mirror of
https://github.com/guillaumemeyer/watermarks-remover.git
synced 2026-08-22 13:11:57 +02:00
COPY preserves source file and directory modes, so a build host with a restrictive umask (e.g. 027) landed the scripts as 0640 root:root and the /app/scripts directory as 0750 -- unreadable and untraversable for the unprivileged runtime user (uid 10001). The image built fine and failed only at container start, making it easy to miss (#131). Normalize after the copy with chmod -R a+rX: world-readable everywhere, execute bit for directories only, intentionally-executable scripts keep their bit -- deterministic regardless of the builder's umask. Co-authored-by: yzxcj797 <yzxcj797@users.noreply.github.com> Co-authored-by: Guillaume Meyer (The Opinionated Man) <1385518+guillaumemeyer@users.noreply.github.com>