larksuite/cli · error

account has no home directory

Error message

account has no home directory

What it means

The policy layer resolves '~' and similar roots from the current user account's home directory (user.Current().HomeDir). If the account database reports an empty HomeDir, no trustworthy home root exists, so the lookup fails rather than guessing a directory.

Source

Thrown at internal/vfs/localfileio/policy.go:113

// guarantee. Release binaries are built with CGO_ENABLED=0, and pure-Go
// os/user answers from $HOME for a uid the database does not list — distroless
// images and `--user 99999` containers among them — as long as $USER is set
// too; with $USER unset it returns an error instead and the ~/files root is
// dropped altogether. Such an invocation does choose where ~/files points.
// What that reaches is a directory named "files" under the path it names and
// nothing else: the home directory itself is not an allow root, and denyRoots
// covers every candidate home, so the credential directories stay protected
// either way.
var trustedHome = sync.OnceValues(func() (string, error) {
	if home, ok := passwdHome(); ok {
		return home, nil
	}
	u, err := user.Current()
	if err != nil {
		return "", err
	}
	if u.HomeDir == "" {
		return "", fmt.Errorf("account has no home directory")
	}
	return u.HomeDir, nil
})

// passwdHome reads this process's home directory straight out of the account
// database, which no environment variable can influence. Reports false when
// the file is absent (Windows, distroless) or holds no entry for the uid
// (macOS keeps regular accounts in DirectoryService, not /etc/passwd).
func passwdHome() (string, bool) {
	if runtime.GOOS == "windows" {
		return "", false
	}
	f, err := vfs.Open("/etc/passwd")
	if err != nil {
		return "", false
	}
	defer f.Close()

View on GitHub (pinned to 7fd6ef3c07)

Solutions

1. Give the running account a home directory (create it and set it in the account database / passwd entry)
2. Set HOME (and USERPROFILE on Windows) to an existing directory — note this only helps paths that consult env vars, not this home lookup; prefer fixing the account
3. Run under a normal user account instead of a bare UID/no-home service account

Example fix

// before (Dockerfile)
USER 10001
// after
RUN useradd -m appuser
USER appuser

u, err := user.Current()
if err != nil || u.HomeDir == "" {
	// home unavailable: provision one before invoking the CLI
}

func hasHomeDir() bool {
	u, err := user.Current()
	return err == nil && u.HomeDir != ""
}

if err != nil && strings.Contains(err.Error(), "account has no home directory") {
	// fallback: set HOME/USERPROFILE or run under a provisioned user, then retry
}

When it happens

Trigger: Running under an account whose home directory is unset — e.g. a service account, a container user with no passwd entry fields, or an environment where user.Current() succeeds but HomeDir is empty — while the policy computes home-based allow/deny roots.

Common situations: Docker containers running as a bare UID with no /etc/passwd entry, Windows service accounts, or stripped-down CI users.

Related errors

• No visible worksheet matched
• cannot determine working directory: %w
• cannot expand ~: %w
• invalid chart size: {size!r}
• +csv-get truncated the scan range at {actual_range}; narrow

AI-assisted analysis of larksuite/cli@7fd6ef3c07 (2026-09-04). Data as JSON: /api/errors/9e93b21c96fe9a86. Report an issue: GitHub.