From 8465b81712207b0f32ce5acb513877cb30b11858 Mon Sep 17 00:00:00 2001 From: OvisMaximus Date: Mon, 5 Oct 2026 00:34:32 +0200 Subject: [PATCH] Make the entrypoint readable for the unprivileged user Background Since the upstream merge (#241), docker-entrypoint.sh drops privileges with gosu and then re-executes itself as PUID:PGID. The Dockerfile copies the script without --chown (owned by root) and only adds the execute bit. A build context that hands the file over without read permission for others - here a Samba share with a restrictive create mask - produced mode 771 in the image. The kernel could exec the script as uid 1000, but /bin/sh could not read it: "cannot open /app/./docker-entrypoint.sh: Permission denied", and the container restarted in a loop. Changes - Dockerfile: chmod 755 instead of chmod +x for docker-entrypoint.sh and start-services.sh, so the mode no longer depends on the build context. Testing On the affected host: stat on /app/docker-entrypoint.sh showed 771 root before and 755 root after the rebuild; the container starts and the restart loop is gone. Impact Images built from a Git checkout already got 755 and are unchanged. Images built from a context without world-read permission start again. Upstream Status Proposed upstream with this change; relates to #241. Co-Authored-By: Claude Opus 5.5 --- Dockerfile | 7 ++++++- 1 file changed, 6 insertions(+), 1 deletion(-) diff --git a/Dockerfile b/Dockerfile index 3c3329b..a260857 100644 --- a/Dockerfile +++ b/Dockerfile @@ -18,7 +18,12 @@ COPY --chown=node:node schemas.js swagger.js ./ COPY --chown=node:node scripts ./scripts/ COPY docker-entrypoint.sh start-services.sh ./ -RUN chmod +x docker-entrypoint.sh start-services.sh +# An explicit mode rather than +x: the entrypoint re-executes itself after the +# privilege drop, so the unprivileged user has to be able to read it, too. A +# build context that hands the files over without read permission for others +# (e.g. a Samba share with a restrictive create mask) would otherwise produce +# 0711 and a restart loop with "cannot open ./docker-entrypoint.sh". +RUN chmod 755 docker-entrypoint.sh start-services.sh # Configure persistent data volume. # Docker seeds a fresh named volume from the image including ownership and mode,