From 26f335ed5a6a4425ec70d064211b841dee0d4653 Mon Sep 17 00:00:00 2001
From: VpEngOps <tsgstaff-coo-vpengops@turnsys.com>
Date: Mon, 7 Sep 2026 10:02:16 -0500
Subject: [PATCH] refactor(scripts): grind-stack fidelity - readonly rootfs,
 chown, sbom cmd

- emulate the Cloudron 8 app contract: --read-only + /tmp,/run tmpfs
- chown /app/data to the image uid (localstorage contract)
- wire the previously unreachable sbom subcommand into dispatch
- probe containers use --entrypoint (images wrap start.sh)

Umbrella: https://projects.knownelement.com/issues/632
---
 scripts/grind-stack.sh | 14 +++++++++++++-
 1 file changed, 13 insertions(+), 1 deletion(-)

diff --git a/scripts/grind-stack.sh b/scripts/grind-stack.sh
index f671fe7..68fa11c 100755
--- a/scripts/grind-stack.sh
+++ b/scripts/grind-stack.sh
@@ -75,10 +75,21 @@ cmd_up() {
       $(label_args) redis:7-alpine --requirepass testrd >/dev/null ;;
   esac
 
+  # emulate the Cloudron localstorage contract: /app/data is chowned to the
+  # app container's user (Cloudron does this in apptask before every start).
+  # --entrypoint is required: package images wrap everything in start.sh.
+  APP_UID="$(docker run --rm --entrypoint id --cgroup-parent "$SLICE" $(label_args) "grind-$APPNAME:test" -u 2>/dev/null || echo 0)"
+  APP_GID="$(docker run --rm --entrypoint id --cgroup-parent "$SLICE" $(label_args) "grind-$APPNAME:test" -g 2>/dev/null || echo 0)"
+  docker run --rm --user 0 --entrypoint chown --cgroup-parent "$SLICE" $(label_args) \
+    -v "grind-$APPNAME-data:/app/data" "grind-$APPNAME:test" \
+    -R "${APP_UID}:${APP_GID}" /app/data >/dev/null
+
   # the same env contract Cloudron injects, pointed at the test services.
+  # Read-only rootfs + writable /tmp,/run matches the Cloudron 8 app contract.
   # No --rm on the app: a crashed container must keep its logs for `logs`.
   docker run -d --name "$APP" --cgroup-parent "$SLICE" --network "$NET" \
     $(label_args) -v "grind-$APPNAME-data:/app/data" \
+    --read-only --tmpfs /tmp --tmpfs /run \
     -p "127.0.0.1:$TESTPORT:$PORT" \
     -e CLOUDRON_POSTGRESQL_HOST="$PG" -e CLOUDRON_POSTGRESQL_PORT=5432 \
     -e CLOUDRON_POSTGRESQL_DATABASE=testdb -e CLOUDRON_POSTGRESQL_USERNAME=testdb \
@@ -161,6 +172,7 @@ case "${1:-preflight}" in
   logs)      cmd_logs ;;
   down)      cmd_down ;;
   sweep)     shift; cmd_sweep "$@" ;;
+  sbom)      shift; cmd_sbom "$@" ;;
   preflight) cmd_preflight ;;
-  *) echo "usage: $0 up <pkg-dir> | curl [path] | logs | down | sweep <pkg-dir> | preflight"; exit 2 ;;
+  *) echo "usage: $0 up <pkg-dir> | curl [path] | logs | down | sweep <pkg-dir> | sbom <pkg-dir> | preflight"; exit 2 ;;
 esac