Updating to :latest (dev) is failing

[bondskin]

":latest" image does not start.

> docker logs ha-mcp
Traceback (most recent call last):
  File "/app/.venv/bin/ha-mcp-web", line 10, in <module>
    sys.exit(main_web())
             ~~~~~~~~^^
  File "/app/src/ha_mcp/__main__.py", line 758, in main_web
    _run_http_server("http", default_port=8086)
    ~~~~~~~~~~~~~~~~^^^^^^^^^^^^^^^^^^^^^^^^^^^
  File "/app/src/ha_mcp/__main__.py", line 739, in _run_http_server
    register_browser_landing(_get_mcp(), path)
                             ~~~~~~~~^^
  File "/app/src/ha_mcp/__main__.py", line 323, in _get_mcp
    _server = _create_server()
  File "/app/src/ha_mcp/__main__.py", line 309, in _create_server
    return HomeAssistantSmartMCPServer()
  File "/app/src/ha_mcp/server.py", line 93, in __init__
    self._initialize_server()
    ~~~~~~~~~~~~~~~~~~~~~~~^^
  File "/app/src/ha_mcp/server.py", line 151, in _initialize_server
    self._apply_settings_visibility()
    ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~^^
  File "/app/src/ha_mcp/server.py", line 335, in _apply_settings_visibility
    config = load_tool_config(self.settings)
  File "/app/src/ha_mcp/settings_ui.py", line 125, in load_tool_config
    path = _get_config_path()
  File "/app/src/ha_mcp/settings_ui.py", line 119, in _get_config_path
    home_dir.mkdir(parents=True, exist_ok=True)
    ~~~~~~~~~~~~~~^^^^^^^^^^^^^^^^^^^^^^^^^^^^^
  File "/usr/local/lib/python3.13/pathlib/_local.py", line 722, in mkdir
    os.mkdir(self, mode)
    ~~~~~~~~^^^^^^^^^^^^
OSError: [Errno 30] Read-only file system: '/.ha-mcp'
Traceback (most recent call last):
  File "/app/.venv/bin/ha-mcp-web", line 10, in <module>
    sys.exit(main_web())
             ~~~~~~~~^^
  File "/app/src/ha_mcp/__main__.py", line 758, in main_web
    _run_http_server("http", default_port=8086)
    ~~~~~~~~~~~~~~~~^^^^^^^^^^^^^^^^^^^^^^^^^^^
  File "/app/src/ha_mcp/__main__.py", line 739, in _run_http_server
    register_browser_landing(_get_mcp(), path)
                             ~~~~~~~~^^
  File "/app/src/ha_mcp/__main__.py", line 323, in _get_mcp
    _server = _create_server()
  File "/app/src/ha_mcp/__main__.py", line 309, in _create_server
    return HomeAssistantSmartMCPServer()
  File "/app/src/ha_mcp/server.py", line 93, in __init__
    self._initialize_server()
    ~~~~~~~~~~~~~~~~~~~~~~~^^
  File "/app/src/ha_mcp/server.py", line 151, in _initialize_server
    self._apply_settings_visibility()
    ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~^^
  File "/app/src/ha_mcp/server.py", line 335, in _apply_settings_visibility
    config = load_tool_config(self.settings)
  File "/app/src/ha_mcp/settings_ui.py", line 125, in load_tool_config
    path = _get_config_path()
  File "/app/src/ha_mcp/settings_ui.py", line 119, in _get_config_path
    home_dir.mkdir(parents=True, exist_ok=True)
    ~~~~~~~~~~~~~~^^^^^^^^^^^^^^^^^^^^^^^^^^^^^
  File "/usr/local/lib/python3.13/pathlib/_local.py", line 722, in mkdir
    os.mkdir(self, mode)
    ~~~~~~~~^^^^^^^^^^^^
OSError: [Errno 30] Read-only file system: '/.ha-mcp'
Traceback (most recent call last):
  File "/app/.venv/bin/ha-mcp-web", line 10, in <module>
    sys.exit(main_web())
             ~~~~~~~~^^
  File "/app/src/ha_mcp/__main__.py", line 758, in main_web
    _run_http_server("http", default_port=8086)
    ~~~~~~~~~~~~~~~~^^^^^^^^^^^^^^^^^^^^^^^^^^^
  File "/app/src/ha_mcp/__main__.py", line 739, in _run_http_server
    register_browser_landing(_get_mcp(), path)
                             ~~~~~~~~^^
  File "/app/src/ha_mcp/__main__.py", line 323, in _get_mcp
    _server = _create_server()
  File "/app/src/ha_mcp/__main__.py", line 309, in _create_server
    return HomeAssistantSmartMCPServer()
  File "/app/src/ha_mcp/server.py", line 93, in __init__
    self._initialize_server()
    ~~~~~~~~~~~~~~~~~~~~~~~^^
  File "/app/src/ha_mcp/server.py", line 151, in _initialize_server
    self._apply_settings_visibility()
    ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~^^
  File "/app/src/ha_mcp/server.py", line 335, in _apply_settings_visibility
    config = load_tool_config(self.settings)
  File "/app/src/ha_mcp/settings_ui.py", line 125, in load_tool_config
    path = _get_config_path()
  File "/app/src/ha_mcp/settings_ui.py", line 119, in _get_config_path
    home_dir.mkdir(parents=True, exist_ok=True)
    ~~~~~~~~~~~~~~^^^^^^^^^^^^^^^^^^^^^^^^^^^^^
  File "/usr/local/lib/python3.13/pathlib/_local.py", line 722, in mkdir
    os.mkdir(self, mode)
    ~~~~~~~~^^^^^^^^^^^^
OSError: [Errno 30] Read-only file system: '/.ha-mcp'
Traceback (most recent call last):
  File "/app/.venv/bin/ha-mcp-web", line 10, in <module>
    sys.exit(main_web())
             ~~~~~~~~^^
  File "/app/src/ha_mcp/__main__.py", line 758, in main_web
    _run_http_server("http", default_port=8086)
    ~~~~~~~~~~~~~~~~^^^^^^^^^^^^^^^^^^^^^^^^^^^
  File "/app/src/ha_mcp/__main__.py", line 739, in _run_http_server
    register_browser_landing(_get_mcp(), path)
                             ~~~~~~~~^^
  File "/app/src/ha_mcp/__main__.py", line 323, in _get_mcp
    _server = _create_server()
  File "/app/src/ha_mcp/__main__.py", line 309, in _create_server
    return HomeAssistantSmartMCPServer()
  File "/app/src/ha_mcp/server.py", line 93, in __init__
    self._initialize_server()
    ~~~~~~~~~~~~~~~~~~~~~~~^^
  File "/app/src/ha_mcp/server.py", line 151, in _initialize_server
    self._apply_settings_visibility()
    ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~^^
  File "/app/src/ha_mcp/server.py", line 335, in _apply_settings_visibility
    config = load_tool_config(self.settings)
  File "/app/src/ha_mcp/settings_ui.py", line 125, in load_tool_config
    path = _get_config_path()
  File "/app/src/ha_mcp/settings_ui.py", line 119, in _get_config_path
    home_dir.mkdir(parents=True, exist_ok=True)
    ~~~~~~~~~~~~~~^^^^^^^^^^^^^^^^^^^^^^^^^^^^^
  File "/usr/local/lib/python3.13/pathlib/_local.py", line 722, in mkdir
    os.mkdir(self, mode)
    ~~~~~~~~^^^^^^^^^^^^
OSError: [Errno 30] Read-only file system: '/.ha-mcp'

