Mount the Claude config directory, so an account switch reaches the container - #362
Conversation
…ontainer A bind mount of a file is attached to the dentry. When the host replaces that file by rename -- which is what Claude does on every token refresh and on an account switch -- the mount is left pointing at an inode with no name, and the container reads it happily and forever. Four of the feature's nine mounts were files, two of them the credentials and account state. So a workspace created before an account switch went on authenticating as the account the developer had left, and each froze at a different moment: three running containers held three different credentials files and none held the host's. Mount ~/.claude as the directory instead. A directory mount resolves names per access, so it follows the rename. The read-only mounts over CLAUDE.md and settings.json go with it, because they were not read-only. The same rename drops a nested file mount from the namespace and the path falls through to the parent, so -- measured on Docker, both ways round, since the direction follows the parent and neither is safe -- a read-write parent leaves the file writable and a read-only parent breaks the token refresh. Directory mounts survive intact, so the read-only list is now exactly the five instruction directories and every source is a directory. The test asserts that rather than the paths: naming the two files again passes review, appears in docker inspect, and stops being true on the next edit. The cost is real and now stated where it is met: CLAUDE.md and settings.json are writable from the container, and settings.json can name hook commands inline. That is the same hole the previous layout had after one edit, minus the claim that it was closed.
![sourcery-ai[bot]](https://avatars.githubusercontent.com/in/48477?s=60&v=4){kind=small}
Reviewer's GuideThis PR changes the claude-code devcontainer feature to mount the host ~/.claude directory read-write and only mount its instruction subdirectories read-only, fixes stale credential/account state caused by file bind mounts across renames, simplifies the init-host pre-create hook to only create directories, and updates documentation and tests (unit + e2e) to assert the new "directory-only" mount invariant and behavior. Sequence diagram for live Claude account switchingsequenceDiagram
participant Host as Host Claude config
participant Container as Running devlaunch container
participant Claude as Claude CLI
Host->>Host: Replace .credentials.json by rename
Claude->>Container: Read .credentials.json
Container->>Host: Resolve path through ~/.claude directory mount
Host-->>Container: Return current credentials
Container-->>Claude: Authenticate with current account
Flow diagram for simplified Claude host initializationflowchart TD
Start([Initialize host config]) --> Create[mkdir -p Claude config directories]
Create --> Mount[Mount ~/.claude as rw directory]
Mount --> Overlay[Mount five instruction directories as ro]
Overlay --> Ready([Container starts])
File-Level Changes
Tips and commandsInteracting with Sourcery
Customizing Your ExperienceAccess your dashboard to:
Getting Help
|
Restoring the bind-type check dropped when this file was rewritten. Without it a volume at ~/.claude/agents passes: the source still names a directory that exists, the read-only flags still match the README, and the container gets an empty configuration with no connection to the host.
resolve() matched the configuration directory without requiring a path separator, so any sibling whose name merely extends .claude sliced to a zero-length relative path and resolved back to the configuration directory. The directory check, and the hook-creates-every-source check that exists to stop 'bind mount source path does not exist' at create time, then both ran against the wrong path and passed.
devpod writes .devpod-internal into the folder it mounts, owned by the container's root, and the fixture that removes it named one workspace id. The new test creates a second, so its copy survived the container and then failed pytest's tear-down of its own temporary directory, once per run and for every later run too. Cleaning every workspace the tracker recorded covers both, and any third. The state file the rename is performed on also comes from a set, so which of the two it picked moved with the hash seed; all of them, sorted, is both deterministic and a wider test.
Both claims were falsified by the mount change and left behind. 'None of them is optional' listed CLAUDE.md, settings.json, .credentials.json and .claude.json, none of which has to exist any more for the create to succeed -- and the list omitted skills/ and wf-skills/, which do. 'You cannot modify Claude settings from within the container' is now the opposite of true for settings.json, which is the one sentence a reader would rely on before trusting the container with a repository.
CHANGELOG only: main released 0.7.1 while this branch held an entry under [Unreleased]. Both kept, the entry above the new release section.
There was a problem hiding this comment.
This was generated by AI during review.
Retrospective review. #335, #362 and #374 were reviewed together as one surface — container identity and the ~/.claude mount — judged against current main (a5f7ed8). The consolidated report is on #374: #374 (review)
Both blocking findings in that report are #362's, and both are on the same thing: the layout change is right and well argued, the disclosure did not follow it everywhere.
