feat(installer): provision Docker for the daily user during the elevated window (#418) by shujaatTracebloc · Pull Request #493 · tracebloc/client

shujaatTracebloc · 2026-07-30T11:55:59Z

What & why

Hospital/enterprise reality: the researcher gets a temporary admin window (or IT runs the install), then elevation is revoked. Today Docker Desktop only auto-adds the installing user to docker-users, autostart + the WSL memory budget are printed Hints — so the researcher's standard account can end up with a broken Docker, a cluster that doesn't recover after reboot, and a 50%-of-RAM VM that OOMs training. The installer runs elevated, so it should just do it.

Changes (`scripts/install-k8s.ps1`)

New Set-DailyUserProvisioning (warn-only; TRACEBLOC_SKIP_DAILY_USER opts out), run during the elevated session:

Resolves the daily user — -DailyUser param, else a prompt when an admin installs for someone else, else the current account (Resolve-DailyUser strips the domain).
net localgroup docker-users <user> /add so the standard account can use Docker.
Docker Desktop autostart via the per-user Run key. (The engine also runs as a service from --always-run-service (feat(installer): control Docker Desktop install flags (--accept-license --backend=wsl-2) #419), so Docker is usable on sign-in regardless, and cluster nodes already carry restart=unless-stopped — so the cluster recovers.)
Training-sized %UserProfile%\.wslconfig — Get-WslConfigMemoryGb = physical RAM − 4 GB (floored) — written for the daily user, preserving an existing tuned file. It applies at the daily user's next sign-in (the acceptance scenario), so we deliberately do notwsl --shutdown and tear down the just-built cluster mid-install.
Prints a "Configured for <user>: …" summary so IT can review what changed.

Acceptance (from #418)

Accept/prompt the daily username; docker-users add
Enable Docker Desktop autostart for that user
Write sized .wslconfig (capped at physical − 4 GB)
"configured for <user>" summary
Standard user next day: Docker starts (service + docker-users), cluster auto-recovers (restart=unless-stopped), budget training-capable — zero admin actions

Scope notes

The .wslconfig takes effect at the daily user's next sign-in/reboot — the exact "next day" acceptance scenario — so no disruptive mid-install wsl --shutdown.
Per-user autostart is set via the Run key for the current account; a different daily user's hive may not be loaded, but --always-run-service (feat(installer): control Docker Desktop install flags (--accept-license --backend=wsl-2) #419) already makes Docker usable for them on sign-in.

Tests

Pure helpers (Get-WslConfigMemoryGb cap/floor, Get-WslConfigContent, Resolve-DailyUser) + source guards (docker-users add, .wslconfig preserve-existing, opt-out + wiring).

Local verification

Pester 309/0/9 · check-style pass · drift clean · manifest regenerated · PS parse OK. (No bash changes — bats unaffected.)

Closes#418

Note

Medium Risk
Changes local group membership and per-user registry/files on the host during install; failures are warn-only but mis-provisioned docker-users would block non-admin Docker use.

Overview
Adds daily-user provisioning to the Windows installer so IT can configure the researcher's standard account while elevation is still available, instead of leaving Docker usable only for whoever ran the install.

After a successful client install, Set-DailyUserProvisioning (warn-only; TRACEBLOC_SKIP_DAILY_USER to skip) resolves the target user via -DailyUser, an optional prompt, or the current account, then adds them to docker-users (verified with Test-LocalGroupMember, not localized net output), sets Docker Desktop autostart for the installing user when applicable, and merges a training-sized [wsl2] memory= into the user's .wslconfig (host RAM − 4 GB, preserving existing tuning). -DailyUser is forwarded through UAC self-elevation so it survives relaunch.

Pester coverage covers the pure helpers and source guards; scripts/manifest.sha256 is updated for install-k8s.ps1.

^{Reviewed by Cursor Bugbot for commit a183119. Bugbot is set up for automated code reviews on this repo. Configure here.}

…indow Hospital/enterprise reality: the researcher gets a temporary admin window (or IT installs), then elevation is revoked -- leaving the standard account unable to use Docker, a cluster that may not recover, and a 50%-of-RAM VM that OOMs training. The installer runs elevated, so provision the day-to-day account now. New Set-DailyUserProvisioning (warn-only; TRACEBLOC_SKIP_DAILY_USER opts out): - Resolves the daily user (-DailyUser param, else prompt when an admin installs for someone else, else the current account); Resolve-DailyUser strips the domain. - net localgroup docker-users <user> /add so the standard account can use Docker. - Docker Desktop autostart via the per-user Run key (current user). The engine also runs as a service (--always-run-service, #419), so Docker is usable on sign-in regardless; cluster nodes already carry restart=unless-stopped (Set-ClusterAutostart). - Writes a training-sized %UserProfile%\.wslconfig (Get-WslConfigMemoryGb: physical RAM - 4 GB, floored) for the daily user, preserving an existing tuned file. It applies at the daily user's next sign-in -- the acceptance scenario -- so we do NOT wsl --shutdown and tear down the just-built cluster mid-install. - Prints a "Configured for <user>: ..." summary so IT can review what changed. Tests: Get-WslConfigMemoryGb (cap/floor), Get-WslConfigContent, Resolve-DailyUser, plus source guards for docker-users / .wslconfig-preserve / opt-out + wiring. Closes#418 Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>

