From ed1a655317ca4da33eb3ad025c257d7defd8668f Mon Sep 17 00:00:00 2001 From: centdix Date: Sat, 21 Feb 2026 18:50:02 +0000 Subject: [PATCH] fix: make cargo registry world-writable in sandbox container The sqlx-cli install populates /opt/cargo/registry as root. Add chmod -R a+rwX after the install so the sandbox user can write to the registry when building. Co-Authored-By: Claude Opus 4.6 --- Dockerfile.sandbox | 3 ++- 1 file changed, 2 insertions(+), 1 deletion(-) diff --git a/Dockerfile.sandbox b/Dockerfile.sandbox index 61a46c429b..6ef3416900 100644 --- a/Dockerfile.sandbox +++ b/Dockerfile.sandbox @@ -43,7 +43,8 @@ RUN curl --proto '=https' --tlsv1.2 -sSf https://sh.rustup.rs | \ # Install sqlx-cli (for database migrations) RUN cargo install sqlx-cli --no-default-features --features native-tls,postgres && \ - ln -sf /opt/cargo/bin/sqlx /usr/local/bin/sqlx + ln -sf /opt/cargo/bin/sqlx /usr/local/bin/sqlx && \ + chmod -R a+rwX /opt/cargo # Embed network init script (sets up iptables firewall, then drops privileges) RUN cat <<'SCRIPT' > /usr/local/bin/network-init.sh