The_Great_Archive/ArchiveBox
1
0
Fork 0
mirror of https://github.com/ArchiveBox/ArchiveBox.git synced 2026-09-14 11:06:13 +05:00
Code Issues Actions Packages Projects Releases Wiki Activity

Avoid recursive dependency chown on container start

Browse Source
This commit is contained in:
Nick Sweeting 2026-08-09 18:31:52 -04:00
parent 1bff21e663
commit 1369fe63f2
No known key found for this signature in database
2 changed files with 11 additions and 12 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

14
bin/docker_entrypoint.sh
View File

@ -112,16 +112,6 @@ ensure_file_owner() {
chmod_if_possible "$path"
}
ensure_runtime_tree() {
local path="$1"
mkdir -p "$path" 2>/dev/null || true
[[ -e "$path" ]] || return 0
if [[ "$(id -u)" == "0" ]] && [[ "$(stat -c '%u:%g' "$path" 2>/dev/null || true)" != "$TARGET_UID:$TARGET_GID" ]]; then
chown -R "$TARGET_UID:$TARGET_GID" "$path" 2>/dev/null || true
fi
chmod_if_possible "$path"
}
ensure_runtime_tmp_tree() {
mkdir -p "$TMP_DIR" 2>/dev/null || true
[[ -e "$TMP_DIR" ]] || return 0
@ -206,9 +196,9 @@ ensure_dir "/home/$ARCHIVEBOX_USER"
ensure_small_runtime_tree "$ABXBUS_CACHE_DIR"
ensure_small_runtime_tree "$ABXBUS_CACHE_DIR/semaphores"
ensure_small_runtime_tree "$UV_CACHE_DIR"
ensure_runtime_tree "$PLAYWRIGHT_BROWSERS_PATH"
ensure_dir "$PLAYWRIGHT_BROWSERS_PATH"
ensure_runtime_tmp_tree
ensure_runtime_tree "$ABXPKG_LIB_DIR"
ensure_dir "$ABXPKG_LIB_DIR"
run_as_archivebox touch "$ABXBUS_CACHE_DIR/semaphores/.permissions_test_safe_to_delete" 2>/dev/null || permission_error "$ABXBUS_CACHE_DIR/semaphores"
rm -f "$ABXBUS_CACHE_DIR/semaphores/.permissions_test_safe_to_delete"
run_as_archivebox touch "$UV_CACHE_DIR/.permissions_test_safe_to_delete" 2>/dev/null || permission_error "$UV_CACHE_DIR"

9
bin/validate_docker_uid_gid.sh
View File

@ -260,6 +260,11 @@ run_case() {
local nested_stat
nested_stat="$("${docker_base[@]}" -v "$case_dir/data:/data" --entrypoint /bin/bash "$IMAGE" -lc "stat -c '%u:%g' /data/archive/existing/file" 2>/dev/null || true)"
[[ "$nested_stat" == "0:0" ]] || ok=0
elif [[ "$post_assert" == runtime-nested-root-stays ]]; then
local lib_stat browsers_stat
lib_stat="$("${docker_base[@]}" -v "$case_dir/lib:/libdir" --entrypoint /bin/bash "$IMAGE" -lc "stat -c '%u:%g' /libdir/existing/file" 2>/dev/null || true)"
browsers_stat="$("${docker_base[@]}" -v "$case_dir/browsers:/browsers" --entrypoint /bin/bash "$IMAGE" -lc "stat -c '%u:%g' /browsers/existing/file" 2>/dev/null || true)"
[[ "$lib_stat" == "0:0" && "$browsers_stat" == "0:0" ]] || ok=0
elif [[ "$post_assert" == users-dir-repaired ]]; then
local users_stat
users_stat="$("${docker_base[@]}" -v "$case_dir/data:/data" --entrypoint /bin/bash "$IMAGE" -lc "stat -c '%u:%g' /data/users" 2>/dev/null || true)"
@ -481,6 +486,10 @@ run_case "nested root-owned archive content is not recursively chowned" \
"chown 0:0 /case/data && chmod 755 /case/data && mkdir -p /case/data/archive/existing && touch /case/data/archive/existing/file && chown -R 0:0 /case/data/archive/existing" \
"-" "-" pass 911 911 "$default_cmd" nested-root-stays
run_case "bundled dependency trees are not recursively chowned" \
"chown 501:20 /case/data && mkdir -p /case/lib/existing /case/browsers/existing && touch /case/lib/existing/file /case/browsers/existing/file && chown -R 0:0 /case/lib/existing /case/browsers/existing" \
"-" "-" pass 501 20 "$default_cmd" runtime-nested-root-stays
run_case "root start fixes read-only top-level data when chmod works" \
"chown 0:0 /case/data && chmod 555 /case/data" \
"-" "-" pass 911 911