Make the examples in the image readable by the pyrtan user

Claude · 2026-10-25 · 303de0cf01de9cda3f336adc3dfb0d50d2796d04 · parents 34229d7

COPY keeps the build context's file modes. A checkout on a share whose default ACL denies "other" (as on an OpenMediaVault ZFS dataset) produced an image where uid 10001 could not open /examples, so the example services started with no trees. Open them up before dropping root.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

Changes

 Dockerfile | 5 ++++-
 1 file changed, 4 insertions(+), 1 deletion(-)

diff --git a/Dockerfile b/Dockerfile
index 6889a90..6f06e6d 100644
--- a/Dockerfile
+++ b/Dockerfile
@@ -17,7 +17,10 @@ LABEL org.opencontainers.image.title="pyrtan" \
       org.opencontainers.image.licenses="AGPL-3.0-or-later"
 COPY --from=build /install /usr/local
 COPY examples /examples
-RUN useradd --system --uid 10001 --home /nonexistent --shell /usr/sbin/nologin pyrtan \
+# The build context keeps the host checkout's modes, which a NAS share
+# can leave unreadable to others; the non-root user must read the examples.
+RUN chmod -R a+rX /examples \
+ && useradd --system --uid 10001 --home /nonexistent --shell /usr/sbin/nologin pyrtan \
  && mkdir -p /trees && chown pyrtan:pyrtan /trees
 USER pyrtan
 VOLUME ["/trees"]