Fix Docker permissions with automatic entrypoint script

The Docker container now handles data directory permissions automatically
without requiring manual user setup.

Changes:
- Added entrypoint.sh script that runs as root, fixes /data permissions,
  then drops to non-root user (towerops) using su-exec
- Updated Dockerfile to install su-exec and use the entrypoint script
- Container starts as root but immediately drops privileges after fixing
  permissions

The agent will now start successfully with just 'docker-compose up -d'
without users needing to run chown commands manually.

Dockerfile

@@ -45,7 +45,7 @@ RUN RUST_TARGET=$(cat /tmp/rust-target) && \
 FROM alpine:3.19
 
 # Install runtime dependencies
-RUN apk add --no-cache ca-certificates
+RUN apk add --no-cache ca-certificates su-exec
 
 # Create data directory
 RUN mkdir -p /data
@@ -53,6 +53,10 @@ RUN mkdir -p /data
 # Copy binary from builder
 COPY --from=builder /tmp/towerops-agent /usr/local/bin/towerops-agent
 
+# Copy entrypoint script
+COPY entrypoint.sh /usr/local/bin/entrypoint.sh
+RUN chmod +x /usr/local/bin/entrypoint.sh
+
 # Volume for database
 VOLUME ["/data"]
 
@@ -60,11 +64,9 @@ VOLUME ["/data"]
 HEALTHCHECK --interval=30s --timeout=10s --retries=3 \
   CMD test -f /data/towerops-agent.db || exit 1
 
-# Run as non-root user
+# Create non-root user (entrypoint will drop to this user)
 RUN addgroup -g 1000 towerops && \
-    adduser -D -u 1000 -G towerops towerops && \
-    chown -R towerops:towerops /data
+    adduser -D -u 1000 -G towerops towerops
 
-USER towerops
-
-ENTRYPOINT ["towerops-agent"]
+# Start as root, entrypoint will fix permissions and drop to towerops user
+ENTRYPOINT ["/usr/local/bin/entrypoint.sh"]

entrypoint.sh

@@ -0,0 +1,11 @@
+#!/bin/sh
+set -e
+
+# Ensure /data directory exists and has proper permissions
+if [ -d /data ]; then
+  # Fix ownership if needed
+  chown -R towerops:towerops /data
+fi
+
+# Drop to towerops user and run the agent
+exec su-exec towerops towerops-agent "$@"