fix: rootless Alpine container support

Patch out chown calls that fail without CAP_CHOWN in rootless
containers. Use find instead of hardcoded gem paths so patches
survive Ruby and gem version changes.

Signed-off-by: Simon Lauger <simon@lauger.de>

Author: slauger

openvoxserver/Containerfile.alpine

@@ -223,8 +223,18 @@ RUN for d in \
 RUN sed -i 's/^ *USER="puppet"/USER=""/' /etc/default/puppetserver
 # `puppetserver setup` forces symlinking the "old" cadir to the "new" one for puppet 6 compatibility 
 # reasons. this won't work because after creating a link ruby tries to call chown
-RUN sed -i '/Puppetserver::Ca::Utils::Config\.symlink_to_old_cadir/ s/^/# /' \
-  /usr/lib/ruby/gems/3.4.0/gems/openvoxserver-ca-3.0.0/lib/puppetserver/ca/action/setup.rb
+RUN find /usr/lib/ruby/gems -name setup.rb \
+    -path '*/openvoxserver-ca-*/lib/puppetserver/ca/action/*' \
+    -exec sed -i '/Puppetserver::Ca::Utils::Config\.symlink_to_old_cadir/ s/^/# /' {} +
+# `FileUtils.chown` calls fail in rootless containers because the process
+# lacks CAP_CHOWN. The ownership is already handled by the g=u / SGID pattern above.
+RUN find /usr/lib/ruby/gems -name file_system.rb \
+    -path '*/openvoxserver-ca-*/lib/puppetserver/ca/utils/*' \
+    -exec sed -i 's/FileUtils\.chown/# FileUtils.chown/' {} +
+# `install --owner/--group` in the foreground script requires CAP_CHOWN which
+# is not available in rootless containers. Replace with a simple touch + chmod.
+RUN sed -i 's|printf.*install -D --owner.*restartfile.*|touch "$restartfile" \&\& chmod 0644 "$restartfile"|' \
+  /opt/puppetlabs/server/apps/puppetserver/cli/apps/foreground
 
 USER puppet:0