mirror of
https://github.com/UNITRONIX/BetterDesk.git
synced 2026-09-10 09:35:39 +00:00
UNITRONIX
05ebd71072
Three related issues reported by user: 1. SQLITE_READONLY: docker-compose.quick.yml mounted /opt/rustdesk as :ro but console needs read access to .api_key (mode 600). Removed :ro. 2. EACCES .session_secret: Dockerfile.console ran as USER betterdesk (UID 10001) but volume files owned by different host UID. 3. docker exec fails: container in restart loop due to permission crash. Fix: - Add docker/console-entrypoint.sh: starts as root, chown data dirs to betterdesk user, then drops privileges via su-exec - Add su-exec to Dockerfile.console runtime packages - Remove USER betterdesk (entrypoint handles privilege drop) - Remove :ro from /opt/rustdesk volume mount in docker-compose.quick.yml
26 lines
1.0 KiB
Bash
26 lines
1.0 KiB
Bash
#!/bin/sh
|
|
# BetterDesk Console — Docker Entrypoint Wrapper
|
|
# Fixes volume file permissions before dropping to non-root user
|
|
set -e
|
|
|
|
# Fix ownership of volume-mounted data directories.
|
|
# Docker volumes preserve UID/GID from the host or previous container,
|
|
# which may not match the betterdesk user (10001) in this container.
|
|
if [ "$(id -u)" = "0" ]; then
|
|
chown -R betterdesk:betterdesk /app/data 2>/dev/null || true
|
|
# Fix permissions on sensitive files
|
|
if [ -f /app/data/.session_secret ]; then
|
|
chmod 600 /app/data/.session_secret
|
|
chown betterdesk:betterdesk /app/data/.session_secret
|
|
fi
|
|
if [ -f /app/data/auth.db ]; then
|
|
chown betterdesk:betterdesk /app/data/auth.db
|
|
fi
|
|
# /opt/rustdesk may be mounted read-only from server volume — only fix if writable
|
|
chown -R betterdesk:betterdesk /opt/rustdesk 2>/dev/null || true
|
|
# Drop privileges and run the actual entrypoint
|
|
exec su-exec betterdesk /app/docker-entrypoint.sh
|
|
else
|
|
exec /app/docker-entrypoint.sh
|
|
fi
|