yunxiafei/openclaw-mission-control
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

fix: chown /app directory after user creation

Browse Source 
Ensure the /app WORKDIR itself is owned by appuser (not just copied
files), preventing runtime failures if the app writes to /app directly.

Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
This commit is contained in:
0xjjjjjj
2026-03-07 20:45:25 -08:00
parent 42368f84bf
commit 9396be6fc0
2 changed files with 4 additions and 2 deletions
Download Patch File Download Diff File Expand all files Collapse all files

3
backend/Dockerfile
View File

@@ -31,7 +31,8 @@ FROM base AS runtime
# Create non-root user before COPY so --chown can reference it. # Create non-root user before COPY so --chown can reference it.
# Using COPY --chown avoids a slow recursive chown on overlay2 (docker/for-linux#388). # Using COPY --chown avoids a slow recursive chown on overlay2 (docker/for-linux#388).
RUN groupadd --system appgroup && useradd --system --gid appgroup --create-home appuser RUN groupadd --system appgroup && useradd --system --gid appgroup --create-home appuser \
&& chown appuser:appgroup /app
# Copy virtual environment from deps stage # Copy virtual environment from deps stage
COPY --from=deps --chown=appuser:appgroup /app/.venv /app/.venv COPY --from=deps --chown=appuser:appgroup /app/.venv /app/.venv

3
frontend/Dockerfile
View File

@@ -33,7 +33,8 @@ ENV NEXT_PUBLIC_AUTH_MODE=${NEXT_PUBLIC_AUTH_MODE}
# Create non-root user before COPY so --chown can reference it. # Create non-root user before COPY so --chown can reference it.
# Using COPY --chown avoids a slow recursive chown on overlay2 (docker/for-linux#388). # Using COPY --chown avoids a slow recursive chown on overlay2 (docker/for-linux#388).
RUN addgroup -S appgroup && adduser -S -G appgroup appuser RUN addgroup -S appgroup && adduser -S -G appgroup appuser \
&& chown appuser:appgroup /app
COPY --from=builder --chown=appuser:appgroup /app/.next ./.next COPY --from=builder --chown=appuser:appgroup /app/.next ./.next
# `public/` is optional in Next.js apps; repo may not have it. # `public/` is optional in Next.js apps; repo may not have it.