tiennm99/goclaw
1
0 Fork 0
mirror of https://github.com/tiennm99/goclaw.git synced 2026-10-14 00:16:38 +00:00
Code Issues Packages Projects Releases Wiki Activity

fix(packages): make .runtime group-writable for goclaw self-update [B24:2794] (#1439)

Browse Source 
The entrypoint set /app/data/.runtime to root:goclaw 0750 so the root
pkg-helper can write apk-packages. But the gateway runs as goclaw and the
github-package self-update flow (running in-process as goclaw) must write
into .runtime: the scratch dir (.runtime/tmp/<pkg>-<tag>-<nanos>) and the
manifest (.runtime/github-packages.json[.tmp], updates-cache.json).

With 0750 the group has no write bit, so updating a github binary package
(e.g. goclaw v0.6.2 -> v0.8.0) fails with:
  create scratch dir: ... mkdir /app/data/.runtime/tmp: permission denied
and, if the scratch is worked around, later:
  manifest save failed: open .../github-packages.json.tmp: permission denied

Change the mode to 0770 so root keeps ownership (apk-packages still root)
while the goclaw group can create the scratch dir and rewrite the manifest.

Co-authored-by: DangTinh311 <dangtinh31193@gmail.com>
This commit is contained in:
SYNITYandDangTinh311 authored and GitHub committed 2026-07-15 17:55:27 +07:00
1 parent c203d45811
commit 02249593a2
1 file changed
+7 -2
Download Patch File Download Diff File Expand all files Collapse all files
docker-entrypoint.sh
+7 -2
View File
@@ -10,12 +10,17 @@ RUNTIME_DIR="/app/data/.runtime"
mkdir -p "$RUNTIME_DIR/pip" "$RUNTIME_DIR/npm-global/lib" "$RUNTIME_DIR/pip-cache" "$RUNTIME_DIR/bin" || true
# Fix .runtime ownership for split root/goclaw access.
# .runtime itself must be root-owned so pkg-helper (root) can write apk-packages.
# .runtime stays root-owned so pkg-helper (root) can write apk-packages, but the
# group (goclaw) needs write access too: the gateway runs as goclaw and must be
# able to create the github-package self-update scratch dir (.runtime/tmp) and
# rewrite the manifest (.runtime/github-packages.json[.tmp], updates-cache.json).
# 0750 (no group write) makes those updates fail with "permission denied"; 0770
# keeps root ownership while letting the goclaw group write.
# Subdirs pip/, npm-global/, pip-cache/ must be goclaw-owned for runtime installs.
# This also handles upgrades from older images where .runtime was fully goclaw-owned.
if [ "$(id -u)" = "0" ] && [ -d "$RUNTIME_DIR" ]; then
chown root:goclaw "$RUNTIME_DIR" 2>/dev/null || true
chmod 0750 "$RUNTIME_DIR" 2>/dev/null || true
chmod 0770 "$RUNTIME_DIR" 2>/dev/null || true
chown -R goclaw:goclaw "$RUNTIME_DIR/pip" "$RUNTIME_DIR/npm-global" "$RUNTIME_DIR/pip-cache" "$RUNTIME_DIR/bin" 2>/dev/null || true
fi