From 3ed1d447d6e3d06759aba4c39693ba440f9ce192 Mon Sep 17 00:00:00 2001
From: MohandL3G <31743237+MohandL3G@users.noreply.github.com>
Date: Wed, 12 Aug 2026 13:12:08 +0200
Subject: [PATCH] fix: run container via entrypoint with PUID/PGID privilege
 drop

Replace the static non-root user with a linuxserver-style entrypoint that
remaps the opencode user to PUID/PGID and chowns the config/state dirs
before dropping privileges, so bind-mounted host directories remain
writable regardless of the host UID/GID.
---
 Dockerfile    | 62 ++++++++++++++++++++++++---------------------------
 entrypoint.sh | 18 +++++++++++++++
 2 files changed, 47 insertions(+), 33 deletions(-)
 create mode 100644 entrypoint.sh

diff --git a/Dockerfile b/Dockerfile
index a322b64..bdff6d3 100644
--- a/Dockerfile
+++ b/Dockerfile
@@ -1,33 +1,29 @@
-FROM node:24.15.0-bookworm
-
-ARG OPENCODE_VERSION=latest
-
-# set working directory
-WORKDIR /app
-
-# check architecture
-RUN uname -m
-
-# install opencode globally
-RUN npm i -g "opencode-ai@${OPENCODE_VERSION}" && \
-  installed_version_raw="$(opencode --version)" && \
-  installed_version="${installed_version_raw#v}" && \
-  echo "Installed opencode version: ${installed_version}" && \
-  if [ "${OPENCODE_VERSION}" != "latest" ] && [ "${installed_version}" != "${OPENCODE_VERSION}" ]; then \
-    echo "Expected opencode version ${OPENCODE_VERSION}, got ${installed_version}" >&2; \
-    exit 1; \
-  fi
-
-# non-root user (recommended)
-RUN adduser --disabled-password opencode
-
-# create necessary directories and set permissions
-RUN mkdir -p /home/opencode/.local/share/opencode/ && \
-  mkdir -p /home/opencode/.local/state/opencode && \
-  mkdir -p /home/opencode/.config/opencode/ && \
-  chown -R opencode:opencode /home/opencode
-
-# switch to non-root user
-USER opencode
-
-# docker buildx build --platform linux/amd64,linux/arm64 -t ghcr.io/pilinux/opencode:0.0.1 --output type=docker .
+FROM node:24.15.0-bookworm
+
+ARG OPENCODE_VERSION=latest
+
+WORKDIR /app
+
+RUN uname -m
+
+RUN npm i -g "opencode-ai@${OPENCODE_VERSION}" && \
+  installed_version_raw="$(opencode --version)" && \
+  installed_version="${installed_version_raw#v}" && \
+  echo "Installed opencode version: ${installed_version}" && \
+  if [ "${OPENCODE_VERSION}" != "latest" ] && [ "${installed_version}" != "${OPENCODE_VERSION}" ]; then \
+    echo "Expected opencode version ${OPENCODE_VERSION}, got ${installed_version}" >&2; \
+    exit 1; \
+  fi
+
+RUN adduser --disabled-password opencode
+
+RUN mkdir -p /home/opencode/.local/share/opencode/ && \
+  mkdir -p /home/opencode/.local/state/opencode && \
+  mkdir -p /home/opencode/.config/opencode/ && \
+  chown -R opencode:opencode /home/opencode
+
+COPY entrypoint.sh /usr/local/bin/entrypoint.sh
+RUN chmod +x /usr/local/bin/entrypoint.sh
+
+ENTRYPOINT ["/usr/local/bin/entrypoint.sh"]
+CMD ["opencode", "serve", "--hostname", "0.0.0.0", "--port", "4096"]
\ No newline at end of file
diff --git a/entrypoint.sh b/entrypoint.sh
new file mode 100644
index 0000000..6c6114c
--- /dev/null
+++ b/entrypoint.sh
@@ -0,0 +1,18 @@
+#!/bin/sh
+set -e
+
+PUID="${PUID:-1000}"
+PGID="${PGID:-1000}"
+
+if [ "$(id -u)" = "0" ]; then
+    usermod -o -u "${PUID}" opencode
+    groupmod -o -g "${PGID}" opencode
+
+    chown -R "${PUID}:${PGID}" /home/opencode/.config /home/opencode/.local
+    chown "${PUID}:${PGID}" /home/opencode
+
+    export HOME=/home/opencode
+    exec setpriv --reuid "${PUID}" --regid "${PGID}" --clear-groups "$@"
+fi
+
+exec "$@"
\ No newline at end of file