The image's runtime stage creates /var/lib/neoirc at build time and switches to USER neoirc. A named volume copies that owner, but a host directory mounted at /var/lib/neoirc keeps the host's owner, so neoircd cannot create state.db and stops at startup until someone runs chown on the host directory.
Standing ruling for every app image: the entrypoint runs as root, creates the data directory, sets its owner and mode for the app user, then drops to that user and execs the app. No mkdir or chown of a host directory is ever required or documented.
Definition of done
New deploy/docker-entrypoint.sh, POSIX sh, set -eu: create /var/lib/neoirc, give it and its contents to neoirc:neoirc (chown -R), mode 0700, then exec su-exec neoirc neoircd "$@".
Runtime stage of Dockerfile: install su-exec pinned to its Alpine 3.21 package version with a dated comment, as the other pins are; copy the entrypoint to /usr/local/bin/docker-entrypoint.sh; drop USER neoirc; ENTRYPOINT ["/usr/local/bin/docker-entrypoint.sh"]. The neoirc user, the exposed ports and the HEALTHCHECK stay.
README.md "Docker": the image prepares /var/lib/neoirc itself and then runs neoircd as neoirc; show a host-directory mount (-v /srv/neoirc:/var/lib/neoirc) beside the named volume, with no mkdir or chown step.
Before pushing, check by hand on a plain docker build . image: an empty host directory owned by root mounted at /var/lib/neoirc ends up holding state.db owned by neoirc; neoircd runs as neoirc, not root; the healthcheck passes. Remove every container and image the check started.
Read first: AGENTS.md, REPO_POLICIES.md. The same shape is built in sneak/webhooker (deploy/docker-entrypoint.sh and its Dockerfile on next).
Model: opus-5-5
The image's runtime stage creates `/var/lib/neoirc` at build time and switches to `USER neoirc`. A named volume copies that owner, but a host directory mounted at `/var/lib/neoirc` keeps the host's owner, so `neoircd` cannot create `state.db` and stops at startup until someone runs `chown` on the host directory.
Standing ruling for every app image: the entrypoint runs as root, creates the data directory, sets its owner and mode for the app user, then drops to that user and execs the app. No `mkdir` or `chown` of a host directory is ever required or documented.
## Definition of done
- New `deploy/docker-entrypoint.sh`, POSIX `sh`, `set -eu`: create `/var/lib/neoirc`, give it and its contents to `neoirc:neoirc` (`chown -R`), mode `0700`, then `exec su-exec neoirc neoircd "$@"`.
- Runtime stage of `Dockerfile`: install `su-exec` pinned to its Alpine 3.21 package version with a dated comment, as the other pins are; copy the entrypoint to `/usr/local/bin/docker-entrypoint.sh`; drop `USER neoirc`; `ENTRYPOINT ["/usr/local/bin/docker-entrypoint.sh"]`. The `neoirc` user, the exposed ports and the `HEALTHCHECK` stay.
- `README.md` "Docker": the image prepares `/var/lib/neoirc` itself and then runs `neoircd` as `neoirc`; show a host-directory mount (`-v /srv/neoirc:/var/lib/neoirc`) beside the named volume, with no `mkdir` or `chown` step.
- Before pushing, check by hand on a plain `docker build .` image: an empty host directory owned by root mounted at `/var/lib/neoirc` ends up holding `state.db` owned by `neoirc`; `neoircd` runs as `neoirc`, not root; the healthcheck passes. Remove every container and image the check started.
Read first: `AGENTS.md`, `REPO_POLICIES.md`. The same shape is built in `sneak/webhooker` (`deploy/docker-entrypoint.sh` and its `Dockerfile` on `next`).
Model: opus-5-5
clawbot
self-assigned this 2026-11-10 20:52:25 +01:00
Built in #266: deploy/docker-entrypoint.sh prepares /var/lib/neoirc as root and runs neoircd as neoirc through su-exec. Checked by hand on a plain docker build . image with a root-owned empty host directory mounted.
The first two builds failed in the ircserver test stage under host load, as tracked in #265.
Model: opus-5-5
Built in https://git.eeqj.de/sneak/neoirc/pulls/266: `deploy/docker-entrypoint.sh` prepares `/var/lib/neoirc` as root and runs `neoircd` as `neoirc` through `su-exec`. Checked by hand on a plain `docker build .` image with a root-owned empty host directory mounted.
The first two builds failed in the `ircserver` test stage under host load, as tracked in https://git.eeqj.de/sneak/neoirc/issues/265.
Model: opus-5-5
Blocking a user prevents them from interacting with repositories, such as opening or commenting on pull requests or issues. Learn more about blocking a user.
The image's runtime stage creates
/var/lib/neoircat build time and switches toUSER neoirc. A named volume copies that owner, but a host directory mounted at/var/lib/neoirckeeps the host's owner, soneoircdcannot createstate.dband stops at startup until someone runschownon the host directory.Standing ruling for every app image: the entrypoint runs as root, creates the data directory, sets its owner and mode for the app user, then drops to that user and execs the app. No
mkdirorchownof a host directory is ever required or documented.Definition of done
deploy/docker-entrypoint.sh, POSIXsh,set -eu: create/var/lib/neoirc, give it and its contents toneoirc:neoirc(chown -R), mode0700, thenexec su-exec neoirc neoircd "$@".Dockerfile: installsu-execpinned to its Alpine 3.21 package version with a dated comment, as the other pins are; copy the entrypoint to/usr/local/bin/docker-entrypoint.sh; dropUSER neoirc;ENTRYPOINT ["/usr/local/bin/docker-entrypoint.sh"]. Theneoircuser, the exposed ports and theHEALTHCHECKstay.README.md"Docker": the image prepares/var/lib/neoircitself and then runsneoircdasneoirc; show a host-directory mount (-v /srv/neoirc:/var/lib/neoirc) beside the named volume, with nomkdirorchownstep.docker build .image: an empty host directory owned by root mounted at/var/lib/neoircends up holdingstate.dbowned byneoirc;neoircdruns asneoirc, not root; the healthcheck passes. Remove every container and image the check started.Read first:
AGENTS.md,REPO_POLICIES.md. The same shape is built insneak/webhooker(deploy/docker-entrypoint.shand itsDockerfileonnext).Model: opus-5-5
Built in #266:
deploy/docker-entrypoint.shprepares/var/lib/neoircas root and runsneoircdasneoircthroughsu-exec. Checked by hand on a plaindocker build .image with a root-owned empty host directory mounted.The first two builds failed in the
ircservertest stage under host load, as tracked in #265.Model: opus-5-5