remo-cli 2.2.0rc2__tar.gz → 2.2.0rc3__tar.gz

{remo_cli-2.2.0rc2 → remo_cli-2.2.0rc3}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.4
 Name: remo-cli
-Version: 2.2.0rc2
+Version: 2.2.0rc3
 Summary: Remote development environment CLI
 License-Expression: MIT
 License-File: LICENSE

{remo_cli-2.2.0rc2 → remo_cli-2.2.0rc3}/docker/Dockerfile

@@ -60,8 +60,14 @@ WORKDIR /app
 #   curl           - AWS CLI/SSM plugin install below, and the container
 #                    healthcheck (compose.example.yml) at runtime
 #   unzip          - AWS CLI v2 install below
+#   gosu           - drops from root to the unprivileged `remo` user in the
+#                    entrypoint AFTER self-healing filesystem permissions
+#                    (see docker/entrypoint.sh). Unlike `su`, it stays PID 1
+#                    with correct signal semantics and adds no setuid-binary
+#                    surface. Packaged for both amd64 and arm64 in Debian, so
+#                    the multi-arch build is unaffected.
 RUN apt-get update && \
-    apt-get install -y --no-install-recommends openssh-client curl unzip && \
+    apt-get install -y --no-install-recommends openssh-client curl unzip gosu && \
     rm -rf /var/lib/apt/lists/*
 
 # Install AWS CLI v2 (needed for SSM proxy), arch-selected via $TARGETARCH.
@@ -85,10 +91,10 @@ RUN if [ "$TARGETARCH" = "arm64" ]; then SM_ARCH="arm64"; else SM_ARCH="64bit";
 # Non-root user (UID/GID 1000 to match compose.example.yml `user: "1000:1000"`).
 RUN useradd -u 1000 -m -s /bin/bash remo
 
-# Install remo-cli[web] system-wide (as root, before USER remo) from the
-# wheel built in stage 2 — avoids needing build tools in this final layer
-# and avoids `pip install --user` (so no PATH fix-up is needed; `remo` /
-# `remo web` land directly on the system PATH for the `remo` user).
+# Install remo-cli[web] system-wide (as root) from the wheel built in stage 2
+# — avoids needing build tools in this final layer and avoids `pip install
+# --user` (so no PATH fix-up is needed; `remo` / `remo web` land directly on
+# the system PATH for the `remo` user the entrypoint drops to).
 COPY --from=wheel-builder /build/wheels/*.whl /tmp/
 RUN pip install --no-cache-dir "$(ls /tmp/*.whl)[web]" && \
     rm /tmp/*.whl
@@ -118,6 +124,19 @@ ENV REMO_WEB_FRONTEND_DIST_DIR=/app/frontend-dist
 # default, FR-052), same as any other containerized service.
 ENV REMO_WEB_BIND_HOST=0.0.0.0
 
-USER remo
-
+# Pin HOME to the `remo` user's home so config-path resolution
+# (core/config.py `Path.home()` / REMO_HOME) is identical whether the
+# entrypoint is running its root-side healing pass or the dropped-to `remo`
+# process — otherwise root's ambient HOME (/root) would resolve the config
+# dir to a different path than the app later reads.
+ENV HOME=/home/remo
+
+# NOTE: intentionally NO `USER remo` here. The image starts as root so the
+# entrypoint can self-heal ownership on a bind-mounted, root-owned config dir
+# and on the /run/remo-ssh tmpfs (which a container *restart* remounts
+# root-owned) BEFORE dropping — via gosu — to the unprivileged `remo` user.
+# The app still ends up running as non-root `remo`; the drop just happens at
+# runtime in the entrypoint instead of at image-build time. A deployer that
+# sets an explicit `--user`/`user:` starts non-root, and the entrypoint skips
+# healing (best-effort) and execs directly. See docker/entrypoint.sh.
 ENTRYPOINT ["/app/docker/entrypoint.sh"]

