AIDC Init problems and fixes

Initializer failures return status 1 and name a configuration, IO or other error. Invalid command syntax returns status 2. Once the entrypoint hands over to your shell, command or systemd, that process owns its output and exit status.

The entrypoint ran as root and found no image marker at /etc/aidc/image/version, which the image feature writes at build time. Rebuild from an image that includes the feature, or confirm the container came from it. For a deliberate custom image, --force bypasses only this marker check:

The username has no default and must come from the environment. The numeric IDs can also come from mounted host identity files at /host/etc/passwd and /host/etc/group.

aidc-init setup needs exactly one of --devcontainer-build (at image build, with --user) or --devcontainer-run (at container start). Both need root: build mode normally runs in the feature's install script, and run mode through sudo, as postCreateCommand does. If sudo prompts or refuses, check the executable path and the generated /etc/sudoers.d/aidc-setup policy.

Run mode only reconciles what build mode wrote. Run build mode at image build first, then run mode at container start. If the file existed before, look for a later build step that clears /etc/aidc/image/.

The saved setup asks for systemd, directly or because the inner Docker daemon needs it, but the image ships none. Rebuild from a base with a minimal systemd, or build with --secured alone when systemd as the first process was not intended.

With no services enabled and no command, the entrypoint starts an interactive login shell, and a container without a terminal attached exits at once. Pass a long-lived command, or build with --secured so a no-command start keeps the container alive:

A step that runs as the configured user could not start gosu. The standard image includes it; a custom or stripped image may not. Install it in the image, or build from the standard base.

Access is aligned by numeric group ID without renumbering protected system groups, so a group can appear under a different name inside the container. Check the numeric memberships and the active socket:

With the inner Docker daemon enabled, the user joins the container's own docker group instead of the socket's group. AIDC_HOST_GROUPS replaces the whole supplementary list, so list every group the account needs.

GPU support needs the device nodes at container creation and the host driver files projected under /host. Check ls -l /dev/nvidia* and look for libGLX_nvidia.so.0 under /host/usr/lib. If the devices are missing, enable GPU passthrough in the launcher and recreate the container. Run the entrypoint with --debug to see whether wiring was skipped.