feat(docker): enhance Dockerfile with entrypoint script and additional packages

- Added `su-exec` to the Docker image for improved user switching.
- Introduced a custom entrypoint script to manage container startup.
- Ensured the creation of necessary directories with appropriate permissions.
- Updated health check configurations for better reliability.

deploy/docker/cfdm/Dockerfile

@@ -34,7 +34,7 @@ RUN --mount=type=cache,target=/root/.local/share/pnpm/store,sharing=locked \
 
 FROM ${BASE_NODE} AS runtime
 WORKDIR /app
-RUN apk add --no-cache ca-certificates wget
+RUN apk add --no-cache ca-certificates wget su-exec
 ARG VERSION=dev
 ARG GIT_SHA=unknown
 ARG BUILD_TIME=
@@ -47,8 +47,11 @@ ENV NODE_ENV=production \
     GIT_SHA=${GIT_SHA} \
     BUILD_TIME=${BUILD_TIME}
 COPY --from=build --chown=node:node /out ./
-RUN mkdir -p /data && chown node:node /data /app
-USER node
+COPY deploy/docker/cfdm/docker-entrypoint.sh /usr/local/bin/docker-entrypoint.sh
+RUN chmod 755 /usr/local/bin/docker-entrypoint.sh \
+    && mkdir -p /data \
+    && chown node:node /data /app
+ENTRYPOINT ["/usr/local/bin/docker-entrypoint.sh"]
 EXPOSE 8080
 VOLUME ["/data"]
 HEALTHCHECK --interval=30s --timeout=5s --start-period=10s --retries=3 \

deploy/docker/cfdm/docker-entrypoint.sh

@@ -0,0 +1,15 @@
+#!/bin/sh
+set -eu
+
+mkdir -p /data
+
+if [ "$(id -u)" = "0" ]; then
+  chown -R node:node /data 2>/dev/null || true
+  chmod -R u+rwX /data 2>/dev/null || true
+  if su-exec node sh -c 'touch /data/.write-test && rm -f /data/.write-test'; then
+    exec su-exec node "$@"
+  fi
+  echo "cfdm: /data is not writable by user node after chown; starting as root" >&2
+fi
+
+exec "$@"

packages/db/src/client.ts

@@ -1,6 +1,6 @@
 import { dirname, join } from "node:path";
 import { fileURLToPath } from "node:url";
-import { readFileSync, readdirSync } from "node:fs";
+import { mkdirSync, readFileSync, readdirSync } from "node:fs";
 import Database from "better-sqlite3";
 import { drizzle } from "drizzle-orm/better-sqlite3";
 import { schema } from "./schema.js";
@@ -19,6 +19,8 @@ export function resolveDatabasePath(databaseUrl: string): string {
 
 export function createDb(databaseUrl: string): { db: Db; sqlite: Sqlite } {
   const path = resolveDatabasePath(databaseUrl);
+  const dir = dirname(path);
+  if (dir && dir !== ".") mkdirSync(dir, { recursive: true });
   const sqlite = new Database(path);
   sqlite.pragma("journal_mode = WAL");
   sqlite.pragma("synchronous = NORMAL");