fix: root-owned bind-mount data dir breaks log writes

entrypoint now chowns the LOG_FILE directory at startup (handles host
volumes created by root/other UIDs) then drops privileges via su-exec.

Author: solutionforestteam

Dockerfile

@@ -7,15 +7,18 @@ RUN CGO_ENABLED=0 GOOS=linux go build -ldflags="-s -w" -o /TinyUptimeRobot .
 
 # ---- runtime stage ----
 FROM alpine:3.20
-RUN apk add --no-cache ca-certificates && adduser -D monitor \
-    && mkdir -p /app/data && chown -R monitor:monitor /app
-
+RUN apk add --no-cache ca-certificates su-exec \
+    && adduser -D monitor \
+    && mkdir -p /app/data \
+    && chown -R monitor:monitor /app
 WORKDIR /app
 COPY --from=build /TinyUptimeRobot /app/TinyUptimeRobot
-USER monitor
+COPY entrypoint.sh /app/entrypoint.sh
+RUN chmod +x /app/entrypoint.sh
+# runs as root only to fix /app/data ownership on bind mounts, then drops to monitor
+ENTRYPOINT ["/app/entrypoint.sh"]
+
 ENV TARGETS_FILE=/app/targets.txt \
     LOG_FILE=/app/data/status.txt \
     CHECK_INTERVAL=60s \
     HTTP_TIMEOUT=10s
-VOLUME ["/app/data"]
-ENTRYPOINT ["/app/TinyUptimeRobot"]

entrypoint.sh

@@ -0,0 +1,11 @@
+#!/bin/sh
+# Fix ownership of the data dir (bind mounts are often owned by root),
+# then drop privileges and run as the unprivileged monitor user.
+set -e
+
+DATA_DIR="$(dirname "${LOG_FILE:-/app/data/status.txt}")"
+mkdir -p "$DATA_DIR" 2>/dev/null || true
+chown -R monitor:monitor "$DATA_DIR" 2>/dev/null || true
+
+# if the targets file is read-only and unreadable, that's fine — the app will error clearly
+exec su-exec monitor:monitor /app/TinyUptimeRobot "$@"