feat: full filesystem persistence (not just /home + /root)

Persist all user-modifiable dirs: /home, /root, /etc, /opt, /var,
/usr/local — with tar -p preserving all permissions. Exclude
Docker-managed files (hostname, hosts, resolv.conf), transient
runtime (var/run, var/lock, *.sock, *.pid), and caches.

Dataset = disk. Container state is fully mirrored.

Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>

entrypoint.py

@@ -4,12 +4,10 @@ HuggingRun v2 — Single entrypoint for Ubuntu Server on HuggingFace Spaces.
 
 Replaces: entrypoint.sh, start-server.sh, git_sync_daemon.py, log_streamer.py
 
-Lifecycle:
-  1. Resolve config (HF_TOKEN, dataset repo)
-  2. Download state.tar.zst from HF Dataset → extract /home, /root
-  3. Reinstall user-added packages
-  4. Start services (sshd, ttyd, ws-bridge, log streamer, sync thread)
-  5. exec nginx (becomes PID 1, opens port 7860)
+Persistence: full filesystem sync via tar.zst ↔ HF Dataset.
+  Dataset = disk. Container state is fully mirrored to the dataset.
+  On startup:  download state.tar.zst → extract to /
+  On sync:     tar selected dirs → upload state.tar.zst
 """
 
 import http.server
@@ -34,6 +32,38 @@ STATE_FILE = os.path.join(PERSIST_PATH, "state.tar.zst")
 PKG_FILE = os.path.join(PERSIST_PATH, "user-packages.list")
 BASE_PKG_FILE = "/etc/base-packages.list"
 
+# Full filesystem persistence — these dirs are synced to/from the dataset.
+# tar -p preserves all permissions, so no corruption.
+PERSIST_DIRS = [
+    "home",
+    "root",
+    "etc",
+    "opt",
+    "var",
+    "usr/local",
+]
+
+# Exclude from tar: Docker-managed, virtual, transient, or regenerable files
+TAR_EXCLUDES = [
+    # Docker-managed (overwritten each container start)
+    "etc/hostname",
+    "etc/hosts",
+    "etc/resolv.conf",
+    "etc/mtab",
+    # Transient runtime
+    "var/run",
+    "var/lock",
+    "var/cache/apt",
+    "var/lib/apt/lists",
+    "var/log",          # logs are ephemeral
+    # Sockets, pids, caches
+    "*.sock",
+    "*.pid",
+    "__pycache__",
+    "*.pyc",
+    ".cache",
+]
+
 
 def log(msg):
     ts = time.strftime("%H:%M:%S", time.gmtime())
@@ -133,12 +163,18 @@ def restore_state():
         log(f"  no state to restore: {e}")
         return
 
-    log("── RESTORE: extracting state.tar.zst")
+    log("── RESTORE: extracting state.tar.zst → /")
     t0 = time.time()
     rc, out = run(f"tar --zstd -xpf {STATE_FILE} -C /")
     elapsed = time.time() - t0
     if rc == 0:
+        # Show what was restored
+        rc2, listing = run(f"tar --zstd -tf {STATE_FILE} | head -1 | cut -d/ -f1 | sort -u")
         log(f"  extracted ({elapsed:.1f}s)")
+        # Count files
+        rc3, count = run(f"tar --zstd -tf {STATE_FILE} | wc -l")
+        if rc3 == 0:
+            log(f"  {count.strip()} files restored")
     else:
         log(f"  extraction failed ({elapsed:.1f}s)")
 
@@ -201,24 +237,23 @@ def save_and_upload():
     except Exception:
         pass
 
-    # Create tar.zst of /home and /root
+    # Create tar.zst of all persist dirs
     t0 = time.time()
-    dirs_to_persist = []
-    for d in ["home", "root"]:
-        if os.path.isdir(f"/{d}"):
-            dirs_to_persist.append(d)
+    dirs_to_persist = [d for d in PERSIST_DIRS if os.path.isdir(f"/{d}")]
     if not dirs_to_persist:
         log("  nothing to persist")
         return
 
-    rc, out = run(f"tar --zstd -cpf {STATE_FILE} -C / {' '.join(dirs_to_persist)}")
+    excludes = " ".join(f"--exclude='{e}'" for e in TAR_EXCLUDES)
+    cmd = f"tar --zstd {excludes} -cpf {STATE_FILE} -C / {' '.join(dirs_to_persist)}"
+    rc, out = run(cmd)
     elapsed = time.time() - t0
     if rc != 0:
         log(f"  tar failed ({elapsed:.1f}s)")
         return
 
     size_mb = os.path.getsize(STATE_FILE) / 1024 / 1024
-    log(f"  tar: {size_mb:.1f}MB ({elapsed:.1f}s)")
+    log(f"  tar: {size_mb:.1f}MB ({elapsed:.1f}s) [{', '.join(dirs_to_persist)}]")
 
     # Upload both files
     api = HfApi(token=HF_TOKEN)