From 02249593a2c8b13a3dc8b690e494585b14d1cdd8 Mon Sep 17 00:00:00 2001 From: SYNITY Date: Wed, 15 Jul 2026 17:55:27 +0700 Subject: [PATCH] fix(packages): make .runtime group-writable for goclaw self-update [B24:2794] (#1439) The entrypoint set /app/data/.runtime to root:goclaw 0750 so the root pkg-helper can write apk-packages. But the gateway runs as goclaw and the github-package self-update flow (running in-process as goclaw) must write into .runtime: the scratch dir (.runtime/tmp/--) and the manifest (.runtime/github-packages.json[.tmp], updates-cache.json). With 0750 the group has no write bit, so updating a github binary package (e.g. goclaw v0.6.2 -> v0.8.0) fails with: create scratch dir: ... mkdir /app/data/.runtime/tmp: permission denied and, if the scratch is worked around, later: manifest save failed: open .../github-packages.json.tmp: permission denied Change the mode to 0770 so root keeps ownership (apk-packages still root) while the goclaw group can create the scratch dir and rewrite the manifest. Co-authored-by: DangTinh311 --- docker-entrypoint.sh | 9 +++++++-- 1 file changed, 7 insertions(+), 2 deletions(-) diff --git a/docker-entrypoint.sh b/docker-entrypoint.sh index 87c67c4e..3cd75faa 100644 --- a/docker-entrypoint.sh +++ b/docker-entrypoint.sh @@ -10,12 +10,17 @@ RUNTIME_DIR="/app/data/.runtime" mkdir -p "$RUNTIME_DIR/pip" "$RUNTIME_DIR/npm-global/lib" "$RUNTIME_DIR/pip-cache" "$RUNTIME_DIR/bin" || true # Fix .runtime ownership for split root/goclaw access. -# .runtime itself must be root-owned so pkg-helper (root) can write apk-packages. +# .runtime stays root-owned so pkg-helper (root) can write apk-packages, but the +# group (goclaw) needs write access too: the gateway runs as goclaw and must be +# able to create the github-package self-update scratch dir (.runtime/tmp) and +# rewrite the manifest (.runtime/github-packages.json[.tmp], updates-cache.json). +# 0750 (no group write) makes those updates fail with "permission denied"; 0770 +# keeps root ownership while letting the goclaw group write. # Subdirs pip/, npm-global/, pip-cache/ must be goclaw-owned for runtime installs. # This also handles upgrades from older images where .runtime was fully goclaw-owned. if [ "$(id -u)" = "0" ] && [ -d "$RUNTIME_DIR" ]; then chown root:goclaw "$RUNTIME_DIR" 2>/dev/null || true - chmod 0750 "$RUNTIME_DIR" 2>/dev/null || true + chmod 0770 "$RUNTIME_DIR" 2>/dev/null || true chown -R goclaw:goclaw "$RUNTIME_DIR/pip" "$RUNTIME_DIR/npm-global" "$RUNTIME_DIR/pip-cache" "$RUNTIME_DIR/bin" 2>/dev/null || true fi