- rootfs/usr/local/bin/entrypoint.sh:
1. The "start all services" gate
(`if [ "$START_SERVICES" = "yes" ] || [ -z "$1" ]`) always evaluated
true on a first-run container regardless of $1, because
START_SERVICES is force-set to "yes" whenever no PID file exists yet.
Any command passed to `docker run` — `exec ...`, `sh -c ...`,
`shell`, or an arbitrary program — was swallowed into the
service-start+monitor branch before reaching the `case "$1"`
statement that already handles those subcommands, hanging the
container as a daemon instead of running the given command. Changed
the condition to `if [ -z "$1" ]` so the daemon branch only fires
when no command was given at all.
2. The `*/bin/sh | */bin/bash | bash | sh | shell)` case branch
unconditionally shifted $1 before `__exec_command "$@"` (a bare
`exec "$@"`). For `docker run image sh -c 'cmd'` this turned the
exec into `exec -c cmd` (command not found, exit 127) instead of
`exec sh -c 'cmd'`. Split the branch: real interpreter names
(*/bin/sh, */bin/bash, bash, sh) now pass through unshifted; the
"shell" keyword (not a real interpreter) gets its own branch that
shifts and prepends "sh" to any remaining args, or falls back to a
bare `__exec_command` (exec bash -l) when none remain.
Verified `bash -n` passes. Found and fixed upstream in
dockersrc/go, confirmed identical in this repo's generated
entrypoint.sh, and mechanically applied here with the same patch.
Ran the AI.md template-update runbook: synced .env.scripts and
Dockerfile ARGs to the current template, regenerated entrypoint.sh
and setup/*.sh from the template, then cleaned up now-dead
DEFAULT_FILE_DIR/DATA_DIR/CONF_DIR/TEMPLATE_DIR references left in
the Dockerfile after the template-files concept was retired.
- .env.scripts: dropped DEFAULT_FILE_DIR/DATA_DIR/CONF_DIR/TEMPLATE_DIR,
ssmtp -> msmtp, license MIT -> WTFPL, ENV_PULL_URL value updated
- Dockerfile: removed now-unused DEFAULT_FILE_DIR/DATA_DIR/CONF_DIR/
TEMPLATE_DIR ARG declarations (3 stages) and the mkdir referencing
them; PACK_LIST ssmtp -> msmtp
- rootfs/usr/local/bin/entrypoint.sh: regenerated from template —
CONTAINER_NAME set to "rust", safer grep -- usage, exec/shell
argument handling fixed to not swallow args when none given
- rootfs/usr/local/etc/docker/functions/entrypoint.sh: regenerated
from template
- rootfs/root/docker/setup/00-init.sh: regenerated; dropped dead
template-files cleanup block
- rootfs/root/docker/setup/01-system.sh: regenerated (boilerplate only)
- rootfs/root/docker/setup/02-packages.sh: regenerated (boilerplate only)
- rootfs/root/docker/setup/03-files.sh: regenerated — dropped
template-files mirroring, added /tmp/usr handling
- rootfs/root/docker/setup/04-users.sh: regenerated (boilerplate only)
- rootfs/root/docker/setup/06-post.sh: regenerated (boilerplate only)
- rootfs/root/docker/setup/07-cleanup.sh: regenerated (boilerplate only)
Note: rootfs/root/docker/setup/05-custom.sh was NOT regenerated —
it holds hand-written Rust toolchain install logic, not template
boilerplate; the runbook's blind regenerate would have destroyed it.
__exec_command was using ${arg:-} which only captured the first element
of the args array, then ran it through "$shell" $pre_exec "$cmdExec"
which effectively discarded everything after $1.
Running `docker run image sh -c 'go build ...'` would:
1. Set arg=("sh" "-c" "go build ...")
2. Set cmdExec="sh" (only first element)
3. Run bash --login -c "sh" (dropping -c and the actual command)
This broke any Makefile GO_DOCKER pattern that relied on passing multi-arg
commands. Simplified to just `exec "$@"` which passes all args through.
- rootfs/usr/local/etc/docker/functions/entrypoint.sh: rewrite __exec_command
rootfs/usr/local/etc/docker/functions/entrypoint.sh
__setup_mta calls __find_replace on /etc/ssmtp/revaliases which returns
1 when the symlink it creates is broken. With set -o pipefail active the
non-zero return kills the entire entrypoint before any command can run.
ssmtp is not installed in this image and email delivery is not a feature
of the Rust developer image, so the MTA setup failure is irrelevant.
Guard the call with || true so initialization continues regardless.
- rootfs/usr/local/bin/entrypoint.sh: __setup_mta || true (non-fatal)
rootfs/usr/local/bin/entrypoint.sh
The grep -vF line that appends /usr/local/etc/hosts entries had a
duplicate 2>/dev/null redirect after the append operator, which is
a no-op but clutters the script. Synced from template.
- rootfs/usr/local/bin/entrypoint.sh: remove duplicate 2>/dev/null
from grep -vF /etc/hosts append line; bump version to 202606261500-git
rootfs/usr/local/bin/entrypoint.sh
Stale copies called __initialize_default_templates, __initialize_config_dir,
and __initialize_data_dir which are not in the old functions library,
causing container startup failures. Replaced with current template
versions (202606041210-git) which no longer call those missing functions.