{remo_cli-2.2.0rc2 → remo_cli-2.2.0rc3}/docker/compose.example.yml

@@ -182,23 +182,39 @@ services:
       # a NEW identity on next boot; it revokes nothing on the instances —
       # remove the old `remo-web@<deployment-id>` authorized_keys line there.
       - "remo-web-state:/home/remo/.config/remo"
-    # Identical hardening to the bind-mount service: adopted mode only moves
-    # WHERE configuration comes from, never loosens the runtime posture.
-    #
-    # The tmpfs mode is pinned because an option-less tmpfs mount is
-    # remounted root-owned 0755 (unwritable to uid 1000) by a container
-    # *restart* — `docker compose restart`, or the restart policy reviving
-    # the process — which would fail the startup runtime-dir check on every
-    # boot after the first. `rw,mode=1777` is exactly what Docker mounts on
-    # first boot anyway; pinning it just makes restarts behave the same.
+    # A PLAIN, option-less tmpfs — no `rw,mode=1777` pin needed anymore. The
+    # image starts as root and its entrypoint re-heals ownership on
+    # /run/remo-ssh on EVERY start, so the well-known Docker quirk (an
+    # option-less tmpfs is remounted root-owned 0755 by a container *restart*)
+    # no longer breaks the startup runtime-dir check on the second boot.
     tmpfs:
-      - "/run/remo-ssh:rw,mode=1777"
+      - "/run/remo-ssh"
     read_only: true
-    user: "1000:1000"
+    # NOTE: no `user:` pin here (unlike the bind-mount service above). This
+    # service starts as ROOT so the entrypoint can self-heal ownership on the
+    # state volume (Docker seeds a fresh named volume root-owned; a bind-mount
+    # host dir is root-owned too) before dropping — via gosu — to the
+    # unprivileged `remo` user. The app STILL runs as non-root `remo`; only
+    # the brief healing pass runs as root. See docker/entrypoint.sh.
     security_opt:
       - "no-new-privileges:true"
+    # Drop everything, then add back ONLY the capabilities the heal-then-drop
+    # entrypoint needs while it is root: CHOWN (fix ownership of the state
+    # dir/tmpfs), DAC_OVERRIDE (traverse/write a dir owned by another uid),
+    # FOWNER (defensive — chmod/utime on files owned by another uid),
+    # SETUID+SETGID (gosu drops to the `remo` uid).
+    # The dropped-to `remo` process holds NONE of these effectively — dropping
+    # uid clears the permitted/effective sets — so the security posture is
+    # unchanged from a plain non-root run; `no-new-privileges` does not block
+    # gosu (dropping privileges is always allowed).
     cap_drop:
       - "ALL"
+    cap_add:
+      - "CHOWN"
+      - "DAC_OVERRIDE"
+      - "FOWNER"
+      - "SETUID"
+      - "SETGID"
     healthcheck:
       # /api/v1/ready answers 200 for BOTH `ready` and `unconfigured` — a
       # container awaiting adoption is healthy and must not crash-loop or

