WeKnora deployment source with the reviewed wiki identity, summary and recovery fixes

scripts/docker-entrypoint.sh

@@ -0,0 +1,88 @@
+#!/bin/bash
+set -e
+
+# ─── Fix ownership of bind-mounted directories ───
+# When users bind-mount host directories (e.g. ./skills/preloaded),
+# the mount inherits the host UID/GID which may differ from the
+# container's appuser. This entrypoint runs as root, fixes ownership,
+# then drops privileges to appuser via gosu — the same pattern used
+# by official postgres/redis images.
+
+# Directories that may be bind-mounted and need appuser access
+MOUNT_DIRS=(
+    /app/skills/preloaded
+    /data/files
+)
+
+for dir in "${MOUNT_DIRS[@]}"; do
+    if [ -d "$dir" ]; then
+        chown -R appuser:appuser "$dir" 2>/dev/null || true
+    fi
+done
+
+# ─── Merge built-in skills into preloaded ───
+# Built-in skills are backed up at /app/skills/_builtin during image build.
+# After a bind-mount replaces /app/skills/preloaded, copy back any
+# missing built-in skills (without overwriting user-provided ones).
+BUILTIN_DIR="/app/skills/_builtin"
+PRELOADED_DIR="/app/skills/preloaded"
+
+if [ -d "$BUILTIN_DIR" ]; then
+    mkdir -p "$PRELOADED_DIR"
+    for skill_dir in "$BUILTIN_DIR"/*/; do
+        [ -d "$skill_dir" ] || continue
+        skill_name="$(basename "$skill_dir")"
+        if [ ! -d "$PRELOADED_DIR/$skill_name" ]; then
+            cp -r "$skill_dir" "$PRELOADED_DIR/$skill_name"
+        fi
+    done
+    chown -R appuser:appuser "$PRELOADED_DIR"
+fi
+
+# ─── Docker socket access for the sandbox backend ───
+# The Engine API socket is typically root:docker 0660. This process then
+# drops to appuser via gosu, which calls initgroups and therefore drops
+# compose group_add. Match the socket's GID in /etc/group before gosu.
+# Never chmod the host socket: that would weaken daemon access on the host.
+grant_docker_sock_to_appuser() {
+    local sock="$1"
+    local gid grp
+    [ -S "$sock" ] || return 0
+    if gosu appuser sh -c "test -r \"$sock\" && test -w \"$sock\"" 2>/dev/null; then
+        return 0
+    fi
+    gid="$(stat -c '%g' "$sock" 2>/dev/null || true)"
+    if [ -z "$gid" ]; then
+        echo "weknora: cannot stat $sock; Docker sandbox may be unable to reach the daemon" >&2
+        return 0
+    fi
+    if [ "$gid" = "0" ]; then
+        echo "weknora: $sock is not writable by appuser and owned by GID 0; Docker sandbox needs a group-writable socket with a non-root GID" >&2
+        return 0
+    fi
+    if ! getent group "$gid" >/dev/null 2>&1; then
+        if ! groupadd -g "$gid" dockersock >/dev/null 2>&1; then
+            echo "weknora: failed to create group for $sock GID $gid; Docker sandbox may be unable to reach the daemon" >&2
+            return 0
+        fi
+    fi
+    grp="$(getent group "$gid" | cut -d: -f1)"
+    if [ -z "$grp" ]; then
+        echo "weknora: no group name for GID $gid on $sock" >&2
+        return 0
+    fi
+    if ! usermod -aG "$grp" appuser >/dev/null 2>&1; then
+        echo "weknora: failed to add appuser to $grp for $sock; Docker sandbox may be unable to reach the daemon" >&2
+        return 0
+    fi
+}
+
+grant_docker_sock_to_appuser /var/run/docker.sock
+case "${DOCKER_HOST:-}" in
+    unix://*)
+        grant_docker_sock_to_appuser "${DOCKER_HOST#unix://}"
+        ;;
+esac
+
+# ─── Drop privileges and exec the main process ───
+exec gosu appuser "$@"