[cf3901646]

Summary of Changes

When strix runs as a system service account (uid < 1000), the Caido sidecar fails to start because the demoted uid lacks a writable HOME directory. The issue is caused by STRIX_HOST_UID/STRIX_HOST_GID being injected into the container environment without setting HOME. This leads to caido-cli panicking when trying to write to an inaccessible directory.

Motivation & Context

Closes #1514

Verification

To verify the fix:

1. Run strix as a system service account (e.g., uid=997, nologin).
2. Execute a scan with --scan-mode quick -n.
3. Observe that the Caido sidecar starts successfully and the scan completes with the full toolchain available.
4. Check that loginAsGuest succeeds on the first attempt without bootstrap failures.

• Gate Report: Python syntax compiled: strix/runtime/docker_client.py; Notice: Python tests had failures in tests/

[greptile-apps]

Confidence Score: 4/5

[Medium impact] The change affects containers created through Strix's Docker sandbox path.

The PR should not merge until HOME points to a directory writable by the container user.

Findings

1.  Linux scans fail at startup ▶

Fix with agent prompt

### Issue 1
strix/runtime/docker_client.py:203-204
`_host_identity_env()` supplies `STRIX_HOST_UID` for every Linux user, including `"1000"` and `"0"`. This condition therefore sets `HOME=/root` for ordinary users too. The image runs as `pentester`, and the entrypoint skips changing users for those values, leaving a non-root process using root's home.

Caido cannot write there. Even if it starts, the entrypoint's append to `~/.bashrc` fails under `set -e`, stopping the container. Use `/home/pentester`, which the entrypoint already prepares for the scan user, rather than `/root`.

---

For each issue above, determine whether it is valid and should be fixed. If so, fix it directly.

Summary

The PR sets HOME=/root whenever the container receives a nonempty STRIX_HOST_UID.

• Docker sandbox containers with a host UID get HOME=/root.

_{Reviews (1) · Last reviewed commit: "fix(strix/runtime/docker_client.py): Set..." · Reviewed by Greptile}

[greptile-apps]

Linux scans fail at startup

_host_identity_env() supplies STRIX_HOST_UID for every Linux user, including "1000" and "0". This condition therefore sets HOME=/root for ordinary users too. The image runs as pentester, and the entrypoint skips changing users for those values, leaving a non-root process using root's home.

Caido cannot write there. Even if it starts, the entrypoint's append to ~/.bashrc fails under set -e, stopping the container. Use /home/pentester, which the entrypoint already prepares for the scan user, rather than /root.

Prompt To Fix With AI

This is a comment left during a code review.
Path: strix/runtime/docker_client.py
Line: 203-204

Comment:
**Linux scans fail at startup**

`_host_identity_env()` supplies `STRIX_HOST_UID` for every Linux user, including `"1000"` and `"0"`. This condition therefore sets `HOME=/root` for ordinary users too. The image runs as `pentester`, and the entrypoint skips changing users for those values, leaving a non-root process using root's home.

Caido cannot write there. Even if it starts, the entrypoint's append to `~/.bashrc` fails under `set -e`, stopping the container. Use `/home/pentester`, which the entrypoint already prepares for the scan user, rather than `/root`.

---

For each issue above, determine whether it is valid and should be fixed. If so, fix it directly.