remo_cli-2.2.0rc3/docker/entrypoint.sh

@@ -0,0 +1,88 @@
+#!/usr/bin/env bash
+# docker/entrypoint.sh
+#
+# Container entrypoint for `remo web` (010-web-session-interface, US4;
+# 011-web-adopt).
+#
+# Self-healing permissions model ("start as root, fix perms, drop
+# privileges"). The image starts as root (no `USER remo` in the Dockerfile)
+# so this script can, when it is UID 0, repair ownership on:
+#
+#   * the config dir ($REMO_HOME, default $HOME/.config/remo) — a deployer
+#     that BIND-MOUNTS this dir gets it owned root:root, so the non-root
+#     `remo` process could not create web-identity/ there (adopted mode,
+#     011-web-adopt) and would fail with EACCES on first boot. Docker seeds a
+#     fresh NAMED volume root-owned too, so the same fix covers that path.
+#   * the SSH ControlMaster runtime dir (/run/remo-ssh) — an option-less
+#     tmpfs is remounted root-owned 0755 (unwritable to `remo`) by a container
+#     RESTART, which otherwise fails the startup runtime-dir check on every
+#     boot after the first. Re-healing it on EVERY start makes restarts behave
+#     like the first boot without the deployer pinning `rw,mode=1777`.
+#
+# After healing, it drops to the unprivileged `remo` user via `gosu` and
+# re-execs itself; that second pass takes the non-root branch below (the gate
+# + serve). `gosu` keeps us as PID 1 with correct signal semantics (SIGTERM
+# reaches uvicorn for graceful shutdown) and, unlike a setuid `su`, adds no
+# privilege-escalation surface — compatible with `no-new-privileges:true`.
+#
+# Healing is BEST-EFFORT and never hard-fails startup: a read-only config
+# mount (mount-configured mode) legitimately cannot be chowned, and a deployer
+# may drop CAP_CHOWN. `remo web check` (below) is the real gate on whether the
+# resulting filesystem is actually usable. If the container is started with an
+# explicit non-root `--user`/`user:`, this script is never UID 0, so it skips
+# healing entirely and just runs the gate + serve.
+#
+# The `remo web check --skip-instance-checks` gate runs unguarded under
+# `set -e`: a non-zero exit from the CONFIG gate aborts before `exec remo web
+# serve`, so the container fails fast on genuinely bad config/mounts and never
+# starts serving. `--skip-instance-checks` is deliberate: the startup gate
+# validates only config/mounts/executables, NOT per-instance reachability. A
+# registered instance that is merely powered off or unreachable must NOT
+# prevent the whole service from starting (FR-006/US1); under `restart:
+# unless-stopped` (compose.example.yml), gating on reachability would
+# crash-loop the container whenever any single instance is down. Full
+# per-instance diagnostics remain available via `remo web check` (no flag),
+# and readiness is (correctly) config-only via GET /api/v1/ready.
+#
+# 011-web-adopt (SC-006): *unconfigured* is a PASSING state for this gate. A
+# fresh writable state volume with no registry/key material yet makes `remo
+# web check` report "awaiting adoption" and exit 0, so an adopted-mode
+# container boots cleanly (no crash loop) while it waits for adoption. Only
+# genuinely broken configuration still aborts here.
+
+set -euo pipefail
+
+# Target uid/gid to drop to. Defaults to the image's baked-in `remo` user
+# (1000:1000); override PUID/PGID for a bind-mount host whose directory owner
+# is some other uid/gid.
+PUID="${PUID:-1000}"
+PGID="${PGID:-1000}"
+
+# Paths that must be writable by the dropped-to user. CONFIG_DIR mirrors
+# core/config.py's REMO_HOME resolution; CONTROL_DIR mirrors
+# WebSettings.ssh_control_dir (REMO_WEB_SSH_CONTROL_DIR, default /run/remo-ssh).
+CONFIG_DIR="${REMO_HOME:-${HOME:-/home/remo}/.config/remo}"
+CONTROL_DIR="${REMO_WEB_SSH_CONTROL_DIR:-/run/remo-ssh}"
+
+if [ "$(id -u)" -eq 0 ]; then
+    # Root (the image default): self-heal, then drop. Every step is
+    # best-effort (`|| true`) so a read-only mount or a dropped CAP_CHOWN can
+    # never abort startup — `remo web check` below is the authority.
+    mkdir -p "$CONFIG_DIR" 2>/dev/null || true
+    mkdir -p "$CONTROL_DIR" 2>/dev/null || true
+    chown -R "$PUID:$PGID" "$CONFIG_DIR" 2>/dev/null || true
+    # chmod BEFORE chown so it runs while root still owns the tmpfs (no
+    # CAP_FOWNER needed). 1777 (sticky, world-writable) already lets the
+    # dropped-to user create control sockets, so the chown that follows is
+    # belt-and-suspenders — harmless if it can't change ownership.
+    chmod 1777 "$CONTROL_DIR" 2>/dev/null || true
+    chown "$PUID:$PGID" "$CONTROL_DIR" 2>/dev/null || true
+    # Re-exec this same script as the unprivileged user; the second pass falls
+    # through to the gate + serve below.
+    exec gosu "$PUID:$PGID" "$0" "$@"
+fi
+
+# Unprivileged: either dropped from root above, or started with an explicit
+# non-root `user:` (healing skipped, by design).
+remo web check --skip-instance-checks
+exec remo web serve

