Merge pull request #695 from mamba-org/no-clobber-home

No clobber `$HOME` , GitHub Actions dependencies updates

Author: wholtz

.github/workflows/push_latest.yml

@@ -176,7 +176,7 @@ jobs:
         labels: |
           distro_id=${{ steps.set_image_variables.outputs.distro_id }}
     - name: Setup docker buildx
-      uses: docker/setup-buildx-action@e468171a9de216ec08956ac3ada2f0791b6bd435
+      uses: docker/setup-buildx-action@8d2750c68a42422c14e847fe6c8ac0403b4cbd6f
     - name: Login to DockerHub
       uses: docker/login-action@5e57cd118135c172c3672efd75eb46360885c0ef
       with:
@@ -237,7 +237,7 @@ jobs:
         labels: ${{ steps.get_metadata.outputs.labels}}
         cache-from: type=registry,ref=ghcr.io/mamba-org/micromamba-cache/cache:${{ steps.set_image_variables.outputs.tag }}
         cache-to: type=registry,ref=ghcr.io/mamba-org/micromamba-cache/cache:${{ steps.set_image_variables.outputs.tag }},mode=max
-    - uses: actions/upload-artifact@330a01c490aca151604b8cf639adc76d48f6c5d4
+    - uses: actions/upload-artifact@b7c566a772e6b6bfb58ed0dc250532a479d7789f
       with:
         name: ${{ steps.set_image_variables.outputs.tag }}.metadata
         path: ${{ steps.get_metadata.outputs.bake-file }}
@@ -255,7 +255,7 @@ jobs:
       with:
         persist-credentials: false
     - name: Get artifacts
-      uses: actions/download-artifact@018cc2cf5baa6db3ef3c5f8a56943fffe632ef53
+      uses: actions/download-artifact@37930b1c2abaa49bbe596cd826c3c89aef350131
       with:
         path: artifacts
         pattern: '*.metadata'

.github/workflows/zizmor.yml

@@ -22,7 +22,7 @@ jobs:
         with:
           persist-credentials: false
 
-      - uses: hynek/setup-cached-uv@2a4a9b893253e16cf11e6def5f774336af2f80bc
+      - uses: hynek/setup-cached-uv@ae460f75dcef535482cb6754a8ca5ad6aac63ce7
 
       - name: Run zizmor 🌈
         run: uvx zizmor --format sarif . > results.sarif

CHANGELOG.md

@@ -3,6 +3,11 @@
 This change log covers changes to the docker image and does not include
 [changes to the micromamba program](https://github.com/mamba-org/mamba/blob/main/CHANGELOG.md).
 
+## 12 January 2026
+
+- No longer clobber `$HOME` values passed via
+  `docker run -e HOME ...` (for `$HOME` values other than `/`).
+
 ## 20 December 2025
 
 - Update CUDA v13.0.2 images to v13.1.0

_entrypoint.sh

@@ -12,11 +12,15 @@ if [[ -f /etc/arg_mamba_user && "${MAMBA_USER}" != "$(cat "/etc/arg_mamba_user")
     exit 1
 fi
 
-# if USER is not set and not root
-if [[ ! -v USER && $(id -u) -gt 0 ]]; then
-  # should get here if 'docker run...' was passed -u with a numeric UID
-  export USER="$MAMBA_USER"
-  export HOME="/home/$USER"
+if [[ $(id -u) -gt 0 ]]; then
+  if [[ ! -v USER ]]; then
+    export USER="$MAMBA_USER"
+  fi
+  # If a user passes HOME="/", it will still get clobbered.
+  # I don't have a good way to work around that.
+  if [[ $HOME == "/" ]]; then
+    export HOME="/home/$USER"
+  fi
 fi
 
 source _activate_current_env.sh

test/user.bats

@@ -130,3 +130,15 @@ setup() {
         assert_success
         assert_output --partial "uid=1100(MaMbAmIcRo) gid=2000(MaMbAmIcRo) groups=2000(MaMbAmIcRo)"
 }
+
+@test "docker run -e HOME="/foobar" ${MICROMAMBA_IMAGE} /bin/bash -c 'realpath ~'" {
+    # shellcheck disable=SC2086
+    run docker run $RUN_FLAGS -e HOME="/foobar" "${MICROMAMBA_IMAGE}" /bin/bash -c 'realpath ~'
+    assert_output "/foobar"
+}
+
+@test "docker run --user=1001:1001 -e HOME="/foobar" ${MICROMAMBA_IMAGE} /bin/bash -c 'realpath ~'" {
+    # shellcheck disable=SC2086
+    run docker run $RUN_FLAGS --user=1001:1001 -e HOME="/foobar" "${MICROMAMBA_IMAGE}" /bin/bash -c 'realpath ~'
+    assert_output "/foobar"
+}