cibuild: the org model, which runs every check uncached (closes #37)

script/cibuild was a plain docker build ., so on a tree Docker had
seen before every check step came from the build cache and the build
still passed. It is now the org model from sneak/prompts, byte for
byte: script/bootstrap, script/check, then docker build --no-cache
with the git describe version as the VERSION build argument.

The workflow puts ~/.local/bin, where bootstrap links what it
installs, on the step's PATH. Bootstrap now installs its pinned node
when the installed one is older than 22.12.0, the oldest the
frontend's dependencies accept (puppeteer-core's engines field), as
it already does for Go against backend/go.mod.

Model: opus-5-5

Dockerfile

@@ -77,9 +77,8 @@ COPY --from=frontend /app/dist /usr/share/nginx/html
 COPY --from=builder /src/netwatch-server /usr/local/bin/netwatch-server
 COPY bin/entrypoint.sh /usr/local/bin/entrypoint.sh
 
-# bin/entrypoint.sh creates DATA_DIR at start and gives it and /data to
-# the netwatch user, whatever is mounted there.
 ENV DATA_DIR=/data/reports
+RUN mkdir -p /data/reports && chown -R netwatch:netwatch /data
 VOLUME /data
 
 # The default public port; PORT changes it.

README.md

@@ -192,9 +192,8 @@ only inside the container, on `127.0.0.1:8081`. The image:
 - Sends the security headers `REPO_POLICIES.md` requires on every response, as
   `security-headers.conf` sets them, in place of the backend's own
 - Stores reports in `DATA_DIR`, `/data/reports` by default, on the `/data`
-  volume. Before the backend starts, the image creates `DATA_DIR` and gives it
+  volume. The backend runs as user `netwatch` (uid 1000), so a directory
-  and `/data` to user `netwatch` (uid 1000), which the backend runs as, so a
+  bind-mounted at `/data` must be writable by uid 1000
-  host directory bind-mounted at `/data` ends up owned by uid 1000
 - Writes buffered reports to disk on `docker stop`, and exits non-zero if nginx
   or the backend exits on its own, so the platform restarts it
 
@@ -204,6 +203,16 @@ What the [upaas](https://git.eeqj.de/sneak/upaas) app for netwatch needs:
 
 - **Port:** container port `8080`.
 - **Volume:** container path `/data`; the reports are kept in `/data/reports`.
+- **First run:** upaas bind-mounts the host directory it is given and does not
+  create it, and the backend, which runs as uid 1000, does not start unless it
+  can write there. Create the directory, owned by uid 1000, before the first
+  deploy:
+
+    ```bash
+    mkdir -p /path/to/data
+    chown 1000:1000 /path/to/data
+    ```
+
 - **Environment variables:** none is required. An empty one counts as unset, and
   one set to a value netwatch cannot use stops the container at start, with the
   reason in its log.
@@ -216,10 +225,8 @@ What the [upaas](https://git.eeqj.de/sneak/upaas) app for netwatch needs:
     - `CORS_ALLOWED_ORIGINS`, default empty: other origins whose pages may call
       the API
     - `DEBUG`, default `false`: debug logging
-    - `DATA_DIR`, default `/data/reports`: the directory the reports are kept
+    - `DATA_DIR`, default `/data/reports`: leave unset; reports kept outside
-      in: `/data` or a path below it, with no `.` or `..` part and no extra `/`.
+      `/data` do not survive a redeploy
-      The container also stops if a part of the path that exists, `/data`
-      included, is a symbolic link
     - `TRUSTED_PROXIES`, default empty: set it to the address the reverse proxy
       in front of the container connects from, as an IP address or CIDR; several
       are separated by commas. nginx takes the client address from

TODO.md

@@ -23,23 +23,6 @@ latest run passes.
 
