clean up

docker/main/rootfs/etc/s6-overlay/s6-rc.d/nginx/run

@@ -69,11 +69,9 @@ function set_worker_processes() {
     sed -i "s/worker_processes auto;/worker_processes ${cpus};/" /tmp/nginx/conf/nginx.conf
 }
 
-# Rebuilt root-owned and fresh every start. A previous unprivileged nginx owned
-# this tree, and the cp and tempio writes below run as root: without wiping it
-# first, a planted symlink here would let those writes land on any root file.
-# rm does not traverse symlinks, and the bare mkdir fails closed if /tmp/nginx
-# is raced into a symlink before we can create it.
+# Rebuilt root-owned every start: a symlink planted by the previously
+# unprivileged nginx would redirect the root cp/tempio writes below onto any
+# root file. rm does not traverse symlinks; the bare mkdir fails closed if raced.
 rm -rf /tmp/nginx
 mkdir /tmp/nginx
 mkdir -p /tmp/nginx/conf /tmp/nginx/client_body /tmp/nginx/proxy \
@@ -113,14 +111,12 @@ echo "$nginx_settings" | \
 
 if [[ "$(id -u)" -eq 0 && "$runs_as_root" -eq 0 ]]; then
     chown -R frigate:frigate /tmp/nginx
-    # heal the cache if a root `nginx -t` chowned it (ngx_create_paths chowns
-    # every cycle path to the `user` directive user when run as root)
+    # heal the cache: a root `nginx -t` chowns every cycle path to the `user` directive user
     if [ -d /dev/shm/nginx_cache ]; then
         chown -R frigate:frigate /dev/shm/nginx_cache
     fi
-    # error_log/access_log /dev/stdout make nginx REOPEN the s6 log pipe by
-    # path, and s6 created it root-owned 0600; without this the non-root
-    # master exits with "open() /dev/stdout failed (13: Permission denied)"
+    # nginx reopens /dev/stdout by path for its logs, and s6 made the pipe
+    # root-owned 0600; without this the non-root master exits EACCES
     chown frigate /dev/stdout
     # self-signed certs are root-generated; tolerant because mounted certs may be :ro
     if [ -f "$letsencrypt_path/privkey.pem" ]; then
@@ -130,8 +126,7 @@ fi
 
 # Replace the bash process with the NGINX process, redirecting stderr to stdout
 exec 2>&1
-# -e stderr: the compile-time default error log under /usr/local/nginx/logs
-# is not writable by the runtime user and would alert before config load
+# -e stderr: the compiled-in error log path is not writable by the runtime user
 if [[ "$(id -u)" -ne 0 || "$runs_as_root" -eq 1 ]]; then
     exec \
         s6-notifyoncheck -t 30000 -n 1 \