clawbot 39ee6ca839 Entrypoint acts as root on nothing outside /data (closes #80) ...

`bin/entrypoint.sh` now runs `netwatch-server prepare-data-dir`, which
refuses a `DATA_DIR` that is not `/data` or a path below it written in
full, then creates `DATA_DIR`, gives `/data` and everything in it to
`netwatch`, and sets mode 750 on `/data` and `DATA_DIR`. Every step goes
through a Go `os.Root` opened on `/data`, and the modes are set on the
opened directories rather than by name, so neither a symbolic link
already there nor one a host process swaps in while the container
starts can make root create or change anything outside `/data`. The
README says which `DATA_DIR` values are accepted.

Model: opus-5-5

2026-10-03 18:24:38 +02:00

..

entrypoint.sh

Entrypoint acts as root on nothing outside /data (closes #80)

2026-10-03 18:24:38 +02:00