git » homepage.git » commit 27a0bc8

Normalize renderer permissions for restrictive CI checkouts

author Alan Dipert
2026-11-10 19:15:36 UTC
committer Alan Dipert
2026-11-10 19:15:36 UTC
parent bfd85887848e3d6b263b0a1f3a277309e34cc7b5
Normalize renderer permissions for restrictive CI checkouts

Set explicit modes for copied source files and the npm install umask so the non-root build user can execute and read the toolchain. Keep Chromium certificate and state files in temporary container storage as well.
Containerfile +7 -4 
diff --git a/Containerfile b/Containerfile
index a5bebf9..6990e47 100644
--- a/Containerfile
+++ b/Containerfile
@@ -2,9 +2,10 @@ FROM docker.io/library/node:22.23.1-bookworm-slim@sha256:6c74791e557ce11fc957704
 
 WORKDIR /opt/mermaid
 ENV PUPPETEER_SKIP_DOWNLOAD=true
-COPY tools/mermaid/package.json tools/mermaid/package-lock.json ./
-RUN npm ci --ignore-scripts --omit=dev --no-audit --no-fund
-COPY tools/mermaid/render.mjs tools/mermaid/stable-css.patch ./
+COPY --chmod=0644 tools/mermaid/package.json tools/mermaid/package-lock.json ./
+RUN umask 022 && npm ci --ignore-scripts --omit=dev --no-audit --no-fund
+COPY --chmod=0755 tools/mermaid/render.mjs ./
+COPY --chmod=0644 tools/mermaid/stable-css.patch ./
 
 FROM docker.io/library/debian:13-slim@sha256:020c0d20b9880058cbe785a9db107156c3c75c2ac944a6aa7ab59f2add76a7bd
 
@@ -64,7 +65,9 @@ ENV LANG=C.UTF-8 \
     LC_ALL=C.UTF-8 \
     TZ=UTC \
     XDG_CACHE_HOME=/tmp/homepage-cache \
-    XDG_CONFIG_HOME=/tmp/homepage-config
+    XDG_CONFIG_HOME=/tmp/homepage-config \
+    XDG_DATA_HOME=/tmp/homepage-data \
+    XDG_STATE_HOME=/tmp/homepage-state
 
 WORKDIR /workspace