Opt the agent-dev image into the non-root agent user

[warp-agent-staging]

Description

Adds ENV WARP_AGENT_NONROOT=1 to docker/agent-dev/Dockerfile, immediately after FROM ubuntu:24.04, so containers built from this image run the agent as the non-root agent user.

The agent entrypoint (entrypoint.bash in warpdotdev/warp-agent-docker) gates the root → non-root downgrade behind WARP_AGENT_NONROOT via nonroot_downgrade_enabled(), and that gate still defaults off (WARP_NONROOT_DEFAULT=0) while workflows migrate to sudo. It is documented under "Non-root rollout gate" in that repo's README.

A Docker ENV is the right mechanism here rather than environment configuration: Oz environments have no env-var setting, and environment setup commands run after the entrypoint has already chosen the user. ENV persists into the runtime environment, so the entrypoint reads it before making that decision.

The goal is that internal dev/staging Oz environments — specifically Wob the Wuilder (elWVZSQ9zfX77iblr2p2W4), which runs warpdotdev/warp-internal-dev:latest-dev built from this Dockerfile — stop running as root.

Scope is exactly this one file. The existing ENV block (RUSTUP_HOME / CARGO_HOME / TFENV_ROOT / PATH) is untouched, and nothing else in the repo changes. Net diff: three added lines.

Note on a superseded PR: an earlier attempt at this change landed in warpdotdev/warp-agent-docker as PR #198, targeting internal-dev/Dockerfile there. That file is a stale copy; this repo's docker/agent-dev/Dockerfile is the authoritative source for the image. PR #198 has been closed in favor of this one.

Linked Issue

Tracked in Linear as REMOTE-2488, not as a GitHub issue, so the ready-to-spec / ready-to-implement checkbox below does not apply — the equivalent gating happened on the Linear ticket.

• The linked issue is labeled ready-to-spec or ready-to-implement. (N/A — tracked in Linear)
• Where appropriate, screenshots or a short video of the implementation are included below. (N/A — no user-visible surface; this is a build-image environment variable)

Testing

Testing-exempt category: constant-or-flag-default (config-only). The change is a single Docker ENV assignment with no logic. A test could only assert the literal value back rather than detect a defect, so no automated test was added.

What was actually run:

• hadolint docker/agent-dev/Dockerfile — parses cleanly and produces the same set of rule codes as the origin/master baseline (DL3008, DL3009, DL4006, SC2086, DL3016, DL3045, DL3003 — all pre-existing and unrelated), differing only by the line-number shift from the added lines. No new findings.
• ./script/format --check — passes (exit 0).
• git diff --check — clean.
• cargo clippy — deliberately not run. I checked rather than assumed: script/format is a thin cargo fmt wrapper and clippy is likewise Rust-only, while this diff touches zero .rs files (git diff --name-only returns only docker/agent-dev/Dockerfile). A full-workspace clippy run cannot be influenced by this change.
• docker build — not run. Docker is unavailable in the environment this change was prepared in (docker: command not found), and no CI job in this repo builds this image (see below). The Dockerfile's syntactic validity is covered by the hadolint parse above.

Runtime confirmation after the image is republished: docker run --rm <image> printenv WARP_AGENT_NONROOT should print 1, and the entrypoint should log a non-root phase instead of phase=root-transitional.

• I have manually tested my changes locally with ./script/run (N/A — this changes a build image, not the app; ./script/run does not exercise it)

Required follow-up after merge

I re-verified this against this repo rather than carrying over the claim from the earlier PR: grep -rl "warp-internal-dev\|agent-dev" across warpdotdev/warp matches only a spec document, no workflow under .github/workflows/ references docker/, and nothing here builds or pushes warp-internal-dev:latest-dev.

So merging this alone changes nothing at runtime. Someone must manually rebuild and push warpdotdev/warp-internal-dev:latest-dev as a multi-arch buildx push. Environments on that tag — including Wob the Wuilder (elWVZSQ9zfX77iblr2p2W4) — pick up the non-root user on their next container start.

Originating thread: https://linear.app/warpdotdev/issue/REMOTE-2488/enable-non-root-agent-user-in-warp-internal-dev-image
ticket_source: adhoc · ticket_id: ff5e3f11-774c-4ae0-9413-70b9024bba36

Agent Mode

• Warp Agent Mode - This PR was created via Warp's AI Agent Mode

CHANGELOG-NONE

Co-Authored-By: Warp Agent agent@warp.dev