From 53ffa72e28facb861838885c6a0b9c2ab06f14dc Mon Sep 17 00:00:00 2001
From: Josh Hawkins <32435876+hawkeye217@users.noreply.github.com>
Date: Thu, 27 Aug 2026 12:28:16 -0500
Subject: [PATCH] validate FRIGATE_ROOT_SERVICES and fail fast on unknown names

---
 .../etc/s6-overlay/s6-rc.d/init-usermod/run   | 24 ++++++++++++++++++-
 1 file changed, 23 insertions(+), 1 deletion(-)

diff --git a/docker/main/rootfs/etc/s6-overlay/s6-rc.d/init-usermod/run b/docker/main/rootfs/etc/s6-overlay/s6-rc.d/init-usermod/run
index 0168bdb01c..744ded7039 100755
--- a/docker/main/rootfs/etc/s6-overlay/s6-rc.d/init-usermod/run
+++ b/docker/main/rootfs/etc/s6-overlay/s6-rc.d/init-usermod/run
@@ -2,7 +2,7 @@
 # shellcheck shell=bash
 # Remap the frigate user to PUID/PGID and register EXTRA_GROUPS.
 # No-op when: started with --user (euid != 0), FRIGATE_RUN_AS_ROOT=true,
-# or PUID/PGID already match.
+# or PUID/PGID already match. FRIGATE_ROOT_SERVICES is validated here too.
 
 set -o errexit -o nounset -o pipefail
 
@@ -12,10 +12,32 @@ if [[ "$(id -u)" -ne 0 ]]; then
 fi
 
 if [[ "${FRIGATE_RUN_AS_ROOT:-false}" == "true" ]]; then
+    if [[ -n "${FRIGATE_ROOT_SERVICES:-}" ]]; then
+        echo "[INFO] FRIGATE_RUN_AS_ROOT=true: ignoring FRIGATE_ROOT_SERVICES"
+    fi
     echo "[INFO] FRIGATE_RUN_AS_ROOT=true: skipping user remapping"
     exit 0
 fi
 
+# Validate before anything consumes the list: a typo silently dropping a
+# service to non-root would defeat the reason the user set it.
+if [[ -n "${FRIGATE_ROOT_SERVICES:-}" ]]; then
+    IFS=',' read -ra root_services <<< "${FRIGATE_ROOT_SERVICES}"
+    for entry in "${root_services[@]}"; do
+        entry="${entry//[[:space:]]/}"
+        if [[ -z "$entry" ]]; then
+            continue
+        fi
+        case "$entry" in
+            frigate|go2rtc|nginx) ;;
+            *)
+                echo "[ERROR] FRIGATE_ROOT_SERVICES contains unknown service '${entry}'; valid names are frigate, go2rtc, nginx" >&2
+                exit 1
+                ;;
+        esac
+    done
+fi
+
 puid="${PUID:-1000}"
 pgid="${PGID:-1000}"