume shadows the image dir). Sibling plugins (hms-runner, +# ressim-runner) run as root for the same reason; uid 1000 gets EACCES on /model. ENV OMP_NUM_THREADS=1 \ OPENBLAS_NUM_THREADS=1 \