Using runc 1.3.0-rc1 has a HOME=/

[heitbaum]

I have tested runc 1.3.0-rc1 and ended up with a HOME=/ which is discussed above.
So assuming that this is a bug to be addressed before 1.3.0 is released?

Originally posted by @heitbaum in #3999 (comment)

Description

runc 1.3.0-rc1 does not set HOME

Steps to reproduce the issue

Compile LibreELEC docker addon with runc-1.3.0-rc1
Run Ubuntu docker image with bash

Describe the results you received and expected

HOME is not being set

What version of runc are you using?

1.3.0-rc1

Host OS information

cat /etc/os-release 
NAME="LibreELEC"
VERSION="devel-20250324084954-c83103b"
ID="libreelec"
VERSION_ID="13.0"
PRETTY_NAME="LibreELEC (heitbaum): devel-20250324084954-c83103b"
HOME_URL="https://libreelec.tv"
BUG_REPORT_URL="https://github.com/heitbaum/LibreELEC.tv"
BUILD_ID="c83103b9cfe831aa450f066eaeae5c7ba5ad776c"
LIBREELEC_ARCH="Generic.x86_64"
LIBREELEC_BUILD="heitbaum"
LIBREELEC_PROJECT="Generic"
LIBREELEC_DEVICE="Generic"
BUILDER_NAME="heitbaum"

Host kernel information

Linux nuc12 6.14.0-rc7 #1 SMP Mon Mar 24 09:10:25 UTC 2025 x86_64 GNU/Linux

[rata]

@heitbaum can you clarify how you are hitting this and share a repro? See the issue template and try to update the issue to match the format.

In particular, are you using libcontainer or the runc binary? Would it be a major problem to set the HOME env var?

[heitbaum]

@heitbaum can you clarify how you are hitting this and share a repro? See the issue template and try to update the issue to match the format.

I’ll update

In particular, are you using libcontainer or the runc binary? Would it be a major problem to set the HOME env var?

I don’t think setting HOME manually is an appropriate workaround.

It is a docker container that I experienced it in:
/storage/.kodi/addons/service.system.docker/bin/containerd-shim-runc-v2 -namespace moby -id 44b55ea81dafbf04e4f3d7cd571b70933c093755f3bc4a2a90588491e05ccb62 -address /var/run/docker/containerd/containerd.sock

Which is just a simple Ubuntu bash shell.

CONTAINER ID   IMAGE                        COMMAND                  CREATED             STATUS             PORTS     NAMES
44b55ea81daf   noble14:latest               "bash --login"           48 minutes ago      Up 48 minutes                frosty_mendel

docker run --log-driver none --workdir /var/media/DATA/home-rudi/LibreELEC.tv --privileged -v /var/run/dbus:/var/run/dbus -v /storage:/storage -it noble14:latest bash --login

Using the following Dockerfile. https://github.com/LibreELEC/LibreELEC.tv/blob/master/tools/docker/noble/Dockerfile

