From d9d53018b15eccd3093df340dbbeb528b207d1c3 Mon Sep 17 00:00:00 2001 From: yzxcj797 <54314860+yzxcj797@users.noreply.github.com> Date: Wed, 19 Aug 2026 03:23:24 +0800 Subject: [PATCH] fix: normalize script modes in the core image (#143) COPY preserves source file and directory modes, so a build host with a restrictive umask (e.g. 027) landed the scripts as 0640 root:root and the /app/scripts directory as 0750 -- unreadable and untraversable for the unprivileged runtime user (uid 10001). The image built fine and failed only at container start, making it easy to miss (#131). Normalize after the copy with chmod -R a+rX: world-readable everywhere, execute bit for directories only, intentionally-executable scripts keep their bit -- deterministic regardless of the builder's umask. Co-authored-by: yzxcj797 Co-authored-by: Guillaume Meyer (The Opinionated Man) <1385518+guillaumemeyer@users.noreply.github.com> --- service/Dockerfile | 7 +++++++ 1 file changed, 7 insertions(+) diff --git a/service/Dockerfile b/service/Dockerfile index c3124c9..8ef6b3c 100644 --- a/service/Dockerfile +++ b/service/Dockerfile @@ -49,6 +49,13 @@ RUN curl -fsSL -o /tmp/c2patool.tar.gz \ COPY scripts /app/scripts +# COPY preserves the source modes, so a build host with a restrictive umask +# (e.g. 027) lands these as 0640/0750 root:root -- unreadable and untraversable +# for the unprivileged runtime user below, and the image only fails at +# container start. Normalize explicitly instead of inheriting the builder's +# umask: world-readable everywhere, execute bit for directories only (#131). +RUN chmod -R a+rX /app/scripts + RUN python3 -m pip install --no-cache-dir "pip==26.2.1" # Unprivileged runtime user. The service only reads request bodies and writes