LukasWodka · 2026-07-30T11:56:17Z

👋 Heads-up — Code review queue is at 36 / 30

Above the WIP limit. The team convention is to review existing PRs before opening new work.

Open PRs currently in Code review (oldest first):

averaging-service#222 — fix(sklearn): unwrap Pipeline to terminal estimator before merge dispatch (Prod: Set kubeconfig context namespace after Helm install for tracebloc #209) · author: @divyasinghds · no reviewer assigned
averaging-service#245 — chore(ci): record gitleaks history baseline (triaged false positives) · author: @LukasWodka · no reviewer assigned
backend#1201 — docs(rfc): Data spaces & federated dataset composition (draft) · author: @LukasWodka · reviewer: @saadqbal
backend#1217 — docs(rfc): Dataset integrity & score reproducibility (draft) · author: @LukasWodka · reviewer: @saadqbal
backend#1261 — RFC-BACKEND-0008: board & process reset (decision RFC — for markup) · author: @LukasWodka · reviewer: @saadqbal
backend#1284 — docs(deploy): backend deploy runbook skeleton (#1263) · author: @LukasWodka · no reviewer assigned
backend#1293 — fix(heartbeat): tolerate unknown experiment_key in training_info (#1287) · author: @divyasinghds · no reviewer assigned
backend#1332 — feat(check-model): allow KNN/GaussianProcess on a single-edge owned dataset (#923 follow-up) · author: @divyasinghds · no reviewer assigned
backend#1352 — fix(tasks): route reaper beat logs to App Insights (backend#1132) · author: @saqlainsyed007 · no reviewer assigned
backend#1353 — chore(ci): baseline historical gitleaks findings + wire caller · author: @LukasWodka · no reviewer assigned

Pull from review before opening new work. (This is a nudge from the kanban WIP check, not a block.)

LukasWodka · 2026-07-30T11:57:29Z

👋 Heads-up — Code review queue is at 37 / 30

Above the WIP limit. The team convention is to review existing PRs before opening new work.

Open PRs currently in Code review (oldest first):

averaging-service#222 — fix(sklearn): unwrap Pipeline to terminal estimator before merge dispatch (Prod: Set kubeconfig context namespace after Helm install for tracebloc #209) · author: @divyasinghds · no reviewer assigned
averaging-service#245 — chore(ci): record gitleaks history baseline (triaged false positives) · author: @LukasWodka · no reviewer assigned
backend#1201 — docs(rfc): Data spaces & federated dataset composition (draft) · author: @LukasWodka · reviewer: @saadqbal
backend#1217 — docs(rfc): Dataset integrity & score reproducibility (draft) · author: @LukasWodka · reviewer: @saadqbal
backend#1261 — RFC-BACKEND-0008: board & process reset (decision RFC — for markup) · author: @LukasWodka · reviewer: @saadqbal
backend#1284 — docs(deploy): backend deploy runbook skeleton (#1263) · author: @LukasWodka · no reviewer assigned
backend#1293 — fix(heartbeat): tolerate unknown experiment_key in training_info (#1287) · author: @divyasinghds · no reviewer assigned
backend#1332 — feat(check-model): allow KNN/GaussianProcess on a single-edge owned dataset (#923 follow-up) · author: @divyasinghds · no reviewer assigned
backend#1352 — fix(tasks): route reaper beat logs to App Insights (backend#1132) · author: @saqlainsyed007 · no reviewer assigned
backend#1353 — chore(ci): baseline historical gitleaks findings + wire caller · author: @LukasWodka · no reviewer assigned

Pull from review before opening new work. (This is a nudge from the kanban WIP check, not a block.)

