#!/bin/sh
# The state directory is a mount point on most hosts, and a bind mount arrives
# owned by root however the image left it. Take ownership as root, then drop to
# the unprivileged user for the daemon itself.
set -e

state_dir=$(dirname "${PDSJS_CI_STATE:-/data/state.json}")
mkdir -p "$state_dir"
chown -R node:node "$state_dir" || true

# A mounted docker socket carries the host's group, which this image has no
# name for. gosu calls initgroups, which replaces the supplementary groups
# with the ones /etc/group gives the user, so `docker run --group-add` alone
# does not survive the drop. Naming the group here and putting node in it
# does. Without the mount this is skipped and no step can reach a daemon.
socket=/var/run/docker.sock
if [ -S "$socket" ]; then
  gid=$(stat -c %g "$socket")
  group=$(getent group "$gid" | cut -d: -f1)
  if [ -z "$group" ]; then
    group=dockerhost
    groupadd -g "$gid" "$group"
  fi
  usermod -aG "$group" node
fi

exec gosu node "$@"