osobh/clawmates
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

fix(build): normalize /etc/clawmates seed-dir perms for the nonroot user

Browse Source 
The server COPYs templates/ and skills/ then drops to USER 65532. When the
build context arrives with mode-700 dirs (e.g. rsync -a preserving a dev's
local perms), COPY bakes 700 into the image and the nonroot runtime user
can't read them — the skills/team-template builtin seed silently skips
("Permission denied (os error 13)"). chmod -R a+rX after the COPYs makes
the seed dirs readable regardless of source perms.

Co-Authored-By: Claude Opus 4.8 <[email protected]>
This commit is contained in:
Omar Sobh
2026-07-28 09:07:42 +02:00
co-authored by Claude Opus 4.8
parent 34409bca0c
commit 11e1379c5f
1 changed files with 5 additions and 0 deletions
Download Patch File Download Diff File Expand all files Collapse all files
images/server.Dockerfile
+5
View File
@@ -58,5 +58,10 @@ COPY --from=builder /clawmates-server /usr/local/bin/clawmates-server
# Builtin templates (team + workflow). Loader upserts them on boot. # Builtin templates (team + workflow). Loader upserts them on boot.
COPY templates /etc/clawmates/templates COPY templates /etc/clawmates/templates
COPY skills /etc/clawmates/skills COPY skills /etc/clawmates/skills
# Normalize perms: the source dirs may arrive mode 700 (e.g. rsync -a
# preserving a developer's local dir perms), which would leave the
# nonroot runtime user unable to read them and silently skip the builtin
# skills/team-template seed. a+rX = dirs traversable, files readable.
RUN chmod -R a+rX /etc/clawmates/templates /etc/clawmates/skills
USER 65532 USER 65532
ENTRYPOINT ["/usr/local/bin/clawmates-server"] ENTRYPOINT ["/usr/local/bin/clawmates-server"]