fix(docker): make mounted data volume writable for the non-root user (0.9.22)

Railway (and other platforms) mount persistent volumes owned by root, so the
non-root 'nextjs' user could not open the SQLite store at /app/data, failing with
'SqliteError: unable to open database file'.

Add docker-entrypoint.sh: when started as root, chown the data dir to nextjs and
drop privileges via gosu; otherwise exec directly. Drop the hardcoded USER nextjs
so the container can fix volume perms at startup, then run as nextjs. Verified the
mechanism locally: entrypoint chowns /app/data to nextjs and pid 1 runs as uid 1001.

Bump to 0.9.22 and point the Railway template at the new image.

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>

Author: cevheri

Dockerfile

@@ -64,7 +64,17 @@ COPY --from=builder /usr/src/app/node_modules/file-uri-to-path ./node_modules/fi
 RUN addgroup --system --gid 1001 nodejs && \
     adduser --system --uid 1001 nextjs && \
     chown -R nextjs:nodejs /app
-USER nextjs
+
+# gosu lets the entrypoint drop from root to the app user after fixing the
+# permissions of a mounted (often root-owned) data volume.
+RUN apt-get update && apt-get install -y --no-install-recommends gosu && \
+    rm -rf /var/lib/apt/lists/*
+
+# Entrypoint makes the SQLite data dir writable by `nextjs` then drops privileges.
+# The container starts as root only long enough to chown the volume mount; the
+# app process itself runs as the non-root `nextjs` user.
+COPY docker-entrypoint.sh /usr/local/bin/docker-entrypoint.sh
+RUN chmod +x /usr/local/bin/docker-entrypoint.sh
 
 # Render uses PORT env variable, default to 3000
 EXPOSE 3000/tcp
@@ -73,4 +83,5 @@ ENV HOSTNAME="0.0.0.0"
 
 # server.js is created by next build from the standalone output
 # https://nextjs.org/docs/pages/api-reference/next-config-js/output
+ENTRYPOINT ["docker-entrypoint.sh"]
 CMD ["node", "server.js"]

deploy/railway/PUBLISH.md

@@ -13,7 +13,7 @@ values to enter are in [`template.json`](./template.json).
 
 - In the editor, click **+ New** (top-right), or open the command palette
   (`⌘K` / `Ctrl+K`) → **+ New Service** → **Docker Image**.
-- Image: `ghcr.io/libredb/libredb-studio:0.9.21` (pinned — never `:latest`).
+- Image: `ghcr.io/libredb/libredb-studio:0.9.22` (pinned — never `:latest`).
 - Rename the service to `libredb-studio`.
 
 ## 3. Variables

deploy/railway/README.md

@@ -29,7 +29,7 @@ Or browse the Railway template marketplace and search **LibreDB Studio**.
 ## Deploy (manual — works today, before publishing)
 
 Railway dashboard → **New Project**, then in the project view click **+ New → Docker Image** →
-enter `ghcr.io/libredb/libredb-studio:0.9.21`, then configure the service to
+enter `ghcr.io/libredb/libredb-studio:0.9.22`, then configure the service to
 match [`template.json`](./template.json):
 
 - **Networking:** enable a public domain, target port `3000`.

deploy/railway/template.json

@@ -8,7 +8,7 @@
       "name": "libredb-studio",
       "icon": "https://raw.githubusercontent.com/libredb/libredb-studio/main/deploy/railway/libredb-studio.png",
       "source": {
-        "image": "ghcr.io/libredb/libredb-studio:0.9.21"
+        "image": "ghcr.io/libredb/libredb-studio:0.9.22"
       },
       "networking": {
         "public": true,

docker-entrypoint.sh

@@ -0,0 +1,18 @@
+#!/bin/sh
+set -e
+
+# Make the SQLite data directory writable by the non-root app user.
+#
+# Some platforms (e.g. Railway) mount persistent volumes owned by root, which
+# the non-root `nextjs` user cannot write to — causing the SQLite store to fail
+# with "unable to open database file". When this container starts as root we
+# chown the data directory to the app user and then drop privileges. When it is
+# already running as non-root (the default for plain `docker run`), we just exec.
+if [ "$(id -u)" = "0" ]; then
+  DATA_DIR="$(dirname "${STORAGE_SQLITE_PATH:-/app/data/libredb-storage.db}")"
+  mkdir -p "$DATA_DIR"
+  chown -R nextjs:nodejs "$DATA_DIR" || true
+  exec gosu nextjs:nodejs "$@"
+fi
+
+exec "$@"

package.json

@@ -1,6 +1,6 @@
 {
   "name": "@libredb/studio",
-  "version": "0.9.21",
+  "version": "0.9.22",
   "private": false,
   "publishConfig": {
     "access": "public"