next into main (#73)

Reviewed-on: #73

.dockerignore

@@ -4,6 +4,3 @@ tmp
 .DS_Store
 *.log
 .claude
-
-# .git is sent so the build can stamp the version, without its config.
-.git/config

Dockerfile

@@ -20,7 +20,7 @@ RUN make lint
 # golang:1.25-alpine (2026-02-27)
 FROM golang:1.25-alpine@sha256:f6751d823c26342f9506c03797d2527668d095b0a15f1862cddb4d927a7a4ced AS builder
 
-RUN apk add --no-cache git make
+RUN apk add --no-cache make
 
 WORKDIR /src
 
@@ -37,24 +37,11 @@ RUN make test
 
 # make build is a shim around backend/script/build, the one definition
 # of the build command:
-# CGO_ENABLED=0 go build -trimpath -ldflags "-s -w -X main.Version=..."
+# CGO_ENABLED=0 go build -trimpath -ldflags "-s -w -X main.Version=... -X main.Buildarch=..."
 # That script reads VERSION from the environment, so it is handed over
 # there rather than as a make variable.
-#
+ARG VERSION=dev
-# The version is the VERSION build argument when one is given, otherwise
+RUN VERSION="${VERSION}" make build
-# `git describe --tags --always` of the repo's .git: the tag on a tagged
-# commit, tag-N-gHASH on a commit after one, the short commit when no
-# tag is reachable. A version that still comes out empty, dev or unknown
-# fails the build. .git goes to /git, not /src/.git, where go build would
-# find it and record VCS details of a work tree holding only backend/.
-COPY .git /git
-ARG VERSION
-RUN version="${VERSION:-$(git --git-dir=/git describe --tags --always)}"; \
-    case "$version" in ""|dev|unknown) \
-        echo "version is '$version' although .git is present" >&2; \
-        exit 1 ;; \
-    esac; \
-    VERSION="$version" make build
 
 # Frontend stage
 # node:22-alpine as of 2026-02-22

README.md

@@ -216,10 +216,8 @@ What the [upaas](https://git.eeqj.de/sneak/upaas) app for netwatch needs:
     - `CORS_ALLOWED_ORIGINS`, default empty: other origins whose pages may call
       the API
     - `DEBUG`, default `false`: debug logging
-    - `DATA_DIR`, default `/data/reports`: the directory the reports are kept
+    - `DATA_DIR`, default `/data/reports`: leave unset; reports kept outside
-      in: `/data` or a path below it, with no `.` or `..` part and no extra `/`.
+      `/data` do not survive a redeploy
-      The container also stops if the path goes through a symbolic link that
-      leads out of `/data` or is written as a full path
     - `TRUSTED_PROXIES`, default empty: set it to the address the reverse proxy
       in front of the container connects from, as an IP address or CIDR; several
       are separated by commas. nginx takes the client address from

TODO.md

@@ -23,16 +23,6 @@ latest run passes.
 
 # Completed Steps
 
-- 2026-10-03: root no longer acts outside `/data` when it prepares `DATA_DIR`
-  (issue #80): `bin/entrypoint.sh` runs `netwatch-server prepare-data-dir`,
-  which refuses a `DATA_DIR` that is not `/data` or a path below it written in
-  full, then creates `DATA_DIR`, gives `/data` and everything in it to
-  `netwatch` and sets the modes, all through a Go `os.Root` opened on `/data`.
-  That refuses any path leading out of `/data`, so neither a symbolic link
-  already there nor one a host process swaps in during the start can make root
-  create or change anything elsewhere, and `DATA_DIR=/etc` no longer gives
-  `/etc` to `netwatch`. The `README.md` section "Running under upaas" says which
-  values are accepted
 - 2026-09-29: the container sets up its own data directory (issue #75):
   `bin/entrypoint.sh`, still as root, creates `DATA_DIR` if missing and gives it
   and `/data` to the `netwatch` user with mode 750 before starting the backend

backend/README.md

@@ -32,7 +32,7 @@ pattern as the repo root: the targets in `backend/Makefile` are thin shims over
 `test`, `fmt` and `fmt-check`:
 
