clean up

docker/main/rootfs/usr/local/bin/fix-ownership

@@ -11,8 +11,7 @@
 #   --mode       append STRING to the sentinel, so changing it re-sweeps once
 #
 # Only files whose uid OR gid differs are touched, so re-runs are cheap.
-# lost+found is skipped: it belongs to the filesystem, not to Frigate, and
-# fsck puts recovered fragments of arbitrary files there under root-only 0700.
+# lost+found is skipped: fsck fills it with root-only recovered fragments.
 # Top-level /config additionally grants group frigate-data TRAVERSE ONLY
 # (g+rx) so the separate go2rtc user can reach its pre-created HomeKit file
 # on hosts where /config is mounted 0700. Never g+w: directory write means
@@ -64,10 +63,8 @@ if [[ "$(id -u)" -ne 0 ]]; then
     exit 0
 fi
 
-# The mode string folds the FRIGATE_ROOT_SERVICES list into the sentinel, so
-# entering or leaving a granular root mode re-sweeps once. That is the
-# backstop for anything a root service created that the per-boot sweep and
-# chown-at-create did not cover.
+# The list folds into the sentinel so entering or leaving a granular root mode
+# re-sweeps once, catching whatever the other ownership mechanisms missed.
 sentinel_content="${schema}:${target_uid}:${target_gid}"
 if [[ -n "$mode" ]]; then
     sentinel_content="${sentinel_content}:${mode}"
@@ -125,8 +122,7 @@ for path in "$@"; do
         continue
     fi
 
-    # -print feeds the progress counter while -exec {} + keeps the chown
-    # batched; the scan above is what makes a real percentage possible
+    # -print feeds the progress counter; -exec {} + keeps the chown batched
     started=$SECONDS
     if find "$path" -name lost+found -prune -o \( -not -uid "$target_uid" -o -not -gid "$target_gid" \) \
         -print -exec chown -h "${target_uid}:${target_gid}" {} + \
@@ -137,8 +133,8 @@ for path in "$@"; do
                 if (pct > 100) pct = 100
                 if (pct >= next_pct) {
                     printf "[INFO] fix-ownership: %s %d%% (%d/%d entries)\n", path, pct, NR, total
-                    # mawk block-buffers to a pipe; without this the whole
-                    # progress log arrives at once when the sweep ends
+                    # mawk block-buffers to a pipe; without fflush the whole
+                    # progress log arrives at once
                     fflush()
                     while (next_pct <= pct) next_pct += 5
                 }

docker/main/rootfs/usr/local/bin/service-runs-as-root

@@ -1,7 +1,6 @@
 #!/bin/bash
-# Exit 0 when FRIGATE_ROOT_SERVICES names the given service.
-# Membership only: FRIGATE_RUN_AS_ROOT precedence and the euid check stay in
-# the callers, which each combine them differently.
+# Exit 0 when FRIGATE_ROOT_SERVICES names the given service. Membership only:
+# the euid and FRIGATE_RUN_AS_ROOT checks stay in the callers.
 #
 # Usage: service-runs-as-root SERVICE
 

docker/main/rootfs/usr/local/nginx/conf/nginx.conf

@@ -1,10 +1,8 @@
-# Copied to /tmp/nginx/conf at startup and loaded with -c from there. Relative
-# includes resolve against the -c file, but every other path directive resolves
-# against the compile-time --prefix, so non-include paths must stay absolute.
+# Loaded with -c from the /tmp/nginx/conf copy: relative includes follow the -c
+# file, all other path directives follow --prefix and must stay absolute.
 
 daemon off;
-# Ignored by a non-root master; required by FRIGATE_RUN_AS_ROOT so workers
-# stay root instead of the compiled-in default user
+# ignored by a non-root master; keeps workers root under FRIGATE_RUN_AS_ROOT
 user root;
 worker_processes auto;