From 7823f83d04f8b5c9756fc04bffa1f11a75db7f8b Mon Sep 17 00:00:00 2001 From: "Michael H." Date: Sat, 29 Aug 2026 01:30:30 +0200 Subject: [PATCH] fix: tailscale ssh user --- apps/frontend/Dockerfile | 12 +++++++++--- 1 file changed, 9 insertions(+), 3 deletions(-) diff --git a/apps/frontend/Dockerfile b/apps/frontend/Dockerfile index d3fe1bddff..9d0f03e4e7 100644 --- a/apps/frontend/Dockerfile +++ b/apps/frontend/Dockerfile @@ -24,10 +24,10 @@ TAILSCALE_DIR=/tmp/tailscale TAILSCALE_SOCKET="$TAILSCALE_DIR/tailscaled.sock" start_tailscale() { + echo "entrypoint: starting tailscale as euid=$(id -u) groups=$(id -G)" >&2 mkdir -p "$TAILSCALE_DIR" - # Userspace networking needs no TUN device or extra capabilities, and running - # as the same user as the server is what lets Tailscale SSH log in as it. + # Userspace networking needs no TUN device or extra capabilities. # --state=mem: registers an ephemeral node; --statedir gives the SSH host keys # somewhere writable to live, which mem: on its own does not. tailscaled \ @@ -66,6 +66,11 @@ if [ -n "${TAILSCALE_AUTH_KEY:-}" ]; then start_tailscale || echo "entrypoint: tailscale setup failed, serving without SSH" >&2 fi +# Only drop if we actually started as root; some runtimes pin their own uid. +if [ "$(id -u)" = "0" ]; then + exec setpriv --reuid=node --regid=node --init-groups -- "$@" +fi + exec "$@" EOF @@ -78,7 +83,8 @@ WORKDIR /app # Nitro bundles every runtime dependency into .output, so no node_modules is needed. COPY --chown=node:node .output ./.output -USER node +# Stays root so tailscaled can setgroups/setuid for SSH sessions; the entrypoint +# drops the server itself to the node user. EXPOSE 3000 ENTRYPOINT ["dumb-init", "--", "/usr/local/bin/entrypoint.sh"]