From eb665273bf4f13ea3fd2b5e6f176a8e2aa1aaef3 Mon Sep 17 00:00:00 2001 From: Alyssa Date: Wed, 30 Sep 2026 07:47:37 +0000 Subject: [PATCH 1/2] entrypoint: keep the home-manager profile in the devhome volume The start-up probe reads /root/.local/state/nix/profiles/home-manager to decide whether the baked generation is already active. home-manager's activate script only writes its profile there when that directory already exists; otherwise it falls back to /nix/var/nix/profiles/per-user/root. The directory never existed in the volume, so every activation landed under /nix - which is baked into the image, not a volume - and vanished with the container. CURRENT was empty on every start, activation re-ran every start, and any in-container `home-manager switch` was reverted by the next start without a word. Evidence from a running container: per-user/root/home-manager-1-link is timestamped at that container's start and is always generation 1. Create the state dir before probing. home-manager then chooses it, the profile persists in devhome, and the existing probe line is correct as written. The alternative - probing the /nix path instead - would not have helped, since that path does not survive --rm either. Co-Authored-By: Claude Fable 5.1 --- docker/entrypoint.sh | 9 +++++++++ 1 file changed, 9 insertions(+) diff --git a/docker/entrypoint.sh b/docker/entrypoint.sh index 0a5d2560..7f9e5e1e 100755 --- a/docker/entrypoint.sh +++ b/docker/entrypoint.sh @@ -3,6 +3,15 @@ # (first start, or a fresh/reset devhome volume) or when the image carries a # newer generation than the one the volume was activated with. +# home-manager's activate script records its profile under +# $XDG_STATE_HOME/nix/profiles only when that directory already exists; it +# otherwise falls back to /nix/var/nix/profiles/per-user/root. /nix is baked +# into the image, not a volume, so the fallback link is gone on every --rm and +# CURRENT never matched BAKED: activation re-ran on every single start, and any +# in-container `home-manager switch` was silently reverted by the next start. +# Creating the state dir first makes the profile land in the devhome volume, +# which is the path probed below. +mkdir -p /root/.local/state/nix/profiles CURRENT=$(readlink -f /root/.local/state/nix/profiles/home-manager 2>/dev/null) BAKED=$(readlink -f /opt/hm-activation) From 5dd36fde41ad1ba63f92523287b8fcecf5bb8e19 Mon Sep 17 00:00:00 2001 From: Alyssa Date: Wed, 30 Sep 2026 07:47:37 +0000 Subject: [PATCH 2/2] agents: strip the legacy container doc from ~/.claude/CLAUDE.md Before #122 the Dockerfile and entrypoint copied docker/CLAUDE*.md over ~/.claude/CLAUDE.md. #122 moved that doc to ~/.claude/rules/container-env.md and stopped the copy, but ~/.claude lives in the claude-home volume and the sync script preserves everything outside the managed markers by design, so the old body stayed. Every session on such a volume loads the doc twice, and the stale copy still claims it is re-copied on every start. Teach the existing awk pass to skip from a legacy `# Machine: ... via Docker container` H1 to the next H1 or EOF. Both the arm64 and the 2012 MBP variants match; the legacy docs have only ## subsections, so the range is bounded by the doc itself. On a machine whose CLAUDE.md never had the heading the rule is inert. Verified against a live 78-line CLAUDE.md (reduces to the managed block) and a synthetic file where hand-written notes follow the legacy body (notes survive). Co-Authored-By: Claude Fable 5.1 --- home-manager/modules/tools/agents.nix | 10 +++++++++- 1 file changed, 9 insertions(+), 1 deletion(-) diff --git a/home-manager/modules/tools/agents.nix b/home-manager/modules/tools/agents.nix index 86590b1d..d1c134b7 100644 --- a/home-manager/modules/tools/agents.nix +++ b/home-manager/modules/tools/agents.nix @@ -82,11 +82,19 @@ let trap 'rm -f "$tmp" "$md.new"' EXIT # Strip the previous managed block, plus any bare import line an - # append-era generation left behind. Everything else is hand-edited. + # append-era generation left behind, plus the container doc that the + # Dockerfile and entrypoint used to copy into this file before #122 moved + # it to ~/.claude/rules/container-env.md. A claude-home volume keeps that + # old body forever otherwise, and it then loads twice per session with one + # copy stale. The legacy doc has only ## subsections, so skip from its H1 + # to the next H1 or EOF. Everything else is hand-edited. ${pkgs.gawk}/bin/awk ' /^