본문으로 건너뛰기
cccskills
무료GitHub에 공개

gorse-runasnonroot-failure

Fix Gorse recommendation engine pods crashing with "user: unknown userid 65532" error. Use when: (1) Gorse master/server/worker pods show CrashLoopBackOff or Error status, (2) Logs show "failed to get user directory" with unknown userid, (3) Running gorse containers with runAsNonRoot security context and custom UID. The gorse images call os.UserHomeDir() at startup which requires the UID to exist in /etc/passwd.

한국어 요약은 준비 중입니다. 원문 설명을 표시하고 있습니다.

divinevideo/divine-mobile
연동 도구Kubernetes
설치 방법 보기

포함된 파일(1)

  • SKILL.md2.8 KB

SKILL.md(원문)

설치하기 전에 에이전트에게 전달되는 지시 내용을 확인할 수 있습니다.

Gorse runAsNonRoot Container Failure

Problem

Gorse recommendation engine containers (master, server, worker) crash immediately on startup when running with Kubernetes runAsNonRoot: true and a custom UID like 65532.

Context / Trigger Conditions

  • Gorse pods show CrashLoopBackOff or Error status
  • Pod logs show: 
    {"level":"fatal","ts":...,"caller":"model/built_in.go:95","msg":"failed to get user directory","error":"user: unknown userid 65532"}
  • Deployment has securityContext.runAsNonRoot: true and runAsUser: 65532
  • Using official gorse images (zhenghaoz/gorse-master, zhenghaoz/gorse-server, zhenghaoz/gorse-worker)

Root Cause

The gorse codebase calls Go's os.UserHomeDir() during initialization in model/built_in.go. This function requires the running UID to have an entry in /etc/passwd. When running as a non-root user that doesn't exist in the container's passwd file, the lookup fails.

Solution

Remove the runAsNonRoot and runAsUser constraints from the pod security context:

# Before (broken)
spec:
  template:
    spec:
      securityContext:
        runAsNonRoot: true
        runAsUser: 65532
        fsGroup: 65532

# After (working)
spec:
  template:
    spec:
      securityContext:
        fsGroup: 1000

Apply to all gorse deployments:

  • deployment-master.yaml
  • deployment-server.yaml
  • deployment-worker.yaml
  • init-db-job.yaml (if using init job)

Verification

After updating the security context:

  1. Delete existing crashing pods: kubectl delete pods -l app.kubernetes.io/name=gorse -n gorse
  2. Wait for new pods to start
  3. Check logs: kubectl logs -l app=gorse-master -n gorse
  4. Verify master shows connection to data store and cache store

Notes

  • This is a limitation of the official gorse images, not a Kubernetes issue
  • The gorse project may fix this in future versions by not requiring home directory
  • If security policy requires non-root, you would need to build custom gorse images with proper /etc/passwd entries for the desired UID
  • Redis Stack images used for gorse cache have the same issue with UID 65532

Related Issues

  • Gorse GitHub: The images don't document this requirement
  • Similar issues affect other Go applications that use os.UserHomeDir()

리뷰

아직 리뷰가 없습니다. 사용해 본 소감을 남겨 주세요.

댓글

로그인 없이 쓸 수 있습니다. 사용 후기, 질문, 작동하지 않은 환경 등을 편하게 남겨 주세요.

아직 댓글이 없습니다. 첫 댓글을 남겨 보세요.

보내면 바로 공개됩니다. 이메일 주소나 전화번호 같은 개인 정보는 쓰지 마세요. URL은 2개까지입니다.

0 / 1,000자

이 양식은 reCAPTCHA로 보호되며 Google 개인정보처리방침 및 서비스 약관이 적용됩니다.

같은 저장소의 스킬

argocd-externalsecret-namespace-permission

무료

Fix ArgoCD ExternalSecret deployment failing with "namespace X is not permitted in project Y". Use when: (1) ExternalSecret shows OutOfSync in ArgoCD but won't sync, (2) ArgoCD application status shows "namespace X is not permitted in project 'infrastructure'", (3) ExternalSecret targets a namespace managed by a different ArgoCD project, (4) Using apps-of-apps pattern with separate infrastructure and application projects.

한국어 요약은 준비 중입니다. 원문 설명을 표시하고 있습니다.

divinevideo/divine-mobile2662026년 10월 20일 업데이트

art-direct

무료

Art direction for any content — reads text, PDF, Word, HTML, PPT, then proposes 2-3 creative directions with photography style, mood, and visual language. After selection, generates AI image prompts and visual briefs section-by-section. Use when the user shares content and needs visual direction, image sourcing, or creative direction for any material.

한국어 요약은 준비 중입니다. 원문 설명을 표시하고 있습니다.

divinevideo/divine-mobile2662026년 10월 20일 업데이트

async-await-null-race-condition

무료

Fix "Null check operator used on a null value" errors when an object is set to null during an async await. Use when: (1) Object reference is nullified while awaiting, (2) Code accesses object with ! after await returns, (3) Cancel/dispose operations run concurrently with async operations on same object. Solution: capture local reference before await.

한국어 요약은 준비 중입니다. 원문 설명을 표시하고 있습니다.

divinevideo/divine-mobile2662026년 10월 20일 업데이트

aws-v4-signing-custom-headers-gcs

무료

Add custom metadata headers (x-amz-meta-*) to AWS v4 signed requests for GCS S3-compatible API. Use when: (1) Adding custom metadata to GCS uploads via S3 API, (2) Getting signature mismatch errors after adding new headers, (3) x-amz-meta-* headers being ignored or causing 403 errors. Custom headers MUST be included in canonical headers and signed headers list.

한국어 요약은 준비 중입니다. 원문 설명을 표시하고 있습니다.

divinevideo/divine-mobile2662026년 10월 20일 업데이트

bash-herestring-newline-secrets

무료

Fix password/secret authentication failures caused by trailing newlines when creating Google Cloud secrets (or similar) with bash here-strings. Use when: (1) Password authentication fails with correct password, (2) Secret created with `<<< "value"` syntax, (3) Error like "password authentication failed" or "invalid token" despite correct value. Bash here-strings (`<<<`) add a trailing newline that corrupts secrets.

한국어 요약은 준비 중입니다. 원문 설명을 표시하고 있습니다.

divinevideo/divine-mobile2662026년 10월 20일 업데이트

blossom-content-addressed-url-filtering

무료

Fix silent video/media processing failures caused by URL extraction code that filters on file extensions (.mp4, .webm, .webp). Use when: (1) Media moderation, transcoding, or analysis silently skips files from Blossom or content-addressed storage servers, (2) URL extraction from Nostr event tags (imeta, r tags) drops URLs without recognized extensions, (3) CDN fallback URLs append .mp4 but the actual server uses extensionless content-addressed paths like /{sha256}. Common in Nostr video events (kind 34236) where different clients use different URL formats.

한국어 요약은 준비 중입니다. 원문 설명을 표시하고 있습니다.

divinevideo/divine-mobile2662026년 10월 20일 업데이트

divinevideo의 스킬 모두 보기

이 스킬의 문제 신고