From 0b61865f3615db80b9bace258c1ae252e8e6c70b Mon Sep 17 00:00:00 2001 From: Claude Date: Thu, 16 Jul 2026 18:29:31 +0000 Subject: [PATCH] fix(claude_desktop): pin selkies base image to a fixed version build.json used the rolling ghcr.io/linuxserver/baseimage-selkies :*-debianbookworm tag, which LinuxServer rebuilds continuously (and which itself installs selkies "latest" at base-build time). The desktop/stream runtime could therefore change under the add-on with no change to its own files. Pin both architectures to the current version (45960cc3-ls113). The versioned tags resolve to exactly the image the rolling tag points at today (amd64 sha256:6a4d5154..., aarch64 sha256:90914dfd...), so this is a no-op for the current build but makes future builds reproducible; the base now only moves when this value is bumped deliberately. Co-Authored-By: Claude Opus 4.8 Claude-Session: https://claude.ai/code/session_014iAzC9599AaN45Ko6RXtSW --- claude_desktop/CHANGELOG.md | 1 + claude_desktop/build.json | 4 ++-- 2 files changed, 3 insertions(+), 2 deletions(-) diff --git a/claude_desktop/CHANGELOG.md b/claude_desktop/CHANGELOG.md index 9aae42b3a2..50733300cc 100644 --- a/claude_desktop/CHANGELOG.md +++ b/claude_desktop/CHANGELOG.md @@ -1,5 +1,6 @@ ## 1.31 (16-07-2026) +- Pin the LinuxServer selkies base image to a fixed version (`…-debianbookworm-45960cc3-ls113`) instead of the rolling `…-debianbookworm` tag. The rolling tag is rebuilt continuously (and itself installs selkies "latest" at base-build time), so the desktop/stream runtime could change under the add-on with no change to its own files — builds are now reproducible and the base only moves when this value is bumped deliberately. The pinned tags resolve to exactly the image the rolling tag currently points at (amd64 `sha256:6a4d5154…`, aarch64 `sha256:90914dfd…`). - Fix Claude Desktop never appearing — the Selkies web client stayed on "waiting for stream" forever with `libEGL warning: failed to open /dev/dri/card0: Permission denied` in the log. The LinuxServer base image grants the desktop user (`abc`) access to the `/dev/dri` render nodes in its `init-video` s6 oneshot, but that oneshot is not a dependency of `svc-xorg`/`svc-selkies`/`svc-de`, so on Home Assistant those long-running services regularly start (via `s6-setuidgid abc`) *before* `abc` has been added to the render group. Xorg/Selkies/pixelflux then open the render device without permission, the video pipeline produces no frames, and the stream never starts. Prepare the exposed DRI nodes in a new `21-gpu_permissions.sh` cont-init script instead: `cont-init.d` runs to completion before any s6-rc service starts, so `abc` is added to each node's owning group (and the node is made world read/write as a timing-independent fallback) in time for the graphical services to use the GPU. Best-effort and a no-op on hosts that expose no GPU. ## 1.30 (16-07-2026) diff --git a/claude_desktop/build.json b/claude_desktop/build.json index 5ab1765eeb..826ca38614 100644 --- a/claude_desktop/build.json +++ b/claude_desktop/build.json @@ -1,6 +1,6 @@ { "build_from": { - "aarch64": "ghcr.io/linuxserver/baseimage-selkies:arm64v8-debianbookworm", - "amd64": "ghcr.io/linuxserver/baseimage-selkies:amd64-debianbookworm" + "aarch64": "ghcr.io/linuxserver/baseimage-selkies:arm64v8-debianbookworm-45960cc3-ls113", + "amd64": "ghcr.io/linuxserver/baseimage-selkies:amd64-debianbookworm-45960cc3-ls113" } }