The set show HOME correctly in 1.2.6

docker@44b55ea81daf:~/LibreELEC.tv$ set
BASH=/usr/bin/bash
BASHOPTS=checkwinsize:cmdhist:complete_fullquote:expand_aliases:extquote:force_fignore:globasciiranges:globskipdots:hostcomplete:interactive_comments:login_shell:patsub_replacement:progcomp:promptvars:sourcepath
BASH_ALIASES=()
BASH_ARGC=([0]="0")
BASH_ARGV=()
BASH_CMDS=()
BASH_LINENO=()
BASH_LOADABLES_PATH=/usr/local/lib/bash:/usr/lib/bash:/opt/local/lib/bash:/usr/pkg/lib/bash:/opt/pkg/lib/bash:.
BASH_SOURCE=()
BASH_VERSINFO=([0]="5" [1]="2" [2]="21" [3]="1" [4]="release" [5]="x86_64-pc-linux-gnu")
BASH_VERSION='5.2.21(1)-release'
COLUMNS=109
DIRSTACK=()
EUID=1000
GROUPS=()
HISTFILE=/var/media/DATA/home-rudi/.bash_history
HISTFILESIZE=500
HISTSIZE=500
HOME=/var/media/DATA/home-rudi
HOSTNAME=44b55ea81daf
HOSTTYPE=x86_64
IFS=$' \t\n'
LANG=en_US.UTF-8
LANGUAGE=en_US:en
LC_ALL=en_US.UTF-8
LINES=13
MACHTYPE=x86_64-pc-linux-gnu
MAILCHECK=60
OPTERR=1
OPTIND=1
OSTYPE=linux-gnu
PATH=/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin
PIPESTATUS=([0]="0")
PPID=0
PS1='${debian_chroot:+($debian_chroot)}\u@\h:\w\$ '
PS2='> '
PS4='+ '
PWD=/var/media/DATA/home-rudi/LibreELEC.tv
SHELL=/bin/bash
SHELLOPTS=braceexpand:emacs:hashall:histexpand:history:interactive-comments:monitor
SHLVL=1
TERM=xterm
UID=1000
_=pwd
gawklibpath_append () 
{ 
    [ -z "$AWKLIBPATH" ] && AWKLIBPATH=`gawk 'BEGIN {print ENVIRON["AWKLIBPATH"]}'`;
    export AWKLIBPATH="$AWKLIBPATH:$*"
}
gawklibpath_default () 
{ 
    unset AWKLIBPATH;
    export AWKLIBPATH=`gawk 'BEGIN {print ENVIRON["AWKLIBPATH"]}'`
}
gawklibpath_prepend () 
{ 
    [ -z "$AWKLIBPATH" ] && AWKLIBPATH=`gawk 'BEGIN {print ENVIRON["AWKLIBPATH"]}'`;
    export AWKLIBPATH="$*:$AWKLIBPATH"
}
gawkpath_append () 
{ 
    [ -z "$AWKPATH" ] && AWKPATH=`gawk 'BEGIN {print ENVIRON["AWKPATH"]}'`;
    export AWKPATH="$AWKPATH:$*"
}
gawkpath_default () 
{ 
    unset AWKPATH;
    export AWKPATH=`gawk 'BEGIN {print ENVIRON["AWKPATH"]}'`
}
gawkpath_prepend () 
{ 
    [ -z "$AWKPATH" ] && AWKPATH=`gawk 'BEGIN {print ENVIRON["AWKPATH"]}'`;
    export AWKPATH="$*:$AWKPATH"
}

Here is the passwd file

docker@44b55ea81daf:~/LibreELEC.tv$ cat /etc/passwd
root:x:0:0:root:/root:/bin/bash
daemon:x:1:1:daemon:/usr/sbin:/usr/sbin/nologin
bin:x:2:2:bin:/bin:/usr/sbin/nologin
sys:x:3:3:sys:/dev:/usr/sbin/nologin
sync:x:4:65534:sync:/bin:/bin/sync
games:x:5:60:games:/usr/games:/usr/sbin/nologin
man:x:6:12:man:/var/cache/man:/usr/sbin/nologin
lp:x:7:7:lp:/var/spool/lpd:/usr/sbin/nologin
mail:x:8:8:mail:/var/mail:/usr/sbin/nologin
news:x:9:9:news:/var/spool/news:/usr/sbin/nologin
uucp:x:10:10:uucp:/var/spool/uucp:/usr/sbin/nologin
proxy:x:13:13:proxy:/bin:/usr/sbin/nologin
www-data:x:33:33:www-data:/var/www:/usr/sbin/nologin
backup:x:34:34:backup:/var/backups:/usr/sbin/nologin
list:x:38:38:Mailing List Manager:/var/list:/usr/sbin/nologin
irc:x:39:39:ircd:/run/ircd:/usr/sbin/nologin
_apt:x:42:65534::/nonexistent:/usr/sbin/nologin
nobody:x:65534:65534:nobody:/nonexistent:/usr/sbin/nologin
ubuntu:x:1002:1002:Ubuntu:/home/ubuntu:/bin/bash
docker:x:1000:1000::/var/media/DATA/home-rudi:/bin/bash

[rata]

@heitbaum so this report is about the development environment of libreelec?

@heitbaum Where is that value for home set? I don't see it in the docker file nor in the docker directory. What am I missing?

I see you updated the issue, thanks! But the information you added is rather vague. PLEASE consider as much as possible the repro case as a script, that anyone could run and hit the issue. This helps A LOT to avoid misunderstandings and have issues we can easily debug. If you don't specify things, its very easy to hit issue like: you were compiling this way, I was doing it this other way; I was checking the issue with this command but maybe you were doing it with another command, and the output doesn't match so we can't know if a fix might be what you expect or not, etc.

