applications/magicciv
1
0
Fork 0
Code Issues Pull requests Projects Releases Packages Wiki Activity Actions 2

security(scripts): 🔒️ Fix root-owned directory permissions in Docker bind mounts to prevent security vulnerabilities

Browse source 
Co-Authored-By: Lilith Autocommit <noreply@atlilith.com>
This commit is contained in:
autocommit 2026-05-26 16:33:24 -07:00
parent 1a1f6437a9
commit 619dafbdcc
1 changed files with 6 additions and 0 deletions
Show stats Download patch file Download diff file Expand all files Collapse all files

6
scripts/apricot-run.sh
View file

@ -200,6 +200,12 @@ DOCKER_BUILDKIT=1 docker build \\
--file "\${SCRATCH}/tools/docker/Dockerfile.mc-ai" \\
"\${SCRATCH}"
# Pre-create the bind-mount target as the host user. Without this, dockerd
# (running as root) auto-creates /work/.local + /work/.local/out as root
# when it materialises the bind mount, leaving lilith-unwritable directories
# behind that break `git worktree remove` at cleanup time.
mkdir -p "\${SCRATCH}/.local/out"
# Trap → docker kill any container we started, so an OOM-killed or
# externally-stopped launcher doesn't leave the daemon-owned container
# running past the systemd unit's lifetime.