admin/Playa
1
0
Fork 0
forked from admin/VolcanicAgenticCore
Code Pull Requests Activity

feat(docker): bind the data volumes to /media/disk1/containers/volcanic_secretary_core

Browse Source 
The entrypoint chowns the three mount roots before dropping to app, since
Docker creates missing bind directories as root.
This commit is contained in:
EugeneTes
2026-09-29 09:40:28 +00:00
parent 8014a0e770
commit 28c6f90d91
3 changed files with 17 additions and 14 deletions
Download Patch File Download Diff File Expand all files Collapse all files

6
Dockerfile
View File

@@ -65,7 +65,8 @@ RUN if [ "$INSTALL_PLAYWRIGHT" = "true" ]; then \
&& rm -rf /var/lib/apt/lists/*; \
fi
# The entrypoint hard-codes uid/gid 1654. Named volumes copy this ownership on first mount.
# The entrypoint hard-codes uid/gid 1654. Named volumes copy this ownership on first mount; bind-mounted roots are
# chowned by the entrypoint (not recursively), since Docker creates missing host directories as root.
RUN test "$(id -u app)" = 1654 && test "$(id -g app)" = 1654 \
&& mkdir -p /data/workspaces /data/agent /data/claude /home/app \
&& chown -R app:app /data /home/app
@@ -85,4 +86,5 @@ ENV Telegram__WorkspaceRoot=/data/workspaces \
# No USER: PID 1 (docker-init with compose's init: true) must stay root, or the agent could read every secret from
# /proc/1/environ. setpriv drops to app and execs dotnet, so Environment.ProcessPath is the muxer the bridge needs.
# An empty bounding set and no_new_privs keep the agent's processes from regaining root through setuid binaries.
ENTRYPOINT ["setpriv", "--reuid=1654", "--regid=1654", "--init-groups", "--inh-caps=-all", "--bounding-set=-all", "--no-new-privs", "--", "dotnet", "Volcanic.AgenticCore.Telegram.dll"]
# The shell only chowns the mount roots and execs setpriv, so the process tree is unchanged.
ENTRYPOINT ["/bin/sh", "-c", "chown 1654:1654 /data/workspaces /data/agent /data/claude; exec setpriv --reuid=1654 --regid=1654 --init-groups --inh-caps=-all --bounding-set=-all --no-new-privs -- dotnet Volcanic.AgenticCore.Telegram.dll"]