pub const HOSTNAME: &str = "qcode";Expand description
The machine name every container QCode creates answers to.
It is one name for all of them, never the engine’s random one, because a harness may bake
the machine name into its login. Gemini CLI does: its installed package
(packages/core/dist/src/services/fileKeychain.js) encrypts gemini-credentials.json with
deriveEncryptionKey() { const salt = ${os.hostname()}-${os.userInfo().username}-gemini-cli; return crypto.scryptSync("gemini-cli-oauth", salt, 32); }. A login made in the sign-in
container is copied into every workspace’s home, and it only decrypts there when the sign-in
container, the courier and the workspace container all report the same machine name.
The other half of that salt, the user name, is already the same everywhere: the image’s
user is qcode at uid 1000 (crate::base::paths::USER), and podman’s --userns=keep-id
maps the person onto it. Docker’s --user <uid>:<gid> path does not: a person whose uid is
not 1000 has no passwd entry in the container, so os.userInfo() throws there and the
login is not written at all. That is a separate gap, not closed by this name.