{remo_cli-2.2.0rc2 → remo_cli-2.2.0rc3}/docs/web-session-interface.md

@@ -358,7 +358,7 @@ tooling.
 | Flag | Value | Why |
 |---|---|---|
 | `read_only` | `true` | The image ships no legitimate reason to write to its own filesystem at runtime — all mutable state is either ephemeral (PTYs, SSH ControlMaster sockets) or lives in the explicit `tmpfs` mount. A read-only rootfs means a compromised process can't persist a backdoor into the image layer. |
-| `user: "1000:1000"` | non-root UID/GID | The image creates a dedicated `remo` user (UID 1000) at build time and drops root via `USER remo` in the Dockerfile before the entrypoint runs. Running as non-root limits what a container-escape or dependency-confusion bug can do to the host. |
+| non-root `remo` (UID 1000) | non-root process | The app always ends up running as the dedicated `remo` user (UID 1000). In the read-only bind-mount service the container is pinned to `user: "1000:1000"`; the adopted-mode service instead starts as **root** and its entrypoint drops to `remo` via `gosu` after self-healing filesystem permissions (chowning a root-owned bind-mounted/named-volume config dir and re-healing the `/run/remo-ssh` tmpfs a restart remounts root-owned). Either way the serving process is non-root, which limits what a container-escape or dependency-confusion bug can do to the host. The adopted service therefore grants back only the minimal capabilities the heal-then-drop needs (`CHOWN`, `DAC_OVERRIDE`, `FOWNER`, `SETUID`, `SETGID`) on top of `cap_drop: ALL`; the dropped-to `remo` process holds none of them effectively. |
 | `security_opt: no-new-privileges:true` | — | Prevents any process in the container (including a compromised one) from gaining privileges via setuid/setgid binaries, closing off a common container-escape vector. |
 | `cap_drop: ALL` | — | The service needs no Linux capabilities at all (it doesn't bind privileged ports, doesn't need `ptrace`, doesn't need raw sockets) — dropping everything removes capabilities an attacker could otherwise abuse. |
 | `restart: unless-stopped` | — | Keeps the service available across host reboots/crashes without fighting an operator's deliberate `docker compose stop`. |

{remo_cli-2.2.0rc2 → remo_cli-2.2.0rc3}/pyproject.toml

@@ -4,7 +4,7 @@ build-backend = "hatchling.build"
 
 [project]
 name = "remo-cli"
-version = "2.2.0rc2"
+version = "2.2.0rc3"
 description = "Remote development environment CLI"
 readme = "README.md"
 license = "MIT"

{remo_cli-2.2.0rc2 → remo_cli-2.2.0rc3}/tests/image/test_docker_image.py

@@ -45,6 +45,16 @@ within 30s, generates a persistent service identity (same fingerprint across
 a container restart, FR-002), and token-gates the setup API (404 when
 `REMO_WEB_API_TOKEN` is unset, FR-021). The pre-existing RO-mount tests
 above are intentionally untouched — them still passing IS SC-005.
+
+A fourth group covers the self-healing permissions model: the image starts
+as root and its entrypoint chowns a ROOT-OWNED (bind-mounted) config dir and
+re-heals the /run/remo-ssh tmpfs on every start, then drops to the non-root
+`remo` user via gosu. These tests start the container with a root-owned bind
+dir, an option-less `--tmpfs /run/remo-ssh` (no `rw,mode=1777` pin), a
+read-only rootfs, `no-new-privileges`, and only the heal-then-drop caps, then
+assert: boot reaches `unconfigured`, web-identity/ is generated owned by
+`remo`, the app process (PID 1) runs as uid 1000 (not root), and a
+`docker restart` keeps the same identity with a still-writable tmpfs.
 """
 
