mirror of
https://github.com/maziggy/bambuddy.git
synced 2026-08-11 00:30:12 -04:00
3407afc0c7
Two related failure modes have been biting Docker users repeatedly, most recently in #1211: 1. Docker named volumes are created by the daemon as root:root, and the previous `chmod 777 /app/data` Dockerfile workaround only covered the named-volume root — so subdirs Bambuddy creates at runtime (virtual_printer/uploads, virtual_printer/certs, etc.) inherited wrong ownership when the container ran as 1000:1000. 2. The shipped docker-compose.yml ships `./virtual_printer:/app/data/virtual_printer` uncommented, and dockerd creates a missing bind-mount source on the host as root before the container starts — leaving the host directory unwritable by uid 1000 inside the container even though the named volume above it had the chmod-777 workaround. Symptom either way: [Errno 13] Permission denied: '/app/data/virtual_printer/uploads', no virtual printer ever starts, "VP doesn't work" support reports follow. Replace the chmod-777 hack with a proper entrypoint: - deploy/docker-entrypoint.sh runs as root, chowns /app/data and /app/logs (and /app/data/virtual_printer when bind-mounted) to PUID:PGID, then drops to that uid via gosu before exec'ing the app. The chown is gated behind a top-level ownership check so subsequent restarts skip the recursive traversal — no multi- second startup penalty on multi-GB archive directories. - A sentinel .bambuddy file in each data path prevents Docker from re-syncing image directory metadata on every mount (otherwise empty volumes have their ownership reverted from the image on each restart, defeating the idempotency). - When the container is started with an explicit `user:` directive or `--user` flag the entrypoint detects it isn't root and falls through to direct exec — preserving compatibility for users who pin a specific uid. Compose template changes: - Remove `user: "${PUID:-1000}:${PGID:-1000}"` (entrypoint owns privilege drop now). - Add PUID / PGID env vars with the same defaults. - Comment out the ./virtual_printer:/app/data/virtual_printer bind mount by default, with explicit "only needed if you also run a native install of Bambuddy on the same host and want both to share the VP CA cert" guidance. The entrypoint chowns the host-side dir through the bind mount the first time it sees wrong ownership, so existing uncomented installs continue to work and #1211 specifically gets fixed. |
||
|---|---|---|
| .. | ||
| bambuddy.service | ||
| docker-entrypoint.sh | ||