From 65aefb47ed7a10c5ab4417ee193bb0d3452326e3 Mon Sep 17 00:00:00 2001 From: brasse b Date: Fri, 10 Apr 2026 14:38:23 +0200 Subject: [PATCH] fix: container permissions and volume setup Problems fixed: - archivum user (UID 1000) could not write to bind-mounted /config or /data because Docker (especially on Windows/WSL2) creates volumes owned by root - /data/wiki and /data/db subdirectories were never created, causing "no such file or directory" when the app tried to write files Changes: - docker/entrypoint.sh: runs as root, creates /config /data/wiki /data/db, chowns them to PUID:PGID, then drops privileges via su-exec - Dockerfile: install su-exec + git, copy entrypoint, remove build-time USER directive (privilege drop happens at runtime via entrypoint) - docker-compose.yml: switch local dev to named volumes so Docker manages ownership automatically (avoids Windows/WSL2 bind-mount permission issues); add TZ env var; explicit comments on how to switch to bind mounts Co-Authored-By: Claude Sonnet 4.6 --- docker/Dockerfile | 36 ++++++++++++++++++++++-------------- docker/docker-compose.yml | 24 +++++++++++++++++++++--- docker/entrypoint.sh | 28 ++++++++++++++++++++++++++++ 3 files changed, 71 insertions(+), 17 deletions(-) create mode 100644 docker/entrypoint.sh diff --git a/docker/Dockerfile b/docker/Dockerfile index b44e958..6d486a5 100644 --- a/docker/Dockerfile +++ b/docker/Dockerfile @@ -12,8 +12,9 @@ FROM golang:1.22-alpine AS backend-builder WORKDIR /app/backend # Copy go.mod first for layer caching. go.sum is written by go mod download -# when it doesn't exist yet (skeleton project), or verified when it does. +# when it doesn't exist yet, or verified when it does. COPY backend/go.mod ./ +COPY backend/go.su[m] ./ RUN go mod download -x COPY backend/ ./ # CGO disabled — pure Go SQLite (modernc.org/sqlite). @@ -22,23 +23,30 @@ RUN CGO_ENABLED=0 go build -ldflags="-s -w" -o /archivum ./cmd/server # ── Stage 3: Runtime image ──────────────────────────────────────────────────── FROM alpine:3.20 -# Allow PUID/PGID override at runtime. -ARG PUID=1000 -ARG PGID=1000 +# su-exec: lightweight tool to drop privileges (replaces gosu / setpriv). +# git: needed for wiki commit operations. +RUN apk add --no-cache su-exec git -RUN addgroup -g "${PGID}" archivum \ - && adduser -u "${PUID}" -G archivum -s /sbin/nologin -D archivum +# Create the app group and user that the entrypoint will run as. +# PUID/PGID can be overridden at runtime via environment variables; +# the entrypoint script uses them rather than these build-time values. +RUN addgroup -g 1000 archivum \ + && adduser -u 1000 -G archivum -s /sbin/nologin -D archivum -# Embed frontend into the binary's working directory. -COPY --from=frontend-builder /app/frontend/dist /srv/archivum/ui -COPY --from=backend-builder /archivum /usr/local/bin/archivum +COPY --from=frontend-builder /app/frontend/dist /srv/archivum/ui +COPY --from=backend-builder /archivum /usr/local/bin/archivum +COPY docker/entrypoint.sh /usr/local/bin/entrypoint.sh +RUN chmod +x /usr/local/bin/entrypoint.sh -# Volumes: config and data live outside the image. +# Declare the volume mount points. The entrypoint creates subdirectories +# and fixes ownership before the application starts. VOLUME ["/config", "/data"] -ENV DOCKER_PATH=/config +ENV DOCKER_PATH=/config \ + UI_DIR=/srv/archivum/ui \ + PUID=1000 \ + PGID=1000 -USER archivum +# Entrypoint runs as root so it can chown the volumes, then drops to PUID:PGID. EXPOSE 4000 - -ENTRYPOINT ["/usr/local/bin/archivum"] +ENTRYPOINT ["/usr/local/bin/entrypoint.sh"] diff --git a/docker/docker-compose.yml b/docker/docker-compose.yml index 9fa9c9a..a0ecb8b 100644 --- a/docker/docker-compose.yml +++ b/docker/docker-compose.yml @@ -8,10 +8,28 @@ services: restart: unless-stopped ports: - "8080:4000" - volumes: - - ${DOCKER_PATH:-./data}/config:/config - - ${DOCKER_PATH:-./data}/data:/data + environment: + # Points to the config directory inside the container. DOCKER_PATH: /config + UI_DIR: /srv/archivum/ui + # Set to match the owner of the host directories (run `id` to check). PUID: ${PUID:-1000} PGID: ${PGID:-1000} + TZ: ${TZ:-Europe/Stockholm} + + volumes: + # Configuration (config.json written here by Setup Wizard). + - archivum-config:/config + # All data: wiki files live in /data/wiki, SQLite db in /data/db. + # Using named volumes for local dev avoids Windows/WSL2 permission issues. + - archivum-data:/data + +# Named volumes let Docker manage ownership automatically. +# Replace with bind mounts if you need direct host access: +# - ./local/config:/config +# - ./local/data:/data +# (and make sure the host directories are owned by PUID:PGID) +volumes: + archivum-config: + archivum-data: diff --git a/docker/entrypoint.sh b/docker/entrypoint.sh new file mode 100644 index 0000000..622d15e --- /dev/null +++ b/docker/entrypoint.sh @@ -0,0 +1,28 @@ +#!/bin/sh +# Archivum container entrypoint +# Runs as root, creates directories, fixes permissions, then drops to PUID:PGID. +set -e + +PUID="${PUID:-1000}" +PGID="${PGID:-1000}" + +echo "[entrypoint] starting as uid=$(id -u) gid=$(id -g)" +echo "[entrypoint] target PUID=${PUID} PGID=${PGID}" + +# ── Ensure required directories exist ────────────────────────────────────── +mkdir -p /config +mkdir -p /data/wiki +mkdir -p /data/db + +# ── Fix ownership so the app user can read/write all volumes ─────────────── +# This is needed because: +# - bind-mounted directories from the host may be owned by root +# - Docker Desktop on Windows mounts volumes with host permissions +# that don't map to the container user +chown -R "${PUID}:${PGID}" /config /data + +echo "[entrypoint] /config and /data ownership set to ${PUID}:${PGID}" + +# ── Drop privileges and exec the application ─────────────────────────────── +echo "[entrypoint] exec archivum as ${PUID}:${PGID}" +exec su-exec "${PUID}:${PGID}" /usr/local/bin/archivum "$@"