From 26800ddf8be47b5fe97ff20a09f19dae6a5a8557 Mon Sep 17 00:00:00 2001 From: Doron Chen Date: Mon, 10 Aug 2026 10:46:07 +0300 Subject: [PATCH] fix(swe-agent): grant agent uid write access to /workspace MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit run.sh creates /workspace/repo at container start as uid 1002 (the eval framework's agent user), but / stays root:root 755 from the base image, so mkdir failed with EACCES before the agent ever ran ("mkdir: cannot create directory '/workspace': Permission denied", agent exit code 1, task reward 0). Pre-create /workspace at build time and chown it to uid 1002, matching the pattern already used for /root, /root/tools, and appworld's /app. Verified with: eval-containers run swe-bench --agent swe-agent --model gcp/gemini-3.5-flash-lite --local --task-id astropy__astropy-12907 — agent now starts, connects to the model, and writes to /workspace without permission errors. Checked against: .agents/benchmarks/RULES.md Signed-off-by: Doron Chen --- containers/agents/swe-agent/Dockerfile | 4 ++++ 1 file changed, 4 insertions(+) diff --git a/containers/agents/swe-agent/Dockerfile b/containers/agents/swe-agent/Dockerfile index c57362fa..83b6b7be 100644 --- a/containers/agents/swe-agent/Dockerfile +++ b/containers/agents/swe-agent/Dockerfile @@ -27,6 +27,10 @@ git clone --depth 1 --branch v${AGENT_VERSION} https://github.com/SWE-agent/SWE- # framework runs the agent as uid 1002, so open up /root at build time. chmod 0777 /root && mkdir -p /root/tools && chmod 0777 /root/tools touch /root/.swe-agent-env /root/state.json && chmod 0666 /root/.swe-agent-env /root/state.json +# run.sh creates /workspace/repo at container start as uid 1002; / stays +# root:root 755 from the base image, so pre-create it here (build time, as +# root) and grant the agent group write access. +mkdir -p /workspace && chown 1002:0 /workspace && chmod g+rwX /workspace I RUN cat > /run.sh <<'E' && chmod +x /run.sh