What is wrong: the image's run script, share/sww.run, gives SWW_STATE_DIR to the sww user with chown -R, but never creates it. The default, /var/lib/sww, exists because the Dockerfile makes it. With SWW_STATE_DIR=/srv/state and nothing mounted there, waf stops at start with a message about a directory that is missing, although the image could have made it.
The ruling for every app image: its entrypoint runs as root, creates its data directory, sets its owner and mode for the app user, then drops to that user and starts the app; no deployment has to mkdir or chown anything.
Definition of done, one PR into next, after #336 lands (it adds the cache directory to the same script):
Before waf starts, share/sww.run creates SWW_STATE_DIR if missing (mkdir -p), gives it to sww:sww, and sets its mode to 0700, as it does for the cache directory. A value that is not an absolute path, or a SWW_STATE_DIR_FILE that cannot be read, still changes nothing, and waf stops naming the setting.
The comment in the Dockerfile above RUN mkdir /var/lib/sww, docs/image.md and SPEC.md say the image creates the directory; nothing tells a deployer to create it.
A test of the image, in the existing image or run script tests, starts waf with SWW_STATE_DIR set to a path that does not exist and finds it created, owned by sww and mode 0700.
Package: none; share/sww.run, the Dockerfile and the documents. Follow AGENTS.md: checks only through make targets. make fmt, then flock -w 1800 /srv/code/tmp/.gate-smallwebwaf.lock make check; a flock timeout also exits 1, so read the output. Edit by hand. Title ending (closes #N) with this issue's number. Label the PR needs-review.
Model: opus-5-5
**What is wrong:** the image's run script, `share/sww.run`, gives `SWW_STATE_DIR` to the `sww` user with `chown -R`, but never creates it. The default, `/var/lib/sww`, exists because the `Dockerfile` makes it. With `SWW_STATE_DIR=/srv/state` and nothing mounted there, `waf` stops at start with a message about a directory that is missing, although the image could have made it.
The ruling for every app image: its entrypoint runs as root, creates its data directory, sets its owner and mode for the app user, then drops to that user and starts the app; no deployment has to `mkdir` or `chown` anything.
**Definition of done**, one PR into `next`, after https://git.eeqj.de/sneak/smallwebwaf/pulls/336 lands (it adds the cache directory to the same script):
- Before `waf` starts, `share/sww.run` creates `SWW_STATE_DIR` if missing (`mkdir -p`), gives it to `sww:sww`, and sets its mode to `0700`, as it does for the cache directory. A value that is not an absolute path, or a `SWW_STATE_DIR_FILE` that cannot be read, still changes nothing, and `waf` stops naming the setting.
- The comment in the `Dockerfile` above `RUN mkdir /var/lib/sww`, `docs/image.md` and `SPEC.md` say the image creates the directory; nothing tells a deployer to create it.
- A test of the image, in the existing image or `run` script tests, starts `waf` with `SWW_STATE_DIR` set to a path that does not exist and finds it created, owned by `sww` and mode `0700`.
Package: none; `share/sww.run`, the `Dockerfile` and the documents. Follow `AGENTS.md`: checks only through `make` targets. `make fmt`, then `flock -w 1800 /srv/code/tmp/.gate-smallwebwaf.lock make check`; a `flock` timeout also exits 1, so read the output. Edit by hand. Title ending ` (closes #N)` with this issue's number. Label the PR `needs-review`.
Model: opus-5-5
clawbot
self-assigned this 2026-11-11 06:48:21 +01:00
Built in #351. Before waf starts, share/sww.run now creates SWW_STATE_DIR when it is missing, gives it to sww:sww and sets mode 0700. The documents say the image creates the directory. script/example-app checks the new behaviour with SWW_STATE_DIR=/srv/missing.
The cache directory's mode is unchanged: share/sww.run never ran chmod on it.
Model: opus-5-5
Built in https://git.eeqj.de/sneak/smallwebwaf/pulls/351. Before `waf` starts, `share/sww.run` now creates `SWW_STATE_DIR` when it is missing, gives it to `sww:sww` and sets mode `0700`. The documents say the image creates the directory. `script/example-app` checks the new behaviour with `SWW_STATE_DIR=/srv/missing`.
The cache directory's mode is unchanged: `share/sww.run` never ran `chmod` on it.
Model: opus-5-5
Blocking a user prevents them from interacting with repositories, such as opening or commenting on pull requests or issues. Learn more about blocking a user.
What is wrong: the image's run script,
share/sww.run, givesSWW_STATE_DIRto theswwuser withchown -R, but never creates it. The default,/var/lib/sww, exists because theDockerfilemakes it. WithSWW_STATE_DIR=/srv/stateand nothing mounted there,wafstops at start with a message about a directory that is missing, although the image could have made it.The ruling for every app image: its entrypoint runs as root, creates its data directory, sets its owner and mode for the app user, then drops to that user and starts the app; no deployment has to
mkdirorchownanything.Definition of done, one PR into
next, after #336 lands (it adds the cache directory to the same script):wafstarts,share/sww.runcreatesSWW_STATE_DIRif missing (mkdir -p), gives it tosww:sww, and sets its mode to0700, as it does for the cache directory. A value that is not an absolute path, or aSWW_STATE_DIR_FILEthat cannot be read, still changes nothing, andwafstops naming the setting.DockerfileaboveRUN mkdir /var/lib/sww,docs/image.mdandSPEC.mdsay the image creates the directory; nothing tells a deployer to create it.runscript tests, startswafwithSWW_STATE_DIRset to a path that does not exist and finds it created, owned byswwand mode0700.Package: none;
share/sww.run, theDockerfileand the documents. FollowAGENTS.md: checks only throughmaketargets.make fmt, thenflock -w 1800 /srv/code/tmp/.gate-smallwebwaf.lock make check; aflocktimeout also exits 1, so read the output. Edit by hand. Title ending(closes #N)with this issue's number. Label the PRneeds-review.Model: opus-5-5
Built in #351. Before
wafstarts,share/sww.runnow createsSWW_STATE_DIRwhen it is missing, gives it tosww:swwand sets mode0700. The documents say the image creates the directory.script/example-appchecks the new behaviour withSWW_STATE_DIR=/srv/missing.The cache directory's mode is unchanged:
share/sww.runnever ranchmodon it.Model: opus-5-5