mirror of
https://github.com/UNITRONIX/BetterDesk.git
synced 2026-09-11 13:49:03 +00:00
UNITRONIX
c93a8eb546
Root cause: Dockerfile.server ran as USER betterdesk (UID 10001) but Docker volume files retain UID/GID from host or previous container. Private key id_ed25519 (mode 600) owned by different UID = unreadable. Fix: - Add docker/server-entrypoint.sh: starts as root, chown+chmod volume files to betterdesk user, then drops privileges via su-exec - Add su-exec to Dockerfile.server runtime packages - Remove USER betterdesk directive (entrypoint handles privilege drop) - Add explicit chmod 600 + chown for id_ed25519 in all-in-one entrypoint
25 lines
860 B
Bash
25 lines
860 B
Bash
#!/bin/sh
|
|
# BetterDesk Server — Docker Entrypoint
|
|
# Fixes volume file permissions before dropping to non-root user
|
|
set -e
|
|
|
|
DATA_DIR="/opt/rustdesk"
|
|
|
|
# Fix ownership of volume-mounted data directory.
|
|
# Docker volumes preserve UID/GID from the host or previous container,
|
|
# which may not match the betterdesk user (10001) in this container.
|
|
# This is especially important for id_ed25519 (mode 600) — if owned by
|
|
# a different UID, the server cannot read the private key.
|
|
if [ "$(id -u)" = "0" ]; then
|
|
chown -R betterdesk:betterdesk "$DATA_DIR" 2>/dev/null || true
|
|
# Ensure private key is readable by betterdesk
|
|
if [ -f "$DATA_DIR/id_ed25519" ]; then
|
|
chmod 600 "$DATA_DIR/id_ed25519"
|
|
chown betterdesk:betterdesk "$DATA_DIR/id_ed25519"
|
|
fi
|
|
# Drop privileges and re-exec
|
|
exec su-exec betterdesk "$@"
|
|
else
|
|
exec "$@"
|
|
fi
|