-
BLOCKING —
.devcontainer/claude-code/README.md:562-581still advertises the protection this PR removed.### What's Protected (Read-Only Mounts)listsCLAUDE.md("Prevents prompt injection attacks") andsettings.json("Prevents config tampering"), and### Security Mitigationssays "Writable files are limited to authentication/state only" and "All configuration and code execution files remain read-only". Your own:98-101says the opposite, and your PR body says it plainly ("this is a real hole"). Reproduced against the exact manifest onmain, from a non-privileged container: read the host's OAuth token, read every host project's transcripts underprojects/, write aSessionStarthook into the host'ssettings.json(arbitrary command execution on the host), and clobber the host's.credentials.json.### Known Risksat:578-581names only the two old risks.CHANGELOG.md:397-441has the same gap — read forward, the standing statement is still the #108 entry at:1521-1523saying transcripts andprojects/are container-local and die with it. -
BLOCKING —
README.md:113and:380state the five-directory guarantee with no qualification. Both are new lines in this PR.mount -o remount,rwdefeats a read-only bind in any container withCAP_SYS_ADMIN, which is every container this repo builds —.devcontainer/devcontainer.json:76notes the DinD feature "brings"privileged": true". Measured: unprivileged, the write is refused andmountsays permission denied; privileged,remount,rwsucceeds and the host's~/.claude/skills/SKILL.mdis rewritten from inside the container. The weakness predates you (#108); the unqualified claim does not.
Non-blocking, also yours: install.sh:172-224 was never updated (stale banner, three-of-five directories, still seeds {} credentials — harmless only because it runs at build time under the mount); TROUBLESHOOTING.md:166-185 Issue 5 answers a symptom that can no longer occur and contradicts itself nine lines later; README.md:551-555 and :424-432 are two drifted copies of the host-prerequisite list that omit skills/+wf-skills/, so the documented recovery still fails the create; README.md:63 still says transcripts are not shared; and init-host.sh:143 creates the OAuth-token directory with the ambient umask (measured 775) two lines above mkdir -m 700 -p "$HOME/.ssh".
And one that cost #335: test/unit/test_init_host_heals_stale_mounts.py:208 derives the heal's parametrization from this README, so removing CLAUDE.md/settings.json from the read-only bullets dropped them from a test whose subject is what legacy containers still mount. Coverage went from 5 paths to 3 while init-host.sh:123-125 still heals 6.
Credit where it is due: the tests you added are strong. Four mutations of devcontainer-feature.json are all caught, including the exact tempting change your PR body predicts — re-adding a readonly file mount over settings.json fails 4 tests.
1 participant
The bug
Changing your Claude account on the host stopped reaching running devlaunch
containers. Measured on the reporter's machine, three running containers held
three different
.credentials.jsonfiles and none of them was the host's:217cb6d6…bd0627d8…94394dc5…Why
A bind mount of a file is attached to the dentry. When the host replaces it
by rename — which is what Claude does on every token refresh and on an account
switch — the mount is left pointing at an inode with no name. The container
reads it happily and forever, so nothing reports it as broken; the workspace
just goes on authenticating as the account you left.
Four of the feature's nine mounts were files, two of them the credentials and
account state. Note that the wayfinder devcontainer, which mounts
~/.claudeasa directory, was never affected — this was specific to the granular layout
introduced in 19d966e for #108.
The fix
Mount
~/.claudeas the directory, read-write. A directory mount resolves namesper access, so it follows the rename.
The read-only mounts over
CLAUDE.mdandsettings.jsongo with it, becausethey were not read-only. The same rename drops a nested file mount from the
namespace and the path falls through to the parent. Measured on Docker, both
ways round, because the direction of the failure follows the parent and neither
direction is safe:
So the read-only list is now exactly the five instruction directories, and every
source in the manifest is a directory. The test asserts that rather than the
paths, because the tempting change — protecting the two files by naming them
again — passes review, appears in
docker inspect, and stops being true on thenext edit.
The cost, stated plainly
CLAUDE.mdandsettings.jsonare writable from the container, andsettings.jsoncan name hook commands inline, so this is a real hole. It is thesame hole the previous layout had after one edit, minus the claim that it was
closed. #108's protection is kept for the five directories, where it is
enforceable.
Verification
test_every_mount_source_is_a_directory— the new invariant, red against theold manifest (8 of 9 unit tests fail there), green here.
test_the_container_follows_the_host_replacing_a_file_by_rename— new e2etest, driven through real devpod. On the old layout it fails with
assert 'after' in '{"account": "before"}'; on this one it passes.🤖 Generated with Claude Code
Summary by Sourcery
Ensure running Claude containers follow host account and configuration changes by switching to a live directory mount and retaining enforceable protection for instruction directories.
Bug Fixes:
Enhancements:
Documentation:
Tests: