Repository navigation
Make the entrypoint readable for the unprivileged user - #367
Open
OvisMaximus wants to merge 1 commit into
Open
OvisMaximus wants to merge 1 commit into
OvisMaximus wants to merge 1 commit into
Conversation
Background Since the upstream merge (admonstrator#241), docker-entrypoint.sh drops privileges with gosu and then re-executes itself as PUID:PGID. The Dockerfile copies the script without --chown (owned by root) and only adds the execute bit. A build context that hands the file over without read permission for others - here a Samba share with a restrictive create mask - produced mode 771 in the image. The kernel could exec the script as uid 1000, but /bin/sh could not read it: "cannot open /app/./docker-entrypoint.sh: Permission denied", and the container restarted in a loop. Changes - Dockerfile: chmod 755 instead of chmod +x for docker-entrypoint.sh and start-services.sh, so the mode no longer depends on the build context. Testing On the affected host: stat on /app/docker-entrypoint.sh showed 771 root before and 755 root after the rebuild; the container starts and the restart loop is gone. Impact Images built from a Git checkout already got 755 and are unchanged. Images built from a context without world-read permission start again. Upstream Status Proposed upstream with this change; relates to admonstrator#241. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
This branch has not been deployed
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Since #241,
docker-entrypoint.shdrops privileges withgosuand then re-executes itself asPUID:PGID. The Dockerfile copies the script as root and only runschmod +x, so the final mode depends on the build context. A context that provides the file without read permission for others (here: a Samba share with a restrictive create mask) produced mode771. The kernel could exec the script as uid 1000, but/bin/shcould not read it:The result was a container restart loop. CI builds from a Git checkout (
644→755), which is why it never showed there.Change:
chmod 755instead ofchmod +xfordocker-entrypoint.shandstart-services.sh.Testing: On the affected host,
stat -c '%a %U' /app/docker-entrypoint.shshowed771 rootbefore and755 rootafter the rebuild. The container starts and the loop is gone.🤖 Generated with Claude Code