mirror of
https://github.com/Studio-Saelix/sencho.git
synced 2026-07-26 11:49:16 +00:00
SaelixCode
987fc3d339
The merge of PR58 into PR59's branch produced a corrupt docker-entrypoint.sh (97 lines) where PR59's if block was cut off mid-way (missing exec su-exec and closing fi) and then PR58's entire if block was appended. This caused: /usr/local/bin/docker-entrypoint.sh: line 98: syntax error: unexpected end of file (expecting "fi") Fix: overwrite with the clean 71-line version and add a defensive `sed -i 's/\r//'` step in the Dockerfile to strip Windows CRLF line endings at build time, preventing this class of error even if CRLF slips past .gitattributes in future.
64 lines
2.9 KiB
Bash
64 lines
2.9 KiB
Bash
#!/bin/sh
|
|
set -e
|
|
|
|
# Resolve the data directory, mirroring DatabaseService.ts logic.
|
|
DATA_DIR="${DATA_DIR:-/app/data}"
|
|
|
|
# If running as root (the default Docker container start), fix volume ownership,
|
|
# fix Docker socket group access, then drop privileges before executing the app.
|
|
#
|
|
# This is the industry-standard pattern used by the official PostgreSQL, Redis,
|
|
# and MariaDB Docker images, and by Docker management tools like Portainer and
|
|
# Dockge that also require access to /var/run/docker.sock as a non-root user.
|
|
#
|
|
# The UID guard also ensures compatibility with strict environments like
|
|
# Kubernetes (runAsNonRoot: true) or OpenShift, where the container is forced to
|
|
# run as a random high UID. In that case both blocks are skipped and the app
|
|
# exec's directly without crashing.
|
|
if [ "$(id -u)" = '0' ]; then
|
|
|
|
# 1. Fix data volume ownership.
|
|
# Handles host volumes previously created by root or a different UID, which
|
|
# would cause SQLITE_READONLY errors when the non-root sencho user starts.
|
|
# Only touches files with wrong user OR group (efficient on large dirs).
|
|
mkdir -p "$DATA_DIR"
|
|
find "$DATA_DIR" \( \! -user sencho -o \! -group sencho \) \
|
|
-exec chown sencho:sencho '{}' +
|
|
echo "[entrypoint] Data directory ownership ensured: $DATA_DIR"
|
|
|
|
# 2. Fix Docker socket group access.
|
|
# The Docker socket on the host is owned by the host's docker group, whose
|
|
# GID varies by Linux distribution and does not match any group inside the
|
|
# container by default.
|
|
if [ -S /var/run/docker.sock ]; then
|
|
DOCKER_SOCK_GID=$(stat -c '%g' /var/run/docker.sock)
|
|
DOCKER_SOCK_MODE=$(stat -c '%a' /var/run/docker.sock)
|
|
echo "[entrypoint] Docker socket found: GID=$DOCKER_SOCK_GID mode=$DOCKER_SOCK_MODE"
|
|
|
|
if [ "$DOCKER_SOCK_GID" = "0" ]; then
|
|
echo "[entrypoint] WARNING: Docker socket is root:root -- adding sencho to root group"
|
|
addgroup sencho root 2>/dev/null || true
|
|
else
|
|
if ! getent group "$DOCKER_SOCK_GID" > /dev/null 2>&1; then
|
|
addgroup -S -g "$DOCKER_SOCK_GID" docker-host
|
|
echo "[entrypoint] Created group docker-host with GID $DOCKER_SOCK_GID"
|
|
fi
|
|
DOCKER_GROUP=$(getent group "$DOCKER_SOCK_GID" | cut -d: -f1)
|
|
addgroup sencho "$DOCKER_GROUP" 2>/dev/null || true
|
|
echo "[entrypoint] Added sencho to group '$DOCKER_GROUP' (GID $DOCKER_SOCK_GID)"
|
|
fi
|
|
else
|
|
echo "[entrypoint] WARNING: /var/run/docker.sock not found -- Docker features unavailable"
|
|
fi
|
|
|
|
echo "[entrypoint] Dropping privileges to sencho (uid=$(id -u sencho))"
|
|
|
|
# 3. Drop privileges.
|
|
# Replace this shell with su-exec so Node becomes PID 1 and receives
|
|
# SIGTERM/SIGINT directly. su-exec calls getgrouplist() for named users,
|
|
# so all supplementary groups added above are inherited by the process.
|
|
exec su-exec sencho "$@"
|
|
fi
|
|
|
|
exec "$@"
|