File size: 1,858 Bytes
6a7089a dc91700 6a7089a 182599f 6a7089a | 1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 16 17 18 19 20 21 22 23 24 25 26 27 28 29 30 31 32 33 34 35 36 37 38 39 40 41 42 43 | #!/bin/sh
set -eu
home_dir="${HOME:-/data}"
xdg_config_home="${XDG_CONFIG_HOME:-$home_dir/.config}"
default_config_path="$xdg_config_home/pinchtab/config.json"
mkdir -p "$home_dir" "$xdg_config_home" "$(dirname "$default_config_path")"
# Generate a persisted config on first boot.
# The PINCHTAB_TOKEN env var can be used to set an auth token via Docker secrets
# or environment variables. Prefer Docker secrets for sensitive data:
# docker run -e PINCHTAB_TOKEN_FILE=/run/secrets/pinchtab_token
if [ -z "${PINCHTAB_CONFIG:-}" ] && [ ! -f "$default_config_path" ]; then
/usr/local/bin/pinchtab config init >/dev/null
# Docker containers need to bind to 0.0.0.0 for port publishing to work
/usr/local/bin/pinchtab config set server.bind "0.0.0.0" >/dev/null
/usr/local/bin/pinchtab config set server.port "7860" >/dev/null
if [ -n "${PINCHTAB_TOKEN:-}" ]; then
/usr/local/bin/pinchtab config set server.token "$PINCHTAB_TOKEN" >/dev/null
elif [ -n "${BEARER_TOKEN:-}" ]; then
/usr/local/bin/pinchtab config set server.token "$BEARER_TOKEN" >/dev/null
fi
fi
# CHROME SANDBOX DISABLED IN CONTAINERS
#
# Chrome requires --no-sandbox inside containers because:
# - Containers don't have user namespaces (sandboxing requires this)
# - Container security (cgroups, capabilities, seccomp) provides isolation
# - The Dockerfile already drops capabilities and uses read-only filesystem
#
# This is standard for headless Chrome in containerized environments.
# Backfill the flag into managed config if not already set.
if [ -z "${PINCHTAB_CONFIG:-}" ] && [ -f "$default_config_path" ]; then
current_flags="$(/usr/local/bin/pinchtab config get browser.extraFlags 2>/dev/null || true)"
if [ -z "$current_flags" ]; then
/usr/local/bin/pinchtab config set browser.extraFlags -- "--no-sandbox --disable-gpu" >/dev/null
fi
fi
exec "$@"
|