- .wslconfig merge: Add-WslMemorySetting keeps an existing memory= AND preserves any other tuning (processors/swap/other sections) instead of overwriting the whole file. Inserts under an existing [wsl2] header, else appends a section. - missing profile: when the daily user has never signed in (Get-UserProfileDir null), note ".wslconfig after first sign-in" in the summary instead of silently skipping. - elevation: forward -DailyUser through Get-ElevationCommand / Invoke-SelfElevate so the choice survives the UAC relaunch. - input hygiene: sanitize the prompted username via ConvertTo-SanitizedInput before it reaches net localgroup and profile paths. Tests: Add-WslMemorySetting (create/keep/insert-preserve/append-preserve), Get-UserProfileDir null, plus wiring guards for the merge helper, the no-profile note, the sanitize call, and -DailyUser elevation forwarding. Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>

- Never hide a docker-users failure behind a green summary (High). Membership is the make-or-break step; track $dockerUsersOk and, when it doesn't take, WARN loudly (with the manual `net localgroup ... /add` to run while admin is still available) even if autostart/.wslconfig succeeded. Green "Configured for" now only prints when membership is confirmed. - Verify membership by STATE QUERY instead of string-matching 2>&1-merged native output (Medium; learned PS rule). New Test-LocalGroupMember (Get-LocalGroupMember, falling back to `net localgroup <group>` STDOUT) + pure Test-NameInGroupOutput (domain-stripped, case-insensitive) replace the locale-fragile `-match 'already a member'` classification. Tests: Test-NameInGroupOutput (bare-name/domain/case/empty), plus source guards for the state-query verification and the loud-warn-on-failure summary. Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>

Bugbot round 3 (Medium): when Get-PfMemGb returns null the .wslconfig budget was skipped with no summary note -- unlike the null-profile path -- so a green "Configured for" could print while the training memory budget was never applied. Add the matching note ("couldn't detect host RAM -- set [wsl2] memory manually") so IT sees the gap. Guard test added. Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>

cursor

Cursor Bugbot has reviewed your changes and found 1 potential issue.

^{❌ Bugbot Autofix is OFF. To automatically fix reported issues with cloud agents, enable autofix in the Cursor dashboard.}

^{Reviewed by Cursor Bugbot for commit 74f2885. Configure here.}

Bugbot round 4 (Medium): if the .wslconfig merge/write throws (permissions/disk), the catch only Logged and recorded no summary note, so with docker-users already confirmed the green "Configured for" line still printed as if the memory budget was set. Add a "couldn't write .wslconfig -- set [wsl2] memory manually" note in the catch, matching the null-profile / RAM-unknown paths. Guard test added. Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>

shujaatTracebloc self-assigned this Jul 30, 2026

shujaatTracebloc marked this pull request as ready for review July 30, 2026 11:57

shujaatTracebloc requested a review from saadqbal as a code owner July 30, 2026 11:57

cursorBot reviewed Jul 30, 2026
View reviewed changes

Comment threadscripts/install-k8s.ps1
Comment threadscripts/install-k8s.ps1
Comment threadscripts/install-k8s.ps1
Comment threadscripts/install-k8s.ps1

cursorBot reviewed Jul 30, 2026
View reviewed changes

Comment threadscripts/install-k8s.ps1 Outdated
Comment threadscripts/install-k8s.ps1 Outdated

cursorBot reviewed Jul 30, 2026
View reviewed changes

Comment threadscripts/install-k8s.ps1

cursorBot reviewed Jul 30, 2026
View reviewed changes

Comment threadscripts/install-k8s.ps1

saadqbal approved these changes Jul 30, 2026
View reviewed changes

shujaatTracebloc merged commit 0b56fcf into developJul 30, 2026
35 checks passed

shujaatTracebloc deleted the fix/418-provision-daily-user branch July 30, 2026 13:13

shujaatTracebloc mentioned this pull request Jul 30, 2026
feat(installer): provision Docker for the daily user during the admin window (docker-users + autostart + sized .wslconfig) #418
Closed

Navigation Menu

Uh oh!

feat(installer): provision Docker for the daily user during the elevated window (#418) - #493

feat(installer): provision Docker for the daily user during the elevated window (#418)#493
shujaatTracebloc merged 5 commits into
developfrom
fix/418-provision-daily-user

shujaatTracebloc commented Jul 30, 2026•
edited by cursor Bot
Loading

Uh oh!

LukasWodka commented Jul 30, 2026

Uh oh!

LukasWodka commented Jul 30, 2026

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

cursorBot left a comment

Uh oh!

Uh oh!

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

4 participants

Uh oh!

Conversation

shujaatTracebloc commented Jul 30, 2026• edited by cursor BotLoading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

What & why

Changes (scripts/install-k8s.ps1)

Acceptance (from #418)

Scope notes

Tests

Local verification

Uh oh!

LukasWodka commented Jul 30, 2026

Uh oh!

LukasWodka commented Jul 30, 2026

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

cursorBot left a comment

Choose a reason for hiding this comment

Uh oh!

Uh oh!

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

4 participants

shujaatTracebloc commented Jul 30, 2026•
edited by cursor Bot
Loading

Changes (`scripts/install-k8s.ps1`)