Switching back to :stable works.

[github-actions]

❌ Evaluation failed

An error occurred:

YOLO mode is enabled. All tool calls will be automatically approved.
Approval mode overridden to "default" because the current folder is not trusted.
YOLO mode is enabled. All tool calls will be automatically approved.
Approval mode overridden to "default" because the current folder is not trusted.
�[31mGemini CLI is not running in a trusted directory. To proceed, either use `--skip-trust`, set the `GEMINI_CLI_TRUST_WORKSPACE=true` environment variable, or trust this directory in interactive mode. For more details, see https://geminicli.com/docs/cli/trusted-folders/#headless-and-automated-environments�[0m

Please check the workflow logs.

[Patch76]

Thanks for the stack trace — pinpoints it cleanly.

The path /.ha-mcp (leading slash, no /home/mcpuser prefix) means Path.home() resolves to /. Root cause: Docker doesn't auto-derive HOME from /etc/passwd when a USER directive is set (moby/moby#2968, #1493) — it leaves HOME=/ by default. The Dockerfile only sets PATH / HA_MCP_BUILD_VERSION / HOMEASSISTANT_* env vars, no ENV HOME=/home/mcpuser. So at runtime under USER mcpuser, HOME=/, and Path.home() / ".ha-mcp" resolves to /.ha-mcp.

This was introduced by #960 (feat: web-based settings UI for per-tool enable/disable/pin, merged 2026-05-02 at 21:20 UTC) which added _get_config_path() in src/ha_mcp/settings_ui.py:114-120. The code unconditionally mkdirs the home dir on every server start, with no fallback for unwritable home cases. v7.4.1 (current :stable) was published 11 minutes before #960 merged, which is why :stable doesn't hit this and :latest does (the dev-channel publish-on-push-to-master workflow has overwritten :latest since).

Fix direction in _get_config_path(): any one resolves the immediate breakage —

• Wrap home_dir.mkdir(...) in try/except OSError and fall back to tempfile.gettempdir() / ".ha-mcp" (loses persistence across restarts but server starts).
• Detect Path.home() == Path("/") (or unwritable home) and skip the settings-UI config-persistence path entirely (log a warning, run with in-memory config defaults).
• Honor an HA_MCP_CONFIG_DIR env var so users with non-standard Docker setups can point it at a writable bind-mount.

src/ha_mcp/utils/usage_logger.py:120 already uses the same Path.home() / ".ha-mcp" pattern but wraps it in try/except OSError so it silently disables instead of crashing — the settings-UI path should adopt the same shape (or share a helper).

Workaround until fixed:

• Pass -e HOME=/home/mcpuser (or any writable path) on docker run — that's what the Dockerfile implicitly assumes.
• Or stay on :stable until the fix lands.

(Sidenote: the ❌ Evaluation failed comment from the triage bot above is unrelated noise — known issue tracked in #1122.)

[bondskin]

Hi @Patch76 ,

Thank you, I can wait and reverted to ":stable" for the moment.
But I don't understand the nature of this issue.
In my Compose file for ha-cmp I am nowhere mentioning "home"

(below is the current config, using :stable)

ha-mcp:
        container_name: ha-mcp
        ports:
            - 8142:8086
        environment:
            - HOMEASSISTANT_URL=${HOMEASSISTANT_URL}
            - HOMEASSISTANT_TOKEN=${HOMEASSISTANT_TOKEN}
        image: ghcr.io/homeassistant-ai/ha-mcp:stable
        command: ha-mcp-web
        networks: 
        - net_homelab
        restart: unless-stopped
        deploy:
            resources:
                limits:
                    cpus: '0.50'
                    memory: 256M  
                reservations:
                    memory: 128M
        security_opt:
          - no-new-privileges:true
        read_only: true
        user: "1000:1000" 
        tmpfs:
          - /tmp