Seed writable Pi runtime config in Docker

Dockerfile

@@ -12,10 +12,14 @@ COPY shared ./shared
 COPY db/migrations ./db/migrations
 COPY scripts ./scripts
 RUN node scripts/stamp-asset-version.mjs
+COPY docker-entrypoint.sh /usr/local/bin/roast-command-center-entrypoint
+RUN chmod 755 /usr/local/bin/roast-command-center-entrypoint
 
-# The optional Pi agent configuration is mounted read-only here at runtime.
+# The optional Pi agent configuration is mounted read-only at /run and copied to this writable
+# runtime directory by the entrypoint; Pi's auth storage needs a sibling lock file.
 ENV HOME=/home/node
 RUN mkdir -p /home/node/.pi/agent && chown -R node:node /home/node/.pi
 USER node
 EXPOSE 8090
+ENTRYPOINT ["roast-command-center-entrypoint"]
 CMD ["node", "server/index.js"]

README.md

@@ -36,7 +36,7 @@ Generate `BOOTSTRAP_SETUP_TOKEN` with `openssl rand -base64 48`, keep it only in
 
 ### Pi agent configuration in Docker
 
-The `app` service mounts `PI_AGENT_CONFIG_DIR` (default `./appdata/pi-agent`) read-only at `/home/node/.pi/agent`, the non-root Node user's Pi configuration directory. This lets `/api/prefill` use the same configured model at runtime without baking credentials into the image. The directory is ignored by Git and Docker build context; do not commit its contents.
+The `app` service mounts `PI_AGENT_CONFIG_DIR` (default `./appdata/pi-agent`) read-only at `/run/pi-agent-config`. Its entrypoint copies that seed into the non-root Node user's writable runtime configuration directory before startup: Pi's credential storage needs to create a lock beside `auth.json`. This lets `/api/prefill` use the configured model without baking credentials into the image or mutating the host configuration. The directory is ignored by Git and Docker build context; do not commit its contents.
 
 Before bringing up the stack, sync only the local Pi agent configuration you intend to make available to the container:
 

docker-compose.yml

@@ -15,8 +15,8 @@ services:
     extra_hosts:
       - "host.docker.internal:host-gateway"
     volumes:
-      # Mount only non-secret Pi agent model/auth configuration; keep it read-only.
+      # Seed Pi's writable runtime config from this read-only credential mount.
-      - ${PI_AGENT_CONFIG_DIR:-./appdata/pi-agent}:/home/node/.pi/agent:ro
+      - ${PI_AGENT_CONFIG_DIR:-./appdata/pi-agent}:/run/pi-agent-config:ro
     depends_on:
       db:
         condition: service_healthy

docker-entrypoint.sh

@@ -0,0 +1,13 @@
+#!/bin/sh
+set -eu
+
+# The mounted Pi configuration contains credentials and must stay read-only. Pi's auth storage
+# takes a lock beside auth.json, so seed a writable per-container copy before the app starts.
+# That lets ModelRuntime read and refresh credentials without ever mutating the host mount.
+if [ -d /run/pi-agent-config ]; then
+	mkdir -p "$HOME/.pi/agent"
+	cp -a /run/pi-agent-config/. "$HOME/.pi/agent/"
+	chmod -R u+rwX "$HOME/.pi/agent"
+fi
+
+exec "$@"