From 209b804423d6049529d028a604356efe9acea1d7 Mon Sep 17 00:00:00 2001 From: Mischa Date: Wed, 8 Jul 2026 11:35:48 +0200 Subject: [PATCH] fix(makefile): create container files as the host user, not root MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit `docker exec` defaults to root, so `make install-plugins` wrote plugins into the ./user bind mount as root — un-removable on the host without a root container (exactly what blocked the 2.0.4 worktree cleanup). The grav service can't simply run `user: 1000` because the base image entrypoint needs root to bind :80 and set up cron, so drop only the file-CREATING CLI to the host user: - HOST_UID/HOST_GID from id -u / id -g - install-plugins makes cache/tmp writable (container-internal, never touches the host) then runs gpm as the host user, so plugins land owned by you — no post-hoc chown, no root files, no root rm needed at teardown Verified: gpm reinstall as uid 1000 leaves 0 root-owned files under ./user (was 11624), site healthy (/ and /admin 200), plugin patches reapplied. Co-Authored-By: Claude Opus 4.8 Claude-Session: https://claude.ai/code/session_01RDS6t8wcpbwKvvrxykVQ5K --- Makefile | 14 +++++++++++++- 1 file changed, 13 insertions(+), 1 deletion(-) diff --git a/Makefile b/Makefile index dfa6462..5154ef1 100644 --- a/Makefile +++ b/Makefile @@ -79,6 +79,13 @@ GRAV_CONTAINER ?= intotheeast_grav GRAV_PORT ?= 8081 TM_PORT ?= 8082 +# The container boots as root (the base image entrypoint needs it to bind :80 +# and set up cron), so a bare `docker exec` runs as root and any file it writes +# into the ./user bind mount is root-owned on the host. Run the file-CREATING +# CLI commands as the host user instead, so their output belongs to you. +HOST_UID := $(shell id -u) +HOST_GID := $(shell id -g) + build: docker compose build @@ -108,7 +115,12 @@ fix-perms: install-plugins: - docker exec -w /var/www/html $(GRAV_CONTAINER) php bin/gpm install $(shell cat plugins.txt | tr '\n' ' ') -y + # cache/ and tmp/ are root-owned in the image, so make them writable first + # (container-internal chown — never touches the host) so gpm can run AS YOU. + docker exec $(GRAV_CONTAINER) chown -R $(HOST_UID):$(HOST_GID) /var/www/html/cache /var/www/html/tmp + # gpm runs as the host user, so the plugins it writes into ./user/plugins are + # owned by you, not root — no post-hoc chown, no root files to clean up later. + docker exec -u $(HOST_UID):$(HOST_GID) -w /var/www/html $(GRAV_CONTAINER) php bin/gpm install $(shell cat plugins.txt | tr '\n' ' ') -y $(MAKE) apply-plugin-patches # Re-apply local fixes to git-ignored, GPM-managed third-party plugins. Run this