forked from mirror/crumbs-original
Claude
effe7e3e72
The image switched to the node user (uid 1000) at build time, so a host folder mounted at /data kept its host ownership and SQLite failed with SQLITE_CANTOPEN in a restart loop. Named and anonymous volumes worked only because Docker copies the image's /data ownership into them. The container now starts as root, hands DATA_DIR and the database folder to node (only entries not already owned by it), and execs the app via setpriv as node. Containers started with an explicit `user:` skip this. Adds a CI step that runs the image with a host-owned bind mount. Fixes #93 Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_016MHECwBhBpM248EFSBi4L5
21 lines
845 B
Bash
Executable File
21 lines
845 B
Bash
Executable File
#!/bin/sh
|
|
# Starts as root so a bind-mounted data folder owned by the host user can be
|
|
# handed to the unprivileged `node` user, then drops privileges before running
|
|
# the app. Without this, a host folder mounted at /data is not writable by
|
|
# uid 1000 and SQLite fails with SQLITE_CANTOPEN.
|
|
set -e
|
|
|
|
if [ "$(id -u)" = "0" ]; then
|
|
for dir in "${DATA_DIR:-/data}" "$(dirname "${DATABASE_URL:-/data/crumbs.db}")"; do
|
|
mkdir -p "$dir"
|
|
# Only touch entries not already owned by node, so restarts on a large
|
|
# attachment folder stay fast.
|
|
find "$dir" \! -user node -exec chown node:node {} + ||
|
|
echo "warning: could not change ownership of $dir; it must be writable by uid 1000" >&2
|
|
done
|
|
exec setpriv --reuid=node --regid=node --init-groups "$@"
|
|
fi
|
|
|
|
# Started with an explicit non-root user (e.g. `user:` in compose): run as-is.
|
|
exec "$@"
|