From e4a4f7197999dd7ed20f8f7550c28d2e6aa8af59 Mon Sep 17 00:00:00 2001
From: Joseph Hale <me@jhale.dev>
Date: Tue, 17 Feb 2026 14:55:46 -0700
Subject: [PATCH] Fix nginx-unprivileged image build and runtime permissions

The nginx-unprivileged image runs as nginx user (uid 101), causing
permission issues when trying to install packages or write to /home.

Key fixes:
- Add USER root before package installation RUN commands
- Change HOME from /home/speedtest to /tmp (writable by any user)
- Set USER nginx only at the end for runtime
- Update docker-compose.yml HOME environment variable

Build and runtime verified:
- docker build completes successfully
- Container starts without permission errors
- nginx serves HTML on port 8080
- curl returns valid HTML response
---
 Dockerfile         | 10 +++++++---
 docker-compose.yml |  2 +-
 2 files changed, 8 insertions(+), 4 deletions(-)

diff --git a/Dockerfile b/Dockerfile
index efd38ea..5616726 100644
--- a/Dockerfile
+++ b/Dockerfile
@@ -1,5 +1,8 @@
 FROM nginxinc/nginx-unprivileged:alpine-slim
 
+# Switch to root for package installation
+USER root
+
 # Install required packages
 RUN apk add --no-cache \
     curl \
@@ -18,8 +21,8 @@ RUN ARCH=$(uname -m) && \
     fi && \
     chmod +x /usr/local/bin/speedtest
 
-# Set HOME environment variable for use in subsequent commands
-ENV HOME=/home/speedtest
+# Set HOME to /tmp for the nginx user (nginx-unprivileged runs as uid 101)
+ENV HOME=/tmp
 
 # Create directories with wide permissions for any UID
 RUN mkdir -p /data /app/html $HOME/.config/ookla && \
@@ -36,8 +39,9 @@ COPY entrypoint.sh /app/
 RUN chmod +x /app/*.sh && chmod 777 /app
 
 # Configure nginx to serve from our html directory
-USER root
 RUN sed -i 's|root   /usr/share/nginx/html|root   /app/html|g' /etc/nginx/conf.d/default.conf
+
+# Switch back to non-root user for runtime
 USER nginx
 
 # Environment variables with defaults
diff --git a/docker-compose.yml b/docker-compose.yml
index 658ba4f..bbdae77 100644
--- a/docker-compose.yml
+++ b/docker-compose.yml
@@ -10,5 +10,5 @@ services:
       - ./data:/data
     environment:
       - CRON_SCHEDULE=${CRON_SCHEDULE:-*/30 * * * *}
-      - HOME=/home/speedtest
+      - HOME=/tmp
     restart: unless-stopped
-- 
2.51.2