 - `script/build` — compile the static `netwatch-server` binary with its version
-  stamped in. The version is `VERSION` from the environment;
+  and architecture stamped in. The version is `VERSION` from the environment;
   when that is unset or empty, it falls back to `git describe` inside a git
   checkout, then to `dev`
 - `script/test` — run the Go tests under a 30-second timeout
@@ -104,9 +104,8 @@ this server. The image's entrypoint, `bin/entrypoint.sh`, starts the server as
 user `netwatch` (uid 1000) with `BIND_ADDRESS=127.0.0.1` and `PORT=8081`, so
 only nginx reaches it, and with `TRUSTED_PROXIES=127.0.0.1/32`, so it takes the
 client address nginx passes on and no other. `DATA_DIR` is `/data/reports`, on
-the `/data` volume; before starting the server, the entrypoint creates it and
+the `/data` volume; the entrypoint creates it and gives it and `/data` to
-gives it and `/data` to `netwatch` with `netwatch-server prepare-data-dir`,
+`netwatch` before starting the server. nginx replaces the security headers
-which acts on nothing outside `/data`. nginx replaces the security headers
 this server sets with those in the root `security-headers.conf`, so those are
 what clients of the image see.
 

backend/cmd/netwatch-server/main.go

@@ -4,7 +4,6 @@ package main
 import (
 	"fmt"
 	"os"
-	"os/user"
 
 	"sneak.berlin/go/netwatch/internal/config"
 	"sneak.berlin/go/netwatch/internal/globals"
@@ -20,8 +19,9 @@ import (
 
 //nolint:gochecknoglobals // set via ldflags at build time
 var (
-	Appname = "netwatch-server"
+	Appname   = "netwatch-server"
-	Version string
+	Version   string
+	Buildarch string
 )
 
 func main() {
@@ -38,28 +38,9 @@ func main() {
 		return
 	}
 
-	// "netwatch-server prepare-data-dir DATA_DIR" gets DATA_DIR ready
-	// for the netwatch user, or exits 1 with the error; see
-	// reportbuf.PrepareDataDir. bin/entrypoint.sh runs it as root
-	// before it starts this server as that user.
-	if len(os.Args) == 3 && os.Args[1] == "prepare-data-dir" {
-		netwatch, err := user.Lookup("netwatch")
-		if err != nil {
-			fmt.Fprintln(os.Stderr, err)
-			os.Exit(1)
-		}
-
-		err = reportbuf.PrepareDataDir("/data", os.Args[2], netwatch)
-		if err != nil {
-			fmt.Fprintf(os.Stderr, "DATA_DIR '%s': %v\n", os.Args[2], err)
-			os.Exit(1)
-		}
-
-		return
-	}
-
 	globals.Appname = Appname
 	globals.Version = Version
+	globals.Buildarch = Buildarch
 
 	fx.New(
 		fx.Provide(

backend/internal/globals/globals.go

@@ -10,18 +10,22 @@ var (
 	Appname string
 	// Version is the git version tag.
 	Version string
+	// Buildarch is the build architecture.
+	Buildarch string
 )
 
 // Globals holds build-time metadata for the application.
 type Globals struct {
-	Appname string
+	Appname   string
-	Version string
+	Version   string
+	Buildarch string
 }
 
 // New creates a Globals instance from package-level variables.
 func New(_ fx.Lifecycle) (*Globals, error) {
 	return &Globals{
-		Appname: Appname,
+		Appname:   Appname,
-		Version: Version,
+		Buildarch: Buildarch,
+		Version:   Version,
 	}, nil
 }

backend/internal/logger/logger.go

@@ -5,7 +5,6 @@ package logger
 import (
 	"log/slog"
 	"os"
-	"runtime"
 
