From 802fd7319ecbd97c6d071e59a47e7b845878993c Mon Sep 17 00:00:00 2001
From: admin <admin@viaeon.com>
Date: Sun, 3 May 2026 15:10:12 +0800
Subject: [PATCH] =?UTF-8?q?fix:=20=E4=BD=BF=E7=94=A8entrypoint=E8=84=9A?=
 =?UTF-8?q?=E6=9C=AC=E8=87=AA=E5=8A=A8=E4=BF=AE=E5=A4=8D=E6=8C=82=E8=BD=BD?=
 =?UTF-8?q?=E7=9B=AE=E5=BD=95=E6=9D=83=E9=99=90?=
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

- 容器以root启动，自动修复权限后切换到appuser运行
- 既保证安全性，又简化部署流程
- 无需手动chown目录
---
 Dockerfile              | 11 +++++------
 docker-compose.prod.yml |  1 -
 docker-entrypoint.sh    | 14 ++++++++++++++
 3 files changed, 19 insertions(+), 7 deletions(-)
 create mode 100644 docker-entrypoint.sh

diff --git a/Dockerfile b/Dockerfile
index a4a5e7b..7d4cab8 100644
--- a/Dockerfile
+++ b/Dockerfile
@@ -32,7 +32,7 @@ RUN CGO_ENABLED=0 GOOS=linux go build -a -installsuffix cgo -o main ./cmd/main.g
 
 FROM alpine:latest
 
-RUN apk --no-cache add ca-certificates tzdata
+RUN apk --no-cache add ca-certificates tzdata su-exec
 
 RUN addgroup -g 1001 -S appgroup && \
     adduser -u 1001 -S appuser -G appgroup
@@ -41,14 +41,13 @@ WORKDIR /app
 
 COPY --from=backend-builder /app/main .
 COPY --from=backend-builder /app/config.yaml .
+COPY docker-entrypoint.sh /usr/local/bin/
 
-RUN mkdir -p /app/data /app/uploads && \
+RUN chmod +x /usr/local/bin/docker-entrypoint.sh && \
+    mkdir -p /app/data /app/uploads && \
     chown -R appuser:appgroup /app
 
-USER appuser
-
 EXPOSE 8080
 
-VOLUME ["/app/uploads"]
-
+ENTRYPOINT ["docker-entrypoint.sh"]
 CMD ["./main"]
diff --git a/docker-compose.prod.yml b/docker-compose.prod.yml
index 53b50d3..aca0d96 100644
--- a/docker-compose.prod.yml
+++ b/docker-compose.prod.yml
@@ -8,4 +8,3 @@ services:
     volumes:
       - ./data:/app/data
       - ./uploads:/app/uploads
-    user: "0:0"
diff --git a/docker-entrypoint.sh b/docker-entrypoint.sh
new file mode 100644
index 0000000..02ac7c4
--- /dev/null
+++ b/docker-entrypoint.sh
@@ -0,0 +1,14 @@
+#!/bin/sh
+set -e
+
+DATA_DIR="/app/data"
+UPLOADS_DIR="/app/uploads"
+
+mkdir -p "$DATA_DIR" "$UPLOADS_DIR"
+
+if [ "$(id -u)" = "0" ]; then
+    chown -R appuser:appgroup "$DATA_DIR" "$UPLOADS_DIR"
+    exec su-exec appuser "$@"
+else
+    exec "$@"
+fi