fix: run the container runtime as the host user (#7)

TestCreateToRunDocker failed on Linux CI (but not macOS) on its second
Init: the dependency cache hashes code/uv.lock and got "permission denied".

Root cause: the container ran as root, so `uv sync` wrote uv.lock into the
bind-mounted source (and populated the venv) as root. On a host where the
invoking user isn't root — Linux CI — the next Init could no longer read the
root-owned uv.lock to hash it. Docker Desktop's UID remapping masked this on
macOS.

Run the container as the invoking host user (uid:gid) so everything it writes
into bind mounts is host-owned. uv's download cache defaults to $HOME/.cache,
which that user can't write inside the image, so mount a dedicated host-owned
cache dir and point UV_CACHE_DIR at it.

Also assert init.Status is READY in the create-to-run test: Init reports
failures through the response status, not the returned error, so the previous
require.NoError let a failed Init through and surfaced as a confusing
empty-network-mappings error later.

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>

Author: antoinetoussaint-byte

main_test.go

@@ -124,6 +124,10 @@ func testRun(t *testing.T, runtime *Runtime, ctx context.Context, identity *base
 		ProposedNetworkMappings: networkMappings})
 	require.NoError(t, err)
 	require.NotNil(t, init)
+	// Init reports failures through the response status, not the Go error, so a
+	// bare NoError check would let a failed Init through and surface as a
+	// confusing empty-network-mappings error further down.
+	require.Equal(t, runtimev0.InitStatus_READY, init.GetStatus().GetState(), init.GetStatus().GetMessage())
 
 	instance, err := resources.FindNetworkInstanceInNetworkMappings(ctx, init.NetworkMappings, runtime.FastAPI.RestEndpoint, resources.NewNativeNetworkAccess())
 	require.NoError(t, err)

runtime.go

@@ -3,6 +3,7 @@ package main
 import (
 	"context"
 	"fmt"
+	"os"
 	"path"
 	"strings"
 
@@ -126,6 +127,12 @@ func (s *Runtime) CreateRunnerEnvironment(ctx context.Context) error {
 			return s.Wool.Wrapf(err, "cannot create docker runner")
 		}
 		dockerEnv.WithPause()
+		// Run as the invoking host user. uv sync writes uv.lock into the
+		// bind-mounted source and populates the venv; as root those files
+		// become root-owned on the host, and a later Init that hashes uv.lock
+		// for its dependency cache then fails with "permission denied" on any
+		// host where the user isn't root (e.g. Linux CI).
+		dockerEnv.WithUser(fmt.Sprintf("%d:%d", os.Getuid(), os.Getgid()))
 
 		instance, err := resources.FindNetworkInstanceInNetworkMappings(ctx, s.NetworkMappings, s.FastAPI.RestEndpoint, resources.NewNativeNetworkAccess())
 		if err != nil {
@@ -147,6 +154,14 @@ func (s *Runtime) CreateRunnerEnvironment(ctx context.Context) error {
 		if err != nil {
 			return s.Wool.Wrapf(err, "cannot create cache location")
 		}
+		// uv's download cache defaults to $HOME/.cache/uv; the host user has no
+		// home inside the image, so give uv a writable, host-owned cache mount.
+		uvCache, err := s.LocalDirCreate(ctx, ".cache/container/uv")
+		if err != nil {
+			return s.Wool.Wrapf(err, "cannot create uv cache location")
+		}
+		dockerEnv.WithMount(uvCache, "/uv-cache")
+		dockerEnv.WithEnvironmentVariables(ctx, resources.Env("UV_CACHE_DIR", "/uv-cache"))
 		s.runnerEnvironment = dockerEnv
 
 	case s.Base.Runtime.IsNixRuntime():