 	"sneak.berlin/go/netwatch/internal/globals"
 
@@ -96,6 +95,6 @@ func (l *Logger) Identify() {
 	l.log.Info("starting",
 		"appname", l.params.Globals.Appname,
 		"version", l.params.Globals.Version,
-		"arch", runtime.GOARCH,
+		"buildarch", l.params.Globals.Buildarch,
 	)
 }

backend/internal/reportbuf/datadir.go

@@ -1,82 +0,0 @@
-package reportbuf
-
-import (
-	"errors"
-	"io/fs"
-	"os"
-	"os/user"
-	"path/filepath"
-	"strconv"
-)
-
-// ErrDataDirOutsideVolume is returned by PrepareDataDir for a DATA_DIR
-// that is not the volume or a path below it, written in full.
-var ErrDataDirOutsideVolume = errors.New(
-	"must be /data or a path below it, with no '.', '..' or extra '/'")
-
-// PrepareDataDir gets dir, the server's DATA_DIR, ready for owner, the
-// user the server runs as, so that a host directory mounted at volume,
-// /data in the image, needs no preparing: it creates dir, gives volume
-// and everything in it to owner, and gives volume and dir the mode the
-// server gives a directory it creates. dir must be volume or a path
-// below it, with no '.', '..', empty part or '/' at the end.
-//
-// bin/entrypoint.sh runs this as root, which would follow a symbolic
-// link anywhere, so every step goes through an os.Root opened on
-// volume: it follows a link only when it is written as a relative
-// path that stays inside volume, and refuses any other. A process on
-// the host can swap a link onto a path in volume at any moment while
-// this runs, but the os.Root checks each link as it reaches it, so the
-// most that can do is make a step fail or act on something else
-// inside volume.
-func PrepareDataDir(volume, dir string, owner *user.User) error {
-	// rel is dir as a path from volume; IsLocal is false for one that
-	// leads out of it.
-	rel, err := filepath.Rel(volume, dir)
-	if err != nil || dir != filepath.Clean(dir) || !filepath.IsLocal(rel) {
-		return ErrDataDirOutsideVolume
-	}
-
-	uid, err := strconv.Atoi(owner.Uid)
-	if err != nil {
-		return err
-	}
-
-	gid, err := strconv.Atoi(owner.Gid)
-	if err != nil {
-		return err
-	}
-
-	root, err := os.OpenRoot(volume)
-	if err != nil {
-		return err
-	}
-
-	defer func() { _ = root.Close() }()
-
-	err = root.MkdirAll(rel, dirPerms)
-	if err != nil {
-		return err
-	}
-
-	// WalkDir does not follow a symbolic link, and Lchown gives the
-	// link itself to owner, not what it points to.
-	err = fs.WalkDir(root.FS(), ".",
-		func(name string, _ fs.DirEntry, err error) error {
-			if err != nil {
-				return err
-			}
-
-			return root.Lchown(name, uid, gid)
-		})
-	if err != nil {
-		return err
-	}
-
-	err = root.Chmod(".", dirPerms)
-	if err != nil {
-		return err
-	}
-
-	return root.Chmod(rel, dirPerms)
-}

