Repository navigation

security(docker): opt-in non-root Go services with safe volume ownership (#339) - #404

Merged

dborup merged 12 commits into

masterfrom

codex/issue-339-nonroot-containers

Oct 13, 2026

Merged

security(docker): opt-in non-root Go services with safe volume ownership (#339)#404
dborup merged 12 commits into
masterfrom
codex/issue-339-nonroot-containers

Commits on Oct 13, 2026
- test(docker): reproduce root-only Go services and a generic geo-filter save error (#339)
  
  dborup
  and
  claude
  committed
  b4dfe95
- feat(docker): opt-in non-root Go services with targeted ownership migration (#339)
  
  dborup
  and
  claude
  committed
  dacac90
- test(docker): make the in-place toggle stats check unambiguous (#339)
  
  dborup
  and
  claude
  committed
  eb49596
- Merge origin/master into codex/issue-339-nonroot-containers
  dborup
  committed
  cadd4d0
- test(docker): pin that root never uses files the non-root services can write (#339)
  
  dborup
  and
  claude
  committed
  759a1d0
- fix(docker): never let root use files the non-root services can write (#339)
  
  dborup
  and
  claude
  committed
  2173593
- test(docker): off start after the non-root mode, and a stricter owner rule (#339)
  
  dborup
  and
  claude
  committed
  2d63760
- fix(docker): off start after the non-root mode; root-read files owned by root or the data dir owner (#339)
  
  dborup
  and
  claude
  committed
  17fc822
- test(docker): full-image fixtures that match the owner rule (#339)
  
  dborup
  and
  claude
  committed
  e34e23b
- test(docker): pin the message for a root-read file owned by the services (#339)
  
  dborup
  and
  claude
  committed
  3b614bc
- Merge origin/master (dd712bc9) into codex/issue-339-nonroot-containers
  
  dborup
  and
  claude
  committed
  3b46c1e
- test(docker): cover the .env trigger on a volume without the marker (#339)
  
  dborup
  and
  claude
  committed
  cddc854

Commits

Commits on Oct 13, 2026