 from __future__ import annotations
@@ -126,11 +136,53 @@ def test_dockerfile_sets_frontend_dist_dir_override():
     assert dist_path in text.replace(dist_env_line, "")  # referenced by a COPY --from= too
 
 
-def test_dockerfile_runs_as_non_root():
+def test_dockerfile_starts_as_root_for_self_healing_entrypoint():
+    """The image must NOT hard-pin `USER remo` — it starts as root so the
+    entrypoint can self-heal ownership on a bind-mounted, root-owned config
+    dir and on the /run/remo-ssh tmpfs before dropping privileges. The drop
+    to non-root now happens at runtime (via gosu in docker/entrypoint.sh),
+    not via a build-time USER line."""
     text = DOCKERFILE.read_text()
-    assert "USER remo" in text
-    # USER remo must come after the package/asset installs (root-only ops).
-    assert text.index("USER remo") > text.index("useradd")
+    # No active `USER remo` directive (a commented mention is fine).
+    assert not any(
+        line.strip().startswith("USER remo") for line in text.splitlines()
+    ), "Dockerfile must start as root; the entrypoint drops to `remo` via gosu"
+    # gosu must be installed for the entrypoint's privilege drop.
+    assert "gosu" in text
+    # The remo user must still be created (root-only op) for gosu to drop to.
+    assert "useradd" in text
+    # HOME is pinned so config-path resolution matches across the root heal
+    # pass and the dropped-to `remo` process.
+    assert "ENV HOME=/home/remo" in text
+
+
+def test_entrypoint_self_heals_as_root_then_drops_via_gosu():
+    """Root branch: mkdir/chown the config dir and the SSH control tmpfs, then
+    `exec gosu` to the unprivileged user (PID 1 / signal semantics preserved)."""
+    text = ENTRYPOINT.read_text()
+    # Guarded on being UID 0 so an explicit non-root `--user` skips healing.
+    assert "id -u" in text
+    assert "chown" in text
+    # The drop is an exec-form gosu (never backgrounded).
+    assert "exec gosu" in text
+    # It heals both the config dir and the SSH control (runtime) dir.
+    assert "CONFIG_DIR" in text
+    assert "CONTROL_DIR" in text
+
+
+def test_entrypoint_healing_is_best_effort():
+    """Healing must never hard-fail startup (a read-only config mount can't be
+    chowned; a deployer may drop CAP_CHOWN) — `remo web check` is the real
+    gate. Every mkdir/chown/chmod step tolerates failure."""
+    text = ENTRYPOINT.read_text()
+    heal_lines = [
+        ln.strip()
+        for ln in text.splitlines()
+        if ln.strip().startswith(("mkdir", "chown", "chmod"))
+    ]
+    assert heal_lines, "expected filesystem-healing lines in the entrypoint"
+    for line in heal_lines:
+        assert "|| true" in line or "2>/dev/null" in line, line
 
 
 def test_dockerfile_entrypoint_is_the_finalized_script():
@@ -216,6 +268,30 @@ def test_compose_mounts_registry_and_ssh_material_readonly():
     assert all(v.endswith(":ro") for v in volumes if not v.strip().startswith("#"))
 
