From 1369fe63f25e6a2c1e996860dcce8a33117815ce Mon Sep 17 00:00:00 2001
From: Nick Sweeting <git@sweeting.me>
Date: Sun, 9 Aug 2026 18:31:52 -0400
Subject: [PATCH] Avoid recursive dependency chown on container start

---
 bin/docker_entrypoint.sh       | 14 ++------------
 bin/validate_docker_uid_gid.sh |  9 +++++++++
 2 files changed, 11 insertions(+), 12 deletions(-)

diff --git a/bin/docker_entrypoint.sh b/bin/docker_entrypoint.sh
index 548fbf5f..16ac3c9f 100755
--- a/bin/docker_entrypoint.sh
+++ b/bin/docker_entrypoint.sh
@@ -112,16 +112,6 @@ ensure_file_owner() {
     chmod_if_possible "$path"
 }
 
-ensure_runtime_tree() {
-    local path="$1"
-    mkdir -p "$path" 2>/dev/null || true
-    [[ -e "$path" ]] || return 0
-    if [[ "$(id -u)" == "0" ]] && [[ "$(stat -c '%u:%g' "$path" 2>/dev/null || true)" != "$TARGET_UID:$TARGET_GID" ]]; then
-        chown -R "$TARGET_UID:$TARGET_GID" "$path" 2>/dev/null || true
-    fi
-    chmod_if_possible "$path"
-}
-
 ensure_runtime_tmp_tree() {
     mkdir -p "$TMP_DIR" 2>/dev/null || true
     [[ -e "$TMP_DIR" ]] || return 0
@@ -206,9 +196,9 @@ ensure_dir "/home/$ARCHIVEBOX_USER"
 ensure_small_runtime_tree "$ABXBUS_CACHE_DIR"
 ensure_small_runtime_tree "$ABXBUS_CACHE_DIR/semaphores"
 ensure_small_runtime_tree "$UV_CACHE_DIR"
-ensure_runtime_tree "$PLAYWRIGHT_BROWSERS_PATH"
+ensure_dir "$PLAYWRIGHT_BROWSERS_PATH"
 ensure_runtime_tmp_tree
-ensure_runtime_tree "$ABXPKG_LIB_DIR"
+ensure_dir "$ABXPKG_LIB_DIR"
 run_as_archivebox touch "$ABXBUS_CACHE_DIR/semaphores/.permissions_test_safe_to_delete" 2>/dev/null || permission_error "$ABXBUS_CACHE_DIR/semaphores"
 rm -f "$ABXBUS_CACHE_DIR/semaphores/.permissions_test_safe_to_delete"
 run_as_archivebox touch "$UV_CACHE_DIR/.permissions_test_safe_to_delete" 2>/dev/null || permission_error "$UV_CACHE_DIR"
diff --git a/bin/validate_docker_uid_gid.sh b/bin/validate_docker_uid_gid.sh
index 5c53485e..d50dc6a4 100755
--- a/bin/validate_docker_uid_gid.sh
+++ b/bin/validate_docker_uid_gid.sh
@@ -260,6 +260,11 @@ run_case() {
         local nested_stat
         nested_stat="$("${docker_base[@]}" -v "$case_dir/data:/data" --entrypoint /bin/bash "$IMAGE" -lc "stat -c '%u:%g' /data/archive/existing/file" 2>/dev/null || true)"
         [[ "$nested_stat" == "0:0" ]] || ok=0
+    elif [[ "$post_assert" == runtime-nested-root-stays ]]; then
+        local lib_stat browsers_stat
+        lib_stat="$("${docker_base[@]}" -v "$case_dir/lib:/libdir" --entrypoint /bin/bash "$IMAGE" -lc "stat -c '%u:%g' /libdir/existing/file" 2>/dev/null || true)"
+        browsers_stat="$("${docker_base[@]}" -v "$case_dir/browsers:/browsers" --entrypoint /bin/bash "$IMAGE" -lc "stat -c '%u:%g' /browsers/existing/file" 2>/dev/null || true)"
+        [[ "$lib_stat" == "0:0" && "$browsers_stat" == "0:0" ]] || ok=0
     elif [[ "$post_assert" == users-dir-repaired ]]; then
         local users_stat
         users_stat="$("${docker_base[@]}" -v "$case_dir/data:/data" --entrypoint /bin/bash "$IMAGE" -lc "stat -c '%u:%g' /data/users" 2>/dev/null || true)"
@@ -481,6 +486,10 @@ run_case "nested root-owned archive content is not recursively chowned" \
     "chown 0:0 /case/data && chmod 755 /case/data && mkdir -p /case/data/archive/existing && touch /case/data/archive/existing/file && chown -R 0:0 /case/data/archive/existing" \
     "-" "-" pass 911 911 "$default_cmd" nested-root-stays
 
+run_case "bundled dependency trees are not recursively chowned" \
+    "chown 501:20 /case/data && mkdir -p /case/lib/existing /case/browsers/existing && touch /case/lib/existing/file /case/browsers/existing/file && chown -R 0:0 /case/lib/existing /case/browsers/existing" \
+    "-" "-" pass 501 20 "$default_cmd" runtime-nested-root-stays
+
 run_case "root start fixes read-only top-level data when chmod works" \
     "chown 0:0 /case/data && chmod 555 /case/data" \
     "-" "-" pass 911 911