fix: mount shared PVC into write-prompt init container #12

2026-04-29T20:22:37Z

kkroo commented

2026-04-29 20:22:37 +00:00

(Migrated from github.com)

Problem

The `write-prompt` init container runs `mkdir -p /paperclip/instances/default/run-logs//` before the main `claude` container starts. The init container's `volumeMounts` only includes `prompt` (and `prompt-secret` on the large-prompt path); the shared `data` PVC mounted at `/paperclip` in the main container is missing.

So the mkdir tries to create `/paperclip` in the busybox overlay rootfs, where uid 1000 cannot write at `/`, and the Job fails before the main container ever runs:

```
mkdir: can't create directory '/paperclip/': Permission denied
```

Reproduced on kubeadm v1.35.3 / containerd 2.2.x / cephfs RWX with adapter v0.2.1 against `paperclip-adapter-claude-k8s@0.2.1` from npm.

Fix

Add `{ name: "data", mountPath: "/paperclip" }` to both branches of `initContainer.volumeMounts` (`useLargePromptPath` true and false) in `src/server/job-manifest.ts`. With the data mount in scope, the existing `mkdir -p /paperclip/.../run-logs/...` writes to the same shared PVC the main `claude` container reads from.

Verification

Reproduced the failure, applied the fix, and re-ran an end-to-end heartbeat against a real Paperclip control plane:

Without fix: pod `Init:Error`, init exit 1, `mkdir: can't create directory '/paperclip/': Permission denied`.
With fix: pod `Succeeded`, main container reaches the `claude` binary and exits cleanly.

The shared PVC is the same one the main container mounts (claim `paperclip-data`, RWX cephfs in our deployment), so no other manifest changes are needed.

Notes

I haven't added tests — the existing `job-manifest.test.ts` covers a lot of init-container shape but doesn't pin the mount list. Happy to add a test asserting both init branches include the `data` volumeMount if you'd prefer.
I didn't bump version — assumed maintainer prerogative for the release cadence.
The companion repo `paperclip-adapter-opencode-k8s` v0.1.38 is not affected — its init container only writes to `/tmp/prompt` and never touches `/paperclip`.

## Problem The \`write-prompt\` init container runs \`mkdir -p /paperclip/instances/default/run-logs/<companyId>/<agentId>\` before the main \`claude\` container starts. The init container's \`volumeMounts\` only includes \`prompt\` (and \`prompt-secret\` on the large-prompt path); the shared \`data\` PVC mounted at \`/paperclip\` in the main container is missing. So the mkdir tries to create \`/paperclip\` in the busybox overlay rootfs, where uid 1000 cannot write at \`/\`, and the Job fails before the main container ever runs: \`\`\` mkdir: can't create directory '/paperclip/': Permission denied \`\`\` Reproduced on kubeadm v1.35.3 / containerd 2.2.x / cephfs RWX with adapter v0.2.1 against \`paperclip-adapter-claude-k8s@0.2.1\` from npm. ## Fix Add \`{ name: "data", mountPath: "/paperclip" }\` to both branches of \`initContainer.volumeMounts\` (\`useLargePromptPath\` true and false) in \`src/server/job-manifest.ts\`. With the data mount in scope, the existing \`mkdir -p /paperclip/.../run-logs/...\` writes to the same shared PVC the main \`claude\` container reads from. ## Verification Reproduced the failure, applied the fix, and re-ran an end-to-end heartbeat against a real Paperclip control plane: - Without fix: pod \`Init:Error\`, init exit 1, \`mkdir: can't create directory '/paperclip/': Permission denied\`. - With fix: pod \`Succeeded\`, main container reaches the \`claude\` binary and exits cleanly. The shared PVC is the same one the main container mounts (claim \`paperclip-data\`, RWX cephfs in our deployment), so no other manifest changes are needed. ## Notes - I haven't added tests — the existing \`job-manifest.test.ts\` covers a lot of init-container shape but doesn't pin the mount list. Happy to add a test asserting both init branches include the \`data\` volumeMount if you'd prefer. - I didn't bump version — assumed maintainer prerogative for the release cadence. - The companion repo \`paperclip-adapter-opencode-k8s\` v0.1.38 is **not** affected — its init container only writes to \`/tmp/prompt\` and never touches \`/paperclip\`.

This pull request is broken due to missing fork information.

View command line instructions

Checkout

From your project repository, check out a new branch and test the changes.

git fetch -u origin kkroo/fix/init-container-data-mount:kkroo/fix/init-container-data-mount

git checkout kkroo/fix/init-container-data-mount

Sign in to join this conversation.

1 Participants

Notifications

Due Date

No due date set.

Dependencies

No dependencies set.

Reference: farhoodlabs/paperclip-adapter-claude-k8s#12