clawbot 64587679a4 Entrypoint checks DATA_DIR in full before acting on it as root (closes #80) ...

`bin/entrypoint.sh` now checks `DATA_DIR` before it creates anything or
changes an owner or mode: it must be `/data` or a path below it with no
`.`, `..` or empty part, and no part of it that exists, `/data`
included, may be a symbolic link. Anything else stops the start with one
message naming `DATA_DIR`. Only then does it create `DATA_DIR`, give
`/data` and everything in it to `netwatch` (`chown -R -h`, so a link in
it is not followed) and set mode 750 on `/data` and `DATA_DIR`. The
README section "Running under upaas" says which values are accepted.

Model: opus-5-5

2026-09-29 10:56:53 +00:00

..

entrypoint.sh

Entrypoint checks DATA_DIR in full before acting on it as root (closes #80)

2026-09-29 10:56:53 +00:00