FROM php:8.3-cli-bookworm

WORKDIR /app

RUN apt-get update \
    && apt-get install -y --no-install-recommends sudo bash tar ca-certificates \
    && rm -rf /var/lib/apt/lists/*

COPY . /app/

# 预置空 /flag(0600 root)：平台注入为截断写，权限不变，www-data 不可直读
RUN mkdir -p /var/lib/app/uploads /var/lib/app/meta /var/lib/app/backupqueue /var/backups \
    && chown -R www-data:www-data /var/lib/app/uploads /var/lib/app/meta /var/lib/app/backupqueue \
    && chmod 733 /var/lib/app/backupqueue \
    && chown root:root /app/backup-helper \
    && chmod 755 /app/backup-helper \
    && install -m 600 /dev/null /flag \
    && printf 'www-data ALL=(root) NOPASSWD: /app/backup-helper\n' > /etc/sudoers.d/yqhl-backup \
    && chmod 440 /etc/sudoers.d/yqhl-backup \
    && chmod +x /app/start.sh

EXPOSE 8080

CMD ["/app/start.sh"]