In fact, having a quick look, the HOME directory is set by the dockerfile. if my guess is true, then you would have realized this if you tried to create a more detailed repro case as I asked for. Therefore you would have to dig deeper and provide a repro that is indeed reproducible (again, if my guess is right).

[heitbaum]

@heitbaum so this report is about the development environment of libreelec?

Have now included simple Ubuntu Dockerfile reproducible case

@heitbaum Where is that value for home set? I don't see it in the docker file nor in the docker directory. What am I missing?

The home directory comes from /etc/passwd

I see you updated the issue, thanks! But the information you added is rather vague. PLEASE consider as much as possible the repro case as a script, that anyone could run and hit the issue. This helps A LOT to avoid misunderstandings and have issues we can easily debug. If you don't specify things, its very easy to hit issue like: you were compiling this way, I was doing it this other way; I was checking the issue with this command but maybe you were doing it with another command, and the output doesn't match so we can't know if a fix might be what you expect or not, etc.

In fact, having a quick look, the HOME directory is set by the dockerfile. if my guess is true, then you would have realized this if you tried to create a more detailed repro case as I asked for. Therefore you would have to dig deeper and provide a repro that is indeed reproducible (again, if my guess is right).

Probably misinterpretation - hopefully the below helps. HOME= is different between the to runc versions.

nuc12:~ # cat runc-test/Dockerfile 
FROM ubuntu:noble

ARG DEBIAN_FRONTEND=noninteractive

USER ubuntu

nuc12:~ # docker build --pull -t runc runc-test
DEPRECATED: The legacy builder is deprecated and will be removed in a future release.
            Install the buildx component to build images with BuildKit:
            https://docs.docker.com/go/buildx/

Sending build context to Docker daemon  2.048kB
Step 1/3 : FROM ubuntu:noble
noble: Pulling from library/ubuntu
Digest: sha256:72297848456d5d37d1262630108ab308d3e9ec7ed1c3286a32fe09856619a782
Status: Image is up to date for ubuntu:noble
 ---> a04dc4851cbc
Step 2/3 : ARG DEBIAN_FRONTEND=noninteractive
 ---> Using cache
 ---> 406706de0eac
Step 3/3 : USER ubuntu
 ---> Using cache
 ---> deb89f384389
Successfully built deb89f384389
Successfully tagged runc:latest

nuc12:~ # runc --version
runc version 1.2.6
commit: e89a29929c775025419ab0d218a43588b4c12b9a
spec: 1.2.0
go: go1.24.1
libseccomp: 2.6.0

nuc12:~ # docker run -it runc bash
ubuntu@28563f2ff525:/$ echo $HOME
/home/ubuntu
ubuntu@28563f2ff525:/$ grep ubuntu /etc/passwd
ubuntu:x:1000:1000:Ubuntu:/home/ubuntu:/bin/bash 
ubuntu@28563f2ff525:/$ exit
exit

nuc12:~ # systemctl stop docker

# replace runc 1.2.6 with runc 1.3.0-rc.1

nuc12:~ # systemctl start docker

nuc12:~ # runc --version
runc version 1.3.0-rc.1
commit: a00ce11e91eb54c9c1bdfd773d13d4cdd41bb206
spec: 1.2.1
go: go1.24.1
libseccomp: 2.6.0

nuc12:~ # docker run -it runc bash
ubuntu@25c28c7ded19:/$ echo $HOME
/  
ubuntu@25c28c7ded19:/$ exit
exit

[rata]

@heitbaum awesome, thanks a lot for the patience and the repro! A few more questions if you don't mind:

@kolyshkin do you have any thoughts on what to do here? It seems the USER directive in the dockerfile was causing the home to be set before.

Maybe we can have some heuristic like if $HOME is not set and WORKDIR was not set in the dockerfile, then try to parse this? I'm not a fan, though.

I'd like to try what crun does, just in case too.

[lifubang]

@heitbaum Thanks.
This is a bug introduced by 7dc2486, which moved HOME env check and set operation to a position before we chroot to the container's file system, so we wrongly used the host's /etc/passwd file to find the current user's default HOME.
This is easy to fix, it will be included in the next rc release.
Thanks again!