edavis.dev
A lexicon-driven AppView for ATProto.
fix: remove user drop from e2e setup
Signed-off-by: Trezy <tre@trezy.com>
author
Trezy
date
(Jul 8, 2026, 7:57 PM -0500)
commit
e3a82a06
e3a82a06f9eb99d7ae8f5be0088fb0d7a34149a8
parent
c1a0680d
c1a0680db518127709709a2022ed749f998c6dd1
+4
-9
+4
-9
scripts/e2e-entrypoint.sh
+4
-9
scripts/e2e-entrypoint.sh
···
6
6
# proxied through Caddy (e.g. the PDS OAuth endpoints).
7
7
#
8
8
# Reading Caddy's CA (its pki/ tree is root-owned, mode 0700 to protect the CA
9
-
# key) and installing it into the system trust store both require root. The
10
-
# image now runs as the non-root `app` user, so the e2e compose overrides the
11
-
# container user back to root for this bootstrap; we install the CA as root and
12
-
# then drop to `app` to run the server, keeping the non-root runtime under test.
9
+
# key) and installing it into the system trust store both require root, so the
10
+
# e2e compose runs this container as root. The production image also runs as
11
+
# root (see the Dockerfile note on the reverted non-root user), so after the CA
12
+
# bootstrap we run the server directly — matching production, no privilege drop.
13
13
CA_CERT=/caddy-data/caddy/pki/authorities/local/root.crt
14
14
if [ -d /caddy-data ]; then
15
15
echo "Waiting for Caddy CA certificate..."
···
19
19
echo "Caddy CA certificate installed."
20
20
fi
21
21
22
-
# Drop back to the unprivileged app user (uid 10001) to run the server when we
23
-
# started as root; run directly otherwise (already unprivileged).
24
-
if [ "$(id -u)" = "0" ]; then
25
-
exec runuser -u app -- /entrypoint.sh "$@"
26
-
fi
27
22
exec /entrypoint.sh "$@"