- rootfs/usr/local/bin/entrypoint.sh: update to current template
- rootfs/usr/local/etc/docker/functions/entrypoint.sh: update to current template
rootfs/usr/local/bin/entrypoint.sh
rootfs/usr/local/etc/docker/functions/entrypoint.sh
--domainname on the container sets the kernel domainname, which c-ares
uses to infer a search domain even when /etc/resolv.conf has no search
line. This caused c-ares to query github.com.casjay.work AAAA and get
the host's own IPv6 address, routing all outbound HTTPS to the local
nginx instead of the real server.
Adding 'search .' and 'options ndots:0' explicitly disables search
domain inference regardless of the kernel domainname setting.
- rootfs/usr/local/etc/resolv.conf: add search . and options ndots:0
rootfs/usr/local/etc/resolv.conf
Hosts with a search domain cause containers to inherit it. When the
zone has a wildcard AAAA record, public hostnames resolve to the host's
own IPv6 address instead of the real server, breaking all outbound
HTTPS and DNS from inside the container.
The entrypoint already has a hook: if /usr/local/etc/resolv.conf
exists it replaces /etc/resolv.conf at container startup. Ship a
clean resolv.conf with Cloudflare + Google DNS and no search domain
so container DNS is always correct regardless of host configuration.
- rootfs/usr/local/etc/resolv.conf: new file — clean DNS, no search domain
rootfs/usr/local/etc/resolv.conf
Synced from casjay-dotfiles templates. Updated functions now check
for existence before copying template-files directories, skipping
gracefully when they are absent.
- rootfs/usr/local/etc/docker/functions/entrypoint.sh: updated to latest
rootfs/usr/local/etc/docker/functions/entrypoint.sh
Install latest stable Rust at build time via rustup-init with SHA256
verification. Add 30 cross-compile targets, cargo-binstall, and a
comprehensive set of cargo development tools. Match the official
rust:alpine env-var convention (RUSTUP_HOME / CARGO_HOME) and declare
those paths as Docker VOLUMEs. Add the Go-image pattern: rust-workflow
runs automatically when the container is invoked with no args, while
explicit commands pass through unchanged. Copy language-agnostic
healthcheck, copy, and symlink utilities from the Go image.
- Dockerfile: WORKDIR /app in final stage; add RUSTUP_HOME, CARGO_HOME,
RUSTUP_TOOLCHAIN ENV vars; extend VOLUME to include cargo and rustup paths
- rootfs/root/docker/setup/05-custom.sh: full Rust toolchain install —
build deps (build-base musl-dev clang lld cmake openssl-dev), SHA256-
verified rustup-init, stable toolchain with rust-src/rust-analyzer/
llvm-tools-preview, 30 cross-compile targets, cargo-binstall bootstrap,
cargo tool suite via binstall, cross-linker config.toml, /usr/local/bin
symlinks, ~/.cargo and ~/.rustup home symlinks, /etc/profile.d/rust.sh
- rootfs/usr/local/bin/rust-workflow: default workflow script —
fmt --check → clippy -D warnings → test --all → build --release;
honours CARGO_WORKDIR and CARGO_BUILD_TARGET env vars
- rootfs/usr/local/bin/entrypoint.sh: __no_exit guarded by $# -eq 0 in
START_SERVICES block; * catch-all now calls rust-workflow on no args
- rootfs/usr/local/bin/healthcheck: copied from Go image (HTTP/TCP/
process/file health probe)
- rootfs/usr/local/bin/copy: copied from Go image (recursive copy utility)
- rootfs/usr/local/bin/symlink: copied from Go image (symlink utility)
Dockerfile
rootfs/root/docker/setup/05-custom.sh
rootfs/usr/local/bin/copy
rootfs/usr/local/bin/entrypoint.sh
rootfs/usr/local/bin/healthcheck
rootfs/usr/local/bin/rust-workflow
rootfs/usr/local/bin/symlink
Update the embedded entrypoint copies in rootfs/ to match the
upstream template change. Internal state files renamed to dotfiles
so they're not matched by `/run/*.pid` cleanup globs:
- /run/init.d/entrypoint.pid -> /run/.entrypoint.pid
- /run/no_exit.pid -> /run/.no_exit.pid
- /run/backup.pid -> /run/.backup.pid
- /run/__start_init_scripts.pid -> /run/.start_init_scripts.pid
Per-service PIDs in /run/init.d/ are unchanged.
Dockerfile
.env.scripts
rootfs/usr/local/bin/copy
rootfs/usr/local/bin/entrypoint.sh
rootfs/usr/local/bin/healthcheck
rootfs/usr/local/bin/symlink
rootfs/usr/local/etc/docker/functions/entrypoint.sh
rootfs/usr/local/etc/docker/init.d/00-rust.sh
rootfs/usr/local/share/template-files/config/env/default.sample
rootfs/usr/local/share/template-files/config/env/examples/zz-entrypoint.sh
jason