From 8495694671bd989cdf10dcc4b108824b06fd1df7 Mon Sep 17 00:00:00 2001
From: Sakurasan <26715255+Sakurasan@users.noreply.github.com>
Date: Tue, 18 Aug 2026 22:25:43 +0800
Subject: [PATCH] =?UTF-8?q?=E6=9E=84=E5=BB=BA:=20=E5=85=A5=E5=8F=A3?=
 =?UTF-8?q?=E8=84=9A=E6=9C=AC=20chown=20=E6=95=B0=E6=8D=AE=E7=9B=AE?=
 =?UTF-8?q?=E5=BD=95=E5=90=8E=E9=99=8D=E6=9D=83=E8=BF=90=E8=A1=8C?=
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

绑定挂载/命名卷被 docker 以 root 自动创建时，容器非 root 用户
写不进 db（SQLITE_CANTOPEN）。改为 entrypoint 以 root 启动，
chown 数据目录到 OT_UID:OT_GID（默认 1000:1000）后 su-exec 降权，
compose 不再需要 user: 覆盖。

Co-Authored-By: Claude <noreply@anthropic.com>
---
 Dockerfile           |  9 +++++----
 docker-compose.yml   |  5 +++--
 docker/entrypoint.sh | 12 ++++++++++++
 3 files changed, 20 insertions(+), 6 deletions(-)
 create mode 100644 docker/entrypoint.sh

diff --git a/Dockerfile b/Dockerfile
index 1a7e5e8..42ad55a 100644
--- a/Dockerfile
+++ b/Dockerfile
@@ -35,18 +35,19 @@ RUN CGO_ENABLED=0 GOOS=$TARGETOS GOARCH=$TARGETARCH \
 
 # ---------- 阶段 3：运行镜像 ----------
 FROM alpine:3.21
-RUN apk add --no-cache ca-certificates tzdata \
-    && addgroup -S openteam && adduser -S -G openteam openteam
+RUN apk add --no-cache ca-certificates tzdata su-exec
 WORKDIR /app
 COPY --from=go-builder /out/openteam ./openteam
 # 与二进制同目录放置，符合服务 CWD 约定（router 按相对路径 web/dist 找静态资源）
 COPY --from=web-builder /src/dist ./web/dist
-RUN mkdir -p /app/data && chown -R openteam:openteam /app
-USER openteam
+# 入口脚本以 root 启动，chown 数据目录后 su-exec 降权为 OT_UID:OT_GID（默认 1000:1000）
+COPY docker/entrypoint.sh /entrypoint.sh
+RUN chmod +x /entrypoint.sh && mkdir -p /app/data
 ENV OT_ENV=production \
     OT_PORT=8080 \
     OT_DB_DRIVER=sqlite \
     OT_DB_DSN=data/openteam.db
 EXPOSE 8080
 VOLUME ["/app/data"]
+ENTRYPOINT ["/entrypoint.sh"]
 CMD ["./openteam"]
diff --git a/docker-compose.yml b/docker-compose.yml
index fc44587..f588c04 100644
--- a/docker-compose.yml
+++ b/docker-compose.yml
@@ -17,8 +17,6 @@ services:
     restart: unless-stopped
     ports:
       - "${HOST_PORT:-8080}:8080"
-    # 以宿主用户运行，保证能写当前目录的 ./data 绑盘（默认 1000:1000，可用 OT_UID/OT_GID 覆盖）
-    user: "${OT_UID:-1000}:${OT_GID:-1000}"
     environment:
       OT_ENV: production
       OT_PORT: 8080
@@ -29,6 +27,9 @@ services:
       OT_MASTER_KEY: ${OT_MASTER_KEY:?请在 .env 中设置 OT_MASTER_KEY}
       OT_ADMIN_PASSWORD: ${OT_ADMIN_PASSWORD:?请在 .env 中设置 OT_ADMIN_PASSWORD}
       OT_JWT_SECRET: ${OT_JWT_SECRET:?请在 .env 中设置 OT_JWT_SECRET}
+      # 入口脚本据此 chown 数据目录并降权运行（默认 1000:1000）
+      OT_UID: "${OT_UID:-1000}"
+      OT_GID: "${OT_GID:-1000}"
     volumes:
       - ./data:/app/data
     healthcheck:
diff --git a/docker/entrypoint.sh b/docker/entrypoint.sh
new file mode 100644
index 0000000..8f9e83d
--- /dev/null
+++ b/docker/entrypoint.sh
@@ -0,0 +1,12 @@
+#!/bin/sh
+# openteam 容器入口：以 root 短暂启动，修正数据目录属主后降权执行服务。
+# 解决绑定挂载/命名卷被 docker 以 root 自动创建、应用非 root 用户写不进 db 的问题。
+set -e
+
+PUID="${OT_UID:-1000}"
+PGID="${OT_GID:-1000}"
+
+mkdir -p /app/data
+chown -R "${PUID}:${PGID}" /app/data
+
+exec su-exec "${PUID}:${PGID}" "$@"