From 498e24a5f3ec5e5b88cb9820fa774fd11b1eca3f Mon Sep 17 00:00:00 2001
From: clawbot <35+clawbot@noreply.example.org>
Date: Sun, 4 Oct 2026 08:41:54 +0000
Subject: [PATCH] Create the smallwebwaf user without useradd's uid warning
 (closes #58)

useradd --system warns when the uid it is given is above SYS_UID_MAX,
999 on Ubuntu; --key raises that limit for this one call, so the uid
stays 65532.

The issue's two other warnings stay, since each needs a change to an
outside tool: minsysusers, which runit's install runs to create its
_runit-log user, reads a shell field that runit's sysusers line leaves
out; runsvinit's reaper and its own wait on runsvdir race for the same
exited process.

Model: opus-5-5
---
 Dockerfile | 7 +++++--
 1 file changed, 5 insertions(+), 2 deletions(-)

diff --git a/Dockerfile b/Dockerfile
index 30aace9..ba114e2 100644
--- a/Dockerfile
+++ b/Dockerfile
@@ -130,9 +130,12 @@ ENV PATH=${PATH}:/nix/var/nix/profiles/default/bin
 COPY --from=runsvinit /usr/local/bin/runsvinit /usr/local/bin/runsvinit
 COPY --from=builder /usr/local/bin/smallwebwaf /usr/local/bin/smallwebwaf
 
+# 65532 is above the uids Ubuntu keeps for system users, which end at
+# 999; useradd warns about it unless --key raises that end for this call.
 RUN groupadd --system --gid 65532 smallwebwaf \
-    && useradd --system --uid 65532 --gid smallwebwaf --no-create-home \
-        --shell /usr/sbin/nologin smallwebwaf
+    && useradd --system --key SYS_UID_MAX=65532 --uid 65532 \
+        --gid smallwebwaf --no-create-home --shell /usr/sbin/nologin \
+        smallwebwaf
 
 # runsvinit starts runit's runsvdir on /etc/service, where Ubuntu's sv
 # looks too.