From 3ad03be0151a80d6c92ae0bf28e4c55d3df3a8a2 Mon Sep 17 00:00:00 2001 From: Josh Knapp Date: Tue, 20 Oct 2026 12:34:38 -0700 Subject: [PATCH] fix(entrypoint): stop chmod -R 755 on the customer home every start entrypoint.sh ran `chmod -R 755 /home/$user` on every container start. /home/$user is the customer's bind-mounted directory, so every file (.env and other app secrets included) became world-readable and executable, and any tighter permissions the customer set were reverted on each restart. It dates from the initial implementation (2989cd5) with no stated reason; the same pattern was removed from cloud-apache-container. The legitimate need: nginx workers run as `nginx` (configs/nginx.conf) and serve /static/ via `alias /home/$user/app/public/`, so nginx must traverse directories. Keep the recursive chown; replace the recursive chmod with chmod 755 on /home/$user itself and o+x on directories lacking it. Regular files are never touched. Co-Authored-By: Claude Opus 5.5 --- scripts/entrypoint.sh | 11 ++++++++++- 1 file changed, 10 insertions(+), 1 deletion(-) diff --git a/scripts/entrypoint.sh b/scripts/entrypoint.sh index 109fbc7..509cb48 100755 --- a/scripts/entrypoint.sh +++ b/scripts/entrypoint.sh @@ -32,7 +32,16 @@ ln -s /home/$user/logs/nodejs /var/log/nodejs # Set ownership and permissions chown -R $user:$user /home/$user -chmod -R 755 /home/$user +# Do NOT `chmod -R 755` here. /home/$user is the customer's bind-mounted +# directory; a recursive 755 on every start made every file (.env, app +# secrets) world-readable AND executable, and reverted any tighter +# permissions the customer had set. nginx workers run as `nginx` (not the +# customer) and serve /static/ straight from /home/$user/app/public/, so they +# only need to traverse directories. Normalise that and nothing else: open the +# home dir itself (adduser -m creates it 0700 when it does not exist yet), and +# add o+x to directories that lack it. Regular files are never touched. +chmod 755 /home/$user +find /home/$user -type d ! -perm -o=x -exec chmod o+x {} + # Start nginx nginx