fix: make update container scripts readable after restrictive ZIP extraction

2026-10-24 14:32:16 +08:00
parent eb478a6e13
commit 2f11a8c904
2 changed files with 15 additions and 1 deletions
@@ -4,7 +4,11 @@ WORKDIR /app
 COPY requirements.txt .
 RUN pip install --no-cache-dir -r requirements.txt
 COPY main.py update_service.py manage.py ./
-RUN useradd --system --uid 10001 --create-home updates \
+# Uploaded ZIP files may have owner-only permissions. Keep code root-owned
+# while making it readable to the unprivileged runtime user.
+RUN chmod 0755 /app \
+    && chmod 0644 /app/requirements.txt /app/main.py /app/update_service.py /app/manage.py \
+    && useradd --system --uid 10001 --create-home updates \
    && mkdir -p /app/data && chown updates:updates /app/data
 USER updates
 EXPOSE 8000