 
+def test_compose_adopted_service_self_heals_without_workarounds():
+    """The adopted-mode service must rely on the entrypoint's self-healing,
+    not on deployer workarounds: a PLAIN tmpfs (no `rw,mode=1777` pin) and no
+    `user:` pin (so it starts as root and heals), while keeping the read-only
+    rootfs + no-new-privileges posture and granting only the capabilities the
+    heal-then-drop needs."""
+    svc = _load_compose()["services"]["remo-web-adopted"]
+    # Plain, option-less tmpfs — the entrypoint re-heals it on every start.
+    assert "/run/remo-ssh" in svc["tmpfs"]
+    assert not any("mode=" in t for t in svc["tmpfs"]), (
+        "the rw,mode=1777 tmpfs pin should be gone — the entrypoint re-heals "
+        "/run/remo-ssh on restart"
+    )
+    # No `user:` pin: starts as root so the entrypoint can heal the state
+    # volume before dropping to `remo`.
+    assert "user" not in svc
+    # Hardening preserved; caps are drop-ALL + only the heal-then-drop set.
+    assert svc["read_only"] is True
+    assert "no-new-privileges:true" in svc["security_opt"]
+    assert svc["cap_drop"] == ["ALL"]
+    for cap in ("CHOWN", "SETUID", "SETGID"):
+        assert cap in svc["cap_add"], cap
+
+
 @pytest.mark.skipif(
     shutil.which("docker") is None, reason="docker compose config requires the docker CLI"
 )
@@ -913,6 +989,180 @@ def test_amd64_setup_routes_hidden_without_token_env(amd64_image, empty_state_di
         _docker_rm(name)
 
 
+# ---------------------------------------------------------------------------
+# Tier 2, group 4: self-healing permissions (root-start heal -> drop). Same
+# opt-in gate and hardening flags, plus the heal-then-drop capability set.
+# ---------------------------------------------------------------------------
+
+# cap_drop ALL + only what the heal-then-drop entrypoint needs, mirroring the
+# `remo-web-adopted` service in compose.example.yml.
+_HEAL_RUN_FLAGS = [
+    "--read-only",
+    "--cap-drop", "ALL",
+    "--cap-add", "CHOWN",
+    "--cap-add", "DAC_OVERRIDE",
+    "--cap-add", "FOWNER",
+    "--cap-add", "SETUID",
+    "--cap-add", "SETGID",
+    "--security-opt", "no-new-privileges:true",
+    # Option-less tmpfs (NO rw,mode=1777 pin): the entrypoint re-heals it.
+    "--tmpfs", "/run/remo-ssh",
+]
+
+
+@pytest.fixture
+def root_owned_state_dir(tmp_path, amd64_image):
+    """A root:root 0755 dir bind-mounted at the container's REMO_HOME.
+
+    Reproduces the bind-mount-from-an-app-platform case the self-healing
+    entrypoint exists for: a non-root process cannot create web-identity/
+    there. Ownership is set (and later cleaned up) via a throwaway root
+    container so the test needs no host root — the same technique
+    `empty_state_dir` uses for cleanup.
+    """
+    state_dir = tmp_path / "rootstate"
+    state_dir.mkdir()
+
+    def _root_sh(script: str, check: bool) -> None:
+        subprocess.run(
+            [
+                "docker", "run", "--rm", "--user", "0:0", "--entrypoint", "sh",
+                "-v", f"{state_dir}:/state", amd64_image, "-c", script,
+            ],
+            check=check,
+            capture_output=True,
+            timeout=30,
+        )
+
+    _root_sh("chown 0:0 /state && chmod 0755 /state", check=True)
+    yield state_dir
+    _root_sh("rm -rf /state/web-identity /state/known_hosts", check=False)
+
+
+def _proc1_uid(name: str) -> str:
+    """The real (numeric) uid of PID 1 inside the container, read from
+    /proc/1/status (python:3.11-slim ships no `ps`)."""
+    result = subprocess.run(
+        ["docker", "exec", name, "cat", "/proc/1/status"],
+        capture_output=True,
+        text=True,
+        timeout=10,
+    )
+    assert result.returncode == 0, result.stdout + result.stderr
+    for line in result.stdout.splitlines():
+        if line.startswith("Uid:"):
+            # "Uid:\treal\teffective\tsaved\tfilesystem"
+            return line.split()[1]
+    raise AssertionError(f"no Uid line in /proc/1/status:\n{result.stdout}")
+
+
+@requires_image_build
+def test_amd64_root_owned_bind_dir_self_heals_and_app_runs_non_root(
+    amd64_image, root_owned_state_dir
+):
+    """Acceptance: a root-owned bind dir + read-only rootfs + option-less
+    tmpfs boots to awaiting-adoption, generates web-identity/ OWNED BY remo,
+    and the app process (PID 1) runs as the non-root `remo` user (uid 1000),
+    not root — the entrypoint healed as root then dropped via gosu."""
+    name = f"remo-web-test-heal-{uuid.uuid4().hex[:8]}"
+    try:
+        cmd = ["docker", "run", "-d", "--name", name]
+        cmd += _HEAL_RUN_FLAGS
+        cmd += [
+            "-v", f"{root_owned_state_dir}:{_CONTAINER_REMO_HOME}",
+            "-e", f"REMO_WEB_API_TOKEN={_SETUP_TOKEN}",
+            amd64_image,
+        ]
+        run = subprocess.run(cmd, capture_output=True, text=True, timeout=30)
+        assert run.returncode == 0, run.stderr
+
+        assert _wait_for_ready_payload(name)["status"] == "unconfigured"
+
+        # The app must run as non-root remo despite starting from root.
+        assert _proc1_uid(name) == "1000"
+
+        # web-identity/ was generated and is owned by remo (uid 1000), proving
+        # the root-side chown healed the root-owned bind dir.
+        owner = subprocess.run(
+            ["docker", "exec", name, "stat", "-c", "%u", f"{_IDENTITY_DIR}/id_ed25519"],
+            capture_output=True,
+            text=True,
+            timeout=10,
+        )
+        assert owner.returncode == 0, owner.stdout + owner.stderr
+        assert owner.stdout.strip() == "1000", owner.stdout
+    finally:
+        _docker_rm(name)
+
+
+@requires_image_build
+def test_amd64_bare_tmpfs_survives_restart_via_reheal(amd64_image, root_owned_state_dir):
+    """Acceptance: with an OPTION-LESS `--tmpfs /run/remo-ssh` (no
+    rw,mode=1777 pin), a `docker restart` — which remounts the tmpfs
+    root-owned 0755 — still comes back `unconfigured` with the SAME identity
+    and a still-writable control dir, because the entrypoint re-heals the
+    tmpfs on every start."""
+    name = f"remo-web-test-reheal-{uuid.uuid4().hex[:8]}"
+    try:
+        cmd = ["docker", "run", "-d", "--name", name]
+        cmd += _HEAL_RUN_FLAGS
+        cmd += [
+            "-v", f"{root_owned_state_dir}:{_CONTAINER_REMO_HOME}",
+            "-e", f"REMO_WEB_API_TOKEN={_SETUP_TOKEN}",
+            amd64_image,
+        ]
+        run = subprocess.run(cmd, capture_output=True, text=True, timeout=30)
+        assert run.returncode == 0, run.stderr
+
+        assert _wait_for_ready_payload(name)["status"] == "unconfigured"
+        fingerprint_before = _service_key_fingerprint(name)
+
+        restart = subprocess.run(
+            ["docker", "restart", name], capture_output=True, text=True, timeout=60
+        )
+        assert restart.returncode == 0, restart.stderr
+
+        # Ready again (the re-heal made the restart-remounted tmpfs writable),
+        # same identity (FR-002).
+        assert _wait_for_ready_payload(name)["status"] == "unconfigured"
+        assert _service_key_fingerprint(name) == fingerprint_before
+
+        # The control dir is writable by the dropped-to remo user after the
+        # restart re-heal.
+        probe = subprocess.run(
+            ["docker", "exec", "--user", "1000:1000", name, "touch", "/run/remo-ssh/probe"],
+            capture_output=True,
+            text=True,
+            timeout=10,
+        )
+        assert probe.returncode == 0, probe.stdout + probe.stderr
+    finally:
+        _docker_rm(name)
+
+
+@requires_image_build
+def test_amd64_explicit_non_root_user_still_boots(amd64_image, empty_state_dir):
+    """A deployer that pins an explicit non-root `--user` starts non-root, so
+    the entrypoint skips healing (best-effort) and execs directly. With a
+    writable state dir it must still boot to `unconfigured` — healing being
+    skipped must never be fatal."""
+    name = f"remo-web-test-explicituser-{uuid.uuid4().hex[:8]}"
+    try:
+        cmd = ["docker", "run", "-d", "--name", name, "--user", "1000:1000"]
+        cmd += _HEAL_RUN_FLAGS
+        cmd += [
+            "-v", f"{empty_state_dir}:{_CONTAINER_REMO_HOME}",
+            "-e", f"REMO_WEB_API_TOKEN={_SETUP_TOKEN}",
+            amd64_image,
+        ]
+        run = subprocess.run(cmd, capture_output=True, text=True, timeout=30)
+        assert run.returncode == 0, run.stderr
+        assert _wait_for_ready_payload(name)["status"] == "unconfigured"
+        assert _proc1_uid(name) == "1000"
+    finally:
+        _docker_rm(name)
+
+
 # ---------------------------------------------------------------------------
 # Helpers
 # ---------------------------------------------------------------------------

