From 2a613653538959c83a9c8721ac7c4b65f9d9b0da Mon Sep 17 00:00:00 2001
From: viettranx <viettranx@gmail.com>
Date: Sat, 18 Apr 2026 15:34:46 +0700
Subject: [PATCH] fix(docker): set 0755 on web static assets so nginx worker
 can read
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

pnpm build under a restrictive umask produces 0600 files; when copied
into nginx:alpine, the non-root nginx worker hits EACCES and serves
403 for every static asset. Force mode via COPY --chmod=0755 (Docker
BuildKit applies uniformly — directories need the exec bit for
traversal, static files don't care about the extra bit).

Closes #761
---
 ui/web/Dockerfile | 5 +++--
 1 file changed, 3 insertions(+), 2 deletions(-)

diff --git a/ui/web/Dockerfile b/ui/web/Dockerfile
index d19df026..c73b2265 100644
--- a/ui/web/Dockerfile
+++ b/ui/web/Dockerfile
@@ -18,8 +18,9 @@ RUN pnpm build
 # ── Stage 2: Serve ──
 FROM nginx:1.27-alpine
 
-# Copy built assets
-COPY --from=builder /app/dist /usr/share/nginx/html
+# Copy built assets — force 0755 so the nginx worker (non-root) can read them
+# regardless of pnpm's build-time umask (see #761).
+COPY --chmod=0755 --from=builder /app/dist /usr/share/nginx/html
 
 # Copy nginx config
 COPY nginx.conf /etc/nginx/conf.d/default.conf