fix(docker): caddy storage locks + podman tmpfs

config/octane.php

@@ -239,7 +239,7 @@
             'HOME' => '/data',
             'XDG_CONFIG_HOME' => '/config',
             'XDG_DATA_HOME' => '/data',
-            'CADDY_GLOBAL_OPTIONS' => "auto_https disable_redirects\n\tpersist_config off",
+            'CADDY_GLOBAL_OPTIONS' => "auto_https off\n\tpersist_config off\n\tstorage file_system {\n\t\troot /data/caddy\n\t}",
         ],
     ],
 

docker-compose.yml

@@ -1,20 +1,22 @@
 x-tmpfs: &tmpfs
-  - /tmp:mode=1777,uid=10001,gid=10001
-  - /data:mode=1777,uid=10001,gid=10001
-  - /config:mode=1777,uid=10001,gid=10001
-  - /app/storage:mode=1777,uid=10001,gid=10001
-  - /app/bootstrap/cache:mode=1777,uid=10001,gid=10001
+  - /tmp:mode=1777
+  - /data:mode=1777
+  - /config:mode=1777
+  - /app/storage:mode=1777
+  - /app/bootstrap/cache:mode=1777
 
 services:
   resolver:
     build: .
     read_only: true
     privileged: false
-    user: "10001:10001"
     cap_drop:
       - ALL
     cap_add:
       - NET_BIND_SERVICE
+      - SETUID
+      - SETGID
+      - CHOWN
     ports:
       - "18083:8000"
     environment:

docker-entrypoint.sh

@@ -1,13 +1,28 @@
 #!/bin/sh
 set -e
-mkdir -p \
-  /app/storage/logs \
-  /app/storage/framework/cache \
-  /app/storage/framework/sessions \
-  /app/storage/framework/views \
-  /app/bootstrap/cache \
-  /config/caddy \
-  /data/caddy \
-  /data \
-  /config
+
+APP_UID="${APP_UID:-10001}"
+APP_GID="${APP_GID:-10001}"
+
+init_dirs() {
+  mkdir -p \
+    /app/storage/logs \
+    /app/storage/framework/cache \
+    /app/storage/framework/sessions \
+    /app/storage/framework/views \
+    /app/bootstrap/cache \
+    /config/caddy \
+    /data/caddy/locks \
+    /data/caddy \
+    /data \
+    /config
+}
+
+if [ "$(id -u)" = "0" ]; then
+  init_dirs
+  chown -R "${APP_UID}:${APP_GID}" /app/storage /app/bootstrap/cache /data /config /tmp
+  exec setpriv --reuid="${APP_UID}" --regid="${APP_GID}" --clear-groups -- "$0" "$@"
+fi
+
+init_dirs
 exec "$@"