From f80298a2ced1ad30a2cf1367b0bf6765367aed2b Mon Sep 17 00:00:00 2001
From: Graham McIntire <graham@mcintire.me>
Date: Thu, 15 Jan 2026 09:30:43 -0600
Subject: [PATCH] Fix Docker socket permissions for auto-updates

- Detect host Docker socket GID at runtime
- Create docker group with matching GID
- Add towerops user to docker group
- Allows non-root container to access Docker socket for self-updates
---
 entrypoint.sh | 14 ++++++++++++++
 1 file changed, 14 insertions(+)

diff --git a/entrypoint.sh b/entrypoint.sh
index dab5e15..583b023 100644
--- a/entrypoint.sh
+++ b/entrypoint.sh
@@ -7,5 +7,19 @@ if [ -d /data ]; then
   chown -R towerops:towerops /data
 fi
 
+# If Docker socket is mounted, add towerops user to docker group
+if [ -S /var/run/docker.sock ]; then
+  # Get the GID of the docker socket
+  DOCKER_GID=$(stat -c '%g' /var/run/docker.sock 2>/dev/null || stat -f '%g' /var/run/docker.sock 2>/dev/null)
+
+  # Create docker group with the same GID as host's docker socket
+  if ! getent group "$DOCKER_GID" >/dev/null 2>&1; then
+    addgroup -g "$DOCKER_GID" docker
+  fi
+
+  # Add towerops user to the docker group
+  addgroup towerops docker 2>/dev/null || true
+fi
+
 # Drop to towerops user and run the agent
 exec su-exec towerops towerops-agent "$@"