Fix media permissions inside app container

Dockerfile

@@ -5,10 +5,10 @@
 # .env.example) - this image builds without a database connection.
 
 FROM node:22-alpine AS base
+RUN apk add --no-cache libc6-compat su-exec
 
 # ---- deps: install once, cached as its own layer -------------------------
 FROM base AS deps
-RUN apk add --no-cache libc6-compat
 WORKDIR /app
 COPY package.json package-lock.json ./
 RUN npm ci
@@ -41,7 +41,11 @@ COPY --from=builder --chown=nextjs:nodejs /app /app
 # Docker volumes mounted over these paths (see docker-compose.yml).
 RUN mkdir -p media backups && chown -R nextjs:nodejs media backups
 
-USER nextjs
+COPY --from=builder --chown=root:root /app/docker/anouma-entrypoint.sh /usr/local/bin/anouma-entrypoint.sh
+RUN chmod 755 /usr/local/bin/anouma-entrypoint.sh
+
+USER root
+ENTRYPOINT ["/usr/local/bin/anouma-entrypoint.sh"]
 
 EXPOSE 3000
 ENV PORT=3000

deploy.sh

@@ -129,6 +129,14 @@ deploy_version() {
   registry_login
   log_info "Pulling ${ANOUMA_IMAGE} …"
   $COMPOSE pull app || return 1
+  # The media directory is a bind mount. Its host ownership can differ from
+  # the unprivileged `nextjs` user inside the image, which otherwise turns a
+  # valid image upload into Payload's generic FileUploadError. The deploy user
+  # already controls Docker, so use the image's root user only for this narrow
+  # ownership repair before starting the app.
+  log_info "Preparing media storage permissions …"
+  $COMPOSE run --rm --user root --entrypoint /bin/sh app -c \
+    'mkdir -p /app/media && chown -R 1001:1001 /app/media && chmod 775 /app/media' || return 1
   log_info "Running database migrations …"
   $COMPOSE run --rm app npm run migrate || return 1
   log_info "Starting containers …"

docker/anouma-entrypoint.sh

@@ -0,0 +1,12 @@
+#!/bin/sh
+set -eu
+
+# /app/media is a persistent host bind mount in production. Its host owner
+# can differ from the unprivileged application user inside the image, so fix
+# the mount ownership before dropping privileges for the actual app process.
+if [ -d /app/media ]; then
+  chown -R nextjs:nodejs /app/media
+  chmod 775 /app/media
+fi
+
+exec su-exec nextjs "$@"