Cieric/Naut
1
0
Fork 0
Code Issues 1 Pull requests Projects Releases Packages Wiki Activity Actions

docker: run as configurable PUID/PGID (default 99:100 for unraid)

Browse source 
The image ran as a hardcoded uid 1000, which doesn't match NAS shares
(unraid files are nobody:users = 99:100), so moving completed files onto
the share failed with EACCES (surfaced as a generic "i/o error").

Drop the baked-in user and instead start the entrypoint as root, chown
the daemon's own state (/data, /run/naut) to PUID:PGID, then gosu down to
that uid:gid before exec'ing nautd. The downloads share is left untouched
so its ownership comes from the host/NFS export. PUID/PGID default to
99:100 so writes to /mnt/user shares work out of the box; override per
your storage owner.

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
This commit is contained in:
ookami125 2026-06-26 01:14:37 -04:00
parent eb226b4af3
commit 8ca1cf3371
1 changed files with 23 additions and 17 deletions
Download patch file Download diff file Expand all files Collapse all files

40
Dockerfile
View file

@ -56,8 +56,8 @@ RUN cmake -S . -B build -DCMAKE_BUILD_TYPE=Release \
# ---------------------------------------------------------------------------
FROM debian:bookworm-slim AS runtime
# Shared libraries the daemon + plugin load at runtime, plus CA certs for
# HTTPS RSS feeds / tracker announces.
# Shared libraries the daemon + plugin load at runtime, CA certs for HTTPS RSS
# feeds / tracker announces, and gosu to drop privileges to PUID/PGID at start.
RUN apt-get update && apt-get install -y --no-install-recommends \
liburing2 \
libssl3 \
@ -65,8 +65,8 @@ RUN apt-get update && apt-get install -y --no-install-recommends \
liblua5.4-0 \
libsqlite3-0 \
ca-certificates \
&& rm -rf /var/lib/apt/lists/* \
&& useradd --system --create-home --home-dir /home/naut --uid 1000 naut
gosu \
&& rm -rf /var/lib/apt/lists/*
WORKDIR /app
@ -93,31 +93,37 @@ ENV NAUT_WEBUI_HOST=0.0.0.0 \
NAUT_WEBUI_DB=/data/webui.db \
NAUT_WEBUI_SAVE_PATH=/downloads \
NAUT_STATE_DIR=/data/state \
NAUT_SOCKET=/run/naut/nautd.sock
NAUT_SOCKET=/run/naut/nautd.sock \
PUID=99 \
PGID=100
# PUID / PGID # uid:gid the daemon runs as. Default 99:100
# # = unraid's nobody:users, so it can write to
# # /mnt/user shares. Match your storage owner.
# NAUT_AUTH_USER=admin # default
# NAUT_AUTH_PASSWORD=... # generated + printed to the log if unset
# NAUT_SESSION_TTL=604800 # login lifetime in seconds (default 7d)
# NAUT_SCRIPT=/app/scripts/anime_sort.lua # set to load a script at startup
# Create the data/download/socket dirs (if the volume is fresh) then exec the
# daemon with the webui plugin and the configured script. Built with printf
# (single-quoted lines keep the $VARs literal) so the image stays a single
# Dockerfile on any builder. --script is only added when NAUT_SCRIPT is set.
# Entrypoint: start as root, create the data/socket dirs and hand the daemon's
# own state (not the downloads share) to PUID:PGID, then drop privileges with
# gosu and exec nautd. Built with printf (single-quoted lines keep the $VARs
# literal) so the image stays a single Dockerfile on any builder.
RUN printf '%s\n' \
'#!/bin/sh' \
'set -e' \
'mkdir -p "$NAUT_STATE_DIR" "$NAUT_WEBUI_SAVE_PATH" "$(dirname "$NAUT_WEBUI_DB")" "$(dirname "$NAUT_SOCKET")"' \
': "${PUID:=99}" "${PGID:=100}"' \
'mkdir -p "$NAUT_STATE_DIR" "$(dirname "$NAUT_WEBUI_DB")" "$(dirname "$NAUT_SOCKET")"' \
'mkdir -p "$NAUT_WEBUI_SAVE_PATH" 2>/dev/null || true' \
'# Own the daemon state so it is writable as PUID:PGID. The downloads share' \
'# is left alone — its permissions come from the host / NFS export.' \
'chown -R "$PUID:$PGID" "$NAUT_STATE_DIR" "$(dirname "$NAUT_WEBUI_DB")" "$(dirname "$NAUT_SOCKET")" 2>/dev/null || true' \
'[ -n "$NAUT_SCRIPT" ] && set -- --script "$NAUT_SCRIPT" "$@"' \
'exec /app/nautd --socket "$NAUT_SOCKET" --plugin /app/naut_webui.so --state-dir "$NAUT_STATE_DIR" "$@"' \
'exec gosu "$PUID:$PGID" /app/nautd --socket "$NAUT_SOCKET" --plugin /app/naut_webui.so --state-dir "$NAUT_STATE_DIR" "$@"' \
> /usr/local/bin/entrypoint.sh \
&& chmod +x /usr/local/bin/entrypoint.sh
# Owned by the unprivileged runtime user; bind-mounted volumes must be writable
# by uid 1000.
RUN mkdir -p /data /downloads /run/naut \
&& chown -R naut:naut /app /data /downloads /run/naut
USER naut
# Mountpoints (ownership is fixed at runtime by the entrypoint per PUID/PGID).
RUN mkdir -p /data /downloads /run/naut
VOLUME ["/data", "/downloads"]
EXPOSE 8080 6881 6881/udp