fix bind mount permissions with gosu entrypoint

Author: MeritonAliu

CHANGELOG.md

@@ -4,6 +4,16 @@ All notable changes to ObjeX are documented here.
 
 ---
 
+## Unreleased
+
+### Fixed
+- Docker bind mount permissions: entrypoint now fixes `/data` ownership via gosu (named volumes unaffected)
+- S3 PUT Object returned 201 instead of 200 (broke warp and some SDKs)
+- S3 `aws-chunked` transfer encoding not decoded, stored chunk framing as part of object data
+- Response compression applied to S3 port, causing size mismatches on download
+
+---
+
 ## v1.1.0 — 2026-04-09
 
 ### Added

Dockerfile

@@ -23,14 +23,17 @@ RUN dotnet publish ObjeX.Api/ObjeX.Api.csproj \
 # Pin to 10.0 — intentional for .NET 10 preview/RC; update when GA lands
 FROM mcr.microsoft.com/dotnet/aspnet:10.0
 
-# Install curl for container healthcheck, then clean up
-RUN apt-get update && apt-get install -y --no-install-recommends curl \
+# Install curl (healthcheck) and gosu (entrypoint privilege drop), then clean up
+RUN apt-get update && apt-get install -y --no-install-recommends curl gosu \
     && rm -rf /var/lib/apt/lists/*
 
 WORKDIR /app
 RUN mkdir -p /data/db /data/blobs && chown -R app:app /data
 COPY --from=build --chown=app:app /app/publish .
 
+# Entrypoint: fix bind mount ownership, then drop to non-root
+RUN printf '#!/bin/sh\nif [ "$(id -u)" = "0" ]; then\n  chown -R app:app /data 2>/dev/null || true\n  exec gosu app dotnet ObjeX.Api.dll "$@"\nelse\n  exec dotnet ObjeX.Api.dll "$@"\nfi\n' > /entrypoint.sh && chmod 755 /entrypoint.sh
+
 ENV ASPNETCORE_URLS=http://+:9001
 ENV ConnectionStrings__DefaultConnection="Data Source=/data/db/objex.db"
 ENV Storage__BasePath="/data/blobs"
@@ -41,5 +44,4 @@ EXPOSE 9000
 HEALTHCHECK --interval=30s --timeout=5s --retries=3 \
     CMD curl -f http://localhost:9001/health || exit 1
 
-USER app
-ENTRYPOINT ["dotnet", "ObjeX.Api.dll"]
+ENTRYPOINT ["/entrypoint.sh"]

README.md

@@ -40,6 +40,8 @@ Open **http://localhost:9001** — log in with `admin` / `admin`.
 
 > ⚠️ Change the default admin credentials before exposing the instance publicly. Set `DefaultAdmin:Username`, `DefaultAdmin:Email`, and `DefaultAdmin:Password` in `appsettings.json` or environment variables.
 
+> **Bind mounts:** If using a bind mount instead of a named volume, mount to `/data` (e.g. `./my-data:/data`). The entrypoint automatically fixes ownership for bind mounts.
+
 ---
 <img width="800" height="496" alt="grafik" src="https://github.com/user-attachments/assets/8cadcd71-de33-4554-a5a0-320362b35e68" />