 # Completed Steps
 
-- 2026-09-29: `bin/entrypoint.sh` checks `DATA_DIR` in full before it acts on it
-  as root (issue #80): `DATA_DIR` must be `/data` or a path below it with no
-  `.`, `..` or empty part, and no part of it that exists, `/data` included, may
-  be a symbolic link; anything else stops the start with a message naming
-  `DATA_DIR`. Only then is `DATA_DIR` created and `/data` given to `netwatch`,
-  so a refused start no longer creates directories outside `/data`, and
-  `DATA_DIR=/etc` no longer gives `/etc` to `netwatch`. The `README.md` section
-  "Running under upaas" says which values are accepted
-- 2026-09-29: the container sets up its own data directory (issue #75):
-  `bin/entrypoint.sh`, still as root, creates `DATA_DIR` if missing and gives it
-  and `/data` to the `netwatch` user with mode 750 before starting the backend
-  as that user, so an empty host directory owned by root, or one holding files
-  from another uid, works with no step on the host. It stops the start instead
-  when a symbolic link is on the path to `DATA_DIR`, since root would change
-  whatever the link points to. The `README.md` first-run step that created and
-  chowned the host directory is gone, and the image no longer sets that
-  ownership at build time
 - 2026-09-29: CI can no longer pass on checks that did not run (issue #37):
   `script/cibuild` is now the org model, byte for byte. It runs
   `script/bootstrap` and `script/check`, then builds the image with `--no-cache`

backend/README.md

@@ -104,8 +104,7 @@ this server. The image's entrypoint, `bin/entrypoint.sh`, starts the server as
 user `netwatch` (uid 1000) with `BIND_ADDRESS=127.0.0.1` and `PORT=8081`, so
 only nginx reaches it, and with `TRUSTED_PROXIES=127.0.0.1/32`, so it takes the
 client address nginx passes on and no other. `DATA_DIR` is `/data/reports`, on
-the `/data` volume; the entrypoint creates it and gives it and `/data` to
+the `/data` volume, which `netwatch` owns. nginx replaces the security headers
-`netwatch` before starting the server. nginx replaces the security headers
 this server sets with those in the root `security-headers.conf`, so those are
 what clients of the image see.
 

bin/entrypoint.sh

@@ -61,47 +61,6 @@ for proxy in $(printf '%s' "$TRUSTED_PROXIES" | tr ',' ' '); do
     echo "set_real_ip_from $cidr;"
 done > /etc/nginx/trusted-proxies.conf
 
-# netwatch-server keeps its report files in DATA_DIR, on the /data
-# volume, which may be a host directory owned by root or by another
-# uid. /data and everything in it are given to the netwatch user here,
-# and /data and DATA_DIR get the mode the server gives a directory it
-# creates, so the host directory needs no preparing.
-#
-# This runs as root, so nothing is created or changed until DATA_DIR is
-# known to be /data or a path below it, with no '.', '..' or empty
-# part, and no part of it that exists, /data included, is a symbolic
-# link: the netwatch user can put one in /data, and root would follow
-# it anywhere in the container. Nothing else runs in the container yet,
-# so no link can appear after the check.
-export DATA_DIR="${DATA_DIR:-/data/reports}"
-data_dir_ok() {
-    # With a / added at the end, a last part of '.' or '..', and a / at
-    # the end, match these patterns too.
-    case "$DATA_DIR/" in
-        */./* | */../* | *//*) return 1 ;;
-        /data/*) ;;
-        *) return 1 ;;
-    esac
-    # Each part from DATA_DIR up to /data. [ -L ] is false for a part
-    # that does not exist.
-    dir="$DATA_DIR"
-    while [ "$dir" != /data ]; do
-        [ -L "$dir" ] && return 1
-        dir="${dir%/*}"
-    done
-    [ ! -L /data ]
-}
-if ! data_dir_ok; then
-    echo "entrypoint: DATA_DIR must be /data or a path below it, with no" \
-        "'.', '..', extra '/' or symbolic link on it, not '$DATA_DIR'" >&2
-    exit 1
-fi
-mkdir -p "$DATA_DIR" || exit 1
-# -h: a symbolic link in /data is itself given to netwatch, not what it
-# points to.
-chown -R -h netwatch:netwatch /data || exit 1
-chmod 750 /data "$DATA_DIR" || exit 1
-
 # A stop signal is only noted here; the loop below acts on it.
 stop_requested=""
 trap 'stop_requested=yes' TERM INT