From 935b6304ad0344ffa528f1bd1507f368d0e9e9a6 Mon Sep 17 00:00:00 2001
From: Anirudh Oppiliappan <anirudh@tangled.sh>
Date: Fri, 20 Jun 2025 17:17:56 +0300
Subject: [PATCH] spindle/engine: mount /tmp as world-writeable

Signed-off-by: Anirudh Oppiliappan <anirudh@tangled.sh>
---
 spindle/engine/engine.go | 11 +++++++----
 1 file changed, 7 insertions(+), 4 deletions(-)

diff --git a/spindle/engine/engine.go b/spindle/engine/engine.go
index 57dfacd8..54570805 100644
--- a/spindle/engine/engine.go
+++ b/spindle/engine/engine.go
@@ -253,11 +253,10 @@ func (e *Engine) StartSteps(ctx context.Context, steps []models.Step, wid models
 
 		select {
 		case <-waitDone:
-			// container finished normally
-			stepCancel()
 
 			// wait for tailing to complete
 			<-tailDone
+			stepCancel()
 
 		case <-stepCtx.Done():
 			e.l.Warn("step timed out; killing container", "container", resp.ID, "timeout", stepTimeout)
@@ -491,8 +490,12 @@ func hostConfig(wid models.WorkflowId) *container.HostConfig {
 				Target: "/nix",
 			},
 			{
-				Type:   mount.TypeTmpfs,
-				Target: "/tmp",
+				Type:     mount.TypeTmpfs,
+				Target:   "/tmp",
+				ReadOnly: false,
+				TmpfsOptions: &mount.TmpfsOptions{
+					Mode: 0o1777, // world-writeable sticky bit
+				},
 			},
 		},
 		ReadonlyRootfs: false,
-- 
2.51.2