chenhg5/cc-connect · error

config: %s.run_as_user must not be root

Error message

config: %s.run_as_user must not be root

What it means

A config validation error from validateRunAsUser: the configured run_as_user is 'root' or UID 0. Running agent subprocesses as root defeats the privilege-separation purpose and is explicitly refused; config load aborts with the prefix identifying the offending section.

Source

Thrown at config/config.go:72

func validateRunAsEnv(prefix string, envVars []string) error {
	for _, v := range envVars {
		name := strings.TrimSpace(v)
		if dangerousEnvVars[strings.ToUpper(name)] {
			return fmt.Errorf("config: %s.run_as_env must not include dangerous variable %q", prefix, name)
		}
	}
	return nil
}

func validateRunAsUser(prefix, name string) error {
	if name == "" {
		return nil
	}
	if runtime.GOOS == "windows" {
		return fmt.Errorf("config: %s.run_as_user is only supported on Linux/macOS", prefix)
	}
	if name == "root" || name == "0" {
		return fmt.Errorf("config: %s.run_as_user must not be root", prefix)
	}
	if !isValidRunAsUserName(name) {
		return fmt.Errorf("config: %s.run_as_user %q contains invalid characters (allowed: a-z, A-Z, 0-9, -, _, .; must start with a letter or underscore)", prefix, name)
	}
	return nil
}

// configMu serializes read-modify-write cycles to prevent lost updates.
var configMu sync.Mutex

// ConfigPath stores the path to the config file for saving
var ConfigPath string

type Config struct {
	DataDir        string `toml:"data_dir"` // session store directory, default ~/.cc-connect
	AttachmentSend string `toml:"attachment_send"`
	// Quiet is legacy: when true and [display] does not set thinking_messages / tool_messages,
	// engines behave as if those flags were false. Per-project quiet overrides when set.

View on GitHub (pinned to 4000b2338a)

Solutions

1. Choose a dedicated non-root user for run_as_user
2. Grant that user the minimal permissions the agents need
3. Remove run_as_user if isolation is not needed

When it happens

Trigger: Thrown at config/config.go:72 when the library encounters an invalid state.

Common situations: See trigger scenarios.

AI-assisted analysis of chenhg5/cc-connect@4000b2338a (2026-09-06). Data as JSON: /api/errors/e15ab892a17478fe. Report an issue: GitHub.