feat(containers): per-container user/group/homeDir + config-only isBuilding (RIG-2404)

[rigel-mintaka]

Ports the Compass agent-image patch set onto src/modules/containers.nix so this shared canonical fork carries the container-identity machinery the Compass agent base image needs. This is the L0a slice of the compass forks-reversal (RIG-2336): the patch that lived as a vendored subtree in compass/forks/devenv/ moves here, into the fork repo it belongs to.

What changes (all in src/modules/containers.nix)

• Per-container user / group / homeDir options. Upstream hardcodes user user with $HOME=/env module-wide; these move the passwd/group/shadow rows, the file-ownership perms, and the image config's User/HOME/USER together per container. Upstream's values are kept as the defaults (user, /env), so a consumer that sets none of them resolves to a byte-identical image — the identity is preserved by construction (the parameterized script bodies keep upstream's exact bytes, including line breaking, since a comment inside runCommand's text is part of the build command and shifts the derivation hash on its own).
• Config-only buildingContainer / buildingHomeDir lookup, replacing the impure envContainerName = builtins.getEnv "DEVENV_CONTAINER" and the two config blocks it drove. The env path is dead: the nix backend already forces both container.isBuilding and containers.<name>.isBuilding (lib.mkForce true), and nothing in the tree writes DEVENV_CONTAINER. Reading identity out of an impure getEnv while the options already carry it is two sources of truth; the config-only lookup keeps one.
• config.env serialized directly into the image config Env (plus HOME/USER from the resolved identity), matching the merged base. No DEVENV_-prefix filter in the module: a reusable module applies the minimal fix, not a blanket namespace strip. The one real leak (DEVENV_PROFILE, an absolute /nix/store path that acts as a closure root) is neutralized consumer-side, gated on isBuilding, exactly as orion already ships it — so this module stays byte-faithful to the currently-shipping image and a future consumer can drop its own override once every consumer relies on the module default.

Base & verification

Rebased onto this fork's current main (1a7cae09, the merged writable-$HOME change RIG-2368), not cherry-picked from the vendored bytes — the identity was re-established against the merged base.

Byte-identity nix-eval check (the gate the design requires): a default-identity container (copyToRoot = [ ], no user/group/homeDir override) resolves to the same image-spec store path on both this patched tree and the unpatched base — myvgpmpylndahwlza46mr4bqkfjhw4nd-image-devenv-shell-probe.json. The refactor is proven-pure for the default path; upstream devenv CI does not exercise the $HOME property, so this check — not the fork repo's own CI — is what proves the port.

CI status (triaged)

• generate-docs — success. This is the defect L0a targets: the workflow's EndBug/add-and-commit auto-commit step is push-gated and 403s under github-actions[bot], so the regenerated docs/gen options were committed locally in this PR. Green confirms the regen matches.
• assign-reviewers — success.
• pipeline (aarch64-linux | x86_64-linux | aarch64-darwin) / build — queued indefinitely, expected. These legs require self-hosted runners (pr-test.yml matrix: ["self-hosted", "linux", "ARM64"] etc.) from the upstream devenv fleet that this fork does not have — runnerName never assigns. "PR Test" has never completed on this repo (all historical runs cancelled/queued). This is an environment gap, not a code defect. They are not merge-blocking: main has no branch protection (404) and no rulesets (gh api .../rules/branches/main → empty).

Spec-impact: none. Refs RIG-2404

Co-authored-by: Matt Wilkinson matt@rigel.build

[linear-code]

RIG-2404

[github-actions]

🔍 Suggested Reviewers

Based on git blame analysis of the changed lines, the following contributors have significant experience with the modified code:

• @domenkozar - 64.2% of changed lines (34 lines)
• @mcdonc - 26.4% of changed lines (14 lines)

Please consider reviewing this PR as you have authored significant portions of the code being modified. Your expertise would be valuable! 🙏

This comment was automatically generated by git-blame-auto-reviewer

Last updated: 2026-08-21T21:33:44.067Z