From d135ae7f02a300caf4aa8c6b3f11cbc666ccb18c Mon Sep 17 00:00:00 2001 From: Frank Date: Sun, 18 Oct 2026 18:04:36 -0700 Subject: [PATCH] =?UTF-8?q?fix(frank-tts):=20create=20the=20engine=20user?= =?UTF-8?q?=20with=20useradd=20=E2=80=94=20the=20base=20has=20no=20adduser?= MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit The runtime stage of Containerfile.engine ran `adduser --system …`. The pinned ubuntu:24.04 base ships no adduser, so the build died at that RUN line with crun's "executable file not found in $PATH". Verified in the base itself on Dankclaw, 2026-10-18: `command -v adduser` prints nothing, and the exact replacement line — `useradd --system --uid 10000 --home-dir /app --shell /usr/sbin/nologin tts` — answers `uid=10000(tts) gid=999(tts)`. Same account as before: numeric uid/gid 10000, non-login shell, no password entry. Its one warning ("uid 10000 is greater than SYS_UID_MAX 999") is cosmetic and is what keeps the uid equal to the façade's, so the comment says so before someone "fixes" it by dropping --system. --- dankclaw/voiceservice/Containerfile.engine | 11 ++++++++++- 1 file changed, 10 insertions(+), 1 deletion(-) diff --git a/dankclaw/voiceservice/Containerfile.engine b/dankclaw/voiceservice/Containerfile.engine index 932a096..4efc980 100644 --- a/dankclaw/voiceservice/Containerfile.engine +++ b/dankclaw/voiceservice/Containerfile.engine @@ -110,7 +110,16 @@ RUN apt-get update -qq \ # Same unprivileged uid as the frank-tts façade (10000): the voice packs and the # model directory are host state mounted read-only, and one uid across the pair # means one thing to remember about what is world-readable. -RUN adduser --system --uid 10000 --home /app --shell /usr/sbin/nologin tts +# +# `useradd`, NOT `adduser`: this trimmed ubuntu:24.04 base ships no `adduser` at +# all (verified 2026-10-18 against this digest — `adduser` is absent from the +# base and is not pulled in by ca-certificates/curl/libgomp1 either), so an +# `adduser` line dies at image-build time with crun's "executable file `adduser` +# not found in $PATH". `useradd --system --uid 10000` succeeds and prints one +# cosmetic warning (`uid 10000 is greater than SYS_UID_MAX 999`); the uid is the +# point, and it is what matches the façade. The alpine façade Containerfile keeps +# its own busybox `adduser -D -u 10000` — different base, different tool, same uid. +RUN useradd --system --uid 10000 --home-dir /app --shell /usr/sbin/nologin tts WORKDIR /app COPY --from=build /src/build/tts-server /src/build/*.so* /app/