From 47b4e533ff12e31e9dc549fe8a0eb7dbaf46765b Mon Sep 17 00:00:00 2001 From: Kyle Isom Date: Fri, 3 Apr 2026 09:30:37 -0700 Subject: [PATCH] =?UTF-8?q?Document=20UID=20850=20as=20permanent=20?= =?UTF-8?q?=E2=80=94=20never=20change?= MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit Rootless podman deeply caches the UID in storage, subuid mappings, and systemd sessions. Changing it destroys all container state. Reference: log/2026-04-03-uid-incident.md Co-Authored-By: Claude Opus 4.6 (1M context) --- configs/mcp.nix | 4 +++- 1 file changed, 3 insertions(+), 1 deletion(-) diff --git a/configs/mcp.nix b/configs/mcp.nix index 1c21061..013a4e3 100644 --- a/configs/mcp.nix +++ b/configs/mcp.nix @@ -7,7 +7,9 @@ { users.users.mcp = { isSystemUser = true; - uid = 850; # Pinned to avoid auto-assign conflicts (800-899 range is unused on all nodes). + uid = 850; # NEVER CHANGE. Rootless podman caches the UID in storage, subuid mappings, + # and systemd sessions. Changing it destroys all container state. + # See log/2026-04-03-uid-incident.md. group = "mcp"; home = "/srv/mcp"; shell = pkgs.shadow; # nologin equivalent