max / alloy

Write down how to rehearse a role in a container Four facts the fw13 rehearsals each cost a run to find: the bootc /home symlink means the tree mounts at /var/home, --user 1000:1000 brings a passwd home of / with it, --rm discards the cargo caches, and the image lives in the root store because the build is rootful.

Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_013wvegQEzB5piwPowYQ3ZbV

Author: Max Johnson <me@maxj.phd> · 2026-09-04 20:40 UTC

Signed with PGP, not checked

Commit: 4be640d2fb9dc14d85aeed73e3e2598dd56cf797

Parent: d82c3e3

1 file changed, +20 insertions, -0 deletions

M docs/IMAGE.md +20

			@@ -341,6 +341,26 @@
341	341		is `build/check-host.sh`'s `toolchain` row, which asks an installed machine for
342	342		the pinned channel and for those two components.
343	343
	344	+	## Rehearsing a role in a container
	345	+
	346	+	The four fw13 rehearsals ran the machine's real work inside a container from the
	347	+	built image, on the Pop install, before the disk was touched. Four things about
	348	+	that are not obvious and each one cost a run to find:
	349	+
	350	+	- Mount the tree at `/var/home/max/Code`, not `/home/max/Code`. On a bootc
	351	+	image `/home` is a symlink to `var/home` and `/var/home` does not exist, so
	352	+	podman cannot create the mountpoint through it. Mounted at the real path,
	353	+	`/home/max/Code/...` still resolves inside.
	354	+	- Run `--user 1000:1000`, or cargo's writes land root-owned in the tree.
	355	+	Note that podman then injects a passwd entry whose home is `/`, so anything
	356	+	inside that reads `$HOME` or passwd sees `/` rather than `/var/home/max`. Set
	357	+	`HOME` explicitly, and mount at `/Code` when running `check-host.sh` this way.
	358	+	- A `--rm` container takes its artifacts with it. Put `CARGO_TARGET_DIR`,
	359	+	`CARGO_HOME` and `RUSTUP_HOME` on a mounted volume; that also caches the
	360	+	dependency build and tauri-cli between rehearsals.
	361	+	- The image builds are rootful (see `build/build-image.sh`), so the image is
	362	+	in root's container store and `podman run` needs the same privilege to find it.
	363	+
344	364		## The answer sheet
345	365
346	366		A recipe can also answer the questions `alloy install` would otherwise ask. The