backend/internal/reportbuf/datadir_test.go

@@ -1,250 +0,0 @@
-package reportbuf_test
-
-import (
-	"errors"
-	"io/fs"
-	"os"
-	"os/user"
-	"path/filepath"
-	"strconv"
-	"syscall"
-	"testing"
-
-	"sneak.berlin/go/netwatch/internal/reportbuf"
-)
-
-// reports is the last part of DATA_DIR in these tests, as in the
-// image's /data/reports.
-const reports = "reports"
-
-// currentUser is the user the test runs as, the only owner a test not
-// run as root can give files to.
-func currentUser() *user.User {
-	return &user.User{
-		Uid: strconv.Itoa(os.Getuid()),
-		Gid: strconv.Itoa(os.Getgid()),
-	}
-}
-
-// tempDirMode700 is a new directory in a t.TempDir with mode 0700, so
-// a test can tell that PrepareDataDir left its mode alone.
-func tempDirMode700(t *testing.T) string {
-	t.Helper()
-
-	dir := filepath.Join(t.TempDir(), "d")
-
-	err := os.Mkdir(dir, 0o700)
-	if err != nil {
-		t.Fatal(err)
-	}
-
-	return dir
-}
-
-func requireMode(t *testing.T, path string, want fs.FileMode) {
-	t.Helper()
-
-	info, err := os.Stat(path)
-	if err != nil {
-		t.Fatal(err)
-	}
-
-	if info.Mode() != want {
-		t.Errorf("%s: mode %v, want %v", path, info.Mode(), want)
-	}
-}
-
-func requireMissing(t *testing.T, path string) {
-	t.Helper()
-
-	_, err := os.Lstat(path)
-	if !errors.Is(err, fs.ErrNotExist) {
-		t.Errorf("%s: created, or Lstat failed: %v", path, err)
-	}
-}
-
-func requireOwner(t *testing.T, path string, uid, gid uint32) {
-	t.Helper()
-
-	info, err := os.Lstat(path)
-	if err != nil {
-		t.Fatal(err)
-	}
-
-	stat, _ := info.Sys().(*syscall.Stat_t)
-	if stat.Uid != uid || stat.Gid != gid {
-		t.Errorf("%s: owner %d:%d, want %d:%d", path, stat.Uid, stat.Gid,
-			uid, gid)
-	}
-}
-
-func TestPrepareDataDirCreatesDataDir(t *testing.T) {
-	t.Parallel()
-
-	volume := t.TempDir()
-	dir := filepath.Join(volume, "a", reports)
-
-	err := reportbuf.PrepareDataDir(volume, dir, currentUser())
-	if err != nil {
-		t.Fatal(err)
-	}
-
-	requireMode(t, volume, fs.ModeDir|0o750)
-	requireMode(t, dir, fs.ModeDir|0o750)
-}
-
-func TestPrepareDataDirTakesTheVolumeItself(t *testing.T) {
-	t.Parallel()
-
-	volume := t.TempDir()
-
-	err := reportbuf.PrepareDataDir(volume, volume, currentUser())
-	if err != nil {
-		t.Fatal(err)
-	}
-
-	requireMode(t, volume, fs.ModeDir|0o750)
-}
-
-// TestPrepareDataDirRefusesDataDirOutsideVolume covers a DATA_DIR that
-// is relative, outside the volume, or not written in full.
-func TestPrepareDataDirRefusesDataDirOutsideVolume(t *testing.T) {
-	t.Parallel()
-
-	volume := tempDirMode700(t)
-	for _, dir := range []string{
-		reports, volume + "/../new", volume + "/", volume + "//" + reports,
-		volume + "/./" + reports, volume + "/" + reports + "/..", volume + "x",
-		"/etc",
-	} {
-		err := reportbuf.PrepareDataDir(volume, dir, currentUser())
-		if !errors.Is(err, reportbuf.ErrDataDirOutsideVolume) {
-			t.Errorf("%q: error = %v, want ErrDataDirOutsideVolume", dir, err)
-		}
-	}
-
-	requireMissing(t, filepath.Join(filepath.Dir(volume), "new"))
-	requireMode(t, volume, fs.ModeDir|0o700)
-}
-
