feat: tao-shen user with sudo, hostname=huggingrun, ttyd login

- Create tao-shen user (sudo NOPASSWD) instead of generic 'user'
- Set hostname to 'huggingrun' for clean prompt
- ttyd uses 'login -f tao-shen' for proper login shell
- Copy root's authorized_keys to tao-shen on restore

Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>

Dockerfile

@@ -38,7 +38,11 @@ RUN dpkg-query -W -f='${Package}\n' | sort > /etc/base-packages.list
 RUN ssh-keygen -A && mkdir -p /run/sshd
 
 # User account (for SSH login); container runs as root for system persistence
-RUN useradd -m -u 1000 -s /bin/bash -p "$(openssl passwd -6 huggingrun)" user 2>/dev/null || true
+RUN useradd -m -u 1000 -s /bin/bash -p "$(openssl passwd -6 huggingrun)" tao-shen 2>/dev/null || true \
+    && apt-get update && apt-get install -y --no-install-recommends sudo \
+    && echo "tao-shen ALL=(ALL) NOPASSWD:ALL" > /etc/sudoers.d/tao-shen \
+    && chmod 440 /etc/sudoers.d/tao-shen \
+    && rm -rf /var/lib/apt/lists/*
 # Root password for SSH login as root
 RUN usermod -p "$(openssl passwd -6 huggingrun)" root
 RUN mkdir -p /data

entrypoint.py

@@ -402,9 +402,18 @@ class LogSSEHandler(http.server.BaseHTTPRequestHandler):
 
 # ── Service Management ────────────────────────────────────────────────
 def ensure_passwords():
-    sh("id user >/dev/null 2>&1 || useradd -m -s /bin/bash user")
-    sh('echo "user:huggingrun" | chpasswd')
+    sh("id tao-shen >/dev/null 2>&1 || useradd -m -s /bin/bash tao-shen")
+    sh('echo "tao-shen:huggingrun" | chpasswd')
     sh('echo "root:huggingrun" | chpasswd')
+    sh("usermod -aG sudo tao-shen 2>/dev/null || true")
+    sh("echo 'tao-shen ALL=(ALL) NOPASSWD:ALL' > /etc/sudoers.d/tao-shen")
+    sh("chmod 440 /etc/sudoers.d/tao-shen")
+    # Copy root's SSH keys to tao-shen if needed
+    if os.path.exists("/root/.ssh/authorized_keys"):
+        sh("mkdir -p /home/tao-shen/.ssh")
+        sh("cp -n /root/.ssh/authorized_keys /home/tao-shen/.ssh/authorized_keys 2>/dev/null || true")
+        sh("chown -R tao-shen:tao-shen /home/tao-shen/.ssh")
+        sh("chmod 700 /home/tao-shen/.ssh && chmod 600 /home/tao-shen/.ssh/authorized_keys")
     sh("ldconfig 2>/dev/null || true")
 
 
@@ -427,7 +436,7 @@ def start_sshd():
 def start_ttyd():
     proc = subprocess.Popen([
         "ttyd", "--port", TTYD_PORT, "--writable", "--base-path", "/",
-        "bash", "--login",
+        "login", "-f", "tao-shen",
     ])
     time.sleep(0.5)
     log(f"[OK] ttyd PID={proc.pid}" if proc.poll() is None else "[FAIL] ttyd")
@@ -452,6 +461,8 @@ def main():
     os.makedirs(PERSIST_PATH, exist_ok=True)
     open(LOGFILE, "a").close()
 
+    sh("hostname huggingrun")
+
     resolve_config()
     ensure_dataset_repo()
     ensure_passwords()