From 7e2e50a7642e9a8e2dddc35d42877a1fb9b9dc47 Mon Sep 17 00:00:00 2001
From: Graham McIntire <graham@mcintire.me>
Date: Wed, 14 Jan 2026 09:36:45 -0600
Subject: [PATCH] Fix Docker permissions with automatic entrypoint script

The Docker container now handles data directory permissions automatically
without requiring manual user setup.

Changes:
- Added entrypoint.sh script that runs as root, fixes /data permissions,
  then drops to non-root user (towerops) using su-exec
- Updated Dockerfile to install su-exec and use the entrypoint script
- Container starts as root but immediately drops privileges after fixing
  permissions

The agent will now start successfully with just 'docker-compose up -d'
without users needing to run chown commands manually.
---
 Dockerfile    | 16 +++++++++-------
 entrypoint.sh | 11 +++++++++++
 2 files changed, 20 insertions(+), 7 deletions(-)
 create mode 100644 entrypoint.sh

diff --git a/Dockerfile b/Dockerfile
index dd8cd4f..797283a 100644
--- a/Dockerfile
+++ b/Dockerfile
@@ -45,7 +45,7 @@ RUN RUST_TARGET=$(cat /tmp/rust-target) && \
 FROM alpine:3.19
 
 # Install runtime dependencies
-RUN apk add --no-cache ca-certificates
+RUN apk add --no-cache ca-certificates su-exec
 
 # Create data directory
 RUN mkdir -p /data
@@ -53,6 +53,10 @@ RUN mkdir -p /data
 # Copy binary from builder
 COPY --from=builder /tmp/towerops-agent /usr/local/bin/towerops-agent
 
+# Copy entrypoint script
+COPY entrypoint.sh /usr/local/bin/entrypoint.sh
+RUN chmod +x /usr/local/bin/entrypoint.sh
+
 # Volume for database
 VOLUME ["/data"]
 
@@ -60,11 +64,9 @@ VOLUME ["/data"]
 HEALTHCHECK --interval=30s --timeout=10s --retries=3 \
   CMD test -f /data/towerops-agent.db || exit 1
 
-# Run as non-root user
+# Create non-root user (entrypoint will drop to this user)
 RUN addgroup -g 1000 towerops && \
-    adduser -D -u 1000 -G towerops towerops && \
-    chown -R towerops:towerops /data
+    adduser -D -u 1000 -G towerops towerops
 
-USER towerops
-
-ENTRYPOINT ["towerops-agent"]
+# Start as root, entrypoint will fix permissions and drop to towerops user
+ENTRYPOINT ["/usr/local/bin/entrypoint.sh"]
diff --git a/entrypoint.sh b/entrypoint.sh
new file mode 100644
index 0000000..dab5e15
--- /dev/null
+++ b/entrypoint.sh
@@ -0,0 +1,11 @@
+#!/bin/sh
+set -e
+
+# Ensure /data directory exists and has proper permissions
+if [ -d /data ]; then
+  # Fix ownership if needed
+  chown -R towerops:towerops /data
+fi
+
+# Drop to towerops user and run the agent
+exec su-exec towerops towerops-agent "$@"