system/memos
1
0
Fork 0
Code Issues Pull requests Projects Releases Packages Wiki Activity Actions 1

fix(scripts): prevent entrypoint restart loop when MEMOS_UID=0

Browse source 
The root-drop guard only checked `id -u = 0`, so when the target user was
also root (MEMOS_UID=0, common under rootless Docker with userns-remap)
su-exec re-execed back into root, re-entered the block, and looped forever
without ever reaching the memos binary — the container hung with no logs.

Add a MEMOS_ENTRYPOINT_SWITCHED marker (preserved across the su-exec
re-exec) so the privilege drop runs at most once, and log the resolved
UID:GID on startup so this path is never silent again.

Closes #6061
This commit is contained in:
boojack 2026-07-03 22:02:53 +08:00
parent 16b47b3be4
commit 3a55edd917
1 changed files with 11 additions and 4 deletions
Show stats Download patch file Download diff file Expand all files Collapse all files

15
scripts/entrypoint.sh
View file

@ -1,18 +1,25 @@
#!/usr/bin/env sh
# Fix ownership of data directory for users upgrading from older versions
# where files were created as root
# Fix ownership of the data directory (e.g. for users upgrading from older
# versions where files were created as root) and drop to a non-root user.
MEMOS_UID=${MEMOS_UID:-10001}
MEMOS_GID=${MEMOS_GID:-10001}
DATA_DIR="/var/opt/memos"
if [ "$(id -u)" = "0" ]; then
# Running as root, fix permissions and drop to nonroot
# MEMOS_ENTRYPOINT_SWITCHED marks that the privilege drop below has already run.
# su-exec preserves the environment, so the marker survives the re-exec. Without
# it, a target of UID 0 (e.g. MEMOS_UID=0, common under rootless Docker) would
# stay root after su-exec, re-enter this block, and loop forever.
if [ "$(id -u)" = "0" ] && [ -z "${MEMOS_ENTRYPOINT_SWITCHED:-}" ]; then
# Started as root: fix permissions, then re-exec as the target user.
if [ -d "$DATA_DIR" ]; then
chown -R "$MEMOS_UID:$MEMOS_GID" "$DATA_DIR" 2>/dev/null || true
fi
echo "memos: starting as UID:GID ${MEMOS_UID}:${MEMOS_GID}"
export MEMOS_ENTRYPOINT_SWITCHED=1
exec su-exec "$MEMOS_UID:$MEMOS_GID" "$0" "$@"
fi
unset MEMOS_ENTRYPOINT_SWITCHED
file_env() {
var="$1"