fix: Docker UID 1000 for openchamber user and non-fatal SSH key generation (#751)

* fix: bind web server to 127.0.0.1 by default and add --host CLI flag

* fix: Docker UID 1000 for openchamber user and non-fatal SSH key generation

Dockerfile

@@ -30,12 +30,12 @@ RUN apt-get update && apt-get install -y --no-install-recommends \
   python3 \
   && rm -rf /var/lib/apt/lists/*
 
-COPY --from=cloudflare/cloudflared:latest /usr/local/bin/cloudflared /usr/local/bin/cloudflared
+# Replace the base image's 'bun' user (UID 1000) with 'openchamber'
-
+# so mounted volumes with 1000:1000 ownership work correctly.
-ENV NODE_ENV=production
+RUN userdel bun \
-
+  && groupadd -g 1000 openchamber \
-# Create openchamber user
+  && useradd -u 1000 -g 1000 -m -s /bin/bash openchamber \
-RUN useradd -m -s /bin/bash openchamber && mkdir -p /home/openchamber && chown -R openchamber:openchamber /home/openchamber
+  && chown -R openchamber:openchamber /home/openchamber
 
 # Switch to openchamber user
 USER openchamber
@@ -47,6 +47,13 @@ RUN npm config set prefix /home/openchamber/.npm-global && mkdir -p /home/opench
   mkdir -p /home/openchamber/.local /home/openchamber/.config /home/openchamber/.ssh && \
   npm install -g opencode-ai
 
+# cloudflared 2026.3.0 - update digest explicitly when upgrading
+COPY --from=cloudflare/cloudflared@sha256:6b599ca3e974349ead3286d178da61d291961182ec3fe9c505e1dd02c8ac31b0 /usr/local/bin/cloudflared /usr/local/bin/cloudflared
+
+ENV NODE_ENV=production
+
+COPY scripts/docker-entrypoint.sh /home/openchamber/openchamber-entrypoint.sh
+
 COPY --from=deps /app/node_modules ./node_modules
 COPY --from=deps /app/packages/web/node_modules ./packages/web/node_modules
 COPY --from=builder /app/package.json ./package.json
@@ -54,7 +61,6 @@ COPY --from=builder /app/packages/web/package.json ./packages/web/package.json
 COPY --from=builder /app/packages/web/bin ./packages/web/bin
 COPY --from=builder /app/packages/web/server ./packages/web/server
 COPY --from=builder /app/packages/web/dist ./packages/web/dist
-COPY scripts/docker-entrypoint.sh /home/openchamber/openchamber-entrypoint.sh
 
 EXPOSE 3000
 

scripts/docker-entrypoint.sh

@@ -17,12 +17,13 @@ fi
 
 if [ ! -f "${SSH_PRIVATE_KEY_PATH}" ] || [ ! -f "${SSH_PUBLIC_KEY_PATH}" ]; then
   if [ ! -w "${SSH_DIR}" ]; then
-    echo "[entrypoint] error: ssh key missing and ${SSH_DIR} is not writable" >&2
+    echo "[entrypoint] warning: ssh key missing and ${SSH_DIR} is not writable, continuing without SSH key" >&2
-    exit 1
+  else
+    echo "[entrypoint] generating SSH key..."
+    if ! ssh-keygen -t ed25519 -N "" -f "${SSH_PRIVATE_KEY_PATH}" >/dev/null 2>&1; then
+      echo "[entrypoint] warning: failed to generate SSH key, continuing without SSH key" >&2
+    fi
   fi
-
-  echo "[entrypoint] generating SSH key..."
-  ssh-keygen -t ed25519 -N "" -f "${SSH_PRIVATE_KEY_PATH}" >/dev/null
 fi
 
 if ! chmod 600 "${SSH_PRIVATE_KEY_PATH}" 2>/dev/null; then
@@ -33,8 +34,10 @@ if ! chmod 644 "${SSH_PUBLIC_KEY_PATH}" 2>/dev/null; then
   echo "[entrypoint] warning: cannot chmod ${SSH_PUBLIC_KEY_PATH}, continuing"
 fi
 
-echo "[entrypoint] SSH public key:"
+if [ -f "${SSH_PUBLIC_KEY_PATH}" ]; then
-cat "${SSH_PUBLIC_KEY_PATH}"
+  echo "[entrypoint] SSH public key:"
+  cat "${SSH_PUBLIC_KEY_PATH}"
+fi
 
 # Handle UI password environment variable
 if [ -n "${UI_PASSWORD:-}" ]; then