From fb011d6f38385b2793e1bd18a91bddd188340b42 Mon Sep 17 00:00:00 2001
From: Iuliia Ivashko <yulia.ivashko@gmail.com>
Date: Mon, 23 Mar 2026 15:08:47 +0200
Subject: [PATCH] fix: Docker UID 1000 for openchamber user and non-fatal SSH
 key generation (#751)

* fix: bind web server to 127.0.0.1 by default and add --host CLI flag

* fix: Docker UID 1000 for openchamber user and non-fatal SSH key generation
---
 Dockerfile                   | 20 +++++++++++++-------
 scripts/docker-entrypoint.sh | 17 ++++++++++-------
 2 files changed, 23 insertions(+), 14 deletions(-)

diff --git a/Dockerfile b/Dockerfile
index 523a32fd..b8d6f5ff 100644
--- a/Dockerfile
+++ b/Dockerfile
@@ -30,12 +30,12 @@ RUN apt-get update && apt-get install -y --no-install-recommends \
   python3 \
   && rm -rf /var/lib/apt/lists/*
 
-COPY --from=cloudflare/cloudflared:latest /usr/local/bin/cloudflared /usr/local/bin/cloudflared
-
-ENV NODE_ENV=production
-
-# Create openchamber user
-RUN useradd -m -s /bin/bash openchamber && mkdir -p /home/openchamber && chown -R openchamber:openchamber /home/openchamber
+# Replace the base image's 'bun' user (UID 1000) with 'openchamber'
+# so mounted volumes with 1000:1000 ownership work correctly.
+RUN userdel bun \
+  && groupadd -g 1000 openchamber \
+  && useradd -u 1000 -g 1000 -m -s /bin/bash openchamber \
+  && chown -R openchamber:openchamber /home/openchamber
 
 # Switch to openchamber user
 USER openchamber
@@ -47,6 +47,13 @@ RUN npm config set prefix /home/openchamber/.npm-global && mkdir -p /home/opench
   mkdir -p /home/openchamber/.local /home/openchamber/.config /home/openchamber/.ssh && \
   npm install -g opencode-ai
 
+# cloudflared 2026.3.0 - update digest explicitly when upgrading
+COPY --from=cloudflare/cloudflared@sha256:6b599ca3e974349ead3286d178da61d291961182ec3fe9c505e1dd02c8ac31b0 /usr/local/bin/cloudflared /usr/local/bin/cloudflared
+
+ENV NODE_ENV=production
+
+COPY scripts/docker-entrypoint.sh /home/openchamber/openchamber-entrypoint.sh
+
 COPY --from=deps /app/node_modules ./node_modules
 COPY --from=deps /app/packages/web/node_modules ./packages/web/node_modules
 COPY --from=builder /app/package.json ./package.json
@@ -54,7 +61,6 @@ COPY --from=builder /app/packages/web/package.json ./packages/web/package.json
 COPY --from=builder /app/packages/web/bin ./packages/web/bin
 COPY --from=builder /app/packages/web/server ./packages/web/server
 COPY --from=builder /app/packages/web/dist ./packages/web/dist
-COPY scripts/docker-entrypoint.sh /home/openchamber/openchamber-entrypoint.sh
 
 EXPOSE 3000
 
diff --git a/scripts/docker-entrypoint.sh b/scripts/docker-entrypoint.sh
index 8f5dcab0..e9e4be22 100644
--- a/scripts/docker-entrypoint.sh
+++ b/scripts/docker-entrypoint.sh
@@ -17,12 +17,13 @@ fi
 
 if [ ! -f "${SSH_PRIVATE_KEY_PATH}" ] || [ ! -f "${SSH_PUBLIC_KEY_PATH}" ]; then
   if [ ! -w "${SSH_DIR}" ]; then
-    echo "[entrypoint] error: ssh key missing and ${SSH_DIR} is not writable" >&2
-    exit 1
+    echo "[entrypoint] warning: ssh key missing and ${SSH_DIR} is not writable, continuing without SSH key" >&2
+  else
+    echo "[entrypoint] generating SSH key..."
+    if ! ssh-keygen -t ed25519 -N "" -f "${SSH_PRIVATE_KEY_PATH}" >/dev/null 2>&1; then
+      echo "[entrypoint] warning: failed to generate SSH key, continuing without SSH key" >&2
+    fi
   fi
-
-  echo "[entrypoint] generating SSH key..."
-  ssh-keygen -t ed25519 -N "" -f "${SSH_PRIVATE_KEY_PATH}" >/dev/null
 fi
 
 if ! chmod 600 "${SSH_PRIVATE_KEY_PATH}" 2>/dev/null; then
@@ -33,8 +34,10 @@ if ! chmod 644 "${SSH_PUBLIC_KEY_PATH}" 2>/dev/null; then
   echo "[entrypoint] warning: cannot chmod ${SSH_PUBLIC_KEY_PATH}, continuing"
 fi
 
-echo "[entrypoint] SSH public key:"
-cat "${SSH_PUBLIC_KEY_PATH}"
+if [ -f "${SSH_PUBLIC_KEY_PATH}" ]; then
+  echo "[entrypoint] SSH public key:"
+  cat "${SSH_PUBLIC_KEY_PATH}"
+fi
 
 # Handle UI password environment variable
 if [ -n "${UI_PASSWORD:-}" ]; then