From e3740c584ea74edc2f68f603e00420f1096d05a1 Mon Sep 17 00:00:00 2001
From: Devon Bautista <devonb@lanl.gov>
Date: Fri, 22 Mar 2024 15:19:40 -0600
Subject: [PATCH] Dockerfile: Use /opaal dir owned by nobody so opaal can write

Without this, opaal, running as nobody, tries to write its sqlite db cache file
to / which is owned by root. With this, an /opaal directory is created, owned
by nobody, and the opaal binary is copied here. That way, it has permission to
write its cache file here. Any config can be copied here as well.
---
 Dockerfile | 9 ++++++---
 1 file changed, 6 insertions(+), 3 deletions(-)

diff --git a/Dockerfile b/Dockerfile
index e10db72..8b4bb3b 100644
--- a/Dockerfile
+++ b/Dockerfile
@@ -2,12 +2,15 @@ FROM cgr.dev/chainguard/wolfi-base
 
 RUN apk add --no-cache tini bash curl
 
+RUN mkdir /opaal
+RUN chown 65534:65534 /opaal
+WORKDIR /opaal
+
 # nobody 65534:65534
 USER 65534:65534
 
+COPY opaal /opaal/opaal
 
-COPY  opaal  /opaal
-
-CMD [ "/opaal" ]
+CMD [ "/opaal/opaal" ]
 
 ENTRYPOINT [ "/sbin/tini", "--" ]