fix(api): keep dev container writes out of the bind-mounted source

.changeset/dev-container-host-ownership.md

@@ -0,0 +1,5 @@
+---
+"seamless-templates": patch
+---
+
+The Express and FastAPI dev containers no longer write into the bind-mounted source. On a Linux host the generated stack runs them as root, so the Express logger's `logs/app.log` and FastAPI's `__pycache__` directories ended up owned by root and `rm -rf` of the project failed without sudo. The Express dev stage now sets `LOG_DIR=/tmp/logs` (the logger reads `LOG_DIR`, and still writes `./logs` when run on the host), and the FastAPI dev stage sets `PYTHONPYCACHEPREFIX=/tmp/pycache`.

templates/api/express/Dockerfile

@@ -48,6 +48,9 @@ CMD ["npm", "run", "start"]
 
 # Last on purpose. See the note at the top of this file before moving it.
 FROM deps AS dev
+# The generated stack bind-mounts the source over /app and runs this as root. On a
+# Linux host, logs/ under /app would be root's and block removing the project.
+ENV LOG_DIR=/tmp/logs
 COPY . .
 EXPOSE 3000
 CMD ["npm", "run", "dev"]

templates/api/express/src/lib/logger.ts

@@ -33,7 +33,7 @@ export default function getLogger(moduleName: string): Logger {
   );
 
   if (!isProd) {
-    const logDir = path.resolve("./logs");
+    const logDir = path.resolve(process.env.LOG_DIR || "./logs");
     if (!fs.existsSync(logDir)) {
       fs.mkdirSync(logDir, { recursive: true });
     }

templates/api/fastapi/Dockerfile

@@ -31,6 +31,9 @@ CMD ["uvicorn", "app.main:build", "--factory", "--host", "0.0.0.0", "--port", "3
 # Last on purpose. See the note at the top of this file before moving it.
 FROM base AS dev
 RUN uv sync --locked
+# The generated stack bind-mounts the source over /app and runs this as root. On a
+# Linux host, __pycache__ under /app would be root's and block removing the project.
+ENV PYTHONPYCACHEPREFIX=/tmp/pycache
 COPY . .
 EXPOSE 3000
 CMD ["uvicorn", "app.main:build", "--factory", "--reload", "--host", "0.0.0.0", "--port", "3000"]