From 1fb53efc59cc829ce27885696fd5a10aed3fd768 Mon Sep 17 00:00:00 2001
From: Denozordec <shatskiy.blog@gmail.com>
Date: Thu, 3 Sep 2026 16:27:48 +0700
Subject: [PATCH] feat(docker): enhance Dockerfile with entrypoint script and
 additional packages

- Added `su-exec` to the Docker image for improved user switching.
- Introduced a custom entrypoint script to manage container startup.
- Ensured the creation of necessary directories with appropriate permissions.
- Updated health check configurations for better reliability.
---
 deploy/docker/cfdm/Dockerfile           |  9 ++++++---
 deploy/docker/cfdm/docker-entrypoint.sh | 15 +++++++++++++++
 packages/db/src/client.ts               |  4 +++-
 3 files changed, 24 insertions(+), 4 deletions(-)
 create mode 100644 deploy/docker/cfdm/docker-entrypoint.sh

diff --git a/deploy/docker/cfdm/Dockerfile b/deploy/docker/cfdm/Dockerfile
index 9cbe64a..a7f4367 100644
--- a/deploy/docker/cfdm/Dockerfile
+++ b/deploy/docker/cfdm/Dockerfile
@@ -34,7 +34,7 @@ RUN --mount=type=cache,target=/root/.local/share/pnpm/store,sharing=locked \
 
 FROM ${BASE_NODE} AS runtime
 WORKDIR /app
-RUN apk add --no-cache ca-certificates wget
+RUN apk add --no-cache ca-certificates wget su-exec
 ARG VERSION=dev
 ARG GIT_SHA=unknown
 ARG BUILD_TIME=
@@ -47,8 +47,11 @@ ENV NODE_ENV=production \
     GIT_SHA=${GIT_SHA} \
     BUILD_TIME=${BUILD_TIME}
 COPY --from=build --chown=node:node /out ./
-RUN mkdir -p /data && chown node:node /data /app
-USER node
+COPY deploy/docker/cfdm/docker-entrypoint.sh /usr/local/bin/docker-entrypoint.sh
+RUN chmod 755 /usr/local/bin/docker-entrypoint.sh \
+    && mkdir -p /data \
+    && chown node:node /data /app
+ENTRYPOINT ["/usr/local/bin/docker-entrypoint.sh"]
 EXPOSE 8080
 VOLUME ["/data"]
 HEALTHCHECK --interval=30s --timeout=5s --start-period=10s --retries=3 \
diff --git a/deploy/docker/cfdm/docker-entrypoint.sh b/deploy/docker/cfdm/docker-entrypoint.sh
new file mode 100644
index 0000000..6270264
--- /dev/null
+++ b/deploy/docker/cfdm/docker-entrypoint.sh
@@ -0,0 +1,15 @@
+#!/bin/sh
+set -eu
+
+mkdir -p /data
+
+if [ "$(id -u)" = "0" ]; then
+  chown -R node:node /data 2>/dev/null || true
+  chmod -R u+rwX /data 2>/dev/null || true
+  if su-exec node sh -c 'touch /data/.write-test && rm -f /data/.write-test'; then
+    exec su-exec node "$@"
+  fi
+  echo "cfdm: /data is not writable by user node after chown; starting as root" >&2
+fi
+
+exec "$@"
diff --git a/packages/db/src/client.ts b/packages/db/src/client.ts
index 30f16b7..a84634b 100644
--- a/packages/db/src/client.ts
+++ b/packages/db/src/client.ts
@@ -1,6 +1,6 @@
 import { dirname, join } from "node:path";
 import { fileURLToPath } from "node:url";
-import { readFileSync, readdirSync } from "node:fs";
+import { mkdirSync, readFileSync, readdirSync } from "node:fs";
 import Database from "better-sqlite3";
 import { drizzle } from "drizzle-orm/better-sqlite3";
 import { schema } from "./schema.js";
@@ -19,6 +19,8 @@ export function resolveDatabasePath(databaseUrl: string): string {
 
 export function createDb(databaseUrl: string): { db: Db; sqlite: Sqlite } {
   const path = resolveDatabasePath(databaseUrl);
+  const dir = dirname(path);
+  if (dir && dir !== ".") mkdirSync(dir, { recursive: true });
   const sqlite = new Database(path);
   sqlite.pragma("journal_mode = WAL");
   sqlite.pragma("synchronous = NORMAL");