fix(executor): make session mounts writable by the runner

[thecodacus]

A runner image's non-root USER cannot write a root-owned session bind mount. Reproduced this on Cortex with a disposable CPU-only container: UID 1000 failed with EACCES against a new root-owned directory; UID 0 wrote successfully.

Create the session directory as the portal user before Docker starts, check it is writable, and pass that user's numeric UID:GID to the runner. This is root only when the portal itself is root. Preserve --rm, capability dropping, and no-new-privileges; document custom-image and existing-directory ownership requirements.

Validation: server build; fake-Docker launch regression checks directory ownership/mode and actual launch arguments; the disposable-container permission reproduction above. No production container was changed.

Fixes #16. The separate mount-namespace correction is PR #26; both are relevant when the portal runs in Docker.

[coderabbitai]

Warning

Review limit reached

Next included review available in 43 minutes.

Check out review usage here.

View limit details

Limit details: You’ve used all 2 included reviews currently available.

You've used all free OSS reviews for now. Wait for the free limit to reset to keep reviewing this public repository.

Learn how review limits work.

Review configuration:

⚙️ Run configuration

Configuration used: defaults

Review profile: CHILL

Plan: Advanced

Run ID: b431ad64-a95d-4eb3-83bb-2527ae452582

📥 Commits

Reviewing files that changed from the base of the PR and between 0dcb312 and e8d1210.

📒 Files selected for processing (3)

• docs/guide/deploying.md
• server/src/executors/index.ts
• tests/runner-permissions.test.mts

---

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands.}