HOME=/root survives the privilege drop, so the embedded Mercure hub cannot start #24

New issue

Closed

opened 2026-08-04 11:25:07 +00:00 by geusebio · 0 comments

geusebio commented

2026-08-04 11:25:07 +00:00

Owner

HOME=/root is baked into the image and survives the drop to app, so Caddy resolves its
data directory to /root/.local/share/caddy and cannot create it.

This blocks FRANKENPHP_MERCURE=On outright — the embedded hub's bolt transport needs
that directory, and the server refuses to start without it:

Error: loading new config: loading http app module: provision http: server php:
setting up route handlers: route 0: loading handler modules: position 0: loading module
'subroute': provision http.handlers.subroute: setting up subroutes: route 0: loading
handler modules: position 0: loading module 'mercure': provision http.handlers.mercure:
provision http.handlers.mercure.bolt: "": invalid transport: creating bolt data directory
"/root/.local/share/caddy": mkdir /root/.local: permission denied

Reproduced with frankenphp php-server -r /app/public --mercure under chpst -u app.

Suggested fix

Set XDG_DATA_HOME (or HOME) to a directory owned by the server user, e.g.

ENV XDG_DATA_HOME=/var/lib/caddy
RUN mkdir -p "$XDG_DATA_HOME" && chown -R app:app "$XDG_DATA_HOME"

Worth doing in the base image alongside the FRANKENPHP_MERCURE support itself, since the
flag cannot work without it.

Related: #22 (the privilege drop that makes root-owned state unreachable).

`HOME=/root` is baked into the image and survives the drop to `app`, so Caddy resolves its data directory to `/root/.local/share/caddy` and cannot create it. **This blocks `FRANKENPHP_MERCURE=On` outright** — the embedded hub's bolt transport needs that directory, and the server refuses to start without it: ``` Error: loading new config: loading http app module: provision http: server php: setting up route handlers: route 0: loading handler modules: position 0: loading module 'subroute': provision http.handlers.subroute: setting up subroutes: route 0: loading handler modules: position 0: loading module 'mercure': provision http.handlers.mercure: provision http.handlers.mercure.bolt: "": invalid transport: creating bolt data directory "/root/.local/share/caddy": mkdir /root/.local: permission denied ``` Reproduced with `frankenphp php-server -r /app/public --mercure` under `chpst -u app`. ### Suggested fix Set `XDG_DATA_HOME` (or `HOME`) to a directory owned by the server user, e.g. ```dockerfile ENV XDG_DATA_HOME=/var/lib/caddy RUN mkdir -p "$XDG_DATA_HOME" && chown -R app:app "$XDG_DATA_HOME" ``` Worth doing in the base image alongside the `FRANKENPHP_MERCURE` support itself, since the flag cannot work without it. Related: #22 (the privilege drop that makes root-owned state unreachable).

geusebio referenced this issue

2026-08-04 11:25:39 +00:00

Publish the FRANKENPHP_MERCURE build — Docker Hub still serves the 2026-07-25 image #26

geusebio referenced this issue

2026-08-04 11:49:30 +00:00

Publish the FRANKENPHP_MERCURE build — Docker Hub still serves the 2026-07-25 image #26

geusebio referenced this issue from a pull request that will close it,

2026-08-04 12:27:27 +00:00

frankenphp: keep groups, HOME and the session dir across the privilege drop #31

geusebio closed this issue

2026-08-04 12:32:14 +00:00

geusebio referenced this issue