External/watermarks-remover
1
0
Fork 0
mirror of https://github.com/guillaumemeyer/watermarks-remover.git synced 2026-08-22 13:11:57 +02:00
Code Issues Packages Projects Releases Wiki Activity

fix: normalize script modes in the core image (#143)

Browse Source 
COPY preserves source file and directory modes, so a build host with a
restrictive umask (e.g. 027) landed the scripts as 0640 root:root and
the /app/scripts directory as 0750 -- unreadable and untraversable for
the unprivileged runtime user (uid 10001). The image built fine and
failed only at container start, making it easy to miss (#131).

Normalize after the copy with chmod -R a+rX: world-readable everywhere,
execute bit for directories only, intentionally-executable scripts keep
their bit -- deterministic regardless of the builder's umask.

Co-authored-by: yzxcj797 <yzxcj797@users.noreply.github.com>
Co-authored-by: Guillaume Meyer (The Opinionated Man) <1385518+guillaumemeyer@users.noreply.github.com>
This commit is contained in:
yzxcj797
2026-08-18 12:23:24 -07:00
committed by GitHub
co-authored by yzxcj797 Guillaume Meyer
parent eaf07b41f3
commit d9d53018b1
1 changed files with 7 additions and 0 deletions
Download Patch File Download Diff File Expand all files Collapse all files
service/Dockerfile
+7
View File
@@ -49,6 +49,13 @@ RUN curl -fsSL -o /tmp/c2patool.tar.gz \
COPY scripts /app/scripts
# COPY preserves the source modes, so a build host with a restrictive umask
# (e.g. 027) lands these as 0640/0750 root:root -- unreadable and untraversable
# for the unprivileged runtime user below, and the image only fails at
# container start. Normalize explicitly instead of inheriting the builder's
# umask: world-readable everywhere, execute bit for directories only (#131).
RUN chmod -R a+rX /app/scripts
RUN python3 -m pip install --no-cache-dir "pip==26.2.1"
# Unprivileged runtime user. The service only reads request bodies and writes