#!/bin/sh
# Inspector container entrypoint.
#
# Started as root (the default): find the group that owns the Docker socket,
# make the mounted folders writable, then drop to an unprivileged user with
# that group added. No DOCKER_GID / group_add needed.
#
# Started as non-root (compose `user:` / older group_add setups): run as-is.
set -e

if [ "$(id -u)" != "0" ]; then
  exec "$@"
fi

PUID="${PUID:-1000}"
PGID="${PGID:-1000}"
SOCK=/var/run/docker.sock

groups="$PGID"
if [ -S "$SOCK" ]; then
  sock_gid="$(stat -c %g "$SOCK")"
  groups="$groups,$sock_gid"
else
  echo "warning: $SOCK is not mounted; Inspector cannot see any containers" >&2
fi

# Mounted folders are often created by Docker as root. Hand them (not their
# contents) to the runtime user so Inspector can write config, logs and data.
for d in /app/config /app/logs /app/data; do
  if [ -d "$d" ] && [ "$(stat -c %u "$d")" != "$PUID" ]; then
    chown "$PUID:$PGID" "$d" 2>/dev/null || echo "warning: could not chown $d" >&2
  fi
done
if [ -f /app/config/config.yml ] && [ "$(stat -c %u /app/config/config.yml)" != "$PUID" ]; then
  chown "$PUID:$PGID" /app/config/config.yml 2>/dev/null || true
fi

exec setpriv --reuid="$PUID" --regid="$PGID" --groups="$groups" "$@"