RC-9-A: Bugfix

docker/worker-entrypoint.sh

@@ -0,0 +1,22 @@
+#!/bin/sh
+set -eu
+
+# Docker named volumes are normally created as root:root. Older Neural Hunt
+# worker versions could also leave identity.json owned by a different UID.
+# Normalize only the dedicated identity mount and the fixed identity file, then
+# permanently drop to the unprivileged app user before the Go client starts.
+if [ "$(id -u)" = "0" ]; then
+    if [ -L /identity/identity.json ]; then
+        echo "refusing symlink at /identity/identity.json" >&2
+        exit 1
+    fi
+
+    chown app:app /identity
+    if [ -e /identity/identity.json ]; then
+        chown app:app /identity/identity.json
+    fi
+
+    exec su-exec app:app /app/neuralhunt-client "$@"
+fi
+
+exec /app/neuralhunt-client "$@"