README: name everything that runs as root in the container

The security-features bullet said only the entrypoint script runs as root. With no USER in the image, the health check and docker exec also run as root; the bullet now names all three. Model: opus-5-5
Container sets its data directory's owner and mode itself (closes #340 )
2026-09-29 10:26:31 +00:00 · 2026-09-29 10:25:59 +00:00 · 2026-09-29 12:01:33 +02:00 · 2026-09-29 11:53:19 +02:00
1 changed files with 7 additions and 3 deletions
@@ -3032,9 +3032,11 @@ check, see [The login endpoint](#the-login-endpoint).
 - Prometheus metrics behind basic auth
 - Static assets embedded in binary (no filesystem access needed at
  runtime)
- The app runs as a non-root user (UID 1000) in the container; only
-  the `ENTRYPOINT` script that sets the data directory's owner runs as
-  root, before the app starts
+- The app runs as the non-root `webhooker` user (UID 1000) in the
+  container. The image sets no `USER`, so these run as root: the
+  `ENTRYPOINT` script, which sets the data directory's owner and mode
+  before the app starts; the image's health check; and `docker exec`,
+  unless given `--user`
 - GORM soft deletes on every entity that carries `BaseModel`, which is
  all of them but `Setting` (data preserved for audit)

@@ -3246,3 +3248,5 @@ MIT
 ## Author

 [@sneak](https://sneak.berlin)
+
+
Author	SHA1	Message	Date
clawbot	42b6916c02	README: name everything that runs as root in the container check / check (push) Successful in 3m40s Details The security-features bullet said only the entrypoint script runs as root. With no USER in the image, the health check and docker exec also run as root; the bullet now names all three. Model: opus-5-5	2026-09-29 10:26:31 +00:00
clawbot	e3c4ba03ad	Container sets its data directory's owner and mode itself (closes #340 ) The image now starts as root through deploy/docker-entrypoint.sh, which creates DATA_DIR if it is missing, gives the directory and anything in it owned by another user to webhooker, sets the directory to 0750, and runs the command as webhooker with su-exec. An empty root-owned bind mount, or data left by another uid, now works with no step on the host. Started with --user, the script only runs the command. The README drops every instruction to create or chown the host directory; the upaas volume bullet names only the path. Model: opus-5-5	2026-09-29 10:25:59 +00:00
sneak	8ad2a86e4b	Sneak/testdeploy (#356 ) check / check (push) Successful in 11s Details Reviewed-on: #356	2026-09-29 12:01:33 +02:00
sneak	a891b726e5	Milestone: next into main (#342 ) check / check (push) Successful in 9s Details Reviewed-on: #342	2026-09-29 11:53:19 +02:00