mirror of
https://github.com/blakeblackshear/frigate.git
synced 2026-09-28 00:38:57 +03:00
Josh HawkinsandNicolas Mowen
40793b8478
* Create frigate and go2rtc runtime users in the image * Add single fix-ownership helper for volume permission migration * Add init-usermod oneshot for PUID and PGID remapping * Chown newly created runtime directories to the frigate user * Run sentinel-guarded ownership sweep during prepare * Add host-side volume permission migration script * Guard log directory ownership for user-mode startup * Fall back to plain s6-log when running without root * Assert PUID remapping and sweep sentinel in CI smoke test * Skip the ownership sweep in the devcontainer * Pin FRIGATE_RUN_AS_ROOT in ownership tests * Do not record the sweep as complete when a chown failed * Validate PUID and PGID in the migration script * Treat a failed ownership scan as an incomplete sweep * Reject PUID and PGID of 0 during remapping * Handle symlinks, dry runs, and sentinel write failures in the sweep * Treat an absent sweep root as an incomplete sweep
19 lines
635 B
Plaintext
Executable File
19 lines
635 B
Plaintext
Executable File
#!/command/with-contenv bash
|
|
# shellcheck shell=bash
|
|
# Prepare the logs folder for s6-log
|
|
|
|
set -o errexit -o nounset -o pipefail
|
|
|
|
dirs=(/dev/shm/logs/frigate /dev/shm/logs/go2rtc /dev/shm/logs/nginx /dev/shm/logs/certsync)
|
|
|
|
mkdir -p "${dirs[@]}"
|
|
|
|
# logutil-service drops s6-log to nobody, so the dirs must stay nobody-owned
|
|
# in root mode. Under docker --user we are already the (only) target user,
|
|
# chown would fail, and the plain s6-log fallback in the *-log services
|
|
# writes as us (the mkdir above is sufficient, /dev/shm is 1777).
|
|
if [[ "$(id -u)" -eq 0 ]]; then
|
|
chown nobody:nogroup "${dirs[@]}"
|
|
fi
|
|
chmod 02755 "${dirs[@]}"
|