-// TestPrepareDataDirRefusesLinkOutOfVolume puts a symbolic link to a
-// directory outside the volume on the path to DATA_DIR, written as a
-// full path and as one that climbs out with '..', and as DATA_DIR
-// itself, where the mode would be set through it.
-func TestPrepareDataDirRefusesLinkOutOfVolume(t *testing.T) {
-	t.Parallel()
-
-	for _, tc := range []struct {
-		name      string
-		climbsOut bool
-		link, dir string
-	}{
-		{"full path", false, "x", "x/reports"},
-		{"climbs out", true, "x", "x/reports"},
-		{"DATA_DIR itself", false, reports, reports},
-	} {
-		t.Run(tc.name, func(t *testing.T) {
-			t.Parallel()
-
-			outside := tempDirMode700(t)
-			volume := t.TempDir()
-
-			climbOut, err := filepath.Rel(volume, outside)
-			if err != nil {
-				t.Fatal(err)
-			}
-
-			target := outside
-			if tc.climbsOut {
-				target = climbOut
-			}
-
-			err = os.Symlink(target, filepath.Join(volume, tc.link))
-			if err != nil {
-				t.Fatal(err)
-			}
-
-			err = reportbuf.PrepareDataDir(volume,
-				filepath.Join(volume, tc.dir), currentUser())
-			if err == nil {
-				t.Error("no error")
-			}
-
-			requireMissing(t, filepath.Join(outside, reports))
-			requireMode(t, outside, fs.ModeDir|0o700)
-		})
-	}
-}
-
-// TestPrepareDataDirRefusesDanglingLink: DATA_DIR is a symbolic link
-// to a name in the volume that does not exist, which is not created.
-func TestPrepareDataDirRefusesDanglingLink(t *testing.T) {
-	t.Parallel()
-
-	volume := t.TempDir()
-
-	err := os.Symlink("missing", filepath.Join(volume, reports))
-	if err != nil {
-		t.Fatal(err)
-	}
-
-	err = reportbuf.PrepareDataDir(volume, filepath.Join(volume, reports),
-		currentUser())
-	if err == nil {
-		t.Error("no error")
-	}
-
-	requireMissing(t, filepath.Join(volume, "missing"))
-}
-
-// TestPrepareDataDirGivesVolumeToOwner gives everything in the volume
-// to a uid and gid that own nothing, which only root can do. A
-// symbolic link in the volume to a directory outside it is given to
-// them itself; what it points to is left as it was.
-func TestPrepareDataDirGivesVolumeToOwner(t *testing.T) {
-	t.Parallel()
-
-	if os.Geteuid() != 0 {
-		t.Skip("only root can give files to another uid")
-	}
-
-	outside := t.TempDir()
-	volume := t.TempDir()
-	old := filepath.Join(volume, "old")
-
-	err := os.WriteFile(filepath.Join(outside, "f"), nil, 0o600)
-	if err != nil {
-		t.Fatal(err)
-	}
-
-	err = os.Mkdir(old, 0o700)
-	if err != nil {
-		t.Fatal(err)
-	}
-
-	err = os.WriteFile(filepath.Join(old, "f"), nil, 0o600)
-	if err != nil {
-		t.Fatal(err)
-	}
-
-	err = os.Symlink(outside, filepath.Join(old, "link"))
-	if err != nil {
-		t.Fatal(err)
-	}
-
-	err = reportbuf.PrepareDataDir(volume, filepath.Join(volume, reports),
-		&user.User{Uid: "4242", Gid: "4343"})
-	if err != nil {
-		t.Fatal(err)
-	}
-
-	for _, path := range []string{
-		volume, filepath.Join(volume, reports), old,
-		filepath.Join(old, "f"), filepath.Join(old, "link"),
-	} {
-		requireOwner(t, path, 4242, 4343)
-	}
-
-	requireOwner(t, outside, 0, 0)
-	requireOwner(t, filepath.Join(outside, "f"), 0, 0)
-}

