clawbot d140cab2f1 Entrypoint acts as root on nothing outside /data (closes #80) ...

`bin/entrypoint.sh` now runs `netwatch-server prepare-data-dir`, which
refuses a `DATA_DIR` that is not `/data` or a path below it written in
full, then creates `DATA_DIR`, gives `/data` and everything in it to
`netwatch` and sets mode 750 on `/data` and `DATA_DIR`. Every step goes
through a Go `os.Root` opened on `/data`, which follows a symbolic link
only when it is relative and stays inside `/data`, so neither a link
already there nor one a host process swaps in while the container
starts can make root create or change anything outside `/data`. The
README says which `DATA_DIR` values are accepted.

Model: opus-5-5

2026-10-03 13:19:19 +00:00

..

netwatch-server

Entrypoint acts as root on nothing outside /data (closes #80)

2026-10-03 13:19:19 +00:00