fix(e2e): avoid recursive home chown in image build

Author: skulidropek

packages/app/src/lib/core/templates/dockerfile.ts

@@ -326,9 +326,12 @@ RUN set -eu; \
 
 const renderDockerfileWorkspace = (config: TemplateConfig): string =>
   `# Workspace path (supports root-level dirs like /repo)
-RUN mkdir -p ${config.targetDir} \
-  && chown -R 1000:1000 /home/${config.sshUser} \
-  && if [ "${config.targetDir}" != "/" ]; then chown -R 1000:1000 "${config.targetDir}"; fi
+RUN set -eu; \
+    HOME_DIR="/home/${config.sshUser}"; \
+    TARGET_DIR="${config.targetDir}"; \
+    mkdir -p "$HOME_DIR" "$TARGET_DIR"; \
+    chown 1000:1000 "$HOME_DIR"; \
+    if [ "$TARGET_DIR" != "/" ] && [ "$TARGET_DIR" != "$HOME_DIR" ]; then chown -R 1000:1000 "$TARGET_DIR"; fi
 
 RUN mkdir -p /opt/docker-git/bootstrap/.orch/auth/codex \
   /opt/docker-git/bootstrap/.orch/auth/codex-shared \

packages/lib/src/core/templates/dockerfile.ts

@@ -326,9 +326,12 @@ RUN set -eu; \
 
 const renderDockerfileWorkspace = (config: TemplateConfig): string =>
   `# Workspace path (supports root-level dirs like /repo)
-RUN mkdir -p ${config.targetDir} \
-  && chown -R 1000:1000 /home/${config.sshUser} \
-  && if [ "${config.targetDir}" != "/" ]; then chown -R 1000:1000 "${config.targetDir}"; fi
+RUN set -eu; \
+    HOME_DIR="/home/${config.sshUser}"; \
+    TARGET_DIR="${config.targetDir}"; \
+    mkdir -p "$HOME_DIR" "$TARGET_DIR"; \
+    chown 1000:1000 "$HOME_DIR"; \
+    if [ "$TARGET_DIR" != "/" ] && [ "$TARGET_DIR" != "$HOME_DIR" ]; then chown -R 1000:1000 "$TARGET_DIR"; fi
 
 RUN mkdir -p /opt/docker-git/bootstrap/.orch/auth/codex \
   /opt/docker-git/bootstrap/.orch/auth/codex-shared \

packages/lib/tests/core/templates.test.ts

@@ -147,6 +147,15 @@ describe("renderDockerfile", () => {
     expect(dockerfile).not.toContain('RUN printf "export PATH=/usr/local/bun/bin:$PATH\\n"')
   })
 
+  it("does not recursively chown the inherited home directory from the base image", () => {
+    const dockerfile = renderDockerfile(makeTemplateConfig())
+
+    expect(dockerfile).toContain('chown 1000:1000 "$HOME_DIR"')
+    expect(dockerfile).toContain('chown -R 1000:1000 "$TARGET_DIR"')
+    expect(dockerfile).not.toContain("chown -R 1000:1000 /home/dev")
+    expect(dockerfile).not.toContain("chown -R 1000:1000 /home/${config.sshUser}")
+  })
+
   it("installs session sync from npmjs with a local fallback", () => {
     const dockerfile = renderDockerfile(makeTemplateConfig())