backend/internal/server/http.go

@@ -4,7 +4,6 @@ import (
 	"errors"
 	"net"
 	"net/http"
-	"runtime"
 	"strconv"
 	"time"
 
@@ -54,7 +53,7 @@ func (s *Server) listenAndServe() {
 	s.log.Info("http begin listen",
 		"listenaddr", s.httpServer.Addr,
 		"version", s.params.Globals.Version,
-		"arch", runtime.GOARCH,
+		"buildarch", s.params.Globals.Buildarch,
 	)
 
 	err := s.httpServer.ListenAndServe()

backend/script/build

@@ -1,6 +1,6 @@
 #!/bin/sh
 # script/build: compile the static netwatch-server binary into the
-# backend project root, with its version stamped in.
+# backend project root, with its version and architecture stamped in.
 set -eu
 
 ROOT="$(cd "$(dirname "$0")/.." && pwd -P)"
@@ -14,7 +14,7 @@ main() {
     version="${VERSION:-$(git describe --always --dirty 2>/dev/null || echo dev)}"
 
     CGO_ENABLED=0 go build -trimpath \
-        -ldflags "-s -w -X main.Version=$version" \
+        -ldflags "-s -w -X main.Version=$version -X main.Buildarch=$(uname -m)" \
         -o netwatch-server ./cmd/netwatch-server/
 }
 

bin/entrypoint.sh

@@ -63,13 +63,26 @@ done > /etc/nginx/trusted-proxies.conf
 
 # netwatch-server keeps its report files in DATA_DIR, on the /data
 # volume, which may be a host directory owned by root or by another
-# uid. Here, as root, netwatch-server prepare-data-dir creates DATA_DIR
+# uid. Both are given to the netwatch user here, with the mode the
-# and gives /data and everything in it to the netwatch user, so the
+# server gives a directory it creates, so the host directory needs no
-# host directory needs no preparing. It stops the start, naming
+# preparing.
-# DATA_DIR, unless DATA_DIR is /data or a path below it, and it acts on
+#
-# nothing outside /data, whatever symbolic links it meets there.
+# chown and chmod, run as root, change whatever a symbolic link on the
+# path points to, anywhere in the container, and the netwatch user can
+# put one in /data. So the start stops unless readlink -f, which
+# follows every link on a path, gives /data and DATA_DIR back as they
+# are. It also writes a path in full, so a DATA_DIR with '.', '..' or
+# an extra '/' in it is refused too.
 export DATA_DIR="${DATA_DIR:-/data/reports}"
-netwatch-server prepare-data-dir "$DATA_DIR" || exit 1
+mkdir -p "$DATA_DIR" || exit 1
+if [ "$(readlink -f /data)" != /data ] ||
+    [ "$(readlink -f "$DATA_DIR")" != "$DATA_DIR" ]; then
+    echo "entrypoint: DATA_DIR must be a full path with no '.', '..'," \
+        "extra '/' or symbolic link on it or on /data, not '$DATA_DIR'" >&2
+    exit 1
+fi
+chown -R netwatch:netwatch /data "$DATA_DIR" || exit 1
+chmod 750 /data "$DATA_DIR" || exit 1
 
 # A stop signal is only noted here; the loop below acts on it.
 stop_requested=""

script/cibuild

@@ -16,8 +16,9 @@ main() {
     "$SCRIPT_DIR/check"
     # Own line: a failing command substitution inside an argument does
     # not trip `set -e`, so the inline form degrades silently to an
-    # empty constant. The VERSION build argument takes precedence over
+    # empty constant. VERSION is computed here because .dockerignore
-    # the version a build stage derives from the .git in the context.
+    # excludes .git, so `git describe` in a build stage yields an empty
+    # version without failing.
     version="$(git describe --tags --always --dirty 2>/dev/null || true)"
     [ -n "$version" ] || version="unknown"
     docker build --no-cache \

script/docker

@@ -12,8 +12,9 @@ main() {
     cd "$ROOT"
     # Own line: a failing command substitution inside an argument does
     # not trip `set -e`, so the inline form degrades silently to an
-    # empty constant. The VERSION build argument takes precedence over
+    # empty constant. VERSION is computed here because .dockerignore
-    # the version a build stage derives from the .git in the context.
+    # excludes .git, so `git describe` in a build stage yields an empty
+    # version without failing.
     version="$(git describe --tags --always --dirty 2>/dev/null || true)"
     [ -n "$version" ] || version="unknown"
     docker build --no-cache \