From 929ce1fe0ae5c7ed0bc39270ef5967c4c96a9b86 Mon Sep 17 00:00:00 2001
From: Casper Biering <cbiering@toogoodtogo.com>
Date: Mon, 24 Aug 2026 23:53:13 +0200
Subject: [PATCH 1/2] fix(docker): caddy storage locks + podman tmpfs

Pre-create /data/caddy/locks, pin Caddy storage, auto_https off. Long-form tmpfs uid/gid for Podman.
---
 config/octane.php    |  2 +-
 docker-compose.yml   | 35 ++++++++++++++++++++++++++++++-----
 docker-entrypoint.sh |  1 +
 3 files changed, 32 insertions(+), 6 deletions(-)

diff --git a/config/octane.php b/config/octane.php
index 3d6e0a3..d31f028 100644
--- a/config/octane.php
+++ b/config/octane.php
@@ -239,7 +239,7 @@
             'HOME' => '/data',
             'XDG_CONFIG_HOME' => '/config',
             'XDG_DATA_HOME' => '/data',
-            'CADDY_GLOBAL_OPTIONS' => "auto_https disable_redirects\n\tpersist_config off",
+            'CADDY_GLOBAL_OPTIONS' => "auto_https off\n\tpersist_config off\n\tstorage file_system {\n\t\troot /data/caddy\n\t}",
         ],
     ],
 
diff --git a/docker-compose.yml b/docker-compose.yml
index 0e8ee22..d54101c 100644
--- a/docker-compose.yml
+++ b/docker-compose.yml
@@ -1,9 +1,34 @@
 x-tmpfs: &tmpfs
-  - /tmp:mode=1777,uid=10001,gid=10001
-  - /data:mode=1777,uid=10001,gid=10001
-  - /config:mode=1777,uid=10001,gid=10001
-  - /app/storage:mode=1777,uid=10001,gid=10001
-  - /app/bootstrap/cache:mode=1777,uid=10001,gid=10001
+  - type: tmpfs
+    target: /tmp
+    tmpfs:
+      mode: 0777
+      uid: 10001
+      gid: 10001
+  - type: tmpfs
+    target: /data
+    tmpfs:
+      mode: 0777
+      uid: 10001
+      gid: 10001
+  - type: tmpfs
+    target: /config
+    tmpfs:
+      mode: 0777
+      uid: 10001
+      gid: 10001
+  - type: tmpfs
+    target: /app/storage
+    tmpfs:
+      mode: 0777
+      uid: 10001
+      gid: 10001
+  - type: tmpfs
+    target: /app/bootstrap/cache
+    tmpfs:
+      mode: 0777
+      uid: 10001
+      gid: 10001
 
 services:
   resolver:
diff --git a/docker-entrypoint.sh b/docker-entrypoint.sh
index a204718..1602d54 100644
--- a/docker-entrypoint.sh
+++ b/docker-entrypoint.sh
@@ -7,6 +7,7 @@ mkdir -p \
   /app/storage/framework/views \
   /app/bootstrap/cache \
   /config/caddy \
+  /data/caddy/locks \
   /data/caddy \
   /data \
   /config

From fd8db67b0b6b07bc2a7cac31c83b2ea36b6c4f54 Mon Sep 17 00:00:00 2001
From: Casper Biering <cbiering@toogoodtogo.com>
Date: Mon, 24 Aug 2026 23:57:09 +0200
Subject: [PATCH 2/2] fix(docker): entrypoint chown tmpfs for podman

Short-form tmpfs only (Podman compat). Root entrypoint chowns /data+/config then setpriv to 10001.
---
 docker-compose.yml   | 39 ++++++++-------------------------------
 docker-entrypoint.sh | 36 +++++++++++++++++++++++++-----------
 2 files changed, 33 insertions(+), 42 deletions(-)

diff --git a/docker-compose.yml b/docker-compose.yml
index d54101c..e406e40 100644
--- a/docker-compose.yml
+++ b/docker-compose.yml
@@ -1,45 +1,22 @@
 x-tmpfs: &tmpfs
-  - type: tmpfs
-    target: /tmp
-    tmpfs:
-      mode: 0777
-      uid: 10001
-      gid: 10001
-  - type: tmpfs
-    target: /data
-    tmpfs:
-      mode: 0777
-      uid: 10001
-      gid: 10001
-  - type: tmpfs
-    target: /config
-    tmpfs:
-      mode: 0777
-      uid: 10001
-      gid: 10001
-  - type: tmpfs
-    target: /app/storage
-    tmpfs:
-      mode: 0777
-      uid: 10001
-      gid: 10001
-  - type: tmpfs
-    target: /app/bootstrap/cache
-    tmpfs:
-      mode: 0777
-      uid: 10001
-      gid: 10001
+  - /tmp:mode=1777
+  - /data:mode=1777
+  - /config:mode=1777
+  - /app/storage:mode=1777
+  - /app/bootstrap/cache:mode=1777
 
 services:
   resolver:
     build: .
     read_only: true
     privileged: false
-    user: "10001:10001"
     cap_drop:
       - ALL
     cap_add:
       - NET_BIND_SERVICE
+      - SETUID
+      - SETGID
+      - CHOWN
     ports:
       - "18083:8000"
     environment:
diff --git a/docker-entrypoint.sh b/docker-entrypoint.sh
index 1602d54..30b0cd7 100644
--- a/docker-entrypoint.sh
+++ b/docker-entrypoint.sh
@@ -1,14 +1,28 @@
 #!/bin/sh
 set -e
-mkdir -p \
-  /app/storage/logs \
-  /app/storage/framework/cache \
-  /app/storage/framework/sessions \
-  /app/storage/framework/views \
-  /app/bootstrap/cache \
-  /config/caddy \
-  /data/caddy/locks \
-  /data/caddy \
-  /data \
-  /config
+
+APP_UID="${APP_UID:-10001}"
+APP_GID="${APP_GID:-10001}"
+
+init_dirs() {
+  mkdir -p \
+    /app/storage/logs \
+    /app/storage/framework/cache \
+    /app/storage/framework/sessions \
+    /app/storage/framework/views \
+    /app/bootstrap/cache \
+    /config/caddy \
+    /data/caddy/locks \
+    /data/caddy \
+    /data \
+    /config
+}
+
+if [ "$(id -u)" = "0" ]; then
+  init_dirs
+  chown -R "${APP_UID}:${APP_GID}" /app/storage /app/bootstrap/cache /data /config /tmp
+  exec setpriv --reuid="${APP_UID}" --regid="${APP_GID}" --clear-groups -- "$0" "$@"
+fi
+
+init_dirs
 exec "$@"