fix: 使用entrypoint脚本自动修复挂载目录权限

- 容器以root启动，自动修复权限后切换到appuser运行
- 既保证安全性，又简化部署流程
- 无需手动chown目录

Dockerfile

@@ -32,7 +32,7 @@ RUN CGO_ENABLED=0 GOOS=linux go build -a -installsuffix cgo -o main ./cmd/main.g
 
 FROM alpine:latest
 
-RUN apk --no-cache add ca-certificates tzdata
+RUN apk --no-cache add ca-certificates tzdata su-exec
 
 RUN addgroup -g 1001 -S appgroup && \
     adduser -u 1001 -S appuser -G appgroup
@@ -41,14 +41,13 @@ WORKDIR /app
 
 COPY --from=backend-builder /app/main .
 COPY --from=backend-builder /app/config.yaml .
+COPY docker-entrypoint.sh /usr/local/bin/
 
-RUN mkdir -p /app/data /app/uploads && \
+RUN chmod +x /usr/local/bin/docker-entrypoint.sh && \
+    mkdir -p /app/data /app/uploads && \
     chown -R appuser:appgroup /app
 
-USER appuser
-
 EXPOSE 8080
 
-VOLUME ["/app/uploads"]
+ENTRYPOINT ["docker-entrypoint.sh"]
-
 CMD ["./main"]

docker-compose.prod.yml

@@ -8,4 +8,3 @@ services:
     volumes:
       - ./data:/app/data
       - ./uploads:/app/uploads
-    user: "0:0"

docker-entrypoint.sh

@@ -0,0 +1,14 @@
+#!/bin/sh
+set -e
+
+DATA_DIR="/app/data"
+UPLOADS_DIR="/app/uploads"
+
+mkdir -p "$DATA_DIR" "$UPLOADS_DIR"
+
+if [ "$(id -u)" = "0" ]; then
+    chown -R appuser:appgroup "$DATA_DIR" "$UPLOADS_DIR"
+    exec su-exec appuser "$@"
+else
+    exec "$@"
+fi