fix(entrypoint): root never follows customer symlinks under /home/$user

/home/$user is the customer's bind mount; they can plant symlinks in it. The
entrypoint ran as root and created/copied/chowned through customer paths (the
example-app copy, ecosystem.config.js generation + non-recursive chown, which
dereferences). Now: refuse to start if /home/$user is not a real dir; logs/ must
be a real dir and symlinks under it are removed and logged (nginx opens those
files as root); app/logs dirs, the example copy and ecosystem.config.js are
created AS THE CUSTOMER (setpriv, runuser fallback); the o+x directory pass runs
as the customer. chown -R is unchanged (GNU default -P never follows symlinks).
app/ itself may stay a symlink (release-dir deploys).

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

scripts/entrypoint.sh

@@ -19,8 +19,38 @@ else
     echo "User $user already exists"
 fi
 
-mkdir -p /home/$user/app
-mkdir -p /home/$user/logs/{nginx,nodejs}
+# ---- root never follows customer symlinks under /home/$user ----
+# /home/$user is the customer's bind mount: they can plant symlinks in it, and
+# root touching/chowning/writing through one (e.g. logs/nginx -> /etc) gives
+# them that target. logs/ is WHP-owned and nginx opens files in it as root, so
+# symlinks there are removed and logged; everything under /home/$user is created/written AS THE CUSTOMER.
+as_user() {
+  if command -v setpriv >/dev/null 2>&1; then
+    setpriv --reuid="$uid" --regid="$uid" --init-groups -- "$@"
+  else
+    runuser -u "$user" -- "$@"
+  fi
+}
+drop_symlink() {
+  if [ -L "$1" ]; then
+    echo "entrypoint: SECURITY: $1 was a symlink to '$(readlink "$1")' - removed" >&2
+    rm -f -- "$1"
+  fi
+}
+if [ -L /home/$user ] || [ ! -d /home/$user ]; then
+  echo "entrypoint: FATAL: /home/$user is not a real directory - refusing to start" >&2
+  exit 1
+fi
+chown -h $user:$user /home/$user
+# app/ may legitimately be a symlink (releases/current deploys): it is left
+# alone, and every root-side operation on it below runs as the customer.
+drop_symlink /home/$user/logs
+if [ -d /home/$user/logs ]; then
+  # nginx opens its logs here as root; find without -L never follows links.
+  find /home/$user/logs -xdev -type l -print0 2>/dev/null | while IFS= read -r -d '' l; do drop_symlink "$l"; done
+fi
+
+as_user mkdir -p /home/$user/app /home/$user/logs/nginx /home/$user/logs/nodejs
 
 # Link log directories
 rm -rf /var/log/nginx
@@ -30,7 +60,8 @@ ln -s /home/$user/logs/nodejs /var/log/nodejs
 # Configure nginx for reverse proxy
 /scripts/create-nginx-config.sh
 
-# Set ownership and permissions
+# Set ownership and permissions. GNU chown -R defaults to -P: symlinks are
+# lchown()ed, never followed.
 chown -R $user:$user /home/$user
 # Do NOT `chmod -R 755` here. /home/$user is the customer's bind-mounted
 # directory; a recursive 755 on every start made every file (.env, app
@@ -40,8 +71,11 @@ chown -R $user:$user /home/$user
 # only need to traverse directories. Normalise that and nothing else: open the
 # home dir itself (adduser -m creates it 0700 when it does not exist yet), and
 # add o+x to directories that lack it. Regular files are never touched.
+# The find runs AS THE CUSTOMER: `-type d` without -L skips symlinks, and if a
+# dir is swapped for a symlink before chmod runs, the customer can only reach
+# what they already own.
 chmod 755 /home/$user
-find /home/$user -type d ! -perm -o=x -exec chmod o+x {} +
+as_user find /home/$user -type d ! -perm -o=x -exec chmod o+x {} + 2>/dev/null || true
 
 # Start nginx
 nginx
@@ -68,15 +102,13 @@ fi
 # Create app directory if it doesn't exist
 if [ ! -d /home/$user/app ]; then
   echo "Creating app directory at /home/$user/app"
-  mkdir -p /home/$user/app
-  chown -R $user:$user /home/$user/app
+  as_user mkdir -p /home/$user/app
 fi
 
 # If app directory is empty, copy the simple-website example
 if [ -z "$(ls -A /home/$user/app)" ]; then
   echo "App directory is empty, copying simple-website example..."
-  cp -r /examples/simple-website/* /home/$user/app/
-  chown -R $user:$user /home/$user/app
+  as_user cp -r /examples/simple-website/. /home/$user/app/
   echo "Copied simple-website example to provide a working application"
 fi
 
@@ -94,8 +126,9 @@ su -c "npm install" $user
 # Check if ecosystem.config.js exists, if not generate it
 if [ ! -f /home/$user/app/ecosystem.config.js ]; then
   echo "No ecosystem.config.js found, generating from package.json..."
-  /scripts/generate-ecosystem-config.sh "$user" "/home/$user/app"
-  chown $user:$user /home/$user/app/ecosystem.config.js
+  # As the customer: it reads their package.json and writes into their app dir.
+  drop_symlink /home/$user/app/ecosystem.config.js
+  as_user /scripts/generate-ecosystem-config.sh "$user" "/home/$user/app"
 fi
 
 # Mirror logs to docker logs in the background.