{remo_cli-2.2.0rc2 → remo_cli-2.2.0rc3}/uv.lock

@@ -1038,7 +1038,7 @@ wheels = [
 
 [[package]]
 name = "remo-cli"
-version = "2.2.0rc1"
+version = "2.2.0rc3"
 source = { editable = "." }
 dependencies = [
     { name = "ansible-core" },

remo_cli-2.2.0rc2/docker/entrypoint.sh

@@ -1,37 +0,0 @@
-#!/usr/bin/env bash
-# docker/entrypoint.sh
-#
-# Container entrypoint for `remo web` (010-web-session-interface, US4).
-# Non-root-safe: runs as whatever user the container was started as
-# (see compose.example.yml `user: "1000:1000"`), no root-only operations.
-#
-# `set -euo pipefail` + running `remo web check --skip-instance-checks`
-# unguarded means a non-zero exit from the CONFIG gate aborts this script
-# before `exec remo web serve` is ever reached — i.e. the container fails
-# fast and never starts serving on bad config/missing mounts.
-#
-# `--skip-instance-checks` is deliberate: the startup gate validates only
-# config/mounts/executables, NOT per-instance reachability. A registered
-# instance that is merely powered off or unreachable must NOT prevent the
-# whole service from starting (FR-006/US1 — unreachable instances stay
-# visible with actionable status; they don't block boot). Under
-# `restart: unless-stopped` (compose.example.yml), gating on reachability
-# would crash-loop the container whenever any single instance is down.
-# Full per-instance diagnostics remain available via `remo web check` (no
-# flag), and readiness is (correctly) config-only via GET /api/v1/ready.
-#
-# 011-web-adopt (SC-006): *unconfigured* is a PASSING state for this gate.
-# A fresh writable state volume with no registry/key material yet makes
-# `remo web check` report "awaiting adoption — run `remo web adopt`" and
-# exit 0, so an adopted-mode container boots cleanly (no crash loop under
-# `restart: unless-stopped`) while it waits for adoption. Only genuinely
-# broken configuration (mounted artifacts present but unusable, missing
-# runtime prerequisites) still aborts here.
-#
-# `exec` replaces this script's process (PID 1) with `remo web serve` so it
-# receives signals (SIGTERM) directly, which graceful shutdown depends on.
-
-set -euo pipefail
-
-remo web check --skip-instance-checks
-exec remo web serve