bdd73b4686
Add -a/--append to runFileWrite so the pervasive /docker/logs log-append idiom (`… | sudo tee -a $logs_dir/$docker_log_file`) routes through the mode-aware helper instead of raw sudo. Convert scripts/config/docker/docker_config_to_container.sh fully: all ops target /docker app config + logs (data-plane), so md5sum/grep/chmod/ cmp/editor -> runFileOp and the log-appends -> runFileWrite -a. Byte-identical in rooted. Co-Authored-By: Claude Opus 4.7 <noreply@anthropic.com> Signed-off-by: librelad <librelad@digitalangels.vip>
53 lines
2.0 KiB
Bash
53 lines
2.0 KiB
Bash
#!/bin/bash
|
|
|
|
# Mode-aware privileged operations.
|
|
#
|
|
# The privilege a file operation needs depends on the Docker mode:
|
|
# rooted — app/container files under /docker are root-owned, so ops run via
|
|
# sudo. This is byte-for-byte the historical behaviour.
|
|
# rootless — those files are owned by the unprivileged Docker install user, so
|
|
# ops run AS that user (via `sudo -u`, no root over the data plane).
|
|
# Centralising the branch here means each call site is written once and is
|
|
# correct in both modes, and rooted installs (incl. live boxes) are unchanged.
|
|
|
|
# Run a /docker data-plane command — mkdir/chown/rm/cp/mv/find/sqlite3/etc. on
|
|
# app or container files.
|
|
# rooted -> sudo <cmd>
|
|
# rootless -> run <cmd> as the Docker install user (no sudo)
|
|
# Note: for stdin-fed writes (e.g. `… | sudo tee file`) use runFileWrite below;
|
|
# this helper is for self-contained commands.
|
|
runFileOp() {
|
|
if [[ "$CFG_DOCKER_INSTALL_TYPE" == "rootless" ]]; then
|
|
dockerCommandRunInstallUser --argv "$@"
|
|
else
|
|
sudo "$@"
|
|
fi
|
|
}
|
|
|
|
# Write stdin to a path with the right privilege (replaces `… | sudo tee path`).
|
|
# rooted -> sudo tee
|
|
# rootless -> tee as the Docker install user
|
|
# Pass -a/--append as the first arg to append instead of truncate (replaces
|
|
# `… | sudo tee -a path`, e.g. the /docker/logs log-append idiom).
|
|
# Usage: some_command | runFileWrite [-a] /path/to/file
|
|
runFileWrite() {
|
|
local append=""
|
|
if [[ "$1" == "-a" || "$1" == "--append" ]]; then
|
|
append=" -a"
|
|
shift
|
|
fi
|
|
local dest="$1"
|
|
if [[ "$CFG_DOCKER_INSTALL_TYPE" == "rootless" ]]; then
|
|
dockerCommandRunInstallUser "tee$append '$dest' >/dev/null"
|
|
else
|
|
sudo tee$append "$dest" >/dev/null
|
|
fi
|
|
}
|
|
|
|
# Genuine system-administration command (ufw/systemctl/apt/sysctl/useradd, /etc
|
|
# edits). Needs real root in both modes; kept as sudo and funnelled through one
|
|
# place so it can later be confined to a scoped sudoers allowlist.
|
|
runSystem() {
|
|
sudo "$@"
|
|
}
|