From a286a453f4503e1d815d8de4614f7184d17d68db Mon Sep 17 00:00:00 2001 From: JustMe Date: Wed, 7 Oct 2026 02:58:34 +0800 Subject: [PATCH] fix: let the update helper write the status volume owned by the app user [CI SKIP] The status helper runs as root with all capabilities dropped, so it could not write a volume owned by uid 1654 (mktemp: Permission denied) and the volume updater failed on rootful Podman. Add DAC_OVERRIDE only. --- packaging/update/moshiro-update.sh | 3 ++- 1 file changed, 2 insertions(+), 1 deletion(-) diff --git a/packaging/update/moshiro-update.sh b/packaging/update/moshiro-update.sh index 6ea503a..107e7b2 100644 --- a/packaging/update/moshiro-update.sh +++ b/packaging/update/moshiro-update.sh @@ -101,7 +101,8 @@ write_status() { # state available_json error printf '{"state":"%s","current":"%s","available":%s,"error":"%s","at":%s}\n' \ "$1" "$(current_digest)" "${2:-null}" "$(printf '%s' "${3:-}" | tr -d '"\\\n' | cut -c1-200)" "$(now)" > "$tmp" if [ -n "$DATA_VOLUME" ]; then - "$ENGINE" run --pull=never --rm -i --user 0 --network none --read-only --cap-drop ALL --security-opt no-new-privileges \ + # 状态卷的属主可能是容器里的 app（1654）；root 丢掉全部能力后写不进去，所以只加回 DAC_OVERRIDE + "$ENGINE" run --pull=never --rm -i --user 0 --network none --read-only --cap-drop ALL --cap-add DAC_OVERRIDE --security-opt no-new-privileges \ -v "$STATUS_VOLUME:/status" --entrypoint /bin/sh "$HELPER_IMAGE" \ -c 'tmp=$(mktemp /status/.status.XXXXXX); cat > "$tmp"; chmod 644 "$tmp"; mv -f "$tmp" /status/status.json' < "$tmp" else